The Open Source Paradox: Unpacking Risk, Equity, and Acceptance
summary
Open source generates many CVE entries but actual exploitation is rare: historical data shows <1% exploited; Red Hat discovers 1,670 vulnerabilities affecting its products but only a handful see real-world exploitation, while a large proprietary vendor reported 1,281 vulnerabilities with a higher proportion rated critical. Synopsys Black Duck scans 1,000 codebases and finds 96% contained open source and 77% of code originates from OSS. Patching everything is costly and risky (Spectre/Meltdown remediation cost ~8,000 person-hours); risk assessment must use context, impact, and exploit evidence.
AI-written summary · about
chapters (13)
- 0:00Introduction and context
- 8:33Transparency in open source
- 9:30Understanding CVSS ratings
- 10:52Comparing risk and reporting
- 15:00Proprietary vs open software
- 22:01Software lifecycle management
- 22:36Case study: Spectre/Meltdown
- 23:34The cost of patching
- 24:22Transparency as a strength
- 25:27Strategic risk management
- 26:07Rethinking security philosophy
- 28:35Empowering users with equity
- 29:47Q&A and closing remarks
related talks
58mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
38mApplication Security in the age of Open Source
30mDevSecOps: Understanding Open Source Software risk in your applications
25mOWASP Top 10 Risks for Open Source Software
39mOpen source security: who’s responsible?
14mThe State of Open Source Vulnerabilities Management in 2019
49mTrustworthy Open Source: The Consequences of Success
47mThe TRUE Cost of Open Source