Keynote: Securing the Open Source Ecosystem
summary
OpenSSF lays out a $150M two‑year mobilization plan across ten themes and already secures $30M in pledges, funding things like a $300k boost to Node.js security and a suite of operational projects: Sigstore for artifact signing, SLSA level 4 adoption for supply chain attestations, the Harvard census to rank critical projects, and Alpha Omega to scan the top 10,000 repos and fund audits; also ships 20‑hour secure coding courses on edX and pushes SBOMs, MFA and incident response capabilities.
AI-written summary · about
chapters (14)
- 0:00Start
- 6:27Supply Chain Integrity
- 6:55Securing Critical Projects Working Group
- 7:19The Harvard Census
- 7:55Securing Software Repositories
- 8:46The Gnu Tool Chain Infrastructure
- 9:32Sig Store
- 10:10Alpha Omega
- 10:43Funding for Key Open Source Projects
- 11:10Node Js Security Team
- 13:25The Mobilization Plan
- 19:33How Do We Develop an Incident Response Team That Can Work with Open Source Projects
- 20:04How Do We Fund More Code Audits
- 20:31Where Might We Invest in Core Libraries
related talks
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
57mFrontiers in Securing the Open Source Ecosystem
04mKeynote: A Secure Supply Chain Vision
11mKeynote: Securing Open Source
15mKeynote: Government's Continuing Path Contributing Towards a Secure Open Source Ecosystem
31mMobilizing the Open Source Industry in the Fight For Better Security By Default
14mKeynote: All Your Base Are Belong to Us