Securing Open Source Software Projects – David A. Wheeler, Open Source Security Foundation

This is texturing TV. Hey guys. Thanks for the throw.

We're here with Dr. David wheeler who is director of Open Source supply chain security for the open source security Foundation. That's a lot of open source security going on there right happening David.

Welcome the show. How are you? Thank you very much.

I'm doing well. We've seen the foundation pick up some new members and we see the government put together its National Security cyber security strategy document. And guess the question I have is are we making progress here or are we just talking about making progress?

What's going on exactly or Supply chains getting more secure. I think we are making progress. I mean that said there's a lot to do so, you know, I have to admit I always look at the you know, what's not needed now what's needed next but from the point of view of are we making progress?

Yes, there's already been Investments and improvements in a number of important projects. There's been a number of changes and improvements and things going on. I can point to a number of specifics if you like I get the one thing I think is a fun specific example is this was a little while ago now the open ssf gave away MFA tokens.

To develop, you know developers of the most white some of the most widely used open source software and this makes it much harder for attackers to take over their accounts by stealing passwords. And so it's it's those little kinds of things that can make a big difference in countering a Packers basically overall. Our job is just to make the attackers life miserable and that makes everyone else's lives happy the maintainers themselves.

How are they reacting because you have like really large open source projects that have a lot of built-in security Linings being the best example because there's a lot of peer review and then we have these projects where it's quite literally maybe two to three people who are working on stuff on the weekend and they're not Security Experts and frankly. They don't necessarily feel like they should be because well, hey they're giving away free software and the people who implement it should be responsible for securing it from their perspective. So, what's the middle ground here?

I think it's a fair thing. And in fact we oh, we've been doing some initial studies. I know some people want to turn this into a little more official but there's actually you mentioned two and three a vast number are exactly one.

You know and so yeah having peer review when there's no one else is a little bit of a challenge and I think that's a legitimate concern and I actually share them. I mean as well as you know, hey, I've got this fancy title. I do open source software development myself and sometimes it's just me and so I completely feel those those concerns.

I think this short answer is we need to make it much easier to do and so there's a variety of of tech of approaches that we're taking, you know anywhere from trying to go make it so that the tools automatically do certain things or at least by default do certain things trying to provide resources to help folks one of the things and you know, I totally get it we don't want to have to have people become quote Security Experts, but the reality is that the code written matters and so we also have Of educational materials like a fundamentals course only takes, you know 16 hours approximately to go through and it basically tells you this is not to do this is what not to do. This is what to do instead without having to you know, relearn the universe we so I don't think there's a simple answer to that question but it's a question we go we ask every day and as a result, I think basically getting the tools out automation where we can trying to make things as automated as possible. And yes, sometimes that may mean paying somebody else to do a security View and give the results back so that instead of them having to be the security expert they can take advantage of the knowledge that somebody else has so short of grading my own homework, which is what a lot of this and it sounds like are the companies that consume open source software doing enough because they could clearly help with some of the security reviews.

They may not be expert enough to write the code in to contribute to the project but there's other things they could be doing right. One fact, the number of them are already doing that, you know both in both directly with the projects when they're when they're using it a number of them do contribute back and also through the open ssf where they put together, you know, the idea of the openness ssf is to try to identify the common pain points and fix them broadly, you know, if you want to fix a particular price a very specific project the best thing to do is work with that project go participate go help them but a number of things are broader where it's the same sort of problem and over and over again. Hey, let's try to work on fixing that and in some cases, you know, these particular projects are so widely critical.

It makes sense to combine resources to help them out. Do you worry we're shining a light on certain projects where cybercriminals are like? Yeah.

Oh, that's where I should go. Look. Haha.

Well, I mean you can argue that about any point where we you try to prioritize. I don't think frankly the criminals need any help. They're they it's it's not hard to figure out where some of the some attacks would be the useful.

So I don't think you know now there's two different kinds of issues one is the hey what's widely used. Um, I don't think that identifying what's widely used is really that much of an aid to the to the criminals. Basically.

Now what we do worry about a lot is when we find specific vulnerabilities, we don't we in general don't post those in public. We generally work with the projects and Upstream that there's a name for this process that's called coordinated disclosure where you disclose to the specific project and the goal is not to shape name and shame the goals to help them. Fix it so that you know when when the vulnerability becomes known it's because there's already fixed go down.

Go update your software you're done. A lot of this Trace is back to the vulnerabilities that were discovered in log4j Shell which then resulted in this fabulous document from the United States government talking about what the national cybersecurity strategy couldn't should be I'm assuming you had a chance to look at this. What's your reaction?

Well, let me first quickly note that the open ssf predates log for shell and of course, you know, I've been interested in open source software and security for decades. So it you know while I think I do agree that log for Shell has basically made a lot more people aware of it people have been working on this issue for much much longer up to come to your specific point though about the cyber security strategy the strategy referring to the from the US. You know, I it says a lot of good things.

I mean it I actually agree with them that software has become very important to societies as a whole absolutely that includes open source software and a key point of that document that I really appreciate is that they want to emphasize focusing on both the the parts that matter and the organizations that can actually have the resources to deal with it all too often. People want to say Hey, you know, hey, you you will developer who has limited time. You know, I expect you all by yourself to do everything and that isn't really that doesn't really make any sense.

So instead they're trying to figure out how to improve the needle without unreasonable expectations and I really think that that's the right overall goal is Focus on the goals focus on ways to reasonably meet that goal. Now it's a strategy. It's not a law it's not executive order.

There's a whole lot to figure out about what how this turns into reality. But I guess I'm I'm cautiously optimistic that you know, and I'm hoping really I think many many governments around the world are very increasingly concerned about security and that's appropriate what I'm hoping is that the interact with and work with the folks who are developing this offer so that together we can produce a better place rather than hey do great things and good luck and figuring and good luck and I have no idea how to do that. Are you at all worried that the mixture of carrots and sticks that are in this document that the sticks might have a chilling effect on the development of software because it seems like there's a lot of emphasis on liability and if you're one or two people working on open source project that's more headache than you can handle.

That's right. I am quite concerned about liability. In particular, I think that a lot of people are thinking oh strict liability is the solution to all things and the thing is we don't normally apply that to anything else that's written, you know, a lot of people.

Oh my gosh, we don't apply to products actually. No if somebody has a typo in a book, we don't sweep. We don't find them with strict liability for example and software writing software is a whole lot more like writing and encyclopedia without ever making a typo.

Um, it's rather challenging to do. Um, so I so I actually think it's reasonable to talk about carrots and sticks. But I also think there needs to be a wait a minute.

You know, what makes actually what makes sense here was appropriate. You're quite right. It's much easier to say.

Hey, let's set up a legal situation where it's not possible to do things safely. Well people just stop doing it. I mean, that's the obvious rhetoric.

I think that one of the other things that a lot of people don't realize about software is in general software developers really don't know how this offer is being used. Um, you know as opposed to say a car most people understand what a car is supposed to do. Okay, you know, he's supposed to get you from point A different point point B, hopefully without exploding got that we we agreed to that but when you're writing a low-level Library, you typically have no idea how it's going to be used in a larger system.

And in fact, there may be 10 or more layers between what you write and what's included which includes that which includes that, you know, maybe many many tears and so Again, I think that what's necessary now is a dialogue to figure out what makes sense. What does not make sense and also seems like to your point. There are a lot of dependencies within an application where people are using multiple components from multiple sources, and it's very hard to discover those dependencies.

So do we need to get better at the discovery side of this equation before we even get anywhere near the liability side of the equation. That's probably true. I mean as far as an ordering perspective.

This is one of the reasons why you know, very you know, US Government European governments are increasingly interested in what's called s-bomb solve for Bill materials because right now I mean there's there's actually been there's actually a very very awesome study number of years ago. It focused on the Java ecosystem, but it's it will be misleading to think it was specific. It's just that's the data that they had and what they found was that internally if a project brings in a component.

And that component is updated later. It's General the case that those internal components aren't updated. You know, lots of people don't update their computers instantaneously when there's a new software available and that is just as true for application developers as for everyone else.

The result though. Is that over time more components become more more obviously have more more known vulnerabilities in them. And so I I think a basically a number of large organizations including these governments are looking at Say Hey, I want to know what's in there so that I can do things like estimate risk from known vulnerabilities so that I can do things like, oh my gosh, log for Shell happened.

Where where is that possibly a risk as well as measuring other things like licensing you if you're doing m&a's in Industry. They often very much want to know. Hey have you followed legal processes and sadly some don't and they appropriately want to know they're not, you know, they're people are actually following the legal the law and the kind contract and you know licensing requirements.

There's been a lot of talk about Ai and cybersecurity these days and of course everybody's assuming the worst of the bad guys will use AI to go discover vulnerabilities. However, can the good guys not use the same tool to discover those vulnerabilities and remediate them faster anyway, so is this one of these tools that may cut both ways. I think it's definitely has that possibility people or you know, it already is has been clearly shown that various, you know, large language models like gpt3 gpt4 can generate code from text which is pretty amazing.

Now, they're not generally a whole applications. They're developing small pieces, but that's okay, you know that still makes them very very useful as far as finding vulnerabilities. People are still studying that they're definitely been specific cases where you know, these tools have found vulnerabilities in particularly in small Snippets of code.

We're still trying to find out but here's my current guess my guess. Is that whether or not right now today, it's clearly the case that they're already tools for finding vulnerabilities. I expect them to improve frankly.

I do expect machine Learning Systems to significantly improve the finding vulnerabilities, but that also means that they Help fix them too. We've already seen cases where people you know say wait a minute. That's a vulnerability.

Please go fix that. So I The scale of it is to be determined, but I think that's likely how it's going to be how it's going to come. And as you said I think it's probably just going to accelerate both sides and so a wash in some sense.

But the more we fix the problems the better off we are be All right, I think people expect that isvs that depend on open source software will logically make contributions to secure but what do you want the average Enterprise it leader to do here. I mean should they just go down in their CEO and say, you know, we need more Lawyers Guns and Money or is there some other things that they ought to be thinking about? I'm not sure about that particular training in there, but I Many many things depend on your specific situation, but the short answer is that pretty almost every company somewhere is well, certainly almost everyone's using software and almost all of them are developing software in some sense.

Now when I say develop software for the most part, they're downloading reusable components and adding some additional glued to bring them together for their specific application and I suspect you already know this but maybe not of your listeners. Do you know the latest studies are showing anywhere from 80 to 90 percent of solve for our open source components open source offer components. It's you know, that is now the normal way to develop software is reasonable components, which when you think about makes sense, that's how we build Hardware devices and have for a long time, you know, usually don't build your own screws.

So bring in reusable components important. So coming back to your original question almost certainly They somewhere in your organization you are bringing in open source software and combining with other things or using it a critical part of your business. It makes sense to go back and work with the key components that you're working with to make sure that they're adequately secure for your situation which by the way even us, you know each you every organization that does that a little bit, you know by working back Upstream you you were going to end up producing much better results in in general, by the way, that's that is just as true for hardware and other things, you know, if you depend on some component that's critical for your business working with your suppliers to make sure that is exactly what you need can often have very large benefits.

But in the software World a small amount of working with can have a lot of benefits All right folks here in here progress is being made. It's a long journey. There's no simple easy fixes.

But anything you can do to contribute would be welcome David. Thanks for being on the show. Thank you.

All right back to you guys in the studio.