SOSS Community Day Europe 2024
2024-09-19
Vienna, Austria
as the organisers put it
SOSS Community Days are an opportunity for Community Members from across the Security and Open Source ecosystem to get together and share ideas.
| title | author | length |
|---|---|---|
| Welcome & Opening Remarks | Katherine Druckman | 08m |
Housekeeping items cover the event code of conduct, badge QR codes for schedule and Wi‑Fi, and a shout‑out to sponsors with GitLab platinum sponsor and new… | ||
| Application Security is a Community Effort | Fernando Diaz | 05m |
Claims that application security improves when many people inspect transparent code and actually shows it: GitLab practices include Collaborative Verification… | ||
| Will eBPF Save Us From the Next Global Outage? | Liz Rice | 14m |
Argues that eBPF lets vendors run safe, high-performance kernel-level security by verifying loaded programs before they execute, reducing risk of kernel… | ||
| CISA Update | Aeva Black | 08m |
U.S. cyber agency is funding startups to build software artifact dependency graph generation tools with up to $1.7M non-dilutive awards, open to teams… | ||
| Hitchhikers' Guide to the Vulniverse | CRob | 23m |
A rapid tour of the actual artifacts and rules used to manage vulnerabilities: identifiers (CVE issued by CNAs), root causes (CWE, ~200 entries), and severity… | ||
| Security Initiatives in Community Driven Projects: Looking Ahead with Python and Rust | Deb Nicholson, Rebecca Rumbul | 20m |
Python and Rust foundations describe concrete outputs: a hired security engineer (Python from the community, Rust brought externally), Python becomes a CNA and… | ||
| We Know Security but How Do We Secure GenAI End-to-End? | Mihai Maruseac | 19m |
Claims concrete fixes: sign models at train time, hash formats the same way used for signatures, and generate salsa provenance for each training cycle (data… | ||
| Finally! Automated End-to-End VEX Streams You Can Trust | Adolfo García Veytia | 19m |
Claims an end-to-end automated VEX stream by using compiler reachability to generate canonical OpenVEX statements, implemented via govulncheck producing… | ||
| Nation-State Threats in the Open-Source Software Supply Chain | Ross Bryant | 16m |
Phylum’s automated platform monitors seven ecosystems and 40 million packages and uncovers Lazarus Group npm campaigns that target developers with fake job… | ||
| Enforcing Organization Policies with Enterprise Contract | Zoran Regvart | 21m |
Enterprise Contract enforces concrete release gates: it validates Sigstore cosign and in-toto attestations, checks image provenance and platform indexes (demo… | ||
| German National Guideline on SOSS-Lifecycle: Community Outreach | Damian Ludwig, Andreas Neth | 13m |
A national guideline for a secure open source lifecycle proposes a tooling-agnostic baseline with tiered implementation levels (incubating vs established)… | ||
| Exploring a Risk Approach to Software Supply Chain Security | Abdullah Garcia | 18m |
Software supply chain attacks act as the initial step in broader attack chains, so adopt a practical risk model that scores data risk, external risk, software… | ||
| Play, Learn, Secure: The Power of Gamification in Security Training | Julia Lamenza | 20m |
Monthly compliance modules feel boring so replace them with hands‑on events: a pentest day initiative runs a full day of planted vulnerabilities that engineers… | ||
| Breaking Barriers: The Art of (Free) Gamified Security Training | Joseph Katsioloudes | 19m |
Open source secure coding game hosted on gh.io/securecodegame uses GitHub Codespaces and GitHub Advanced Security for instant, browser‑based labs, with 2,000… | ||
| OSS Dependency Health: Towards Maturity and Sustainability Risk Assessment Model | Georg Link, Miguel Ángel Fernández Sánchez, Ana Jiménez Santamaría, Wietse Braam | 20m |
A Risk Model implemented on top of CHAOSS GrimoireLab aggregates seven metrics into a 0–10 score and a red/yellow/green flag to rate dependency maintenance… | ||
| Rules of Engagement for Forking a Dependency | Chris Swan | 11m |
Customers flag a vulnerable dependency via Dependabot and the response follows a concrete four-step escalation: check for an existing issue or PR, raise an… | ||
| The Current State of Open Source Security Compliance Tooling Is … Well, Sad. | Philippe Ombredanne | 18m |
A recent study finds many generated SBOMs are invalid JSON and tools disagree on identifiers, with inconsistent CycloneDX outputs and mismatched package URL… | ||
| ML Model Signing: Cryptographically Paving the Way to Provenance in Machine Learning Models | Mihai Maruseac | 21m |
An open source library creates a signed manifest of every file or hash shards inside an ML model, converts that manifest to an in-toto payload and records the… | ||
| Prioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis | Joseph Hejderup | 23m |
Demonstrates using static reachability analysis and call graphs to cut noise from SCA alerts: manifests list transitive libraries but code-level reachability… | ||
| Managing Vulnerabilities in Open-Source Dependencies | Eva Sarafianou | 13m |
Argues that open-source vulnerability management needs tooling plus process and gives concrete steps: define must-have requirements first (languages, package… | ||
| Securing Content Distribution with RSTUF, an Incubating OpenSSF Project | Kairo De Araujo, Martin Vrachev | 22m |
RSTUF is an incubating OpenSSF project that implements a generic TUF repository service and is already in use for PyPI and RubyGems staging tests and private… | ||
| Secure Coding Guide for Python | David Mather, Bart Karas | 18m |
OpenSSF-backed Secure Coding Guide maps concrete CWE entries to runnable Python snippets and currently contains about 70–80 compact examples, one 47-line case… | ||
| Web Developer Security: Best Practices & Beyond | Daniel Appelquist | 18m |
Last year’s workshop launches an ongoing community group (SWAG) that gathers W3C, OpenSSF, Open Web Docs, Mozilla, Google, OpenJS, BBC and others to fix… | ||
| Exploring Some Essential Security Checks for Any Open Source Go Project | Cosmin Cojocar | 25m |
Shows concrete CI steps and tools to harden Go projects: add gosec as a fast GitHub Action emitting SARIF, run fuzzing with Go’s built‑in fuzzer and OSS‑Fuzz… | ||
| Userspace CNI - Developing in the Open with Remaining Secure | Michael O'Reilly | 15m |
A neglected userspace CNI repo is restored to build and to CI by updating out‑of‑date dependencies, fixing broken API calls, deleting an accidental binary, and… | ||
| Let Devs Be Devs Without Sacrificing Security | Andrew McNamara | 18m |
Proof of concept and production builds run through the same pipeline framework while risk is enforced by policy rather than separate processes: Tekton for… | ||
| Navigating the Quantum Readiness Journey: Open-Source Cryptography, PKI and Signing Tools | Mike Agrenius Kushner | 13m |
NIST releases final postquantum algorithms and renames them to mlsa, slh DSA and mlem, which bring larger keys, bigger signatures and key encapsulation… | ||
| Run GenAI Projects at Scale Securely: From the Operating System to the MLOps Platform | Michelle Tabirao | 21m |
GenAI production needs an end-to-end secure stack: Ubuntu with Ubuntu Pro LTS (5 years, extendable to 12) plus livepatches for kernel fixes, Charmed QFlow and… | ||
| Closing Remarks | Katherine Druckman | 01m |
Thanks and congratulations for sticking through a full day of open source security; agenda items are concrete: listen to the What's in the SOSS podcast, read… | ||
| nothing matches | ||