OpenSSF Day 2022
2022-06-20
-- online --
[SupplyChainSecurityCon at Open Source Summit North America 2022, SupplyChainSecurityCon @ Open Source Summit Europe 2023, Open Source SecurityCon Europe 2026, SupplyChainSecurityCon @ Open Source Summit North America 2024, Open Source SecurityCon North America 2025, SupplyChainSecurityCon @ OSS NA 2023]
who it's for
open source maintainers, security engineers, program managers, software supply chain engineers, platform engineers, tooling developers, developer educators
topics
Sigstore cosign keyless signing; SBOM generation and automation; Alpha-Omega project triage; vulnerability disclosure timelines; Scorecard checks and Allstar enforcement; CodeQL Semgrep and fuzzing; Maven Central repository operations; secure-development training course; OSV API vulnerability normalization; supply chain incident response playbooks
| title | author | length |
|---|---|---|
| Welcome & Opening Remarks | Christopher R Robinson | 08m |
Event opens by honoring Juneteenth recognition and pointing attendees to a posted code of conduct; room logistics include proximity stickers… | ||
| A New Era for Open Source Security | Nithya A. Ruff | 17m |
Argues that open source ubiquity now creates systemic risk and that coordinated fixes—governance, tooling, and funding—are required. Cites specific incidents… | ||
| Mobilizing the Open Source Industry in the Fight For Better Security By Default | Brian Behlendorf | 31m |
A mobilization plan lays out 10 work streams with concrete targets: invest in memory safety for core internet daemons and audited rewrites, fund third‑party… | ||
| What You Need to Know and Do about Vulnerability Disclosure | Anne Bertucio | 18m |
OpenSSF Vulnerability Disclosure WG recommends a 90-day disclosure timeline, a 3–5 person vulnerability management team for triage, and use of a simple… | ||
| Improving Global Software Supply Chain Security with Alpha-Omega | Michael Scovetta, Michael Winser | 22m |
Alpha-Omega focuses funding and people on the Alpha: top 100–150 projects with contracts and resident security engineers while Omega: ~10,000 projects scanned… | ||
| Demystifying Digital Signatures | Priya Wadhwa | 15m |
Explains how Sigstore components actually work by showing cosign keyless signing that generates ephemeral keys in memory only and requests a short lived… | ||
| Finding LibRaska: The Open Source Library that Props up our Infrastructure | Julia Ferraioli, Caleb Brown, Amir Montazery | 41m |
Project identification relies on concrete signals: dependency graphs, SBOMs, package analysis, truck‑factor and time‑to‑fix metrics, plus seven years of audits… | ||
| Automated Techniques for Measuring Trustworthiness of Open Source Code and Communities | Jeff Mendoza, Naveen Srinivasan | 19m |
Automated tools measure trustworthiness by running concrete checks and taking actions: Scorecard runs via docker or a GitHub Action using a GitHub token to… | ||
| Education & Training for Secure Software Development & Distribution | David A. Wheeler | 36m |
Many developers lack formal secure-development training: industry surveys report a skills gap (46% to 57% saying shortages), about 4 million unfilled… | ||
| The Secret Life of Maven Central | Joel Orlina | 33m |
Maven Central serves about 10 billion weekly requests and Sonatype runs publication through Nexus Repository Manager, orchestrates builds with Jenkins and… | ||
| Fireside Chat | Brian Behlendorf, Jamie Thomas | 25m |
Argues that product security must merge with cyber operations to stop software supply chain attacks like SolarWinds and Log4j, cites IBM’s concrete moves: 5000… | ||
| Action and Impact Panel: How OpenSSF and Industry Improve Open Source Security | Tracy Ragan, Rao Lakkakula, Bob Callaway | 42m |
OpenSSF coordinates concrete work: adoption of Sigstore for signing, launch of the OSV API to normalize vulnerability data, and an emergency response SIG to… | ||
| Closing Remarks | Brian Behlendorf | 02m |
Videos of sessions appear on the OpenSSF YouTube channel in about two weeks and mailing list subscribers get the announcement; the event is sponsored by… | ||
| nothing matches | ||