21 min

How secure is your open source project? A story about open source software supply chains

Open source contributes a significant part of the applications that our teams build everyday. Unfortunately, criminals have found that attacking the supply chains underpinning these open source projects is a very effective way to gain access to many targets at once. We saw this recently with the xz-utils/liblzma software supply chain attack. Customers are waking up to the fact that the bad guys have the ability, and are inclined to spend years building sophisticated attacks on the open source software we all depend on. In this talk Paul will describe a real-world software supply chain issue he ran into and how it affected the customer. Luckily this wasn't an attack, but it had significant consequences for the customer consuming open source. This presentation will also describe a number of tools and processes for identifying risk in open source software supply chains.

Paul McCarty

Red Team Staff Engineer at GitLab