Completed
1. Better Open Source Publishing Protection - Single factor authentication is unacceptable • Registries should ideally allow enforcing of 2FA for publishing • Consumers can elect to use dependencies …
Class Central Classrooms beta
YouTube videos curated by Class Central.
Classroom Contents
Unsolved Problems in Open Source Security
Automatically move to the next video in the Classroom when playback concludes
- 1 Intro
- 2 Open Source Security: Navigating the Iceberg
- 3 The Enemy Gets a Vote
- 4 Dependency Maturity Levels
- 5 Open Source Detection
- 6 Security Notifications
- 7 Remediating Open Source Vulnerabilities
- 8 Important: Vulnerable vs Malicious Packages
- 9 Malicious Packages . Bad from the start - Typosquatting
- 10 Identity Concepts
- 11 Identity: Risk and Reward • Package compromise rewards are mostly predictable: • Stolen credentials
- 12 FA Challenges • Transitive dependencies
- 13 Security Multipliers
- 14 Why Malicious Updates Are Missed
- 15 Open Source Updates: Inconvenient To Review . Source control platforms are designed for reviewing your code, not someone else's you imported
- 16 All things equal, Decentralized makes Security Worse . Whenever a malicious package is discovered, the first instinct is: Why didn't the registry detect this, and how long did it take them to remove
- 17 SemVer Range Example
- 18 Uncapped Version Ranges Are An Antipattern
- 19 Version Selection: The Way Forward
- 20 1. Better Open Source Publishing Protection - Single factor authentication is unacceptable • Registries should ideally allow enforcing of 2FA for publishing • Consumers can elect to use dependencies …
- 21 2. Verifiable Source Code using Reproducible Builds . There's no point reviewing for malicious code if we're scanning the wrong code to begin with - Non-reproducible builds should be a code smell, li…
- 22 Open Source Dependencies Should Be Sandboxed • Today's approach to malicious open source packages can be compared to Windows 95 pre-malware tsunami . Unfortunately, no relief in sight from language e…
- 23 Package Managers Implement Minimal Selection . It's madness that a malicious package release can be installed accidentally seconds after it's published, without anybody reviewing it • Minimal Version…
