In Hawkins, the real threat wasn't the one anyone could see. It was the hidden dimension bleeding through the walls, corrupting everything before anyone knew to look. Sound familiar? In open source, the Upside Down is r…
In Hawkins, the real threat wasn't the one anyone could see. It was the hidden dimension bleeding through the walls, corrupting everything before anyone knew to look. Sound familiar? In open source, the Upside Down is real. It's the malicious package three layers deep in your dependency tree. The build pipeline compromised long before your artifact ships. The release so opaque that, like Will Byers, something goes missing for days before anyone notices.
Hawkins had Eleven and the Squad. We have OpenSSF: developers, security engineers, and maintainers working to close the gates before the Mind Flayer gets through.
This session is a practical tour through OpenSSF's greatest hits. No gatekeeping, no jargon, just tools that make the secure path the path of least resistance:
Scorecard, like Eleven's psychic compass for your dependencies, tells you what's really going on before you trust a package. Sigstore, because friends don't lie, makes signing and verification usable, so what you deploy is what was built. SLSA gives your software an auditable chain of provenance. OSPS Baseline is the Squad's survival rulebook, a step-by-step framework any project can adopt from zero. Alpha-Omega is the Hopper of the ecosystem, backing the critical, under-resourced projects everyone depends on.
You'll leave with a toolkit to keep your pipeline out of the Upside Down, and the reminder you're not in this alone. The scariest threats are the ones you can't see. Until now. Sobre Katherine Druckman: Katherine Druckman is a senior technologist, speaker, and longtime advocate for open ecosystems. Currently Head of Community and Partnership Engagement at JetBrains, she specializes in developer experience, combining software ecosystem strategy, content strategy, and community building, grounded in a foundation of hands-on software engineering experience and proven leadership. She is a long-time open source advocate, developer, and podcaster, and is currently the host of the Reality2.0 podcast. Sobre Stacey Potter: Stacey brings extensive experience in open source community building, marketing, and event coordination. With a background spanning projects like Minder, Flux and Flagger, OpenFeature, and Keptn, she has played a key role in fostering engagement and driving adoption across cloud-native and open source security ecosystems.
Watch talk