Software Security and Slippery Slopes: How to elevate an entire ecosystem at scale
summary
Laid‑out claims and concrete results: trusted Publishers for Pi Pi ships and replaces long‑lived API tokens with a GitHub Actions flow that needs three small edits, reducing secret leakage risk; a security key giveaway puts thousands of keys in circulation and yields 37 000 users with two‑factor enabled on Pipi; automation (dependency bots, scanners) and targeted incentives beat vague exhortations; sigster / six store emerges as a revolutionary code‑signing stack that is costly to adopt but worth the trade‑off.
AI-written summary · about
chapters (14)
- 0:00Ecosystem security intro
- 1:06Why security upgrades hard
- 3:54Users skip proactive security
- 6:23Maintainers resist changes
- 7:51Changing security behavior
- 10:38Churn necessary for security
- 11:42What not to do when addressing churn
- 14:54Minimizing churn with automation
- 17:21Cost-justified security changes
- 18:47Incentivizing security features
- 20:10Security boosts sustainability
- 22:17Security improvement slope
- 24:26How to improve security
- 25:50Acknowledgments
related talks
37mAI, the Software Supply Chain, and Other (Not So) Puzzling Pieces
30mSecuring the Open Source Software Supply Chain
29mReducing the "Oops Factor": Pipelines for a Secure Python Development Lifecycle
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
31mSharing Security Secrets: How to Encourage Security Advocates
23mBuilding Secure Package Pipelines
18mContinuous Security - Building Security into your Pipelines
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?