Lightning Talk: Navigating the Intersection: AI’s Role in Shaping the Secure Open Sour...
summary
The talk maps four concrete intersections: open source packages underpin AI systems and face supply‑chain risk, with tools like Scorecard giving point‑in‑time repo health; open‑sourcing models needs cryptographic provenance via sigstore or a new model signing spec; AI already automates finding and fixing bugs (DARPA’s AI Cyber Challenge); and real threats include model/data poisoning, maintainer overload from mass fixes, and repo DOS from flooding PRs — OpenSSF runs an AI/ML working group (≈9 months old, ~20 initial participants) and hosts 40+ projects.
AI-written summary · about
chapters (9)
- 0:00OPSSF and its mission
- 1:02Open source meets AI
- 2:49Supply chain risks at AI-open source
- 4:59Long-term systemic risks
- 6:03Q&A on model signing
- 7:50Mitigating contributor strain
- 9:59Trust and compiler safety in AI
- 11:43OpenSSF Scorecard for repos
- 14:52Engaging AI players in security
related talks
21mNavigating the Intersection: AI’s Role in Shaping the Secure Open Source Software Ecos...
05mIgnite: Security of Open-Source AI: is there any difference?
14mDesigning the open and safe AI future
26mSponsored Session: Navigating Open Source AI with Guardrails
16mKeynote: Navigating Turbulent Waters of AI: Building a Secure and Safe Foundation
25mHow AI Is Changing Open Source Communities: Lessons From openEuler
29mThe Open Source Imperative in AI: Transparency, Governance, and Global Collaboration
36mThe Dark Side of AI: The Hidden Risks in Open-Source AI Models