Global Security Vulnerability Summit @ Open Source Summit North America 2022
2022-06-23..2022-06-24
-- online --
[SupplyChainSecurityCon @ Open Source Summit Europe 2023, CVE/FIRST VulnCon 2025, SupplyChainSecurityCon at Open Source Summit North America 2022, Critical Software Summit @ Open Source Summit North America 2023, SupplyChainSecurityCon @ Open Source Summit Europe 2024, Open Source SecurityCon Europe 2026]
as the organisers put it
The Global Security Vulnerability Summit aims to bring multiple industries and communities together to solve the way organizations produce and consume vulnerability information.
| title | author | length |
|---|---|---|
| A Vulnerability Database Should Not Be About Vulnerabilities! | Hritik Vijay, Tushar Goel | 32m |
Argues that a vulnerability database must be package-first and use upstream advisories as the source of truth, not noisy derived feeds; builds vulnerablecode… | ||
| Future of CVE | Art Manion | 45m |
CVE is moving from a GitHub pilot to proper API submission and self-managed CNAs, adds a JSON5 with containers format so multiple data providers can contribute… | ||
| BoF | 36m | |
Group discussion argues that current vulnerability feeds expose many derived fields but omit foundational provenance, making validation and large-scale… | ||
| Closing Remarks | Emily Fox | 08m |
Closing remarks announce a new working group that launches with a kickoff July 11 at 3 pm ET / noon PT to scope and build tooling around CVE-era limits, VEX… | ||
| Hidden Vulnerabilities in Open Source | Sharon Benzeev, Shaul Ben Hai | 30m |
Research finds classes of untracked defects: hidden but visible (commits with explicit fixes), hidden but fixed (bug-like commits that are actually security… | ||
| Managing Audits for Critical Open Source Projects | Amir Montazery | 41m |
An independent nonprofit runs end-to-end security audits for OSS, coordinating scoping, RFPs and fixes and logging 40+ high/CVSS≥7 findings and about 250… | ||
| Open Source Runs the World, Why Not Vulnerability Identifiers? | Josh Bressers, Josh Buker | 43m |
Open-source Global Security Database (GSD) puts vulnerability identifiers and multiple feeds into a GitHub-hosted, machine-readable repo that is cve-compatible… | ||
| Securing Open Source Software - End-to-End, at Massive Scale, Together | Christopher R Robinson, Anne Bertucio | 44m |
OpenSSF lays out concrete fixes: a 10‑point plan, a critical projects program and Alpha/Omega code reviews targeting high‑impact libraries; tooling work… | ||
| Understanding OSS Risk Beyond Code Vulnerabilities | Shripad Nadgowda, Caroline Lee | 40m |
Describes a prototype called Gauge that compares successive releases to list PRs/commits, labels change types, and flags risks so teams can automate update… | ||
| Vulntology - A Methodology to Characterize Vulnerabilities While Providing A Granular & Intuitive... | Christopher Turner | 45m |
A formal ontology maps vulnerabilities into concrete objects—vulnerability identifiers, scenario object, product, barrier, action and impact—so free text CVE… | ||
| Welcome & Opening Remarks | Brandon Lum | 35m |
Opening remarks set summit goals: coordinate working groups and BoFs to turn proposals into action, not just talk. Notes that vulnerabilities evolve from… | ||
| Effective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis | Aharon Abadi, Ph.D | 38m |
An analysis method builds a sound, scalable call graph by abstractly interpreting dynamic types across application plus direct and indirect dependencies to… | ||
| hijacking.gov.uk - Identifying and Communicating Risks to the Digital State | Terence Eden | 16m |
UK government domains contain frequent, concrete risks: over 300 registrars gives attackers many weak links, dangling CNAMEs and typo'd name servers lead to… | ||
| Informing Cloud Native Vulnerability Management: Some Views from the Past | Rory McCune | 14m |
Argues for auditability and openness: use grype and trivy so results can be inspected and differences explained; treat appliances and SaaS as black boxes that… | ||
| Scalable Management of Vulnerabilities in Open Source | Oliver Chang, Kate Catlin | 41m |
A new machine-readable advisory format called OSV schema encodes exact ecosystem names, package ids and version or commit ranges so automated scanners can map… | ||
| Rising Threat: Securing Your Open-Source Pipeline | Hassam Mian | 34m |
Walks through a real dependency confusion case where a researcher uploads mimicking packages to a public repo and successfully exfiltrates host and user info… | ||
| VEX Overview | Allan Friedman PhD | 47m |
VEX is a machine‑readable binding that pairs a vulnerability identifier with a specific product and a status such as affected/not affected/fixed/under… | ||
| nothing matches | ||