Open Source is making security better with James Ward
summary
Salesforce describes that opening code reduces attack surface because more eyes find and fix bugs, not expose secrets, and requires legal IP and QA gates: security review, legal review, and an open-source core-team review. A self-built CLA management tool automatically checks GitHub pull requests, prompts unsigned contributors, records signatures and updates the PR status. Internal process lives in Chatter/Salesforce workflow and the next goal is more automation to cut friction without removing safeguards.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:50Challenges
- 1:54Open Source
- 3:01Culture Shift
- 3:38Helping Competitors
- 4:19Challenges with Open Source
- 5:57Reducing friction
- 6:45Biggest challenges
- 8:05What has changed
related talks
40mSecurity: Why It _has_to Be Open Source
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
44mOpen Source Security: The World Needs Our Help
39mOpen Source Software Supply Chain Security — Why does it matter?
35mOpen source security: Opportunity or oxymoron?
05mKeynote: OpenSearch, Open Security: Bringing Transparency to Our Security Processes
40mSecure Your Code from Open Source Vulnerabilities
09mSecuring the Software Supply Chain with Open Source