Scoring your project’s security

Ship It! Cloud, SRE, Platform Engineering

Autumn and Justin are joined by Chris Swan to discuss tech industry trends like AI and sustainability, gamifying the software development process and motivating devs to write more secure code, OpenSSF Scorecards and how they offer a way to measure and improve the security and compliance of GitHub repos, the scoring system, and the security posture of a repository.

Join the discussion

Changelog++ members save 10 minutes on this episode because they made the ads disappear. Join today!

Sponsors:

• Synadia – Take NATS to the next level via a global, multi-cloud, multi-geo and extensible service, fully managed by Synadia. They take care of all the infrastructure, management, monitoring, and maintenance for you so you can focus on building exceptional distributed applications.
• Sentry – Launch week! New features and products all week long (so get comfy)! Tune in to Sentry’s YouTube and Discord daily at 9am PT to hear the latest scoop. Too busy? No problem - enter your email address to receive all the announcements (and win swag along the way). Use the code CHANGELOG when you sign up to get $100 OFF the team plan.
• Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.

Featuring:

• Chris Swan – Website, GitHub, LinkedIn, Mastodon, X
• Justin Garrison – GitHub, LinkedIn, X
• Autumn Nash – GitHub, LinkedIn, X

Show Notes:

Links of the week

• List of 2024 leap day bugs
• Prescription orders delayed as US pharmacies grapple with “nation-state” cyber attack

Person, place, thing, || null

• Linux - person (Linus Torvalds)
• git - person (Linus Torvalds)
• Kubernetes - thing (helmsman)
• Algorithms - person (Al-Khwarizmi, Persian mathmetition)
• Trojan Horse - place (Troy)
• Bluetooth - person (Harold Bluetooth, Denmark king)
• Hadoop - thing (kids elephant toy)
• Venn diagram - person (John Venn)
• MySQL - person (My Widenius)
• Debian - person (Deb and Ian)
• Neon - Greek neon meaning new

Something missing or broken? PRs welcome!

Bab

1. This is Ship It! (00:00:00)

2. The opener (00:00:32)

3. Sponsor: Sentry (00:13:25)

http://sentry.io/events/launch-week/

4. Welcome Chris Swan! (00:17:11)

5. What is Open SFF? (00:17:56)

6. What are scorecards? (00:18:49)

7. Gameifying your dev process (00:20:09)

8. Simplifying security assurance (00:22:58)

9. What permissions does it need? (00:24:34)

10. Versioning scorecards (00:26:49)

11. Promoting security norma (00:28:39)

12. Justin tries the scorecard (00:30:14)

13. Easy open source contributions (00:34:21)

14. Good docs are important (00:37:09)

15. Building confidence (00:39:49)

16. Scorecards and the supply chain (00:40:37)

17. Signed artifacts (00:43:20)

18. Tool maintenance and regulation (00:45:20)

19. Maintainer attention (00:47:27)

20. Open SFF's great community (00:55:15)

21. How to get involved (00:56:20)

22. Thank you for joining us! (01:02:24)

23. Sponsor: Synadia (01:03:08)

https://www.synadia.com/changelog

24. The ender (01:08:19)

25. Outro (01:23:03)