SOSS Fusion 2024
2024-10-22..2024-10-23
Atlanta, United States
as the organisers put it
SOSS Fusion is an event where the brightest in software dev & cybersecurity converge as one to secure the open source software that we all depend on.
| title | author | length |
|---|---|---|
| Continuous Assurance of Supply Chain Security Levels of Open Source Artifacts using SLSA 0.1 | Krithika Venugopal, Raj Krishnamurthy | 11m |
An assessment tool is demonstrated that parses SLSA 0.1 provenance and actually verifies claims: it detects tampered artifacts and typosquatted packages… | ||
| Open Source Software (OSS) Transparency for Acquisition | Scott Hissam | 35m |
Argues for treating software supply chain as a first class object in acquisition and offers a reuseable Security Acquisition Framework with 51 goals and 334… | ||
| Living with and Leveraging GCC | James Lowden, Bob Dubner | 43m |
GCC now officially accepts the effort to add COBOL frontend with the goal of a free compiler that runs legacy mainframe code without rewriting it, using flex… | ||
| Open & Secure: Novel Sandboxing Technique for Any Open Source Library | Gal Elbaz | 33m |
Claims a deployable runtime that fingerprints library behavior and detects deviations to stop exploits without CVEs, using eBPF plus Google’s KRSI hooks to… | ||
| Save the Elephants - Secure Your PostgreSQL Databases with TDE | Lori Lorusso | 34m |
Percona releases an open source PostgreSQL extension called pgde that implements TDE to encrypt data at rest, aims for minimal core impact and regulatory… | ||
| An Inside and Outside Look at the Government’s Ongoing Journey with Open Source Tech | Austen Bryan, Camdon Cady | 33m |
Government programs report ~86–90% of projects include open source, run 1,600 nightly rebuilt images through Iron Bank, and require signed SBOMs plus CVE… | ||
| Innovate Fast, Operate Securely: AI-Powered Protection for Containerized Workloads | Rick Bosworth | 35m |
SentinelOne demonstrates an integrated CNAPP: agentless Singularity SCAP that performs asset discovery, KSPM, and an offensive security engine that… | ||
| QEMU-Native Hooking Bridge for Binary Fuzzing | Subhojeet Mukherjee | 11m |
A QEMU-native hooking bridge for AFLplusplus implements hook functions as a TCG plugin with only a six-line GDB change inside QEMU, installs a small trampoline… | ||
| Building Developer Confidence in Software Security with the DevRel Community | K. Druckman, L. Lorusso, T. DiDomenico | 40m |
OpenSSF surfaces concrete tools and entry points: the OpenSSF Security Scorecard (repo-level automated checks), the Best Practices Badge (checklist to earn a… | ||
| Fortify Your Code: Secure Your Supply Chain with Scorecard | Aditya Soni | 16m |
Scorecard runs automated checks against a repo and returns a 0–10 numeric score based on tests like branch protection, binary artifacts, dependency hygiene and… | ||
| Artificial Intelligence Cyber Challenge (AIxCC): Overview and Releasing Research as Open Source Software | David A. Wheeler, Jeff Diecks | 44m |
Two-year DARPA/ARPA‑H competition asks teams to build AI systems that find and fix vulnerabilities in real code bases; partners (Anthropic, Google, Microsoft… | ||
| The Current State of SBOMs for End Users | Eddie Zaneski | 29m |
Current state: SBOM formats are inconsistent and checkboxes let empty JSON or Word docs satisfy regulators, while tooling is sparse and fragmented. Protobom… | ||
| Validating Validations - Who's Watching the Watcher? | Megan Wolf | 23m |
Lula is a CLI/TUI that repeatedly injects or collects Kubernetes resources, runs Rego/Kyverno checks, and emits OSCAL assessment-results showing whether… | ||
| What Is Going On In Your Source Code? Understanding SCA In Plain Language | Dwayne McDaniel | 30m |
Breaks down software composition analysis into concrete checks: generate SBOMs + VEX attestation (CycloneDX / in-toto JSON), map known flaws via… | ||
| From Cosign to an Ecosystem: The Evolution of Sigstore | Cody Soyland | 29m |
Sigstore is a modular stack: Cosign (sign/verify CLI supporting keyless flows, KMS and hardware keys), Fulcio (free public CA issuing 10-minute certificates)… | ||
| Keynote: Enshittification Was a Choice | Cory Doctorow | 18m |
Argues that internet enshittification is a policy choice and traces a repeatable pattern: platforms start user‑friendly then lock users in, then reallocate… | ||
| Keynote: There Is Just One Way to Do Open Source Security: Together | Marten Mickos | 16m |
Claims concrete outcomes and numbers: the platform reports one critical vulnerability every hour fixed for customers, and a community of 2 million ethical… | ||
| Keynote: Welcome | Adrianne Marcum | 02m |
Opening logistics and sponsors are covered: Defense Unicorns and SentinelOne get a gold-sponsor shoutout and a sponsor showcase in Skelton is open with demos… | ||
| Secure AI Orchestration: Mitigate Model-centric Attacks with Flyte | Niels Bantilan | 27m |
Outlines two concrete attack classes: pickle-based code injection that executes on model deserialization and agent prompt-injection leading to arbitrary… | ||
| How to Scale InnerSource Adoption in Regulated Industries | Joseph Zang | 12m |
Fannie Mae’s InnerSource program builds an ASO that enforces governance and security, partners with legal/risk, and measures adoption with repo metrics… | ||
| Episode AI: The Phantom (Dependency) Menace | Darren Meyer | 25m |
Endor Labs research shows AI/ML projects often carry phantom dependencies—packages installed at runtime or by scripts that aren’t in manifests—and in 15… | ||
| Solving Air-Gap Problems the Cloud Native Way with Zarf | Austin Abro | 25m |
Zarf packages bundle Kubernetes manifests, Helm charts, OCI images and Git repos into a single declarative zarf package OCI artifact that pushes image layers… | ||
| End-to-End Secure ML Development | Mihai Maruseac | 23m |
Covers an end-to-end recipe that actually signs and verifies models using model signing with six store and logs inclusion proofs so model hubs can verify… | ||
| Keynote: Government's Continuing Path Contributing Towards a Secure Open Source Ecosystem | Timothy Pepper | 15m |
CISA outlines four concrete goals from the Open-Source Software Security Roadmap (2023): establish agency role, map prevalence of critical dependencies, reduce… | ||
| The Power of Confidential Computing: Exploring Open Source Projects | Sal Kimmich | 12m |
Overview of concrete tools and results rather than promises of privacy A catalogue of OSS components that run in hardware attested TEEs with examples and… | ||
| Secure Numerical Computing is Hard: Lessons from 10 Years of Open Data Science & the Long Road Ahead | Peter Wang | 35m |
Annual survey data plus 12 years and ~$30M of investment show open numerical stacks carry brittle, value-dependent correctness: Fortran/C extensions, JITs and… | ||
| Crash Course on AI Risk Management Framework | Andrew Staton | 25m |
NIST publishes an AI Risk Management Framework that is high level and requires the companion Playbook and interactive website for actionable steps, with the… | ||
| 5 Things OSS Can Do To Make Life Easier For The Public Sector | Eddie Zaneski | 15m |
Five concrete changes that increase public-sector uptake: design for air-gapped environments and add explicit no-root install or override options so tools… | ||
| Keynote: Opening Remarks | Todd Moore | 22m |
Linux Foundation hosts hundreds of projects growing ~30% year over year with about 900,000 contributors and an estimated $100 billion of code value… | ||
| Why Is My Software on Fire? | Laurent Goderre | 16m |
Argues that missing version metadata breaks vulnerability alerts and forces costly recalls by analogy to airbags and peanut butter, cites recalls spanning 100… | ||
| Project Copacetic: Directly Patch Container Image Vulnerabilities | Ashna Mehrotra | 20m |
Project Copacetic (Copa) is a Go CLI that reads Trivy JSON output or scans an image itself then applies OS package upgrades as a single new Buildkit patch… | ||
| ClearlyDefined: A Crowdsourced Database of Licensing Metadata | Nick Vidal, Lynette Rayle, Qing Tomlilnson | 27m |
A crowdsourced database that serves licensing metadata via a simple REST API and hourly change notifications powers SBOM and compliance workflows, harvesting… | ||
| Role-Based Access Is so Yesterday: Revolutionizing Authorization with Open FGA | Kiah Imani | 37m |
Claims that Open FGA replaces brittle RBAC by evaluating relationship tuples so access is inferred rather than hardcoded, with immediate revocation when a… | ||
| Supply-Chain Security, Outside in: What Helping ~200 Projects Improve Their Security Looks Like | Pedro Nacht, Diogo Teles Sant'Anna | 36m |
Google’s open source security team targets ~200 critical projects using OSS-F criticality and Scorecard to prioritize work, makes 455 contributions focused on… | ||
| Trojan Model Hubs: Hacking the ML Supply Chain & Defending Yourself from Threats | Sam Washko, William Armiros | 27m |
Public model hubs host over 3,000 models that would execute arbitrary code on deserialization and 41% of those evade Hub detection; up to 46% of cloud buckets… | ||
| The Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack | Erez Yalon | 34m |
Shows concrete attacker methods and real incidents: account takeovers on npm that push crypto miners from a 10M-weekly-download ua‑parser release, a March 7… | ||
| How to Use CNCF’s Falco to Protect Yourself from the New SCARLETEEL Attack! | Parthi Srinivasan | 10m |
Falco is a CNCF runtime detector that uses eBPF probes and a rule engine to spot each step of the SCARLETEEL path: unexpected inbound container activity, calls… | ||
| Assessing Open Source Software Projects in the Software Supply Chain | Scott Hissam, Joshua "CoCo" Crisp | 31m |
A small bash-based MVP aggregates public APIs and proprietary feeds to score OSS projects and produce JSON reports published to Confluence, then generates risk… | ||
| PEP 740 and PyPI: Bootstrapping Provenance for the Python Ecosystem | William Woodruff | 31m |
PEP 740 defines how PyPI serves attestation objects (adestations) compatible with Sigstore and ties them to PyPI’s trusted publishing identities, with index… | ||
| The Simple, Yet Lethal, Anatomy of an AI Attack | Erez Yalon | 30m |
Shows concrete attacks: a known campaign targets the Ray package and Ray package had no auth, letting attackers leverage dependencies to touch model training… | ||
| The Open Source Paradox: Unpacking Risk, Equity, and Acceptance | Vincent Danen | 47m |
Open source generates many CVE entries but actual exploitation is rare: historical data shows <1% exploited; Red Hat discovers 1,670 vulnerabilities affecting… | ||
| Navigating the Open Source Policy Labyrinth: Unraveling Global Policy Efforts for a Secure Future | Dan Lorenc | 29m |
Argues open source is measurably more secure but needs regulation because of concentration risk (one library everywhere), a steep rise in supply‑chain malware… | ||
| Navigating the Quantum Readiness Journey: Hands-on Guidance for Starting Your Migration- | Eric Mizell | 30m |
Explains that Shor’s algorithm already gives a concrete path to breaking RSA/ECC and estimates full-sized threats by ~2033 but likely sooner, cites IBM and… | ||
| Easier, Faster, and Safer Open Source Consumption Governance | Brando Himes, Brian Greenwood | 32m |
Over 12 years Vanguard builds an internal package registry (2012), adds CI, then a manual artifact request flow (2017) with lawyers and security pros… | ||
| Unpaid Maintainers: The Security Threat No One Is Talking About (yet) | Lauren Hanford | 28m |
Surveyed maintainers report 60% unpaid and 58% have considered quitting, with many projects aging and contributors dropping under 25. The xz utils backdoor and… | ||
| A Glimpse Into OSS Vulnerability Disclosure Practices | Jessy Ayala | 31m |
Study analyzes ~4,500 GitHub security advisories plus Hunter and HackerOne bug bounties, finds reviewed advisories average 177 per month leaving a backlog that… | ||
| Ace of Base: Meeting the OpenSSF Security Baseline with Minder | Adolfo García Veytia | 24m |
Minder is an open source security platform now in the OpenSSF sandbox that observes repos, builds and artifacts and reconciles state to a declared desired… | ||
| Scorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories | Jeff Mendoza, Stephen Augustus | 31m |
OpenSSF Scorecard runs as a CLI, GitHub Action, API and weekly cron that already scans 1.2 million projects, and supports Allstar to open GitHub issues when… | ||
| Keynote: Setting the Standard - Safely Operationalizing OSS Contributions | Brenton Stevens | 13m |
A regulated fintech can increase Open Source contributions by routing proposals through a gate called Ark that enforces five entry requirements (benefit… | ||
| Keynote: Back to Security Basics: Evaluating, Consuming, and Contributing Open Source Software | Katherine Druckman | 16m |
Open source code now appears in 96% of surveyed packages and makes up about 77% of many codebases, with package counts growing from 1M in 2019 to ~3.6M today… | ||
| Keynote: Stop Peeing in the Pool! | Dan Lorenc | 15m |
Argument that open source suffers a gradual brand erosion as companies relicense projects with near‑open but noncompliant terms, often adding clauses that bar… | ||
| Keynote: Fireside Chat with Window Snyder & Katherine Druckman | Window Snyder, Katherine Druckman | 23m |
Device platforms lag behind OS and mobile security and cause long‑lived risks in cars, medical gear and infrastructure; the practical fixes offered are… | ||
| Keynote: Welcome Back & Remarks | Todd Moore | 04m |
Welcome back remarks thank sponsors named in the transcript including Defense Unicorns, Sentinel, one fosa and startups Lineage and Stack Loock, and announces… | ||
| nothing matches | ||