The Changelog: Software Development, Open Source Securing GitHub (Interview)
Jun 19, 2024
Jacob DePriest, VP and Deputy Chief Security Officer at GitHub, shares insights on securing GitHub and open-source software. He discusses the vital role of Artifact Attestations and the challenges of social engineering in developer security. The conversation covers GitHub's advanced security features, like mandatory two-factor authentication and code scanning, revealing how they bolster the safety of software dependencies. DePriest also highlights the synergy between AI tools and security measures, emphasizing collaborative efforts to navigate security complexities.
AI Snips
Chapters
Transcript
Episode notes
Defender's Challenge
- Defenders must secure everything, while attackers only need one entry point, making defense feel futile at times.
- The sheer volume of code in systems like Debian makes overhauling security practices daunting.
Secure by Design
- Prioritize secure-by-design principles, even if they add friction for developers.
- Enable features like push protection for secrets by default.
GitHub Scanning Process
- GitHub scans code in a sandboxed, encrypted environment before pushing it to repos.
- Secret scanning partners with industry players to detect and alert on various secret types.