Sustainability and security: it’s time to connect the dots
A presentation at Upstream by Tobie Langel
Sustainability & Security: It’s time to connect the dots Tobie Langel (@tobie) Principal, UnlockOpen tobie@unlockopen.com
🇵🇹 Image by XKCD, CC BY-NC 2.5. Tobie Langel (@tobie) Principal, UnlockOpen
🏭 INDUSTRY-WIDE EFFORT Organized by the Linux Foundation. Backed by tech giants. 💰 MULTI-MILLION $ FUND Administered by Linux Foundation and a steering group of industry experts. 🎯 GOAL Harden the security of key open source projects. 👓 STRICT FOCUS ON “CORE INFRA” The goal is to prevent a new Heartbleed. Not to make open source as a whole more sustainable.
🔁 CORE INFRA INITIATIVE 2.0 Still run by the Linux Foundation. OpenSSF is membership-driven, so more resourced and more sustainable. 🏆 WIDER SCOPE 10K projects + critical build tools & package managers. Training. Best practices. 🧭 NEW 10 POINT PLAN - prevent security defects and vulnerabilities - improve vulnerability discovery - shorten ecosystem patching response time
The Heartbleed Bug Tobie Langel (@tobie) Principal, UnlockOpen
Heartbleed bug impact 👩⚕ 4.5 MILLION The number of US patient records whose con dentiality was compromised. 💰 $500 MILLION fi Estimated cost to the industry.
Pivotal moment where tech industry realizes open source is: 🌏 UBIQUITOUS 2/3 of active sites on the Internet rely on the OpenSSL library. ⚠ CRITICAL OpenSSL encrypts private communications, bank transactions, medical records, etc. 💸 UNDERFUNDED Only 1 full-time maintainer, shoestring budget ($2k/year).
Tobie Langel (@tobie) Principal, UnlockOpen
Towards a sustainable solution to open source sustainability Tobie Langel, Principal, UnlockOpen
🛥 WHAT IS IT? Red Hat business model for the long tail. 🛎 SERVICES Provides security updates, maintenance, and legal assurances for all open source projects in an organization’s stack. 👨💻 HOW? By paying the actual maintainers to do the work. 🏆 SUCCESS STORY None yet. Still too early.
Photo by Parihav, CC BY-SA 3.0. Tobie Langel (@tobie) Principal, UnlockOpen
Worldwide developer population Non-pro 4.30M Full-time Part-time 11.65M 6.35M Source: IDC, : h t a m e p lo e v n the e f o k c a b k ic Qu 780B $ = K 5 6 $ x 12M FT devs 210B $ = K 5 3 $ devs x T P M 6 + ars ~= 1 trillion doll , 2018.
$100
$10,000
1 million dollars
100 million dollars
1 trillion dollars
100 million dollars
Tobie Langel (@tobie) Principal, UnlockOpen
Tobie Langel (@tobie) Principal, UnlockOpen
Thank you ! Tobie Langel (@tobie) Principal, UnlockOpen tobie@unlockopen.com
Over the past years we’ve seen an acceleration of security issues across all of open source, so much so that software supply chain attacks and open source security have caught the White House’s attention.
Current approaches have been focused on fixing the symptoms.
It’s time that we realize that improving the situation durably will require a more holistic approach that considers sustainability, community health, and project lifecycles as key to open source security.
