Back To Schedule
Tuesday, October 27 • 18:30 - 19:20
Unsolved Problems in Open Source Security - Rhys Arkins, WhiteSource

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Feedback form is now closed.
Very few people today doubt the principles and benefits of Open Source, but you can definitely be forgiven for having concerns about its security. Some of the ways we rely on Open Source today are fundamentally flawed, yet almost never discussed - from registries hosting unsigned artifacts of unreproducible source to package managers which propagate new versions of dependencies at the earliest opportunity. It's time to identify these unsolved - and mostly undiscussed - risks, evaluate their potential impact, and determine what can be done in the Open Source community to address them. This presentation will discuss why we need reproducible builds in open source, verified artifacts, and why the majority of package managers may need a substantial change, while one in particular got it right. It will also provide some recommendations on defensive use of open source particularly for products and industries at the highest risk of software supply chain attacks.

avatar for Rhys Arkins

Rhys Arkins

VP of Product management, Mend
Rhys Arkins is responsible for developer solutions at WhiteSource. He was the founder of Renovate Bot, an automated tool for software dependency updating, which was acquired by Mend in 2019. Rhys is particularly fond of automation and a firm believer in never sending humans to do... Read More →

Tuesday October 27, 2020 18:30 - 19:20 GMT
OS Dependability Theater