AI, the Software Supply Chain, and Other (Not So) Puzzling Pieces
summary
Live demos show concrete wins and gaps: Copilot-powered fixes spot and patch an SQL injection in-editor, push protection blocked secret (CosmosDB) before a push, and actions produce attestations via OIDC + sigstore that verify PyPI packages and feed policies (Open Policy Agent) for deploy-time checks. Numbers stress scale: 4.5B GitHub contributions, 730M Actions minutes, 10M leaked secrets in 2023 and 7M unresolved code alerts. Operational practices are emphasized: Dependabot auto-updates, required 2FA with 95% opt‑in and 1.4M passkeys.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:57Software supply chain basics
- 7:58Software security challenges
- 8:46AI in supply chain security
- 11:41AI code security demo with Copilot
- 17:03Platform and dev security
- 19:34Build security and dependencies
- 22:22Software signing demo with provenance
- 28:03Supply chain security in practice
- 30:12AI and open source involvement
- 31:00Q&A
related talks
58mSecuring Code in the Age of AI
41mCode Security Reinvented Navigating the era of AI
32mCode Security Reinvented: Navigating the Era of AI
30mHuman vs AI: How to Ship Secure Code
28mOwn Goal: How AI Agents Are Quietly Scoring for the Other Side
26mSmarter Code, Sneakier Risks: Supply Chain Security in the Age of AI
27mHidden Dangers Of AI In Developer Workflows: Navigating... with Dwayne McDaniel
48mAI Impact on Cybersecurity and Privacy