Panel Discussion: Open Source Supply Chain Security - Are Containers..
summary
Claims that containers are the biggest blind spot get grounded in numbers and tools: the panel cites scanned 3 million containers and npm scale of 2.3M packages (≈32M releases, 1M new/mo), notes top public images often fix under 20% of CVEs in 180–195 days, and finds 1% of packages explain 25% of CVEs while 86% show zero known CVEs (the “popularity paradox”). Concrete mitigations: use ebpf + Tetragon, runtime observability, SBOM/VEX automation, and prioritize automation over manual review.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 2:09Open source vs proprietary security
- 4:14Weakest link in supply chain
- 7:29Mitigating container risks
- 8:54Supply chain security trends
- 12:25Runtime security with eBPF
- 15:34Myths vs reality in attacks
- 18:48AI's impact on security
- 22:38Containers vs VMs security
- 25:24Maintainers vs security
- 31:07Q&A on zero CVEs and government
- 39:58Closing remarks
related talks
32mWhat Data Tells Us About Software Supply Chain Security & What To Do About It
44mPanel Discussion: Improving the Software Supply Chain Security
37mThe State of Open Source Security
29mFragile by Design: Large-Scale Evidence of Supply Chain Risk
45mPanel Discussion: Managing Open Source...
16mUnpacking Open Source Security in Public Repos
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
28mCode, Dependencies and Security: Where Is the Risk