OpenSSL After Heartbleed
summary
Heartbleed forces a rewrite of process and resources: funding from the Core Infrastructure Initiative pays two full-time maintainers and expands the team to ~15, producing ~3,200 commits, ~730 pull requests and ~970 closed issues in a year and addressing ~29 CVEs. Development moves to GitHub pull requests, mandatory two-person reviews, CI, Coverity and Coverity and mutation fuzzing in builds, a plan for Apache v2 relicensing, TLS 1.3 work and a multi‑year FIPS 2.0 module effort.
AI-written summary · about
chapters (28)
- 0:00Intro
- 1:00Internet Date
- 1:11Heartbleed
- 2:51Cartoon
- 3:55Transparency
- 4:38How many catastrophic bugs do occur
- 5:34The nature of the bug
- 6:23What actually happened
- 8:06The bug
- 9:15Why would they close
- 12:51Github stats
- 13:49How did we let this happen
- 16:10How to not break things
- 18:42What happened
- 19:51Before Heartbleed
- 21:29The CII
- 27:24Core Infrastructure
- 29:53Defect Tracking System
- 35:13Project Roadmap
- 35:48Increased Vitality
- 36:08Future Plans
- 37:12Fitz Validation
- 38:47Phipps Validation
- 39:47Next Voyage
- 41:06What have we learnt
- 42:25How to contribute
- 45:36Make them stand
- 46:26Questions
related talks
44mCryptography in the age of Heartbleed
57mFrontiers in Securing the Open Source Ecosystem
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
47m11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
01h 01mHTTPS & TLS in 2016: Security practices from the front lines
17mA New Era for Open Source Security
39mOpen source security: who’s responsible?