Developing a Secure, Open Future
summary
OpenSSF offers concrete, actionable outputs: a 100% free secure-development course with hands-on labs, a two‑page concise guide/checklist for maintainers, and tooling like Scorecard scans over one million projects weekly plus Allstar and a Best Practices Badge to automate and signal repo hygiene. New tools include GUAC visualizes dependency trees and OSV’s vulnerability and malicious-package lists. Guidance covers MFA, password vaults, private security advisories, CNAs for CVE control, and simple CI protections such as branch protection and Dependabot/renovate.
AI-written summary · about
chapters (12)
- 0:00Open source security challenges
- 3:50Upstream maintainers as targets
- 7:25Single maintainer challenges
- 15:08OpenSSF solutions
- 17:19Security education today
- 24:07Account and credential protection
- 26:58Securing code and CI/CD
- 30:13Third-party dependencies security
- 33:44Project security practices
- 36:13Vulnerability disclosure processes
- 38:01CVE and reporting navigation
- 40:30Conclusion and Q&A
related talks
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
40mBuilding Developer Confidence in Software Security with the DevRel Community
57mFrontiers in Securing the Open Source Ecosystem
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
37mOpenSSF Best Practices for Everyone!
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...