Why is security work unlike any other contribution to an open source project?
We need to re-think the tight association between maintainers and security work if we want sustainable open source security.
Read more: sethmlarson.dev/security-work-…
#opensource #oss #security #supplychain
Open Source Security work isn't “Special”
I gave this keynote at OpenSSF Community Day NA 2025 in Denver, Colorado. There will be a YouTube video recording available at a later date. This talk was given as the Security-Developer-in-...sethmlarson.dev
daniel:// stenberg://
in reply to Seth Larson • • •Seth Larson
in reply to daniel:// stenberg:// • • •Definitely, that's a challenge too. I don't think we can completely hand over security to other contributors, we have to think about backwards compatibility, performance, releases, and all of that.
I think having maintainers "in-the-know" about other contribution types is necessary too, to varying extents (docs, community, governance, funding, etc).