Scoring Your Project’s Security  ## Metadata - Author: [[Changelog Master Feed]] - Full Title: Scoring Your Project’s Security - Category: #podcasts - URL: https://share.snipd.com/episode/c00f62a7-3d1f-4908-b36f-a7a823237430 ## Document Notes ## Highlights - **Secure Healthcare IT Systems** - Understand the critical impact cyber attacks have on essential services like pharmacies. - Prioritize securing healthcare IT systems to prevent interruptions affecting life-saving medication access. Transcript: Speaker 4 I'm not eating drinking coffee thing. And now we're just like making me feel old. Speaker 1 I'm sorry. Okay. My link is prescription orders delayed as US pharmacies grapple with national state cyber attack. So some pharmacies, including CVS weren't able to fulfill orders because of a cyber attack on Wednesday, February 21st. It was enterprise wide connectivity issues that forced the system to stay down, which is just like wild because you know, when you think of technology, we know that it's in everything, But you almost forget how much it is like just between like thinking about your link in my link like lights, pharmacies, like it is in like every part of our lives now. And then with AI, it's going to be an even more parts of our lives. People want to put it everywhere. And then it's like, but what are the impacts of that when something goes wrong? You know, people weren't able to get their prescriptions and it's crazy because since COVID, like, I don't know if other people are having this problem, but like if you have a kid with ADHD, it's been so hard to get like regular ADHD meds because there's a shortage. So think about on top of that when like there's so many medicines that are like life threatening that you need and you like with the laws, you know, you can only get so many days of them. And then you like have to get a new prescription or you have to do it where it's like very strictly time. So can you imagine like if a cyber attack takes down like a pharmacy and you're on like your last day of like some life, life saving medication or something that like is hard to get, you Know, that could really affect people's lives. ([Time 0:05:39](https://share.snipd.com/snip/a387b89b-e158-4504-a967-2703348546e7)) - **OpenSSF Scorecards Visualize Security** - OpenSSF Scorecards offer a visual security assessment for GitHub repos with a colored badge indicating security posture. - The system gamifies security by encouraging developers to improve their scores incrementally through best practices. Transcript: Speaker 1 All right, thank you so much Chris one for being on the show today to talk all about open S S F scorecards and Chris tells about yourself. Where do you work and what do you what do you do. So hi, I'm Chris one. Speaker 2 I'm an engineer at at sign where we're building a platform for next generation networking based on personal data services. And one of my focuses there is on how we show that we care about security. And that's why we ended up implementing scorecards, which I guess is what we're here to talk about. Speaker 1 The way you phrase that makes me very how we show that we're interested in security or care about security like immediately in my head. Things of security theater where hey, there's a thing that we have to do for a checklist that doesn't really matter, but I know that's different than what you're actually working on. So let's start with what is open S S F open S S F is the open source security foundation. Speaker 2 It's a thing inside of Linux foundation. So sort of sits alongside of CNC F as one of the projects. Speaker 1 So it's its own foundation and what is it focused on what's the purpose of a new foundation that is open security. Speaker 2 So it focuses on securing the supply chain. Yeah, it seems to have had a lot of initial energy, at least from Google. So, you know, we first kind of came across scorecard when Dart and flutter implemented scorecards on their get every post and they did a blog post about why they've done that. And we saw that and thought, yeah, that's them showing us that they care about security in a very sort of visual way. And we immediately thought, this is a good way for us to communicate to our customers that we care about security. Speaker 1 So what exactly is a scorecard then? Like, is that a report card on my get commits? Is this a badge that I put in my banner of my read me? What is it? Speaker 2 So it is ultimately a badge that you put in the banner of the read me and it has sort of colored element to it. So, as the score gets better, it goes from sort of, you know, red to yellow to shades of green. So once you get a score of eight or better, it's a nice bright green scorecard. If you click on the badge, that'll take you to the most recent output file from the scorecard action running. And so what's happening there is it's implemented as a GitHub action. And every time there's a merge to trunk, that action is going to run. And it's checking against a whole bunch of sort of different areas of security. So do you have known vulnerabilities? Are you pinning your dependencies? Branches protected in your config. Do you do static source code analysis? Do you do dynamic source code analysis? Have you completed the OpenSSF best practices questionnaire to a passing grade or silver or gold? And so it's measuring each of those dimensions and then adding all of that together into a score out of 10. You know, it's really interesting. Speaker 1 I was reading this article and it said, gamifying like parts of like your development process, you know, like pipelines or different ways of like writing good code and showing developers That they write good code and that they've done something. Like, I don't know if it's all because we love video games, but it's proven to help people to like, if you game file like your metrics, you know, like what colors or just anything like that, They've proven that people will write better code, you know. So it's like super interesting that I wonder if the way that the scorecards have that, the little buy-in to make you want to get, you know, that extra 5% then 5 more percent, you know. Speaker 2 Yeah, it certainly does do that. And, you know, once we started putting all of our scorecards together on a table, then it made me want to make sure that they were all at least green. But then that gets you into the whole, it's about 20% of the effort to get 80% of the score. So it's, you know, relatively easy to get an 8. To get from an 8 to like a 9 is a ton more effort. So, you know, it's a sort of pareto thing of 80, 20, 20% of the effort to get 80% of the score, but then it's all uphill from there because you're then putting in the other 80% of the effort To get the residual 20% of the score. And it's a bit sort of law of diminishing returns at some point there. But honestly, if ([Time 0:17:11](https://share.snipd.com/snip/8f9bd7e0-f9b2-41fa-9357-871e16f1557d)) - **Large Orgs Drive Scorecard Adoption** - Large organizations like Intel adopt OpenSSF Scorecards broadly for thousands of repos to enforce security culture. - Such scale adoption pushes continuous improvement and integration of security best practices across projects. Transcript: Speaker 2 That's just an example of a large organization with a big open source presence, deciding to adopt it and committing themselves to the process of a implementing it and then be kind of Turning the ratchet to make the scores get better. And, you know, working with their internal teams to change some of the tooling and culture that actually lies behind achieving those scores. ([Time 0:26:24](https://share.snipd.com/snip/e05b6693-b1da-4c6d-b8c7-7cbed9358f9f)) - **Use Best Practices Questionnaire** - Use the OpenSSF best practices questionnaire to improve your security score from zero to gold level. - Continuously work through the questionnaire as an actionable roadmap for better security compliance. Transcript: Speaker 1 Here seeing just like what is it because like, I don't have a license file in this repo, which I should, I generally put license files, but I don't have a license file. So it's a zero fuzzing zero maintained zero, but I also have no packaging. There's no binary. So I have no binary artifacts, which is a 10. I was like, Hey, cool. You don't have any binary. So this is a good thing because we can see all the code available in the repo. So it's interesting. Yeah, because you could, I don't want to say you could game this, but I could not run this on certain things to make sure like, you know, like, I don't want to have to deal with that right Now. I mean, just like you were saying, to get the eight score, like I could pick and choose the things that are going to get me a better average to get me to that eight point of saying like, Hey, This has again, those best practices. ([Time 0:32:34](https://share.snipd.com/snip/92e5a5ca-8549-4e0c-b4cd-00374d3025f1)) - **Begin Contributions With Docs** - Start open source contributions with documentation PRs to improve usability. - Small fixes, like correcting typos or dependencies, create useful contributions and reduce user frustration. Transcript: Speaker 1 I also really think that maybe this could be a gateway into contributing to open source because when you first start wanting to contribute to open source, you're like, Well, what do I even contribute? Like, how do I even? And the fact that, you know, something as simple as like fixing docs or, you know, linting stuff or, you know, maybe if there are like low hanging things that you could do and contribute To make the scorecard better could be somebody's first couple contributions, you know, because it helps you figure out where to implement these things and then you can go and figure Out how to do that. You know, so there's like a lot of debate about like how to get into open source right now and how to do your first contribution. So maybe scorecard gives not only the best practices that we start to learn, you know, but also is a new way for the next generation of people that want to contribute to open source and Then they can start that journey with best practices. Speaker 2 Yeah, and I always encourage people to start with the documentation PR's. And I think it's so frequently the case that the creator of a project and especially sort of small projects, it worked on their environment and they tried to document it as they think Somebody needs to for using it, but you come along and try and use it. Yeah, let's say it's a Ruby project. You find that there's a whole bunch of gems that you need that they had on their laptop, but that weren't actually documented. And so you can then make a contribution to read me to say, you know, dependencies, you actually need to install these gems and then it's going to work. And that's going to be really useful for the next person coming along wanting to use that. Speaker 1 So that's such a good thought too, because how many times have you tried a project or done something and then it doesn't work the way that you think it is and it's like so frustrating. But that's really an opportunity to do for one, make better software for the next person, but also be that contribution to open source. So that's a really good perspective. Yeah, we've ([Time 0:34:20](https://share.snipd.com/snip/6ee06a20-0ccf-47d4-9b95-b8c90753d8d9)) - **Scorecards Link to Supply Chain Security** - Scorecards measure repository security practices as a piece of software supply chain security. - They help consumers assess and choose dependencies based on security attention and best practices. Transcript: Speaker 1 And how does this specifically how do scorecards tie into that? Why is this an important piece of a supply chain? Because like supply chains are generally like hashes built on hashes that are secure to like, no, I can go back to the point of commits or whatever code I'm running was authored and made Sure that that's the actual thing I'm running is the thing that they committed. How does this tie into that? Speaker 2 It's a piece to the puzzle. And if you go and take a look at open SSF, then there's a whole bunch of other projects there, which are related to how we have things flowing through the software supply chain and how we Can attest to the security of them and measure that. So things like software, bill of materials and signing artifacts and stuff like that come into play with some of the other projects. But when we look at the scorecard itself, I think it kind of directly relates to do it in two ways. So we were just talking about dependency pinning. That's one of the things that it's pushing you to do. That's pinning against shards, not just against semvers. So you absolutely stating that this is intended to work with that particular version of a dependency. The problem with that is it creates a whole bunch of toil. So, you know, dependencies are changing under our feet at a frightening pace, something like Python cryptography. I think I've seen four bumps to that in the last week or so. It's followed a pattern of so there's been two CVEs where it's become a known vulnerability to be stuck on the on the old version, because there's been buffer overflows or whatever. But then there's then been a sort of follow up patch of, oh yeah, that security fix broke something else for a whole bunch of corner cases that our tests weren't covering before now, but People complained and we figured out what was going wrong. And so there's another patch. You know, we've now fixed the tests as well. So this stuff can be fast moving and staying on top of it is a bunch of work. The other way it kind of relates to the supply chain is what autumn was talking about earlier. It's like, as you're choosing things that you're going to depend on, if you're seeing the scorecard there, then that's giving you a measure of the quality of attention being paid to Security in that project. And so if you do have a choice, and you know, quite often when we're picking packages, there may be very little choice. You find the one package that does the thing and everybody's depending on that. ([Time 0:40:43](https://share.snipd.com/snip/9d00e328-51f0-41e9-b04c-c2651ef42b7c)) - **Scorecards as Learning Tools** - OpenSSF Scorecards provide hands-on learning for developers to understand and improve security practically. - Fixing security issues in your repos engages learning far more effectively than theoretical study. Transcript: Speaker 1 My personal repose where I just like, actually, I don't think I wanna pin this because I'm okay if it breaks and I'm not, I don't have an SLA and I'm not getting paid for this code. It's just me to experiment and learn and put something out there to share. That is okay to not have a scorecard. See, I think I'm in the opposite. I'm like, I wanna put this on everything so then I can learn all, just like I love reading about security in post-mortem but then now I'm just like, I can actually figure out how all these Things work in context. When you get to work in software, you work in your realm of software and you don't always get exposed to other things. So it's so fun finding ways to expose yourself to ways that other people are using this to actually build things but on the level where you can play with it on the weekends and at night, You know what I mean? ([Time 0:48:41](https://share.snipd.com/snip/dce92a13-9f28-4192-8dda-a2ad06afa099)) - **Maintainer Attention Is Finite** - Maintaining open source projects demands managing finite maintainer attention, not just owning the code. - Scorecards provide visibility on maintainer commitment and invite community contributions to sustain projects. Transcript: Speaker 1 And you have to really guard that. It's also part of like the culture of software though, because we're always like, this is the only job that you do your job for fun on the weekends. You know what I mean? Like it's just like expected that you build projects all weekend and like, you know, that like you're constantly like how many people have bought domains, created things. And it's like at some point like, where do you get that work life balance or just kind of like when do you decide that you're done with that project, you know, or? But I mean, it's not just software though, right? Cause like I thought I was going to be a mechanic my entire life. I love cars. I was working on cars. I'd work on cars on the weekend, right? Like I would go like I'd get paid to work on cars and then I'd go home and I'd work on cars. And that's what I liked doing. But I wasn't publicly visible to people that was like, I'm just spending time in my garage. And that's okay because it is still my guarded area of like, you know what? Like I don't have to answer questions someone else. In the book also they point out like Christmas lights for in the United States. Like it's a big thing. Like you decorate the outside of your house for a holiday, which is weird to kind of do because you're just like showing up. Like at some point like, oh, maybe this is a competition. I don't know. But like someone can drive by my house and they can look at my Christmas lights. And that's okay. Like that's what I want. Some people definitely make it a competition. Some people. You absolutely. Like you can go there's not some negatives and consumers in that. But also for like me to like, I like how my house looks when it's decorated and I'm going to spend a day or half a day decorating my house. And then anyone that drives by, it's free for them to look at. They can come, I want them to come drive by and see the cool thing that I created out of my creativity and budget and whatever in my time. But at the end of the day, like if they want me to make changes to it, like no one's knocking on my door and saying like, hey, can you get the bigger snowman next time or can you like move this Light? Cause I don't like how that looks. But that's how software works. Like an open source, like I put something out there. So I was like, actually like this flag is bad. Can you go change that for me? Like no, like this is not, this is mine. Right? This is I decorated this, I built it and I don't really care like to take outside contributions right now, but there is this like assumption in open source that you can just go and do that Because you're just like, well, it's open source. I'm gonna go add an issue and say like, please change this output to be something different to fit my needs. I'm like, no, go fork it and do it. You're like, well, no, that's maintenance for them. And they don't want the maintenance, right? Cause but my house, no one has ever knocked on my door to say, please change your lights. And it's just like a different mindset of how we treat open source. And in this case, like a scorecard gives them the visibility that like I care about this thing. I'm gonna do enough to provide this information to you of here's the basics and we do care about this. We're gonna try to improve it or at least keep maintain this number. ([Time 0:51:47](https://share.snipd.com/snip/e5fe3629-209e-44c2-bf9c-a8a782e52793)) - **Automate Security Configurations** - Leverage tools like Terraform to automate and maintain consistent security configurations across multiple repositories. - Create repeatable templates to minimize toil and ensure security standards are uniformly applied. Transcript: Speaker 1 Oh, they're absolutely. Speaker 2 I answer there's so many projects and so much work to be done. And so, yeah, I'd encourage people to go and take a look there. There's new stuff happening on an almost daily basis. And of course, an awful lot of toil behind it, which needs many hands to get to the work there. The other thing this gets you to is when you're doing this in your own repost, and especially if you've got multiple ones, as you're moving forward from that, you want to have good quality Templates that just have everything done already. But also, you want to have repeatable config. All of them you were saying earlier, I want to get into Terraform. It's like, that's your hook to get into Terraform because you can use Terraform to have consistent good config across all of you, get a group. ([Time 1:00:22](https://share.snipd.com/snip/538e3798-7027-4e0d-b20d-f47c5e253697))