Simplifying Coordinating Vulnerabilities & Disclosures in Open Source...
summary
Explains concrete steps and tools: publishes two OpenSSF guides on GitHub (maintainer and reporter), recommends publishing a clear security policy, setting a security team, creating private intake channels and private branches for fixes, and using CVE CNAs to assign IDs; describes CSAF and emerging VEX statements, bug bounty and Safe Harbor tradeoffs, and plans for tooling to auto‑generate advisories. Claims bad actors monitor repos constantly and CVSSv4 rollout is imminent—practical, checklistable guidance rather than theory.
AI-written summary · about
chapters (6)
- 0:00Welcome
- 8:10Why coordinated vulnerability disclosure matters
- 15:54Implementing coordinated vulnerability disclosure
- 24:01Q&A on monitoring
- 32:11Government role in vulnerability disclosure
- 39:17Q&A on standards
related talks
01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
18mWhat You Need to Know and Do about Vulnerability Disclosure
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
48mApplying Cybersecurity Regulations and Industry Standards to Open Source Projects
13mManaging Vulnerabilities in Open-Source Dependencies
39mSecurity Advisory Programs: Creating Transparency Along the Software Supply Chain
05mKeynote: OpenSearch, Open Security: Bringing Transparency to Our Security Processes