Navigating the Open Source Policy Labyrinth: Unraveling Global Policy Efforts for a Secure Future
summary
Argues open source is measurably more secure but needs regulation because of concentration risk (one library everywhere), a steep rise in supply‑chain malware since 2021, and inevitable interdependence; cites log4j fixed by volunteers in days while companies took months. Recommends industry‑aligned standards like NIST SSDF and non‑tech‑specific incentives (government as largest buyer, targeted grants for memory safety) and warns against the EU’s early approach that would place liability on maintainers or mandate specific languages or mailing source code.
AI-written summary · about
chapters (13)
- 0:00Introduction to talk
- 1:45Why open source needs regulation
- 5:13Concentration risk in open source
- 8:42Rising vulnerabilities and attacks
- 10:50Open source in critical systems
- 11:32Wrong ways to regulate open source
- 15:33Right ways to regulate open source
- 18:41US government policy efforts
- 21:08Secure software development framework
- 22:10Liability reform and negligence
- 24:38Software bill of materials critique
- 25:21EU Cyber Resiliency Act concerns
- 28:40Conclusion and Q&A
related talks
44mNavigating Open Source and Open Standards for Better Cybersecurity
17mA New Era for Open Source Security
28mKeeping Networks Secure: The Open Way
05mThe Long Arc of Digital Rights: Securing our Open Source Future
42mBuilding Resilience: The Next Decade of Open Source
34mCan Open Source be Secure by Design?
30mSecuring the Open Source Software Supply Chain
27mDriving Policy To Secure the Open Source Ecosystem