Back to Security Basics: Evaluating, Consuming, and Contributing Open Source...
summary
Covers how to evaluate open source by concrete signals—active commits, release cadence, issue and PR responses, governance and contributor guides—and by running tools: OpenSSF Scorecard and OpenSSF Best Practices Badge, S2C2F and CVE-bin-tool. Demonstrates running Scorecard on python-fire (5.1/10), flags missing branch protection and no badge, and shows scores break down into actionable areas. Recommends taking ownership of ingested deps, contributing fixes or docs, and using automated scans in CI to catch vulnerabilities and improve maturity.
AI-written summary · about
chapters (7)
- 0:00Open source security basics
- 1:23Why security is challenging
- 8:25Evaluating projects securely
- 17:03Tools for evaluation
- 23:03Demo: Python Fire with Scorecard
- 28:47Contributing to security
- 31:39Q&A
related talks
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
16mKeynote: Back to Security Basics: Evaluating, Consuming, and Contributing Open Source Software
10mLightning Talk: Secure Consumption of Open Source Software: Evaluating, Util...
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
27mHow Do You Trust Your Open Source Software?
42mDeveloping a Secure, Open Future
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
37mOpenSSF Best Practices for Everyone!