Open Source Summit North America 2022

Open source software is a significant part of the core infrastructure in most enterprises in most sectors around the world and is foundational to the internet as we know it. It also represents a massive and profoundly valuable attack surface. Each year more lines of source code are created than ever before - and along with them, vulnerabilities. In this presentation, we’ll share key lessons learned in our experience coordinating the industry-wide remediation of some of the most impactful vulnerabilities ever disclosed, present a threat model of the many unmitigated challenges to securing the open source ecosystem, share new data which illustrates just how fragile and interdependent the security our core infrastructure can be, debate the challenges to securing OSS at scale, and speak unspoken truths of coordinated disclosure and where it can fail. We will also discuss the Open Source Security Foundation (OpenSSF) and share guidance for how members of the security community can get involved and contribute meaningfully to improving the security of OSS - especially through coordinated industry-wide efforts.

This presentation describes corollary evidence suggesting that, despite many high-profile examples in recent years of vulnerabilities discovered in open source software used by millions of people around the world, there continues to be an under-investment in security for open source projects as compared to proprietary ones.

The study uses a public data source to perform an econometric analysis of bug bounties that were paid for discovery of software vulnerabilities. The study compares the amount and frequency of bounties paid for a sampling of open source critical Internet infrastructure projects (such as the Nginx server) and a sampling of proprietary Internet infrastructure projects, and finds a statistically relevant difference between the two.

The presentation discusses possible explanations for why this is the case, drawing from economic theory, and provides direction for future research related to the subject.