BoF
Panelat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Thursday, 2022-06-23·
summary
Group discussion argues that current vulnerability feeds expose many derived fields but omit foundational provenance, making validation and large-scale analytics impossible; proposals include publishing the commit that fixed (or range from introduction to fix) to enable automated exclusion of false positives and claiming a practical win of reducing scanner false positives by ~50%. Other concrete asks: a uniform maintenance-status identifier (not a CVE), standard machine-readable templates and a simple CLI workflow plus bounties to incentivize better records.
AI-written summary · about
chapters (6)
- 0:00Start
- 4:16Analysis of Vulnerability Data
- 18:46Levels of Vulnerability Information
- 20:49Gaps in the Vulnerability Identifiers
- 21:09Identifying the Vulnerabilities
- 28:35What Is Deprecated
related talks
22mOn the Shoulders of Giants: Security in FOSS
57mA Paradigm Shift in Vulnerability Identity: Why Vulnerability Databases Struggle
25mBOF: Vulnerability Data Consumers
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
51mVulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software
01h 04mOpen Discussion - International Challenges with CVD, CNA, and CVE
49mImproving FOSS Security
27mThe Vulnerability Ecosystem’s Vendor Bias — Exposed by Open Source