OpenSSF Best Practices for Everyone!
summary
OpenSSF Best Practices Working Group offers concrete tooling and metrics: Scorecard (0–10) runs ~18 checks and is used via CLI, Docker or GitHub Action to flag missing branch protection, unsigned releases and unpinned deps; organizations monitor results across repos. Industry numbers: 97% of codebases use open source and ~77% of app weight is OSS. Memory bugs account for ~70% of CVEs. AI agents hallucinate ~20% fake package suggestions but, when combined with tooling and iterative prompts, can produce a 75% uplift in secure code.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 3:42Open source in supply chains
- 8:00Security for developers
- 10:06OpenSSF mission and tools
- 12:38OpenSSF Scorecard intro
- 17:10Scorecard checks and probes
- 19:15Pinning dependencies
- 21:48Memory safety challenges
- 26:29AI agents and supply chain risks
- 29:17AI hallucinations and risks
- 31:10Secure AI for code
- 33:00OpenSSF resources
- 34:25Call to action
related talks
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
50mHow Do You Trust Open Source Software?
42mDeveloping a Secure, Open Future
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
27mHow Do You Trust Your Open Source Software?
25mHow do you trust your open source software?