OpenSSF Courses

What Makes a Project Critical? Discovering and Evaluating Popular Open Source Software

Discover criteria for evaluating critical open source projects and learn to assess their impact on infrastructure and society.

• YouTube
• 12 minutes
• Self-Paced
• Free Video

SBOMs Everywhere - Work in Progress and Challenges Ahead

Explore the progress and challenges of Software Bill of Materials (SBOMs) implementation across industries with insights from a leading expert in dependable embedded systems.

• YouTube
• 19 minutes
• Self-Paced
• Free Video

Driving Security at Scale: Principles for Package Repository Security - Lecture

Explore principles for enhancing package repository security, including a four-level maturity model. Learn about CISA's collaboration with OpenSSF to improve open source ecosystem security at scale.

• YouTube
• 19 minutes
• Self-Paced
• Free Video

Leveraging Sigstore Capabilities in a Local Environment

Explore Lockheed Martin's integration of Sigstore for secure, auditable software development. Learn about internal Kubernetes deployments, certificate authorities, and streamlined GitLab pipelines for enhanced security.

• YouTube
• 13 minutes
• Self-Paced
• Free Video

Beyond "Just Update All the Things": Uncovering the Nuances of Dependency Security

Uncover complexities of dependency security, explore OSV project solutions, and learn strategies for integrating vulnerability management into developer workflows.

• YouTube
• 19 minutes
• Self-Paced
• Free Video

Compiler Options Hardening for C and C++

Explore compiler options to enhance C/C++ program security. Learn about memory-safety issues, mitigation techniques, and the OpenSSF Compiler Options Hardening Guide for informed decision-making.

• YouTube
• 17 minutes
• Self-Paced
• Free Video

Born of Hard Times - The Clean Dependency Project is Here to Help

Explore the Clean Dependency Project's proactive approach to OSS vulnerability management and learn how to contribute to this innovative open-source initiative.

• YouTube
• 14 minutes
• Self-Paced
• Free Video

Sigstore: 2024 and Beyond

Explore Sigstore's achievements, future roadmap, and vision for securing open source software. Learn about upcoming milestones and opportunities to contribute to this de-facto signing solution.

• YouTube
• 14 minutes
• Self-Paced
• Free Video

Improving FOSS Security - Best Practices for Vulnerability Management

Discover best practices for FOSS projects to enhance security, from vulnerability prevention to effective response strategies. Learn to protect users through responsible security management.

• YouTube
• 18 minutes
• Self-Paced
• Free Video

Under the Radar: How We Found 0-Days in the Build Pipeline of OSS Packages

Explore critical vulnerabilities in OSS build pipelines, including 0-day discoveries in major projects. Learn about attack trees, mitigations, and 'Living Off the Pipeline' components for enhanced security.

• YouTube
• 20 minutes
• Self-Paced
• Free Video

Every Journey to Securing the Software Supply Chain Starts with a Single Step

Explore NYU's journey in software supply chain security, uncovering challenges, best practices, and a roadmap for enhancing software security.

• YouTube
• 13 minutes
• Self-Paced
• Free Video

Embrace the Differences: Securing Open Source Ecosystems Where They Are

Explore efforts to fix the libwebp vulnerability in Python packages, examining interactions between security standards and open source ecosystems.

• YouTube
• 18 minutes
• Self-Paced
• Free Video

Eating the Open Source Security Sandwich with Skootrs

Explore Skootrs, an open-source tool simplifying adoption of security practices for software developers through automation and guardrails.

• YouTube
• 19 minutes
• Self-Paced
• Free Video

Build Provenance: Lessons from Homebrew

Explore build provenance for Homebrew package manager, including achievements, challenges, and technical insights. Learn about its architecture and implications for similar ecosystems.

• YouTube
• 16 minutes
• Self-Paced
• Free Video

The Journey of the Node.js Permission Model

Explore the creation of Node.js Permission Model, uncovering motivations, challenges, and solutions. Gain insights into this experimental security feature and its impact on the ecosystem.

• YouTube
• 15 minutes
• Self-Paced
• Free Video