What's in the SOSS? An OpenSSF Podcast
Kusari’s Michael Lieberman Talks GUAC, SLSA and Securing the Open Source Supply Chain
Jan 7, 2025
Michael Lieberman, CTO and co-founder of Kusari, dives into the essential world of supply chain security in open source. He shares his journey from programming to leading security initiatives like SLSA and GUAC. Learn about how maintainers can utilize Software Bill of Materials (SBOM) to tackle dependency management challenges. Michael also offers practical advice for newcomers to cybersecurity, emphasizing community engagement and the importance of diverse participation in enhancing security practices.
21:06
Episode guests
AI Summary
AI Chapters
Episode notes
Podcast summary created with Snipd AI
Quick takeaways
- Michael Lieberman emphasizes the necessity of establishing trust through signed documentation and transparency to enhance supply chain security in open source.
- The discussion highlights the importance of initiatives like SLSA and GUAC in strengthening software integrity and vulnerability management within the open source ecosystem.
Deep dives
Understanding Supply Chain Security
Supply chain security has emerged as a critical focus within the software development ecosystem, emphasizing the need for developers to ensure that their open source software is secure and trustworthy. The discussion highlights how vital it is for consumers of software to feel confident that appropriate security measures are implemented, which can be validated through signed and attested documentation. This verification process aims to establish robust connections back to software maintainers, underscoring a mutual responsibility for security. Consequently, organizations, particularly in sensitive sectors like finance, are urged to prioritize transparency in their open source contributions to improve security practices across the board.
Remember Everything You Learn from Podcasts
Save insights instantly, chat with episodes, and build lasting knowledge - all powered by AI.
