Security Things: How OpenSSF’s Technical Initiatives Keep You Safe from the Upside Down!

In Hawkins, the real threat wasn't the one anyone could see. It was the hidden dimension bleeding through the walls, corrupting everything before anyone knew to look. Sound familiar?
In open source, the Upside Down is real. It's the malicious package three layers deep in your dependency tree. The build pipeline compromised long before your artifact ships. The release so opaque that, like Will Byers, something goes missing for days before anyone notices.

Hawkins had Eleven and the Squad. We have OpenSSF: developers, security engineers, and maintainers working to close the gates before the Mind Flayer gets through.

This session is a practical tour through OpenSSF's greatest hits. No gatekeeping, no jargon, just tools that make the secure path the path of least resistance:

Scorecard, like Eleven's psychic compass for your dependencies, tells you what's really going on before you trust a package. Sigstore, because friends don't lie, makes signing and verification usable, so what you deploy is what was built. SLSA gives your software an auditable chain of provenance. OSPS Baseline is the Squad's survival rulebook, a step-by-step framework any project can adopt from zero. Alpha-Omega is the Hopper of the ecosystem, backing the critical, under-resourced projects everyone depends on.

You'll leave with a toolkit to keep your pipeline out of the Upside Down, and the reminder you're not in this alone. The scariest threats are the ones you can't see. Until now.