Scorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
Discover strategies for implementing OpenSSF Scorecard at scale, exploring various tools and methods to assess, monitor, and enhance repository security across large organizations.
Open Source Software Transparency for Acquisition - Making Security Trade-off Decisions
Explore software security measurement strategies and trade-off decisions for organizations using open-source components, focusing on vulnerability assessment, process metrics, and cybersecurity analysis.
Assessing Open Source Software Projects in the Software Supply Chain Security
Discover techniques for evaluating open source software trustworthiness through process assessment, risk analysis, and supply chain practices, with insights from DoD's Unified Platform project.
A Glimpse Into Open Source Software Vulnerability Disclosure Practices
Explore current challenges and solutions in open-source software vulnerability disclosure, examining security advisories, bug bounty reports, and maintainer perspectives for improved OSS security practices.
PEP 740 and PyPI - Bootstrapping Provenance for the Python Ecosystem
Explore how PEP 740 enhances PyPI's security through digital attestations, integrating with Sigstore and SLSA to provide robust package provenance without complex key management.
Secure Numerical Computing is Hard: Lessons from 10 Years of Open Data Science and the Long Road Ahead
Explore key security challenges and lessons learned from a decade of open data science, focusing on enterprise adoption of ML/AI technologies and emerging threats in numerical computing.
Easier, Faster, and Safer Open Source Consumption Governance
Discover practical strategies for automating and securing open source consumption while maintaining effective governance and legal compliance in enterprise environments.
The Open Source Paradox - Unpacking Risk, Equity, and Acceptance
Explore the complex dynamics between open source and proprietary software, examining risk tolerance, security biases, and evolving enterprise acceptance patterns in modern technology landscapes.
Analysis of and Lessons from the Xz-Utils Vulnerability - What Might Come Next
Delve into the technical analysis of the xz-utils vulnerability incident, exploring the combined attack techniques, social engineering aspects, and future implications for open-source software security.
Device Management and Delta Update for Embedded Devices with SWUpdate and TUF
Discover how to implement secure and efficient software updates for embedded devices by integrating SWUpdate with TUF framework, focusing on delta updates and device management for resource-limited environments.
Understanding Linux Kernel CVEs and Their Recent Surge
Understand how the Linux kernel community manages CVE assignments, their new structured approach to vulnerability reporting, and best practices for handling security updates.
The Current Situation of SBOM in Japan - Software Supply Chain Management and Implementation
Discover Japan's evolving SBOM landscape through insights on implementation challenges, government guidelines, and industry best practices from a leading Japanese SBOM evangelist and METI advisor.
Trials and Tribulations of Updating Dependencies for Vulnerability Remediation
Discover how to effectively manage and update dependencies for vulnerability remediation, exploring automated solutions and practical strategies for npm and Maven ecosystems while minimizing potential breakages.
The Telemetry of Trust - Using Attestations to Secure Your Software Development Lifecycle with Open Source Tools
Discover how attestations and cryptographic telemetry can secure software delivery at scale, building trust through verifiable inputs and enabling safer deployment decisions across diverse development environments.
SBOM Implementation Reality: From Crawl to Walk - SPDX Lite Profile for the First Step
Discover how to create Software Bill of Materials (SBOMs) efficiently using SPDX Lite profile, featuring practical JSON examples and implementation strategies for meeting regulatory requirements in software supply chains.
Hunting Trojans with AST Transformers and Machine Learning
Discover advanced techniques for detecting malicious Python projects using AST Transformers and machine learning, focusing on obfuscation methods and countermeasures in cybersecurity.
Demystifying Thread Call Stack Spoofing - Advanced Techniques for Stack Manipulation
Dive into advanced thread stack spoofing techniques, combining stack frames forging with ROP and JOP to achieve stealthy module execution and call stack manipulation.
Everything You Didn't Want to Know About CVE - Understanding Vulnerability Disclosure Challenges
Dive into the complexities of vulnerability disclosure and CVE processes, exploring recent events that highlight systemic issues and their impact on security professionals' ability to manage threats effectively.
The XZ Backdoor Story: How a Supply Chain Attack Nearly Compromised SSH Servers
Uncover the gripping investigation of the XZ backdoor incident, exploring the mysterious maintainer Jia Tan, technical analysis of the compromise, and crucial lessons for open-source security.
Regenerating Passwords from RoboForm's Password Generator - A Time-Based Attack
Delve into reverse engineering RoboForm's password generator vulnerability, exploring techniques to regenerate historical passwords and recover locked Bitcoin wallets through systematic analysis.
Open Source Software Supply Chain Security - Understanding Threats and Best Practices
Explore critical threats to open source software supply chains, industry best practices for security, and practical strategies for protecting against vulnerabilities and cyberattacks.