Funding Security in Open Source: Insights From FreeBSD’s Audit Journ...
summary
Alpha Omega funds a FreeBSD security audit that targets two subsystems, Beehive and Capsicum, after outreach in November 2023 and approval in early February; auditors find 28 vulnerabilities in six weeks. The project adds a security engineer, project manager, technical writer and marketing, creates an internal tracker (Bugzilla remains for normal bugs), enforces monthly encrypted reporting, and discovers auditors produce issues faster than maintainers can fix them, prompting new vulnerability workflows and sustained culture change.
AI-written summary · about
chapters (15)
- 0:00FreeBSD security audit journey
- 2:51Foundation’s role and mission
- 6:21Security funding start
- 8:07Choosing subsystems
- 10:36Selecting auditing vendor
- 13:27Project team and roles
- 15:37Handling audit findings
- 19:55Tracking vulnerabilities
- 23:50Downstream users and communication
- 25:35Project completion and outcomes
- 27:41Lessons from audit
- 30:57Process improvements
- 34:34Cultural shift and impact
- 36:41Future audit plans
- 38:24Q&A
related talks
53mAlpha-Omega: What We've Learned From Funding Open Source Security Over the Past 3Years, What's Ahead
32mImproving the FreeBSD security advisory process
41mManaging Audits for Critical Open Source Projects
49mImproving FOSS Security
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
44mSecurity Research with Open Source Software: Vol. Omega
29mNavigating Open Source Risk: A Strategic Approach
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up