The State of Open Source Security
summary
Open source dependency risk is quantified with concrete findings: NPM tops 1M packages, 78% in transitive dependencies are where vulnerabilities surface, and the top ten Docker images each contain at least 30 vulnerable system libraries. Demonstrated attacks include a get-cookies backdoor hidden behind a compromised mailparser chain that reached millions of downloads. Fixes and tools shown include rebuilding images to drop 20% of vulnerabilities, switching base images to remove 44% of issues, and practical checks like lockfile-lint and npq for vetting packages and sources.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:03The State of Open Source Security
- 0:46Open-Source Has Made an Incredible Impact on Modern Software Development
- 7:20Where Do We Find Security Vulnerabilities
- 17:38Security Blind Spot
- 19:32Lock File Lint
related talks
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
25mOWASP Top 10 Risks for Open Source Software
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
42mHacking the OSS Supply Chain
16mUnpacking Open Source Security in Public Repos
27mStrangerDanger: Finding Security Vulnerabilities Before They Find You
16mAre we Forever Doomed to Software Supply Chain Security?
24mHow to Find Secure Software in Open Source Repositories