AI-powered
podcast player
Listen to all your favourite podcasts with AI-powered features
What's in the SOSS? An OpenSSF Podcast
Jack Cable of CISA and Zach Steindler of GitHub Dig Into Package Repository Security
Nov 26, 2024
Jack Cable, a senior technical advisor at CISA specializing in open source software security, and Zach Steindler, a principal engineer at GitHub focused on supply chain security, dive into the critical topic of package repository security. They discuss the significance of secure package management in the open-source ecosystem and highlight their recently published best practices guide. Their conversation includes insights on trusted publishing, community engagement for newcomers, and the lighthearted debate on personal tech preferences, showcasing their expertise and camaraderie.
23:44
Episode guests
AI Summary
AI Chapters
Episode notes
Podcast summary created with Snipd AI
Quick takeaways
- Package repositories are vital for open source software, impacting security and integrity across various sectors including critical infrastructure.
- The development of the 'Principles for Package Repository Security' document outlines best practices to enhance repository security through collaborative efforts and voluntary participation.
Deep dives
Importance of Package Repositories
Package repositories are essential components of the open source software ecosystem, functioning as the key systems through which users download software, such as NPM and PyPI. These repositories handle vast quantities of software downloads daily, making them crucial for developers and users worldwide. The security of these repositories directly impacts the integrity of the software used across diverse sectors, including critical infrastructure. Recognizing this, organizations like CISA prioritize efforts to bolster the security measures of package repositories to ensure the safety of open source software consumption.
Get the Snipd
podcast app
Unlock the knowledge in podcasts with the podcast player of the future.
AI-powered
Discover
highlights
Listen to the best highlights from the podcasts you love and dive into the full episode
Save any
moment
Hear something you like? Tap your headphones to save it with AI-generated key takeaways
Share
& Export
Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more
AI-powered
podcast player
Listen to all your favourite podcasts with AI-powered features
Discover
highlights
Listen to the best highlights from the podcasts you love and dive into the full episode