Scaling Security: Inside the GitHub Securing Open Source Software Fund  ## Metadata - Author: [[What's in the SOSS? An OpenSSF Podcast]] - Full Title: Scaling Security: Inside the GitHub Securing Open Source Software Fund - Category: #podcasts - URL: https://share.snipd.com/episode/966b3556-6192-426c-b81d-8a7abd1272fc ## Document Notes ## Highlights - **Funding Plus Training Drives Security** - Combining funding, training, and community creates the greatest impact for open source security. - Aligning these elements incentivizes maintainers to adopt and sustain secure practices. Transcript: Kevin Crosby Yeah, maybe kicking it off with an interesting insight that we had from the GitHub Accelerator last year. One of the key modules that I was thinking about, and this was a brainstorm with Xavier, was do we actually know how much security education and training do people have for these emerging, Fast-growing projects, and even some of the ones that are becoming vital to the ecosystem. And so I just literally threw it out to Xavier as an experiment. Like, can we try to run this content and engagement with these projects and see what the results would be? And so we did it. And maybe Xavier, if you want to talk about that initial experience, it'd be great to just kind of get your point of view from it as well. Xavier Rene-Corail Oh, yeah. Well, it was exactly as you said, it was an experiment at first, right, part of the accelerator. And it came a bit last minute, right? But, I mean, at GitHub, we're ready to pivot fast and to try things fast. And so we did some office hours. We did some one-on audits of these projects. And we did some basic training about security posture. And yes, and the results were great. I mean, the engagement of the of the maintainers and the result, the impact that it had on them was great. So yeah, so Kevin came again. Kevin Crosby I came asking again, like, can we make this bigger? And, you know, I think the learning that we had is when you connect funding with time training and expertise, you're able to maximize the impact of the training and education. And so, and it also kind of dovetailed with a lot of the needs around security within the open source supply chain. So you kind of had this serendipitous moment of high need, both in terms of like a macro level, but also high need from a developer level to make this work and also lining that up with the Incentive structure of funding and education that make it really special for these maintainers. That actually is what kind of seeded this idea of let's build a programmatic open source fund targeting security that links the funding to the outcomes of security specifically. Round trip from like the seed to actually getting the program previewed at GitHub universe, bringing folks along, getting funders to commit to the program, lining up what a scaffolding Curriculum might look like. And so we had that in like 27 days to preview it at GitHub universe. And I actually think that was the first time you and I spoke about it too, because we were like, oh, hey, what do you think? Great. That was exactly it. Yeah. Xavier Rene-Corail I mean, it was great because so my team, the security lab, you know, we're already doing these trainings, these free training, these educational content, this office hours. It was already part of what we do for open source. But with this, program, we had the opportunity, you know, to have the, yeah, the programmatic power, you know, and the marketing and the partnership and the funding, et cetera. So when Kevin came to me with that, I said, yes, please, yes, let's do that. And I must say that, yes, the turnaround was impressive. And in particular, thanks to partners like OpenSSL, who, I mean, CoreView immediately said, yes, let's do it. And yes, it went pretty fast. ([Time 0:06:26](https://share.snipd.com/snip/e6a5f501-7d5f-4ff9-8418-85868a2ac027)) - **Participate in Security Fund Program** - Apply to the Securing Open Source Software Fund to receive a $10K stipend and intensive security training. - Engage fully in the program's boot camp and ongoing check-ins to embed security best practices. Transcript: Kevin Crosby So Xavi, I would love you to kind of jump in on the curriculum of education. Xavier Rene-Corail Yeah, thank you, Kevin. Well, again, I mean, this is things that we were doing, but this program really brought the opportunity to amplify it. So it's not only, it's really together that we managed to put that up. To have a mix of basic security posture and some advanced training, for example, on fuzzing, on static analysis, things like that. So you really have a mix because you have a mixed audience. So you need to, I mean, not everyone is at the same moment of their security journey, right? So you have a mix of that. We are trying to address all aspects, from coding to incident response to vulnerability management. So again, a mix of that. And of course, the important thing is that we are in a continuous improvement mode. So from the feedback from the first cohort, we will get to add more content. We have some people who are coming to us and proposing new content. And we're like, oh, yes, please come in. So, yeah, so that's in a nutshell. Yes, that's how we built this program. We are trying to get experts giving this training. So from us, but also from our partners, from the great David Wheeler, for example, from OpenSSF. So this is adding something to the learners, the maintainers, to have these great presenters who know what they're talking about, giving them these presentations and answering the Questions. So yes, that's it, you know, the challenge. Kevin Crosby I was going to say, and just to double click on that a little bit, I mean, I think the uniqueness of it, to Xavier's point, is how we framed and packaged it. So, like, if we zoom out and say, like, what does a maintainer get? It's three-week security boot camp with all of the education and expertise with these topics really focused on the programming. They get access to the security lab. They get access to the maintainer community, they get access to the ecosystem partners that we've brought in and the funding partners as well. And then on top of that, they get embedded with like the data of like, how are we progressing in our own security journey? Like, are we making progress? Are we embedding it in our community? How are we collaborating with other projects and maintainers through that as well? And so that's kind of what the maintainers get. And the last thing that I think, you know, we didn't really touch on, but the funding is really, you know, aligning the maintainers to spend the time commitment on it. So we provide a $10,000 stipend to the projects. Most of that comes up front, you know, the $6,000 up front of the program to really solidify the three-week boot camp. And then the others are to align on to the reporting and kind of the touch points and making sure they're continuing on their security journey. And so by aligning the funding and linking it to the outcomes that we're trying to get with security, it becomes a really great model that is helpful for maintainers and for the projects That are being improved with security throughout the program. ([Time 0:12:35](https://share.snipd.com/snip/890fd45e-20d5-488c-836d-0f300f64ee81)) - **Craft Engaging Security Curriculum** - Offer a mix of basic and advanced security training to meet varied maintainer skill levels. - Make training interactive and fun to improve engagement and learning effectiveness. Transcript: Xavier Rene-Corail Yeah, thank you, Kevin. Well, again, I mean, this is things that we were doing, but this program really brought the opportunity to amplify it. So it's not only, it's really together that we managed to put that up. To have a mix of basic security posture and some advanced training, for example, on fuzzing, on static analysis, things like that. So you really have a mix because you have a mixed audience. So you need to, I mean, not everyone is at the same moment of their security journey, right? So you have a mix of that. We are trying to address all aspects, from coding to incident response to vulnerability management. So again, a mix of that. And of course, the important thing is that we are in a continuous improvement mode. So from the feedback from the first cohort, we will get to add more content. We have some people who are coming to us and proposing new content. And we're like, oh, yes, please come in. So, yeah, so that's in a nutshell. Yes, that's how we built this program. We are trying to get experts giving this training. So from us, but also from our partners, from the great David Wheeler, for example, from OpenSSF. So this is adding something to the learners, the maintainers, to have these great presenters who know what they're talking about, giving them these presentations and answering the Questions. ([Time 0:12:39](https://share.snipd.com/snip/ea64101f-a636-4725-93b6-417e88fe45c0)) - **Maintainers Embrace Security Ethos** - Maintainers in the Secure Open Source Fund program showed unexpected enthusiasm and engagement. - They embraced security principles deeply, expressing "we live security now." Transcript: Kevin Crosby Maybe Xavier, do you want to go first? Xavier Rene-Corail Well, yeah, my big surprise was the enthusiasm of everyone. I mean, I know this is something that is a passion for me, but I was, I mean, I don't know, I wasn't expecting that level of enthusiasm and of engagement from everyone. Really, you know, I was expecting some of the projects to be already quite advanced in their journey and then to react a bit like, okay, there is content that is interesting for me, but Some of the content is too basic. I was expecting that, right? No, everyone was really, really super engaged and super enthusiastic. So that was the big positive surprise for me. What about you, Kevin? Kevin Crosby Yeah, I echo that. I kind of bucket them in three different functions. One is, I think there was a very strong level of trust from the outset, because they were all shared alignment on security within their project. And so I think everyone walked in, and this kind of drove the enthusiasm of like, we're all here for the same thing and having the same impact. So that was great. Two, I think the community lens was very fascinating to me just to see folks across different sizes of projects, stages of their growth or in kind of like distribution, as well as their Own maturity journey within security. And like just seeing that community fuse really well together to cut across different frameworks, languages, et cetera, was really powerful. And I think the last thing that I'd say on this is the outcomes that we see is meaningful, like not just from like, did the things go red to green or anything like that, but really like you See them embody this change of what it means to be a steward of security within open source. And that's really unique. I don't think, and we kind of saw glimmers of that within the accelerator, but I didn't think we'd, I didn't know if we'd see it at this scope and scale. And I think that that was one of the most impressive things is just seeing these maintainers emerge out of a program and say, wow, you know, we live security now, you know, I think that That was pretty cool. ([Time 0:16:41](https://share.snipd.com/snip/eb77380c-3a8c-425d-917e-0f7afc1d060e)) - **Adopt See One, Do One, Teach One** - Use a "see one, do one, teach one" method to help maintainers quickly learn and internalize security. - Encourage maintainers to teach others to solidify their own security understanding. Transcript: Xavier Rene-Corail Because that was a positive feedback from participants, is adding some fun to the training. All of the trainings that were, you know, interactive and fun and with quizzes, et cetera, worked very well. And so, yeah, you know, I used to say that boring is the archenomy of learning. And so, yeah, I think that I want to add a bit more fun to the curriculum. Christopher Robinson Well, I, for one, totally agree with that. I think security is a lot of fun. It is. Kevin Crosby Security is a lot of fun. You know, it was super interesting to see the modules, I'd say, that had interactive coding engagement. Like people really love just diving into it. And the other thing that was kind of unique that I don't think it's super surprising, but this concept of like see one, do one, teach one. Like it's people coming through this journey. And like as you emerge, the first time you see it, you're like, oh, my gosh, like this is overwhelming. The next time you do it, like I can actually do a coding exercise on this and actually implement some changes. And then you see people a day later that are teaching like, oh, this is how I did it or this is how I'm thinking about it. It's really cool to see that, like, transpire throughout the program. And people loved it. Like, to your point on fun, that made it fun, you know, to be able to teach people and engage is really unique. ([Time 0:20:30](https://share.snipd.com/snip/509af2ac-d858-4504-9c34-d3b2303294f9)) - **Expand and Enrich Program** - Scale the program rapidly to onboard 125 projects this year. - Continuously enhance curriculum with new content, especially language-specific security training. Transcript: Christopher Robinson Gaze out over the horizon and kind of what's coming down the pipe for the GitHub Securing Open Source Software Fund? What do you have in your bag of tricks next? Kevin Crosby Bag of tricks. That's always a great question. Xavier said, I mean, we have to scale. So we did first session. Our objective is to do 125 projects this year. So we have multiple sessions that will be going on throughout the back half of the year. Session two will be kicking up in the next couple of months. And so we're rapidly preparing for that. Yeah, I think that that's where we're looking forward to just in the back half of the year. Yeah. Xavier Rene-Corail And in terms of curriculum, as I said, I'm receiving a lot of proposals to add content. So going through that, going to add this ([Time 0:21:50](https://share.snipd.com/snip/75251df6-ef2c-4f1c-bceb-e0fc41916818)) - **Join Fund or Partner Up** - Maintainers should apply to the fund to improve their security measures with expert support. - Ecosystem partners can contribute content or refer maintainers to enrich the program. Transcript: Kevin Crosby Certainly. Right now, any maintainers that are interested in joining to uplevel their security, we're welcoming applications. They're rolling ongoing throughout the year. As you know, we have a robust pipeline of projects to go through in multiple sessions. So always feel free to apply. Secure their own dependencies, welcome those conversations. I think it allows us to unlock more opportunities and projects with funders. They also bring unique insights and resources from their own ecosystems. And Xavier said it too, and ecosystem partners that are ready for the journey to provide education, curriculum, engagement with maintainers. Some of them are even unlocking referrals for their maintainers that are coming through the program things like that so we would we would certainly welcome those opportunities throughout The throughout the year it's not just today it's not just tomorrow but it's an ongoing journey and any advice for the audience zav or a call to action uh no no honestly uh nothing to add Xavier Rene-Corail I already made my call to action i i need some training for language-specific training for security. So if you want to help open source projects, please reach out to me. ([Time 0:24:33](https://share.snipd.com/snip/2d43dd4a-b736-4477-918a-f843a9bc9a7e))