Sonatype’s Brian Fox and the Perplexing Phenomenon of Downloading Known Vulnerabilities

What's in the SOSS? An OpenSSF Podcast

Το περιεχόμενο παρέχεται από το OpenSSF. Όλο το περιεχόμενο podcast, συμπεριλαμβανομένων των επεισοδίων, των γραφικών και των περιγραφών podcast, μεταφορτώνεται και παρέχεται απευθείας από τον OpenSSF ή τον συνεργάτη της πλατφόρμας podcast. Εάν πιστεύετε ότι κάποιος χρησιμοποιεί το έργο σας που προστατεύεται από πνευματικά δικαιώματα χωρίς την άδειά σας, μπορείτε να ακολουθήσετε τη διαδικασία που περιγράφεται εδώ https://el.player.fm/legal.

4M ago 22:24

MP3•Αρχική οθόνη επεισοδίου

Brian Fox is Co-founder and Chief Technology Officer at Sonatype, bringing over 28 years of hands-on experience driving software development for organizations of all sizes, from startups to large enterprises.
A recognized figure in the Apache Maven ecosystem and a longstanding member of the Apache Software Foundation, Brian has played a crucial role in creating popular plugins like the maven-dependency-plugin and maven-enforcer-plugin. His leadership includes overseeing Maven Central, the world's largest repository of open-source Java components, which recently surpassed a trillion downloads annually.

As a Governing Board member for the Open Source Security Foundation, Brian actively contributes to advancing cybersecurity. Working with other industry leaders, he helped create The Open Source Consumption Manifesto, urging organizations to elevate their awareness of the Open Source Software (OSS) components they use.

00:57 Brian shares his background
03:56 The confusing trend of people downloading assets on Maven with known vulnerabilities
08:16 How this trend continues in other repos
11:08 Brian and CRob discuss Log4Shell
16:54 Brian answers CRob’s rapid-fire questions
18:46 Brian’s advice for up-and-coming security professionals
19:50 Brian’s call to action

Episode links:

19 επεισόδια

#Tech #Omkhar Arasaratnam, Open SSF #Omkhar Arasaratnam #Open SSF