Back to Security Basics: Evaluating, Consuming, and Contributing Open Source...
summary
Open source use is ubiquitous — npm grows from 1 million to 3.6 million releases in three years — and that volume creates risk. Evaluation relies on concrete signals and tools: OpenSSF Scorecard and Best Practices Badge assess governance, CI, branch protection and tests; Intel’s CVEvin finds binary CVEs; S2C2F offers a consumption framework. A live demo scores python-fire 5.1/10, OpenSSF scans over 7,500 projects, highlighting fixable gaps like missing branch protection.
AI-written summary · about
chapters (7)
- 0:00Open source security basics
- 1:23Why security is challenging
- 8:25Evaluating projects securely
- 17:03Tools for evaluation
- 23:03Demo: Python Fire with Scorecard
- 28:47Contributing to security
- 31:39Q&A
related talks
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
16mKeynote: Back to Security Basics: Evaluating, Consuming, and Contributing Open Source Software
10mLightning Talk: Secure Consumption of Open Source Software: Evaluating, Util...
27mHow Do You Trust Your Open Source Software?
42mDeveloping a Secure, Open Future
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
35mOpen source security: Opportunity or oxymoron?
37mOpenSSF Best Practices for Everyone!