Tobie Langel

The first half of 2024 saw an entirely new category of threat against open source, one that rocked its trust-based system at its core: social engineering takeover attempt of critical open source projects.

These attacks uncovered a systemic gap in open source security management.

Up until now, the open source community wasn’t thought of as a potential cyber attack target. But when critical open source projects become stepping stones for industrial espionage, ransomware attacks, or cyberwarfare, maintainers need to adopt comparable security practices to those found in target organizations.

This creates a unique set of challenges for open source because of its highly distributed nature and volunteer-based model. Meaningfully improving security at scale while preserving the ethos, culture, and diversity of communities that characterize open source and that are largely responsible for its innovative potential isn’t an easy task.

In this talk we’ll do a post-mortem of the social engineering takeover attempt at the OpenJS Foundation. While preserving confidentiality, we’ll outline industry gaps uncovered during this attack. We’ll suggest ways to meaningfully improving security at scale while preserving the ethos, culture, and diversity of communities that characterize open source and that are largely responsible for its success.