Preparing for Zero-Day: Vulnerability Disclosure in Open Source Software
summary
OpenSSF publishes a coordinated vulnerability disclosure guide with runbooks, communication templates and a recommendation to coordinated disclosure over shotgun public drops; projects must publish a security policy and a contact (security@) and typically request a CVE via MITRE to track fixes. Advisories should be machine‑readable (CSAF/OVAL), use GitHub security advisories or CERT CC VINCE for multi‑party cases, negotiate 14/30/60/90 windows, ask finders to test patches, and expect no definitive dataset proving one model always wins.
AI-written summary · about
chapters (10)
- 0:00Start
- 12:30Embargo
- 16:52Private Disclosure
- 25:17Cve Identifier
- 32:01Coordinated Vulnerability Disclosure
- 32:31Bug Bounty
- 40:51Lack of Communication
- 48:38Recommendations
- 55:09Making Real Fixes for Vulnerabilities
- 1:05:01How How Do We Feel if There's a Vulnerability and It's Discovered that It's Being Actively Exploited during the Embargo Period
related talks
44mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
18mWhat You Need to Know and Do about Vulnerability Disclosure
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
05mKeynote: OpenSearch, Open Security: Bringing Transparency to Our Security Processes
39mSecurity Advisory Programs: Creating Transparency Along the Software Supply Chain
48mHow to report a vulnerability: Responsible Disclosure for Developers
27mThrough the Looking Glass: How Open Source Projects See Vulnerability Disclosure
13mManaging Vulnerabilities in Open-Source Dependencies