Understanding OSS Risk Beyond Code Vulnerabilities
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Thursday, 2022-06-23· at 14:55· Room 205 (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
Describes a prototype called Gauge that compares successive releases to list PRs/commits, labels change types, and flags risks so teams can automate update policies; uses GitHub GraphQL, SBOMs, crane, Sift and Grype to gather data; finds zombie commits and recommends safe upgrade paths; measured 95% location resolve accuracy for contributor origin, saw images with up to 53 package changes per release, and surfaces zombie commits detected as a concrete risk indicator.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:12OSS Ecosystem
- 3:31Vulnerability Management
- 5:20Let's get real
- 9:52Export Control Compliance
- 16:59Open-source Solutions
- 19:04Spatial Loss
- 25:47Docker Image Release Survey
- 30:39nd Degree use
- 31:27rd Degree Application
- 34:51Project Gauge
related talks
41mManaging the risk and growth of using Open Source Software
31mAssessing Open Source Software Projects in the Software Supply Chain
25mDefining the Limits of Risk
31mThe Value of OSS Management for Risk Mitigation
27mHealth Check-ups on OSS Software Projects: Managing Risks While Promoting (Re)use
35mThe Benefits and Pitfalls of OSS Project Metrics: Measuring Health and Risk in Open Source Communities
52mScaling the Security Researcher to Eliminate OSS Vulnerabilities Once and for...
20mOpen source in the enterprise