Trust, but Verify: Proactive Security in Open Source
summary
Capsoc is an open source CLI that builds Go packages with the Go toolchain, computes call graphs, and reports capability analysis (network, exec, filesystem) for direct and transitive dependencies. Applied to real incidents—bolt db typo-squat, event-stream, TJ actions, xz—Capsoc highlights added execution and network capabilities and provides a capability diff git tool for presubmits. Empirically only 3% of Go updates add a new capability and about 8.5% module mirror diffs show capability changes.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:02Trust gap in source vs artifacts
- 3:11Malicious Bolt DB fork case
- 7:27Event Stream npm takeover case
- 9:33CI/CD compromise with TJ Actions case
- 13:41XZ Utils supply chain infiltration case
- 15:47Build artifacts as security source
- 17:09Capability analysis model
- 19:36Capsoc artifact analysis
- 22:49Capsoc Git diff tool
- 25:20From reactive to proactive security
- 26:45Preventing supply chain attacks
- 27:49Future of capability analysis
- 28:30Q&A
related talks
17mUnderstanding Supply Chain Threats with Static Analysis
38mCapslock: Escaping Bad Dependencies- 38mCapslock: Escaping Bad Dependencies
23mThe Code You Reviewed is Not the Code You Built
25mExploring Some Essential Security Checks for Any Open Source Go Project
45mEssential security checks for your Go project
49mTrustworthy Open Source: The Consequences of Success
31mGo Security – Past, Present, and Future