Supply-Chain Security: What Helping 200 Projects Improve Their Security Looks Like

Learn about Google Open Source Security Team's (GOSST) groundbreaking initiative to enhance supply-chain security across ~200 critical open-source projects in this 36-minute conference talk. Explore the challenges maintainers face in implementing security improvements, where the benefits primarily serve package consumers rather than adding direct features or fixing bugs. Discover the team's successful approach that resulted in over 500 accepted contributions, gaining insights into their philosophy, methodology, and key learnings from working with various open-source projects. Gain valuable knowledge about supporting maintainers in strengthening open-source security, whether you're a consumer, maintainer, or security enthusiast interested in contributing to a more secure open-source ecosystem.