Collaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
summary
Cloud platform codebase includes vast open source dependencies and attackers have backdoored packages like Event-Stream and left-pad or removed last-good releases (Bootstrap-sass) leaving eight days of exposure; automated tools find bugs at scale: CodeQL queries on GitHub, fuzzing via OSS-Fuzz (17,000 bugs across 250 projects), compiler hardening and reproducible builds reduce classes of bugs, and provenance + policy via in-toto SBOMs lets release systems detect tampered artifacts and block compromised builds.
AI-written summary · about
chapters (23)
- 0:00Start
- 0:23Mark Russinovich I'M the Chief Technology Officer of Microsoft Azure
- 3:19Restclient
- 8:39How Do We Prevent Unwanted Products from Entering a Supply Chain
- 9:26How Do We Help the Open Source Ecosystem Find Vulnerabilities in the Source Code
- 9:50Vulnerabilities in Source Code
- 10:28Typosquatting
- 12:02Static Code Analysis
- 12:35Synopsis
- 13:16Source Code Vulnerability Analysis
- 13:59Security Lab
- 14:53Demo of Code Ql
- 17:31Uninitialized Variables
- 21:07Electron
- 26:13How Do You Know What Your Upstream Dependencies Look like
- 28:26Automate Your Dependency Mapping and Your Build Pipelines
- 28:54Build Systems and Package Managers
- 31:50Build Tampering
- 39:54Licensing
- 45:29Docker Build
- 48:16Automated Dependency Tools
- 50:23Learn More about Software Building Materials
- 50:49Conclusion
related talks
43mThe Importance of Developer Tooling to Make Open Source More Secure by Default
49mTrustworthy Open Source: The Consequences of Success
44mOpen Source Security: The World Needs Our Help
39mOpen source security: who’s responsible?
01h 06mStrengthen open source software supply chain security: Log4Shell to xz
38mApplication Security in the age of Open Source
35mOpen source security: Opportunity or oxymoron?
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together