►
From YouTube: Finding LibRaska: The Open Source Library that Props up our Infr... Julia Ferraioli & Amir Montazery
Description
Finding LibRaska: The Open Source Library that Props up our Infrastructure: Julia Ferraioli, Open Source Technical Leader, Cisco & Amir Montazery, Chief Operating Officer, Open Source Technology Improvement Fund (OSTIF)
Little-known or non-obvious packages often play an outsized role in critical infrastructure, sometimes taking down large ecosystems as a result. Amir, Caleb and Julia will discuss the challenges of finding these projects and how to support them.
---
Open source software is pervasive in data centers, consumer devices, and applications. Securing open source supply chains requires a combination of automated tooling, best practices, education, and collaboration.
Join the growing list of organizations supporting the advancement of securing open source technology and funding the development and adoption of OpenSSF initiatives. https://openssf.org/
A
A
Awesome
yeah,
so
we're
going
to
talk
about
the
classic
problem
of
the
comic.
As
Crow
mentioned,
you
know
finding
those
projects
that
really
support
a
lot
of
modern
digital
infrastructure,
but
aren't
really
well
known
or
usually
maintained
by
one
person
and
for
some
reason
that
person
lives
in
Nebraska,
but
no
I'm
kidding.
They
live
everywhere.
But
yeah
we're
excited
to
talk
to
you
about
that.
Today.
A
A
One
of
the
objectives
of
the
work
group
is
to
identify
a
set
of
of
projects
deemed
critical
and
what
we've
learned
from
multiple
discussions
very
insightful
discussions
with
the
working
group
and
the
community
at
large
is
that
it's
going
to
be
very
difficult,
if
not
impossible,
to
have
a
de
facto
comprehensive
list
that
applies
to
every
single
user.
Every
single
stack,
every
single
person
as
critical,
and
so
the
best
thing
to
do
in
a
case.
A
Code
audits
for
three
of
the
top
five
critical
Java
libraries
and
since
we
last
spoke
in
June,
has
patched
25,
critical
or
high
severity
cves
proactively.
So
so
there's
a
lot
to
be
done.
But
thankfully
a
lot
is
also
being
done
and
we
have
great
folks,
like
Julia
and
the
working
group
really
just
trying
to
hammer
out
this.
This
age-old
question
of
what
are
the
critical
projects
out
there.
B
A
little
bit
you
and
I
have
talked
about
how
hard
it
is
to
to
come
up
with
this.
This
list
right-
and
you
alluded
to
the
fact
that
there's
not
going
to
be
one
list
which
is
interesting,
because
you
know
in
I
work
in
open
source
programs
offices
which
oftentimes
stewards
open
source
for
a
company,
both
incoming
and
outgoing,
and
it
is
actually
really
difficult
when
somebody
comes
to
you
oftentimes
much
more
senior
than
you
are
saying.
A
B
A
I
think
one
thing,
especially
when
you
really
get
down
to
it
is
I
think
it's
all
kind
of
contextual
right.
So
what
might
be
a
critical
project
for
me
or
my
organization
might
not
be
critical
for
you,
a
new
organization,
so
I
think
a
lot
of
it
is
very
context
based
and
it's
going
to
be
and
there's
there's
really
no
absolutes
here
I
would
say
you
can't
absolutely
say
that
you
know
system,
D
or
many
other
projects
out.
A
There
are
critical
to
every
single
person
or
user
of
Open
Source,
so
I
think
that's
really
where
the
challenge
lies
and
that
everyone's
needs
are
different
and
their
Stacks
are
different.
And
while
it
might
sound
super
easy
to
just
say,
hey,
you
know
generate
me
a
list
in
practice:
I
think
that
becomes
a
lot
a
lot
more
difficult
to
manifest
and.
A
Absolutely
yeah
the
the
qualitative
versus
quantitative
question
comes
up
quite
a
lot
and
at
the
end
of
the
day,
I
definitely
think
both
are
are
critical
to
to
solving
this
problem,
because
because
quantitative
models
can
only
go
so
far
and
you're
absolutely
right,
lots
of
times
don't
consider
those
edge
cases
or
maybe
emerging
projects
or
emerging
technologies.
That
might
not
be
a
standard
or
very
popular
now.
But
you
know
five
years
from
now
could
be.
A
You
know,
replace
the
the
current
kind
of
de
facto
standard,
so
it
and
it's
also
a
moving
Target
right
so
that
that
adds
even
more
complexity
to
it.
But
I
think
one
thing
that
really
helps
with
that
is
and
I
think,
where
a
lot
of
value
of
like
our
working
group,
for
example,
securing
critical
projects
and
openness
and
stuff
and
the
open
source
Community
as
a
whole,
is
that
curation
that
discussion
like,
for
example,
at
open
source
technology
Improvement
fund
at
Host.
A
If
we
have
a
very
large
advisory
Council,
you
know
people
that
are
just
in
the
space
that
we
can
discuss
with
and
and
and
can
bring
to
us,
potentially
those
edge
cases
or
have
us
consider
those
edge
cases
and
open
ssf,
I
believe
is
doing
the
same
thing
and
having
a
very
large
network
of
of
people
and
experience
that
can
kind
of
share
this
information
and
kind
of
curate.
This
this
focus
and
hopefully
help
us
have
a
much
more
representative
sample.
As
we
talked
about.
B
But
when
you're
talking
about
qualitative
data,
that's
also
bring
your
selecting,
who
is
a
part
of
the
conversation
so
right
now
this
room,
we
are
the.
We
are
the
choir
right,
we're
fairly
like-minded
I,
I
hope
being
in
this
room,
and
so
we
just
need
to
make
sure
that
we
are
thinking
about
who
isn't
part
of
the
conversation
right
now,
who
should
be.
A
Absolutely
absolutely
diversity
is
incredibly
important,
especially
when
it
comes
to
solving
complex
problems
and
I
think
it
really
doesn't
get
more
complex
than
open
source.
So
yes,
I,
I,
completely
agree
and
I
do
think.
That's
why
it's
great
to
see
so
much
movement
into
you
know,
let's
consider
everyone's
opinion.
Let's
let
everyone
have
a
voice.
Let's
have,
let's
consider
those
voices
that
may
not
have
been
heard
before
or
may
be
suppressed.
So
I
couldn't
agree
more
with
you.
There.
B
Yeah,
it's
even
it's
even
about
bringing
folks
that
don't
think
that
they
work
with
open
source
software,
because
there
are
a
number
of
people
who
think
that
they
do
not
work
with
open
source
software.
They
may
not
directly,
but
they
sure
do
indirectly
and
understanding
that
kind
of
psychology
of
computer
programming,
which
is
book
that
I
read
a
long
time
ago.
B
B
A
A
great
question
yeah
and
that
that's
something
we're
hopefully
looking
into
building
out
as
we
explore
this
this
this
this
problem
and
that
how
do
we
kind
of
have
some
insight
into
projects
and
I
think
you
know
active
maintainership,
for
example,
I
mean
that's
a
bit,
that's
a
bit
obvious,
but
maybe
not
considered
all
the
time
that
there
could
very
well
be
very
large
projects
out
there.
That
may
not
be
as
actively
maintained
as
you
would
think
or
assume.
B
A
So,
assuming
something
like
that
I
think
would
be
a
bad
idea,
so
how
I
would
say
active,
maintainership,
Community,
really
the
people
behind
the
the
project,
because
I
think
sometimes
we
forget
that
at
the
end
of
the
day,
this
is
all
powered
by
people
by
human
beings
and
being
able
to
to
represent
that
as
accurately
as
possible
is
going
to
be
really
important.
So
that's
that's
what
I
would
say
do
you
have
any
thoughts
on
that.
B
B
A
A
And
I
think
that's
where
the
the
value
of
curation
comes
into
play,
where
this
is
going
to
be
a
moving
Target
things
do
change,
Technologies
change,
use
cases
change,
so
it's
it's!
It's
always
I,
I,
Envision,
it
being
very
much
a
living
breathing
thing.
That
is,
that
is
Nimble
enough
to
to
react
to
changes
in
the
landscape,
but
but
kind
of
like
we
were
talking
about
earlier.
Being
Nimble
is
important,
but
also
really.
A
A
Because,
because
if,
if
the
results
of
our
work
is
kind
of
to
help,
let's
say
for
resource
allocation
or
to
help
organizations,
you
know
to
put
a
spot,
Spotlight
or
think
about
projects.
You
know
we
really
do
want
to
think
really
hard
about
what
we
are
putting
out
there,
because,
while
I
do
think
again,
it's
a
very
context
dependent.
A
There
are
very
much
consequences
to
shining
a
spotlight
or
saying
you
know.
We
think
these
projects
are
critical
and
one
thing
we've
actually
started
moving
towards
is
at
least
for
now
using
the
term
set,
because
because
lists
in
themselves
can
be
very
problematic
and
can
imply
some
kind
of
prioritization
or
which
is
something
we'd
very
much
like
to
do.
But
right
now,
it's
really
just
what?
What
is
this
set
of
projects
that
we
should
be
focusing
on
or
thinking
more
about?
A
That
I
think
should
very
much
incorporate
into
how
we
prioritize
or
a
prioritize
investment
in
projects,
because
you
don't
want
to
you
know
you
don't
want
to
put
a
new
roof
on
a
house
that
has
a
has
no
Foundation.
You
know
so
so
really
thinking
about
this
stuff
is
is
important
and
I
just
want
to
give
a
shout
out
to
the
work
group.
You
know
be
for
showing
up
at
all
meetings
and
having
great
discussions.
Yes,
as
well
as
everyone
who
has
who
has
volunteered
their
time
their
Insight
their
experience.
It's
been
really
helpful.