Security: Why It _has_to Be Open Source
summary
Argument: security software works better open because independent review, reproducible signing and supply-chain tooling scale trust—examples include Sigstore and SLSA plus OpenSSF scorecard and the Confidential Computing Consortium coordinating vendors. Claim: the many-eyes myth is real but incomplete—expert reviewers are scarce and need funding. Operational specifics: vulnerability management uses short embargos with clean-room patches, enterprises prefer packaged products over raw projects, and visible architecture diagrams speed threat discovery and patch deployment.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:55Proprietary vs open source security
- 8:28Open source licenses and ethics
- 11:59Many eyes hypothesis debunked
- 16:41Projects vs products in security
- 21:42Consortia in security
- 25:36Vulnerability management challenges
- 30:52Architecture diagrams matter
- 33:43Conclusion and Q&A
related talks
35mOpen source security: Opportunity or oxymoron?
12mWhy Open Source is Not Optional - Especially When It Comes to Trustworthiness
44mNavigating Open Source and Open Standards for Better Cybersecurity
39mOpen Source Software Supply Chain Security — Why does it matter?
09mSecuring the Software Supply Chain with Open Source
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
16mKeynote: There Is Just One Way to Do Open Source Security: Together
34mCan Open Source be Secure by Design?