From Concept to Deployment - The Life and Death of Security Features
Explore the journey of security features from concept to deployment, examining successful implementations and abandoned ideas in the tech industry, with insights from BlackBerry's research.
Defeating Secure Code Review GPT Hallucinations - Understanding LLM Limitations in Code Analysis
Explore the limitations and pitfalls of LLMs in code security analysis, focusing on common mistakes in code search and clone detection tasks, particularly with misleading variable names.
Why Is My Software on Fire? - Understanding Software Versioning and Supply Chain Security
Discover essential software versioning practices and supply chain management principles to enhance security and prevent hazards in open source development.
QEMU-Native Hooking Bridge for Binary Fuzzing
Explore advanced binary fuzzing techniques through QEMU-Native Hooking Bridge, offering improved instruction hooking and memory control for efficient vulnerability detection in compiled code without source access.
Navigating the Open Source Policy Labyrinth: Unraveling Global Policy Efforts for a Secure Future
Explore global policy initiatives shaping open-source software security, from US Executive Orders to EU regulations, while understanding how modern frameworks like SLSA and Software Self Attestation enhance digital infrastructure.
Validating Kubernetes Webhook Controllers - A Framework for Testing and Monitoring
Discover how to validate Kubernetes webhook controllers using Lula, enabling systematic testing and monitoring of critical security functions in evolving cluster environments.
Trojan Model Hubs: Hacking the ML Supply Chain and Defending Against Model Serialization Attacks
Discover essential strategies for protecting ML systems from supply chain attacks, focusing on model scanning and cryptographic signing to defend against Model Serialization Attacks in public model hubs.
ClearlyDefined: A Crowdsourced Database of Licensing Metadata for Supply Chain Compliance
Discover how ClearlyDefined simplifies software licensing compliance through its crowdsourced database, API integration, and automated metadata management for efficient supply chain security.
From Cosign to an Ecosystem - The Evolution of Sigstore
Explore the evolution of Sigstore's software security ecosystem, from its core components to advanced integrations for package managers, CI workflows, and policy enforcement tools.
Phantom Dependencies in AI and ML Projects - Managing Hidden Software Dependencies
Discover how phantom dependencies impact AI/ML projects and learn effective strategies for identifying, managing, and securing these hidden software dependencies in your applications.
The Current State of Software Bill of Materials (SBOMs) for End Users
Explore the challenges and opportunities of Software Bill of Materials (SBOMs), examining current implementation issues, regulatory requirements, and emerging solutions through OpenSSF projects like Protobom and bomctl.
How Dependabot Applies Advisory Databases to Python
Discover how GitHub's Dependabot leverages advisory databases to enhance Python security, including community collaboration and automated vulnerability detection processes.
A Day in the Life of a Base Image - Evolution of Vulnerabilities in Popular Containers
Explore container security evolution through data-driven analysis of popular DevOps images, vulnerability scanning challenges, and practical solutions for maintaining secure development workflows.
Building a Secure CI/CD Pipeline - Beyond Security Tools Integration
Discover effective strategies for optimizing security tools in CI/CD pipelines, moving beyond basic implementation to achieve meaningful security improvements and practical outcomes.
Security By Design
Discover essential principles and practices of integrating security throughout the software development lifecycle with guidance from security expert Ana Oprea.
Prototype Pollution Leading to Remote Code Execution in NodeJS
Delve into prototype pollution vulnerabilities in Node.js, exploring how they enable remote code execution, analyzing real-world exploits, and understanding recent security mitigations.
Maturing Your Application Security Program - A Practical Guide to Next Steps
Discover practical steps to advance your AppSec program through three maturity levels, with actionable strategies for immediate security posture improvement based on experience with 400+ companies.
Handling Security Vulnerabilities in Eclipse Projects - A Guide for Project Maintainers
Learn how to effectively handle security vulnerabilities in your projects, from initial reporting through resolution, using Eclipse Foundation's processes and new security management tools.
Software Supply Chain Security - Transforming Challenges into Improved Open Source Software
Discover practical strategies for navigating software supply chain security challenges through community-driven approaches and developer empowerment in the open-source ecosystem.
Eclipse Open VSX and Open VSX Registry - A Strategic Overview
Discover how Eclipse Open VSX and its registry serve as a marketplace solution, exploring Ericsson's strategy for decentralized deployment, security governance, and community-driven development initiatives.
Trojan Model Hubs - Hacking the ML Supply Chain and Defending Against Security Threats
Discover essential security strategies for ML model hubs, focusing on detecting Model Serialization Attacks and implementing cryptographic signing to protect against compromised artifacts and system vulnerabilities.