Securing the World’s Open Source Software, Together
summary
Open source underpins 97% of projects and GitHub reports 413 million contributions in 2022, so the platform focuses on concrete steps: a staffed GitHub Security Lab, an open Security Advisory Database, and tooling like Dependabot that pushes alerts to 375,000 repositories and helped update over 18 million packages (50% more vulnerable packages fixed in 2022 than 2021). Work also includes mandatory MFA for npm and GitHub contributors, $32M distributed via GitHub Sponsors, and adoption of Sigstore attestations.
AI-written summary · about
chapters (5)
- 0:00Introduction and context
- 3:37Empowering developers in open source
- 13:55Software supply chain security
- 23:33Government collaboration and policy
- 37:32Q&A on open source program offices
related talks
27mBuilding a Secure Open Source Project on GitHub
30mSecuring the software supply chain together
15mGetting Started Contributing
38mFortifying Your Codebase with GitHub
25mSecure Your Open-Source Project with GitHub
49mProtect Your Code with GitHub Security Features
16mKeynote: Back to Security Basics: Evaluating, Consuming, and Contributing Open Source Software
12mKeynote: Our Responsibility to the Global Open Source Community