►
From YouTube: Best Practices Make Perfect! How the OSSF is Impro... Marta Rybczynska & Christopher 'CRob' Robinson
Description
Best Practices Make Perfect! How the OSSF is Improving Secure Development Education - Marta Rybczynska, Founder, Syslinbit & Christopher 'CRob' Robinson, Intel Corporation
Open source projects come in different shapes and colors. They also face different security challenges. However, there are good practices that improve the security of every single project. Marta and CRob will walk the audience through some of the initiatives from the OpenSSF Best Practices group:
- Scorecards and Best Practices badge that allow evaluation of each project
- documents projects can refer to
- a training on developing secure software
---
Open source software is pervasive in data centers, consumer devices, and applications. Securing open source supply chains requires a combination of automated tooling, best practices, education, and collaboration.
Join the growing list of organizations supporting the advancement of securing open source technology and funding the development and adoption of OpenSSF initiatives. https://openssf.org/
A
A
So
let
us
start
right
away
because,
on
the
title
of
our
talk
is
best
practices
make
perfect.
So
we're
going
to
talk
about
how
the
open
ssf
is
helping
developers
write
better
code
and
help
improve
the
whole
community.
Let's
see
here
how's
this
going
to
work
bam.
That's
not
right!
You're
killing
me
Smalls!
A
Oh
there
we
go
perfect
all
right,
so
I'll
start
off
here.
I'm
probe
I
have
the
privilege
of
being
the
facilitator
for
the
best
practices
working
group
as
part
of
the
open
ssf
we
were.
One
of
the
original
working
groups
been
doing
stuff
for
nearly
three
years
now.
The
best
practices
working
group
is
focused
on
trying
to
help
developers
by
identifying
good
practice,
helping
them
learn
how
to
do
new
coding
skills
and
then
generally
just
trying
to
help
people
adopt
better
practices.
A
We
have
oh
I,
think
six
sub
projects
that
are
part
of
this
group.
We
have
best
practices
working,
bads
education,
scorecards,
some
of
which
we're
going
to
talk
about
here's
part
of
this
presentation,
and
we
just
recently,
if
you're
watching
the
the
twitterverse,
we
have
some
exciting
news
which
Mart
is
going
to
go
into
depth
on
a
little
bit.
The
group
just
recently
released
two
new
guides
to
help
developers
both
write
and
evaluate
open
source
security.
Don't
worry,
we're
gonna
have
a
whole
slide.
Just
on
that
it'll
be
great.
A
It'll
change
your
lives,
so
first
off
we're
going
to
talk
about
scorecards
scorecards
is
a
visible
way
of
showing
the
security
posture
of
an
open
source
project.
It's
an
automated
tool
that
goes
out
and
evaluates
a
project
going
through
a
series
of
tests
and
criteria,
and
it
provides
a
score
about
the
general
relative
security
posture
of
how
well
that
project
does
the
security.
A
It
gives
you
an
aggregate
score.
You
can
look
dive,
you
can
drill
in
and
look
at
scores
in
different
areas
around
different
aspects
of
security
and
securing
your
project
and,
as
always
like
all
of
our
patches
within
the
openssf.
They
are
looking
for
ideas
for
improvement.
They
provide
suggestions
for
projects,
but,
as
anything
we
talk
about
today,
patches
are
always
welcome.
So
if
you
have
an
idea
for
a
thing,
you
think
would
make
a
great
contribution
to
scorecard
open
up.
A
Pr
we'd
love
to
see
it
and
talk
about
the
idea,
but
in
general
this
Project's,
designed
to
help
consumers
understand
what
they're
getting
into
when
they
select
a
product
and
provides
the
maintainers
some
advice
on
how
they
could
potentially
do
things
a
little
better.
The
example
checks
here,
if
you
look
at
we
say,
is
the
project
free
of
checked
in
binaries?
Does
the
project
run
tests
in
a
CI
system?
Does
the
project
contain
a
security
policy?
These
are
kind
of
fundamental
elements.
Good
behaviors
we'd
like
to
see
good
practices.
A
We
want
them
to
execute
on,
and
the
scorecard
helps
help
folks
evaluate
that.
Currently
it
works
with
GitHub
as
a
repository,
but
there
are
a
couple
PR's
open
to
move
to
enable
this
functionality
in
other
repositories
like
gitlab
and
others.
So
again,
patch
is
welcome.
If
you
have
a
suggestion
idea
somewhere
you'd
like
to
see
this
go,
submit
a
PR
for
us
and
most
recently
and
I,
think
one
of
the
biggest
features
that
the
the
community
that's
been
using.
This
has
been
asking
for.
A
B
So
there
are
quite
many
categories
in
best
practices
like
what
is
on
the
website.
That
is,
has
enough
information,
the
licensing,
the
documentation
if
they
use
the
Change
Control
what
they
have
on
reporting
on
quality,
of
course,
on
security,
and
you
can
click
and
see
the
whole
criteria
list.
That
is
pretty
long,
and
it's
pretty
interesting.
Also
when
you
are
looking
into
the
data
each
project
has.
B
We
have
also
different
layers
like
the
the
there's,
a
gold
badge
that
has
more
criteria
that
that
are
being
met,
and
currently
there
are
more
than
5
000
projects.
We
have
recently
passed
the
5
000
project
mark
what
is
called
my
personal
personal
experience
with
best
practices
is
bad
is
sometimes
you
find
information.
You
cannot
easily
find
anywhere,
for
example,
I
want
to
know
if
a
given
project
is
using
static
analysis
and
for
a
random
project
where
they
are
looking
for.
B
A
Next
up
another
area
that
the
best
practices
working
group
works
on
is
we
provide
a
two
training
classes
on
secure
coding
fundamentals.
These
are
available
on
multiple
platforms.
So,
if
you're
familiar
with
the
edx
platform,
first
started
out
there
it's
available
in
GitHub
that
you
could
pull
down
and
use
there.
A
We
also
recently
started
offering
courses
through
the
Linux
Foundation
education
program
and
now
back
at
the
Austin
found
Austin
Summit
day,
we
announced
that
we
are
now
delivering
the
secure
fundamentals
class
in
a
using
a
format
called
scorm,
and
that's
what
a
lot
of
academic
and
corporate
Learning
Management
Systems
use
to
kind
of
share
and
showcase
their
content.
So
now
participating
organizations
are
allowed
to
use
the
scorm
connect
and
pull
in
the
fundamentals:
training
class
as
part
of
their
learning
management
system.
B
A
B
The
best
practices
working
group
has
been
working
on
two
documents
trying
to
compress
knowledge
into
short
documents.
So
they
have
been
very
long
and
deep
discussions
about
what
we
include
and
what
we
do
not
know
include
and
each
with
all
the
what
is
really
important.
What
is
important
for
all
projects?
What
is
important
just
for
certain
ecosystems,
and
we
have
come
with
two
documents
that
are
released
there
in
GitHub.
You
have
links,
so
you
can
read
it.
B
Of
course
we
can
comment,
you
can
post
appear
and
the
two
documents
first
is
the
guide
on
developing
most
secure
software.
Those
are
techniques,
tooling
that
you
can
consider
using
to
make
your
software
development
better.
For
example,
Point
11
in
the
25
points
that
are
here
prominently
document
how
to
report
vulnerabilities
and
prepare
for
them.
B
B
B
B
A
One
way
we
achieve
the
concise
nature
of
these
guys
is
through
links,
so
wherever
possible.
If
there
was
a
practice,
you
know
prominently
document
on
how
to
report
vulnerabilities.
If
there
was
an
authoritative
Source,
we
would
try
to
provide
links
right
to
that.
That
might
explain
how
to
do
that
technique
or
we
try
to
provide
examples
of
Open
Source
tools
where
there
are,
and
sometimes
where,
there's
commercial
tools.
That
also
can
help
augment
some
of
these
things.
B
A
One
of
the
most
exciting
and
new
aspects
of
the
working
group
is
our
adoption
of
stream,
one
of
the
openss
mobilization
plan
for
those
of
you
that
were
interested
and
were
joined
us
up
here
in
the
corner
in
the
front
of
the
room.
We
talked
a
little
bit
about
that
right
before
lunch,
but
for
those
of
you
that
didn't
have
that
option
show
something
else
or
come
in
here
a
little
late.
What
the
foundation
did
and
Brian's
going
to
give
us
a
more
detailed
explanation
here
in
a
little
bit,
but
basically
they
laid
out.
A
We
talk
about
things
like
improving
security,
with
CI
CD
systems,
General
devops
training
talking
about
just
general
code
hygiene.
Well,
it's
not
necessarily
a
security
problem.
It
could
become
a
security
problem.
If
your
code
is
too
complex
and
unreadable,
you
may
not
be
able
to
appropriately
update
it.
Others
might
not
be
able
to
contribute.
So
we
have
a
lot
of
different
areas
where
we'll
be
focusing
in
on
and
you'll
see
the
fully
published
revised
plan
later
this
year
and
as
always
patches
or
welcome
contributions,
are
welcome.
A
I'm
very
excited
about
working
around
this
and
another
one
of
our
tenants.
Also,
a
Beyond
servicing
underserved
communities
is
more
globalization
around
our
training.
We
have
commitments
to
convert
all
this
training
into
starting
off
with
five
human
languages
and,
as
that
program
develops
we'll
potentially
add
in
more
as
we
get
folks
that
are
able
to
translate
for
us
and
provide
this
training
around
the
globe.
B
B
We
have
worked
on
the
general
ideas
now
the
group
has
split
into
three
groups
working
on
three
stages,
so
there
is
a
stage
where
we
want
to
evaluate
the
training
that
exists
today
find
out
what
exists,
what
they
cover.
What
is
the
audience
the
technique?
Technologies,
they
use,
find
out
what
is
missing
and
what
will
be
needed
to
add
the
first
group.
B
Well,
it's
good
to
have
all
those
trainings,
but
then
how
do
we
make
actually
the
Developers
there
on
the
right
so
how
to
work
on
the
different
ways
we
can
bring
the
Developers
either
by
former
education
or
by
badges
or
by
by
sponsoring
them,
taking
those
trainings
or
going
to
conferences.
So
the
work
is
currently
in
progress
for
all
those.
Three
groups,
and
if,
if
you
have
an
ideas
in
the
area,
if
you
are
interested
in
those
subjects,
if
you
have
inside
for
a
specific
domain,
when
they
are
specific,
is
some
specific
requirements.
A
So
what
you're
going
to
see
us
do
over
the
next
year
is,
as
that
plan
is
finalized,
we're
going
to
start
executing
on
it,
taking
pieces
of
it
and
reaching
out
to
different
groups
or
collecting
different
materials
and
then
planning
out
how
we're
going
to
start
providing
this
information
to
the
broader
community
and
then,
as
Marta
mentioned,
how
are
we
can
we
incentivize
and
reward
Developers
for
taking
this
training?
How
can
we
entice
hiring
organizations
to
hire
someone
that
took
this
coursework?
A
You
know,
or
at
least
showcase
that
as
part
of
their
CV
or
online
profiles,
so
a
lot
of
things
good
things
there
and
then
the
best
practices
working
groups
going
to
continue
forward,
making
adjusting
the
current
guides.
We
have
and
producing
other
more
focused
guides,
like
the
npm
best
practices
guide,
was
an
effort
that
spun
up
out
of
our
group
and
then
the
npm
crew
kind
of
took
that
and
ran
with
it
based
off
of
our
models.
A
B
Would
like
to
add
a
personal
story:
I've
run
into
the
group
when
I
was
working
on
security
processes
for
a
new
distribution,
so
I
run.
I
was
someone
recommended
to
me
to
go
and
see
what
is
open
ssf
doing
on
the
subject
and
I
thought
exactly
the
guide
having
a
to-do
list.
What
should
security
policy
include?
Of
course,
I
did
some
adjustments
to
fit
a
special
case,
but
it
was
so
helpful.
So
I
would
like
to
see
different
documents,
different
resources
for
different
type
of
projects
that
you
can
come.
A
A
B
A
So
the
question
is:
are
we
aware
of
any
tooling
that
connects
spdx
with
either
scorecards
or
the
best
practices
badge
I'm,
not
personally
aware
at
this
time,
but
there's
a
special
guest?
An
expert
will
be
coming
talking
about
spdx
later
today
and
you
could
ask
her
that
question
I'm
not
familiar
myself.
I
can
look
it
up,
but
we'll
have
someone
here
that
can
probably
directly
answer
your
question
here
in
a
little
bit:
okay,
okay,
any
other
questions
about
best
practices
or
education
in
the
back.
A
A
So
the
question
was
approximately:
how
long
does
it
take
for
someone
to
go
through
a
petitioner
to
go
through
the
best
practices
badging
process?
The
answer
is
going
to
be.
It
depends
how
much
time
and
how
much
documentation
does
that
project
have
up
front.
We
will
we
move
with
the
velocity
of
the
project.
I'm
told
typically
like
a
basic
and
get
the
for
the
basic
level.
A
It
takes
a
couple
weeks
like
two
weeks
to
go
through
and
double
check
all
the
information
and
then,
as
you
go
further
along
like
for
silver
or
gold
level,
there
are
potentially
changes.
The
project
has
to
go
through
to
have.
You
know
more
documented
maintainers
that
might
take
some
time
to
get
those
people
up
to
speed,
so
the
the
silver
and
gold
they
don't
have.
Any
statistics,
David
wheeler,
would
be
a
person
you
want
to
reach
out
to.
He
would
know
exactly
because
he's
the
dude
that
does
the
interviews.
A
Wow,
the
first
question
was:
do
the
badges
expire
I
don't
know,
but
I'll
find
out
during
the
next
speech
and
I'll?
Let
you
know
afterwards?
What
was
your
second
question,
that
is
it
yeah,
so
I
I
don't
know,
but
Mr
Wheeler
is
awake
over
in
the
United
States,
so
I'll
reach
out
to
him
and
see
if
I
can
get
an
answer
for
you
over
Slack
you're
welcome.
A
Oh
phenomenal
question:
well,
we
have
a
publicly
available
Google
Calendar
that
has
all
of
the
meetings
and
links
to
get
into
the
zoom
calls
all
the
calls
are
generally
conducted
over
Zoom.
The
groups
generally
will
do
like
their
meeting
notes
in
Google,
which
will
get
converted
into
a
git
artifact
in
their
repo.
But
every
one
of
these
working
groups
has
a
git
repository,
you're,
welcome
to
get
in
and
look
at
submit
issues
or
pull
requests,
and
that
also
talks
about
meeting
times.
Meeting
frequency
and
other
information
like
what's
our
slack
Channel.
A
B
A
C
If
you
scroll
all
the
way
to
the
bottom
of
the
badge
itself,
you
will
see
the
questionnaire
you'll
see
what's
been
self-attested
and
there'll,
be
a
record
of
when
was
the
last
modification
and
whether
that
like
changed
the
gradient,
if
they're
like
90
there
or
they're
125
percent
Beyond
a
passing
under
like
a
paying
the
silver
or
gold
batch,
but
yeah,
it
does
not
expire.
But
yeah.
Some
projects
have
padded
for
three
years.
A
A
Okay,
excellent
and
it
potentially,
if
that
is
an
issue,
if
you
would
like
to
see
that
that's
something
you
could
submit
in
the
project,
maintainer
and
the
working
group
can
talk
through,
but
right
now,
as
the
gentleman
mentioned,
there
is
no
current
expiration
on
the
badge
itself.
Thank
you
all
right.
Thank
you.
Everybody
I
really
appreciate
it.