Keynote: Back to Security Basics: Evaluating, Consuming, and Contributing Open Source Software
summary
Open source code now appears in 96% of surveyed packages and makes up about 77% of many codebases, with package counts growing from 1M in 2019 to ~3.6M today, so assessment matters: prioritize projects with living maintainers, recent commits and issue responses, clear licenses, documented governance and contributor guides, and a secure bug reporting process. Use automated checks like scorecard and binary scanning like cve-bin-tool, adopt a checklist for maintenance cadence, dependency depth, and user communication.
AI-written summary · about
chapters (12)
- 0:00Introduction and thanks
- 0:21Why open-source security matters
- 1:23Challenges in open-source communities
- 4:17Unsupported projects and risks
- 5:42Evaluating open-source projects
- 7:04Basic health checks for projects
- 9:15Governance and licensing importance
- 10:18Maintenance and release processes
- 11:00Community engagement and documentation
- 12:21Tools for open-source assessment
- 13:43S2C2F and user responsibilities
- 14:24Taking ownership of dependencies
related talks
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...- 41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
10mLightning Talk: Secure Consumption of Open Source Software: Evaluating, Util...
11mKeynote: Securing Open Source
39mSOS: Sustainable Open Source
41mManaging the risk and growth of using Open Source Software
01h 01mKeynote - Open source is just about the source, isn't it?
39mOpen source security: who’s responsible?