Let's talk about open source security

Let's talk about open source security!

I will share insights from the state of open source security report that I released earlier this year and we can discuss the role of security for developers.

• How would you rate your security knowledge?
• How do you bake security as part of your projects? at work and open source?
• What are some action items to follow-up on?

We will follow-up this open discussion with a Live Hack! exploiting several well-known vulnerability types that lurk in your open source projects.

Stranger Danger, Finding Security Vulnerabilities Before They Find You!

Open source modules are undoubtedly awesome. However, they also represent an undeniable and massive risk. You're introducing someone else's code into your system, often with little or no scrutiny. The wrong package can introduce severe vulnerabilities into your application, exposing your application and your user's data.

This talk will use a sample application, Goof, which uses various vulnerable dependencies, which we will exploit as an attacker would. For each issue, we'll explain why it happened, show its impact, and – most importantly – see how to avoid or fix it. We'll live hack exploits like the classic struts vulnerability that recently made it famous, along with Spring Break and several others.

About Liran:

Liran Tal is a Developer Advocate at Snyk and a member of the Node.js Security working group. He is a JSHeroes ambassador, passionate about building communities and the open source movement and greatly enjoys pizza, wine, web technologies, and CLIs.

Liran is also the author of Essential Node.js Security, a core contributor to OWASP NodeGoat project and loves to dabble about code, testing, and software philosophy.