Co-host Sponsor Session: Making Open Source More Secure by Moving Upstream
summary
Open source security shifts from loose practices to formal requirements like SLSA level 4 and build signatures, creating a weakest‑link risk because the median project has one contributor while SLSA demands two+ sign‑offs. Automated scanners and new specs create an avalanche of alerts; money flows ($Google pledges $10B, startups like Snyk reach unicorn status) but remuneration for maintainers does not scale. Spec writers must design for varied project types and developer motivation; enterprises must demand a clear theory of change.
AI-written summary · about
chapters (7)
- 0:00Start
- 2:46Why Does Security Feel So Different
- 6:38Amateurism
- 9:37What Are the Limits of Professionalism
- 16:03Why Is Security Somewhat Different Again from What's Gone Before in Open Source
- 20:36Developer Motivation
- 23:05Enterprise Consumers
related talks
17mA New Era for Open Source Security
35mOpen source security: Opportunity or oxymoron?
34mCan Open Source be Secure by Design?
44mOpen Source Security: The World Needs Our Help
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
30mSecuring the Open Source Software Supply Chain
44mNavigating Open Source and Open Standards for Better Cybersecurity
43mOur Dependence on Open Source Is Scary. SLSA, SBOM and Sigstore to the Rescue