Software Update Security for Humans - A Gentle Introduction

Explore fundamental software security concepts through this 26-minute conference talk that introduces The Update Framework (TUF) and its role in Drupal's Automatic Updates initiative. Learn how software supply chains create vulnerabilities for Drupal sites and discover how collaborative efforts across open source projects are improving supply chain security. Understand digital signatures and asymmetric key-pairs through accessible real-world analogies like cheques, contracts, and notaries before diving into the technical aspects of software package validation. Examine the basics of Drupal and Composer workflows, identify where they become vulnerable to attacks, and see how TUF enables Automatic Updates to verify that newer module versions haven't been tampered with. Gain practical knowledge about keeping Drupal sites secure while reducing barriers for diverse organizations to adopt Drupal, with no prerequisites required for this beginner-friendly introduction that grounds complex security concepts in everyday examples.