A New Era for Open Source Security
summary
Argues that open source ubiquity now creates systemic risk and that coordinated fixes—governance, tooling, and funding—are required. Cites specific incidents like Heartbleed and Log4j and the reality of millions of projects with uneven maintenance, plus examples of contributed stacks such as Hadoop and Kubernetes-as-a-service. Describes company responses (Linux Foundation, an open source program office at Amazon), maintainer burnout, gaps in dependency visibility, and growing government involvement, framing OpenSSF work as coordination of policy, training, and supply-chain tooling rather than abstract advocacy.
AI-written summary · about
chapters (8)
- 0:00Start
- 2:47The 1980s and 1990s: New Ideas & Community
- 4:01Late 1990s: Start of Company Engagement
- 5:41Foundations and Big Company Support
- 8:33The Cloud Builds on Open Source
- 10:15Open Data and Open Hardware
- 10:26Transforming New Industries
- 12:15The Open Source Security
related talks
29mNavigating the Open Source Policy Labyrinth: Unraveling Global Policy Efforts for a Secure Future
44mNavigating Open Source and Open Standards for Better Cybersecurity
57mFrontiers in Securing the Open Source Ecosystem
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
44mOpen Source Security: The World Needs Our Help
26mCo-host Sponsor Session: Making Open Source More Secure by Moving Upstream
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...
38mApplication Security in the age of Open Source