A Teen’s Perspective on Navigating Open Source Security with GUAC
summary
GUAC builds a dependency graph by ingests SBOMs, then ranks packages by calculating dependents and by OpenSSF Scorecard values; it produces a combined 0–1 risk score using a modified sigmoid (Rob Pike–inspired) formula with adjustable weights. Example: package G has five dependents and a scorecard of 7.2, package F has two dependents and 4.5, and F registers higher risk because of its low scorecard. The feature is called “next actionable critical dependency.”
AI-written summary · about
related talks
43mThe Burden of Knowledge: Dealing With Open Source Risks
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
20mBuilding Secure Software OpenSSF Best Practices for Everyone!
40mUnderstanding OSS Risk Beyond Code Vulnerabilities
42mDeveloping a Secure, Open Future
50mHow Do You Trust Open Source Software?
57mReviewing NuGet Packages security easily using OpenSSF Scorecard
27mHow Do You Trust Your Open Source Software?