Michael Lieberman
where else to find them
what they talk about
all 8 in the filters
where they keep going back
- Open Source Summit Europe3 editions2023–2025
- KubeCon + CloudNativeCon Europe2 editions2021–2025
- SupplyChainSecurityCon @ Open Source Summit Europe2 editions2023–2024
all 12 in the filters
on a stage with
all 19 in the filters
who talks about the same things
- Dan Lorenc21 talks
- Santiago Torres-Arias14 talks
- John Kjell16 talks
- Brandon Lum23 talks
- Joshua Lock12 talks
- Brandt Keller10 talks
| title | conference | date |
|---|---|---|
| Panel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience | Open Source Summit Europe 2025 | 2025-08-25 |
CRA deadline 2027 and most organisations remain unready; the Act treats companies that ship software as manufacturers and keeps maintainers largely out of… | ||
| Practical Software Bill of Materials: From Generation to Distribution Workshop | CVE/FIRST VulnCon 2025 | 2025-04-07 |
SBOMs are generated with Trivy (or Syft), augmented with sbom-azim or a checked-in JSON and jq, then enriched via Parlay(ecosystems) to add licenses, repos and… | ||
| Merging Security and Compliance: Perspectives on Emerging Regulations and Best Practices | CVE/FIRST VulnCon 2025 | 2025-04-07 |
The EU Cyber Resilience Act creates legal duties mainly for manufacturers selling “products with digital elements,” shifts liability downstream (maintainers… | ||
| Production, Consumption, and the Data: The Open Source Security Sandwich | CVE/FIRST VulnCon 2025 | 2025-04-07 |
Argues that security requires stitching production metadata to consumption controls and demonstrates an implemented pipeline: ingest SBOMs, OpenSSF Scorecard… | ||
| Keynote: Cutting Through the Fog: Clarifying CRA Compliance in Cloud Native | KubeCon + CloudNativeCon Europe 2025 | 2025-04-01 |
European Cyber Resilience Act goes into full effect in 2027 with a first enforceable reporting duty on Dec 11, 2026 for known exploitable vulnerabilities… | ||
| Mind the Gap: Bridging Supply Chain Policy With Git-less GitOps and GUAC | KubeCon + CloudNativeCon Europe 2025 | 2025-04-01 |
Live demo shows an exploited dependency introduced, an SPDX SBOM generated with Trivy and uploaded into OpenSSF GUAC which indexes dependencies so a single… | ||
| Improving the Software Supply Chain Security | SupplyChainSecurityCon @ Open Source Summit Europe 2024 | 2024-09-16 |
Panel lists concrete progress and gaps: GUAC ingesting SBOMs, dep.dev and OSV with GraphQL/REST APIs now used by Google and Microsoft; Sigstore shows broad… | ||
| Panel Discussion: Improving the Software Supply Chain Security | Open Source Summit Europe 2024 | 2024-09-16 |
Panelists describe concrete progress: GUAC ingesting SBOMs and exposing GraphQL/REST APIs today to answer whether a CVE impacts one or 100 apps; sigstore for… | ||
| Is the Internet on Fire? Strategies for Mitigating Open Source... | CloudNativeSecurityCon North America 2024 | 2024-06-26 |
Open source packages repeatedly carry real-world implants and zero days (Log4Shell, Sunburst, typo‑squatting) that bypass CI and SCA; defenders build an asset… | ||
| Improving Supply Chain Integrity with Ope... | SupplyChainSecurityCon @ Open Source Summit North America 2024 | 2024-04-16 |
OpenSSF technologies target concrete gaps: Salsa v1 defines three incremental build-integrity levels plus a provenance document and is expanding to protect… | ||
| Fresh SLSA and GUAC Starts with Knowing Your Ingredients | SupplyChainSecurityCon @ Open Source Summit North America 2024 | 2024-04-16 |
Open source dependency graphs explode quickly: a small Java microservice demo pulls 114 direct and transitive components; Log4j hit ~70,000 projects directly… | ||
| The Road to Zero CVEs: People and Technology | SupplyChainSecurityCon @ Open Source Summit Japan 2023 | 2023-12-05 |
Claims that "zero CVEs" is a destination are false; it’s a continuous journey that combines people, process, and tooling. Practical steps shown include signing… | ||
| Eliminating the Unknowns: Using GUAC to Better Understand Your Software Supply... | SupplyChainSecurityCon @ Open Source Summit Japan 2023 | 2023-12-05 |
GUac ingests and correlates real SBOMs and attestations (CycloneDX and SPDX SBOMs, in-toto SLSA attestations signed by Sigstore), pulls OSV, VEX, salsa… | ||
| Ketchup, Mustard, and Relish... | SupplyChainSecurityCon @ Open Source Summit Europe 2023 | 2023-09-19 |
Salsa reaches version 1.0 (April) with a focused build track and three build levels emphasizing provenance generation, attestation, and isolation; Fresca… | ||
| Ketchup, Mustard, and Relish... | Open Source Summit Europe 2023 | 2023-09-19 |
Panel covers concrete outputs: SLSA 1.0 (April, 3 build levels) defines provenance, unforgeable attestations and isolation strength for build platforms; the… | ||
| Panel Discussion: Ketchup, Mustard, and Relish of Software Supply Chain Security | SupplyChainSecurityCon @ OSS NA 2023 | 2023-05-10 |
OpenSSF Supply Chain Integrity work focuses on concrete deliverables: Salsa 1.0: five build requirements (provenance, isolation, strength) after cutting ~20… | ||
| SLSA with Us: The Dance of AppSec | SupplyChainSecurityCon @ OSS NA 2023 | 2023-05-10 |
SLSA Build 1.0 enforces provenance for source-to-artifact builds and defines three levels: L1 exists provenance, L2 signed provenance, L3 unforgeable per-build… | ||
| Let’s Talk Software Supply Chains with TAG Security | CloudNativeSecurityCon North America 2023 | 2023-02-01 |
Outputs include the Software Supply Chain Security Whitepaper, a living catalog of supply chain compromises with dozens of writeups, and a Secure Software… | ||
| Securing Your Supply Chain by Building with FRSCA | CloudOpen @ Open Source Summit Japan 2022 | 2022-12-05 |
FRSCA implements the Secure Software Factory reference architecture to enforce provenance, signatures, and SBOMs for builds, using Tekton and Tekton Chains… | ||
| It's Dangerous To SLSA Alone Out There! Take This Artifact Knowledge Graph! | KubeCon + CloudNativeCon North America 2022 | 2022-10-24 |
A knowledge graph called guac ingests SBOMs, in-toto/SLSA attestations, Sigstore records and VEX feeds, correlates them in Neo4j and answers blast‑radius… | ||
| SLSA FRSCA Recipe For Secure Supply Chain | KubeCon + CloudNativeCon North America 2022 | 2022-10-24 |
Claims an end-to-end secure factory that reaches SLSA Level 3 by combining Tekton Pipelines/Chains, Sigstore/Cosign, SPIFFE/SPIRE, Kyverno, Tetragon, Vault and… | ||
| Putting the Supply Chain Pieces together: A Deep Dive into the Secure softwar... | Cloud Native SecurityCon Europe 2022 | 2022-05-16 |
An implementation of the CNCF Secure Software Factory that ties Tekton Chains, SPIRE identities, Sigstore and Kyverno to produce signed attestations and… | ||
| Getting Started with Supply Chain Security is Easier Than You... | SupplyChainSecurityCon North America 2021 | 2021-10-11 |
Claims that getting started is practical: a demo builds a Rust Hello World with Kaniko, emits a CycloneDX SBOM, attaches Cosign signatures and Tekton Chains… | ||
| An Introduction to the Financial Services User Group | KubeCon + CloudNativeCon Europe 2021 | 2021-05-04 |
A user group for financial services maps concrete constraints onto cloud-native projects, not vague theory: monthly meetings (third Tuesday, 14:30 GMT)… | ||
| nothing matches | ||