Mobilizing for the Open Source Security Mobilization Plan
Learn how OpenSSF's 10-point plan aims to improve open source software security and discover ways to contribute to this crucial initiative.
Trials, Tribulations and Triumphs - An End User's Perspective on Software Supply Chain Security
Explore enterprise challenges, initiatives, and future vision for open source software supply chain security from an end user perspective. Learn about threat mitigation strategies and collaborative efforts.
Secure Software Supply Chain Framework (S2C2F) Guide - OpenSSF SIG Meeting
Explore secure open source software consumption practices and improve your software supply chain integrity with the S2C2F guide.
SLSA: Enhancing Software Supply Chain Security - More Than Just a Garnish for Your Pipelines
Explore SLSA principles for securing software supply chains. Learn threat models, security levels, and how to contribute to this OpenSSF project for enhanced DevSecOps processes.
Securing Software Supply Chains Using the SLSA Framework
Implement SLSA framework to secure software supply chains. Learn practical, vendor-neutral examples for code, build process, provenance, and deployment to create a resilient software development lifecycle.
Security Concerns in Every Stage of the Software Supply Chain
Explore security concerns throughout the software supply chain, from development to deployment. Learn strategies to mitigate risks and enhance overall security posture in DevOps practices.
Bridging Business and Open Source - Integrating Innovation and Community Contributions
Explore how Cybertrust Japan bridges open source and business, focusing on MIRACLE LINUX, AlmaLinux contributions, SBOM generation, and security enhancements through OpenSSF activities.
Improving the Security of a Large Open Source Project One Step at a Time
Explore Node.js security initiatives, from new features to vulnerability management. Learn to apply these insights to your development process and contribute to the Node.js community's security efforts.
How to Serve Open Source Maintainers Without Annoying Them
Discover best practices for reporting bugs to open source maintainers, including coordinated disclosure and effective communication, to improve acceptance rates and reduce friction.
Improving the Security of a Large Open Source Project One Step at a Time
Explore Node.js security initiatives, learn from real-world vulnerabilities, and discover how to contribute to the project's safety. Gain insights to enhance your own development process and ecosystem security.
AI Showdown - The Good, The Glitchy, and The Risky
Evaluating top AI frameworks for CI/CD integration, focusing on accuracy, security, coding practices, and compliance with emerging standards and legislation.
Trojan Model Hubs: Hacking the ML Supply Chain and Defending Against Model Serialization Attacks
Discover essential strategies for protecting ML systems from supply chain attacks, focusing on model scanning and cryptographic signing to defend against Model Serialization Attacks in public model hubs.
Solving Air-Gap Problems the Cloud Native Way with Zarf
Discover how to streamline Kubernetes deployments in air-gapped environments using Zarf, enabling efficient packaging and deployment of workloads while maintaining supply chain visibility through automated SBOM creation.
Meeting the OpenSSF Security Baseline with Minder
Discover how Minder platform helps monitor and ensure OpenSSF Security Baseline compliance across repositories, with practical demonstrations of automated security posture management.
The Current State of Software Bill of Materials (SBOMs) for End Users
Explore the challenges and opportunities of Software Bill of Materials (SBOMs), examining current implementation issues, regulatory requirements, and emerging solutions through OpenSSF projects like Protobom and bomctl.
Trojan Model Hubs - Hacking the ML Supply Chain and Defending Against Security Threats
Discover essential security strategies for ML model hubs, focusing on detecting Model Serialization Attacks and implementing cryptographic signing to protect against compromised artifacts and system vulnerabilities.
Secure Coding Guide for Python
Learn secure coding practices for Python, focusing on CWE framework-based advice and executable examples to enhance open source project security and developer skills.
Protecting Kubernetes Resource Manifests in End-to-End Software Development Lifecycle
Secure Kubernetes manifests throughout the software development lifecycle. Learn about integrity protection, signing techniques, and end-to-end supply chain security.
Better Build Pipelines with OpenSSF Projects - Enhancing Trust and Security
Enhance build pipeline security using OpenSSF projects: cosign, SBOMs, and SLSA. Demonstrate kpack for container image building on Kubernetes, integrating signed images and SBOM generation.
The Journey of the Node.js Permission Model
Explore the creation of Node.js Permission Model, uncovering motivations, challenges, and solutions. Gain insights into this experimental security feature and its impact on the ecosystem.
Embrace the Differences: Securing Open Source Ecosystems Where They Are
Explore efforts to fix the libwebp vulnerability in Python packages, examining interactions between security standards and open source ecosystems.