OpenSource and its Impact on ProdSec - Interview with David Nalley скачать в хорошем качестве

OpenSource and its Impact on ProdSec - Interview with David Nalley

In this video, we interview David Nalley (AWS Director of Developer Experience and Open Source Strategy + Former President of the Apache Software Foundation) about 'OpenSource and its Impact on Product Security in the world increasingly powered by AI'.   / davidnalley   Discussion Topics: 1. Evolution of Open Source & David’s career journey from sysadmin to open source leader. 2. Dependency Risk & Governance Gaps: Incidents like Log4Shell underscore the critical failures in dependency governance — fast remediation is not enough when vulnerable versions are still widely downloaded. 3. Maintainer Blind Spots & Burnout: Open source maintainers often have no visibility into how their code is used — from cloud infra to medical devices. 4. Security in the AI Supply Chain: Developers frequently import random, low-maintenance libraries sourced from GitHub. 5. AI & the Developer Lifecycle: The rise of “vibe coding” (prompt-driven development) accelerates software creation but demands greater upfront clarity on goals and architecture. 6. Code Review is the New Bottleneck: With AI increasing volume, projects must scale up review mechanisms—not just code gen. 7. Open Source vs “Open” AI: The term “open source” is misused in the LLM world—many projects share weights but not data, training methods, or full model transparency. 8. Licensing Complexity: Existing licenses were built for source code, not for models, weights, or datasets. There’s growing consensus that new definitions and licenses (beyond Apache 2.0, GPL) are needed for open models. 9. Wrap up & Advice to Security & Engineering Leaders Contacts: Chiradeep Vittal :   / chiradeepvittal   Pratik Roychowdhury:   / proychowdhury   00:00 Introduction and Guest Overview 01:25 David Nalley's Journey into Open Source 04:42 Challenges in Open Source Security 13:15 AI's Impact on Software Development 24:46 Open Source in the AI Era 37:27 Concluding Thoughts and Advice