Open Source Security Foundation

EU Open Source Policy Summit 2024
2024-02-02
Speaking: Come join us at OpenForum Europe’s EU Open Source Policy Summit where OpenSSF General Manager will be on stage in a panel discussion on Open Source Software, Security, and Policy.

Speaking: FOSDEM 2024
2024-02-03 - 2024-02-04
We’re going to be at FOSDEM 2024. We will have a few talks in various Dev Rooms as well as a stand. Please connect with us if you are going to be in town!

FS-ISAC Americas Spring Summit
2024-03-03 - 2024-03-06
Speaking: OpenSSF will be in San Diego this March with the FS-ISAC Americas Spring Summit. FS-ISAC is the member-driven, not-for-profit organization that advances cybersecurity and resilience in the global financial system, protecting financial institutions and the people they serve.

SXSW
2024-03-08 - 2024-03-16
Speaking: OpenSSF will be at South by Southwest (SXSW), speaking at panel: How AI Can Save Critical Infrastructure from Cyberattacks. This year, the Defense Advanced Research Projects Agency (DARPA) kicks off its AI Cyber Challenge, which aims not only to produce the next generation of cybersecurity tools using the latest AI technologies but also to show how we can use AI to defend code that powers critical infrastructure. Leveraging the proven DARPA challenge model as a forcing function to drive innovation, the AI Cyber Challenge invites potential competitors to vie for more than $20 million in prize money by identifying AI-enabled solutions to address some of the most critical vulnerabilities facing our nation’s infrastructure.

KubeCon + CloudNativeCon EU
2024-03-19 - 2024-03-22
Speaking: OpenSSF will be speaking at KubeCon + CloudNativeCon EU this March! The conference gathers adopters and technologists from leading open source and cloud native communities in Paris, France from 19-22 March, 2024.

VulnCon 2024
2024-03-25 - 2024-03-27
Sponsoring: The OpenSSF is excited to be sponsoring an after hours event at VulnCon 2024. This event provides a platform to showcase and educate on Information Security, data protection, and privacy. VulnCon’s aim is to facilitate collaboration among the private sector, Government bodies, investigation agencies, academia, and industry leaders for a safer cyber world. The conference features diverse technical, non-technical, legal, and community events.

Let's Chat Open Source Security!
2024-03-27 14:00 - 15:00 (Asia/Kolkata)
Join us as part of the first (of many) India Initiative live streams!
In this live stream, we invite you to join in on a special conversation with Vandana Verma. Vandana is a security advocate and promotes secure coding practices. In this chat we will be talking about what developers lack in terms of security best practices and how best to fill that gap.

(Please note: Times specified are in IST)

How To Secure Open Source Code?
2024-03-28 12:00 - 13:00 (Asia/Kolkata)
In this live stream, join us to learn how to secure open source software. It is a great way for you to learn about open source, secure coding practices, and *bonus* the benefits of being an OpenSSF member!

Hosting: Techniques & Tools ― PINNY
2024-04-11 14:00 - 15:00 (Asia/Kolkata)
In this special live stream, we will take a look at PINNY. It is designed as a simple tool for developers to hash-pin Dockerfiles and GitHub actions(two OSS dependencies which don’t have package managers but are instead directly downloaded from source) which protects from dependency hijacking & confusion. We will also be chatting about why securing CI/CD pipelines is important, which is opined to be an overlooked aspect of software supply chain security.
Our special guest will be Abhishek Anand, founder of Koalalab.

SOSS Community Day NA 2024
2024-04-15
Hosting: We’re back at Open Source Summit North America (NA) with a co-location event: the Secure Open Source Software (SOSS) Community Day NA on April 15, 2024 in Seattle, Washington. SOSS Community Days are an opportunity for Community Members from across the Security and Open Source ecosystem to get together and share ideas and progress on capabilities that make it easier to sustainably secure the development, maintenance, and consumption of the open source software (OSS) we all depend on. SOSS Community Days are held regionally, alongside the Open Source Summits and were formerly called OpenSSF Days. The change in name reflects the need to capture the broader interest in the security of open source software. What’s in the SOSS? Come to a Community Day to find out!
The call for proposals (CFP) to speak is open through Friday, February 9, at 11:59 pm PST.

OpenSSF SLSA Workshop
2024-04-15 09:30 - 12:00 (America/Los_Angeles)
Hosting: OpenSSF SLSA Workshop
In this hands-on workshop, we will explain how organizations can leverage the Supply-chain Levels for Software Artifacts (SLSA) framework to harden the SDLC of code deployed in production.

To build a good understanding of how SLSA can be deployed at scale, we will take participants through a series of hands-on coding activities to secure a container developed on GitHub and deployment on Kubernetes. Our example will enforce two important properties: First, that all released images are integrity-protected against unauthorized parties. Second, that all deployed images are restricted to a set of cloud privileges, the same way we restrict privileges for OS processes.
We will then present how SLSA can be applied to harden AI models’ development and inference, the same way we do for traditional software like containers. We will take users through hands-on activities and demos to apply SLSA to AI models.
How to Register: Pre-registration is required. To register for OpenSSF SLSA Workshop, add it to your Open Source Summit North America registration.

OpenSSF Scorecard New Contributor Workshop
2024-04-15 13:30 - 17:00 (America/Los_Angeles)
Hosting: The OpenSSF Scorecard New Contributor Workshop is an opportunity for hands-on onboarding with project maintainers with potential to submit first PR to OpenSSF Scorecard in real time. An overview of the project and architecture will be presented with breakouts based on participant interest.
How to Register: Pre-registration is required. To register for OpenSSF Scorecard New Contributor Workshop, add it to your Open Source Summit North America registration.

Open Source Summit North America 2024
2024-04-16 - 2024-04-18
Sponsoring: We’re honored to sponsor the Open Source Summit NA this year. Open Source Summit is the premier event for open source developers, technologists, and community leaders to collaborate, share information, solve problems, and gain knowledge, furthering open source innovation and ensuring a sustainable open source ecosystem. It is the gathering place for open-source code and community contributors.

Hosting: Tools & Techniques ― BOLT
2024-05-02 14:00 - 15:00 (Asia/Kolkata)
In this technical deep dive, Abhishek (founder of Koalalab) will showcase BOLT:. It is meant for transparent egress monitoring for build systems to harden the GitHub CI environment to enable protection against exfiltration of secrets and tampering of source-code. The idea is to teach how to bring security rigor to build pipelines using paradigms that typically help secure production systems.

RSA Conference
2024-05-06 - 2024-05-09
Speaking: OpenSSF is attending the RSA Conference this year in May. Omkhar Arasaratnam, the General Manager of OpenSSF, will be speaking at the event. The RSA Conference has been a driving force behind the world’s cybersecurity community for 32 years. And over that time, we’ve seen the need to expand our mission beyond yearly Conferences. Because cyberthreats are constantly evolving, and we as a community must continue to evolve, too.

SOSS Policy Summit Europe 2024
2024-05-14
Hosting: Join us in SOSS Policy Summit Europe this year as we set the stage for impactful security initiatives, policy efforts, and cross-collaboration among the OSS community, European governments, and private sector to the secure open source software that we all depend on.
This event is complimentary to attend, but has limited space. Please express your interest to attend and the Team will confirm registration details.

Hosting: Supply Chain Security ― Fundamentals and more...
2024-05-23 14:00 - 15:00 (Asia/Kolkata)
In this live stream, join Sangam Biradar as he explores the fundamental building blocks of Supply Chain Security. He will progressively showcase how to build more security into the code, build, and other phases of the SDLC.

Hosting: Confidential Computing ― A Refreshing Perspective
2024-05-30 14:00 - 15:00 (Asia/Kolkata)
Vaishali joins us for a stream where she brings the ideas of Confidential Computing to the fore in the backdrop of global events. Join us to learn about technology, geopolitics, and how these events intersect!

Hosting: Building A Culture Of Security
2024-06-14 14:00 - 15:00 (Asia/Kolkata)
In this interesting chat with Gowtham Sundar, who currently leads AppSec @ SPH Media, we discuss how organizations build a culture of security awareness among its employees. We delve into details about how individuals tasked with the challenge of rolling out security initiatives face unique challenges ― both technical and cultural ones.
Watch the stream live here:

Hosting: SLSA, A Security Paradigm For Your Builds
2024-06-27 14:00 - 15:00 (Asia/Kolkata)
Join Teja Kummarikuntla from Harness as we discuss various levels of SLSA achievable. Teja will walk viewers through the basics of Software Supply Chain Security, viz. provenance, attestation, and other pipeline runs that provide artifact integrity. The talk will make use of several tools such as Cosign to accomplish this. Join us to learn how supply chain security can benefit your organization.
The conversation will be streamed here:

OSPOs for Good 2024 Conference
2024-07-09 08:00 - 2024-07-10 17:00 UTC
Speaking: OpenSSF will be speaking at OSPOs for Good 2024 Conference this July. The OSPOs for Good symposium is set to be a multi-day conference held on 9th and 10th July 2024, with a richer global presence of diverse open source thinkers, with bigger ambitions and strides for championing OSPOs as a global network for good.

What’s Next for Open Source?
2024-07-11
Speaking: Join us for the “What’s Next for Open Source?” event, which will feature interactive workshops organized into three tracks: OSPOs & Social Impact, OSS Community, and Digital Infrastructure. Participants will engage in discussions and hands-on activities to explore the future of open source and its impact on global cooperation.
We will be hosting a “Secure Open Source Software for Resilient Societies” workshop, featuring Omkhar Arasaratnam, General Manager for the OpenSSF, and Arun Gupta, OpenSSF Governing Board Chairperson, as part of the panel and speakers. This session will delve into the critical role of secure open source software in fostering resilient societies and will include discussions on hardening the open source supply chain and making open source sustainable.

Hosting: Tips, Tricks, and Techniques to Ace Supply Chain Security
2024-07-11 14:00 - 15:00 (Asia/Kolkata)
In this live stream, we will be hosting Saiyam Pathak who is a seasoned technology evangelist. He comes with a lot of experience in the CNCF, Docker, WASM, and other communities and has recently begun to focus on software supply chain security. Saiyam Pathak is the founder of Kubesimplify, focusing on simplifying cloud-native and Kubernetes technologies. Previously at Civo, Walmart Labs, Oracle, and HP, Saiyam has worked on many facets of Kubernetes, including machine learning platforms, scaling, multi-cloud, and managed Kubernetes services. He is a prolific speaker and is best known for helping a huge number of folks learn and practice Kubernetes and cloud native tech.
In this stream, Saiyam will focus on his journey with software supply chain security, and in particular how some OpenSSF projects have helped him along the way. He will also demonstrate some of his favourite tools.

Black Hat USA
2024-08-07 - 2024-08-08
Attending: The OpenSSF is attending the Black Hat USA this year. Black Hat USA is the world’s leading information security event, providing attendees with the very latest in research, development and trends. Black Hat USA 2024 opens with four days of technical Trainings followed by the two-day main conference featuring Briefings, Arsenal, Business Hall, and more.

DEF CON
2024-08-08 - 2024-08-11
Attending: Catch us this summer at DEF CON! DEF CON is one of the oldest continuously running hacker conventions around, and also one of the largest. DEF CON is generally held in the last week of July or first week of August in Las Vegas. DEF CON 31 will be held August 8th through August 11th, 2023. Many people arrive a day early, and many stay a day later.

SBOM-a-Rama Fall 2024
2024-09-11 - 2024-09-12
Attending: OpenSSF is attending SBOM-a-Rama! We are excited for you to join us September 11-12, 2024, at the Denver Athletic Club in Denver, CO. Day 1 is the SBOM-a-Rama as you know it, a day of presentations from across the global software community on SBOM-related topics and a chance to discuss important opportunities and issues. Day 2 features our first SBOM-Solutions Showcase, where suppliers of commercial and open-source SBOM solutions will have a chance to share how they are helping meet the needs of community.

Open Source Summit EU
2024-09-16 - 2024-09-18
Attending: Open Source Summit is the premier event for open source developers, technologists, and community leaders to collaborate, share information, solve problems, and gain knowledge, furthering open source innovation and ensuring a sustainable open source ecosystem. It is the gathering place for open-source code and community contributors.

SOSS Community Day Europe
2024-09-19 08:00 - 17:00 UTC | Austria Center Vienna, Bruno-Kreisky-Platz 1, 1220 Wien, Austria
Secure Open Source Software (SOSS) Community Days are an opportunity for Community Members from across the Security and Open Source ecosystem to get together and share ideas and progress on capabilities that make it easier to sustainably secure the development, maintenance, and consumption of the open source software (OSS) we all depend on. SOSS Community Days are held regionally, alongside the Open Source Summits and were formerly called OpenSSF Days. The change in name reflects the need to capture the broader interest in the security of open source software. What’s in the SOSS? Come to a Community Day to find out! Brought to you by OpenSSF.

Nordic Software Security Summit
2024-09-23 - 2024-09-24
Attending: OpenSSF is attending the Nordic Software Security Summit this fall! This is the new conference on application security, focusing on the new EU legislation for software.

Keyfactor Meeting
2024-09-26
Attending: We’re attending the 2024 Keyfactor Community Tech Meetup in Stockholm this September.
This event is inviting engineers and security specialists from Stockholm, the Nordics and around the world. Prepare yourself for an immersive experience filled with engaging presentations, hands-on workshops, and demos.
