Thank you.
Yeah, so I'm glad that actually like so many people nowadays like really care about security.
I think it wasn't the case when I first started doing Python.
I was one of those people who just put things together with duct tapes.
So that's good.
And I'm going to dive deeper into you know what the PSF has been doing and also what
you should do and also maybe some information that like you may find
interesting to know like what we are doing.
So this is the most important slide of the whole slide deck because it has a link to the whole slide deck.
So with this you don't have to take pictures after.
So maybe you want to keep this you know the picture of this slide just in case.
And also you can also you know tag me, message me, I love that.
So I'm Czech.
I love open source.
People ask me oh how can you get involved in like Python.
Well I just step by step like most of you I was like you know it was the data scientists
are doing Python and then you know go to meet up and then people ask do you want to organize
meet up. Yes I organize meet up and then do you want to come to the conference.
Yes I come to the conference and then you want to organize the conference.
Yes I won't organize the conference.
So after saying yes multiple times and then I'm here.
So now I am a Python software foundation but members are one of the directors and fellow.
So that's my volunteer work so how do I do like what I do in my day job.
I am a community manager at OpenSSF.
So a lot of things I talk about here actually like related to these two hats that I'm wearing
from time to time which is very special.
So yeah you know OpenSSF we are part of Linux foundation.
We have a stand at the building K level 2.
So come to us we have stickers there as well.
So that's OpenSSF stickers so you can come and get some stickers for me.
I would tell you more about that there.
I won't talk about it here now.
So let me ask you a question.
So when you let let's imagine you have to move tomorrow.
You have to choose a place to live.
So what are the criteria right?
What are what are you looking for?
Like if you go to like do a viewing what questions you would ask that stay agent or people show
you around.
So for me one of the things I'll ask like is this neighborhood safe right?
Safety is very important no matter who you are you know you don't want to live in somewhere
that maybe you every time you go back home in the dark you feel scared or maybe you worry
that someone may break into your house and stole things you know.
So safety is very important also same as software right?
You don't want someone to break into your house but you also don't want someone to
hack into your computer or your system or things like that.
So that's very important and I'm glad that a lot of us care about that these days.
Security in Python is even more important.
A lot of times I make the analogy because like I love Python and the community so much it feels
like my family they're like I don't want these people to be vulnerable and got attacked so
I'm protecting you know Python and the community is very important.
So why Python is you know why do people care about security in Python?
I think one of the things special about Python is that we have a lot of different people using
Python including people who may not be traditionally like trained as a you know
a software engineer like for example some researcher we have a huge scientific computing
community that they maybe a researcher themselves they use Python to help them with their research.
Data scientists I was a data scientist you know I was the one who doesn't care about
security so I know.
Bank you know this is you know again like you know I have worked in a bank before at some point so
I know that bank use Python and you know this is a very important you know organization and you know
Python is there. Government as well government also use Python I have like friends who have
worked in the government before there are lots of governments actually using Python.
Teachers teaching young people teaching the next generation of software developers
they also use Python maybe this this is the first language a lot of young people these days
like the first language is instead of like us you know who have a little bit like gray hair
is like oh we just see when we're learning but now it's like maybe they're learning Python.
And anybody you and me like we're here in the Python death room so we use Python.
Yeah so Python is vulnerable because again like these people may not be trained as a you know
software developer so they just kind of go to code in the first day you know and like you know
then the profile is very different we can't just like for example we can't just focus on
securing the Python in bank that's not good enough where how about the government how about the
people who are writing software as a hobby and like you know all this we have to try to cover
everybody and it's very hard when you have a diverse user profile and again a lot of people
nowadays especially young people this is the first programming language and
you know they may learn Python before they know what is cyber security right so
that's very important because they may not know it so yeah how can we help these people
to be more secure when they're coding so also is like to make things more complex now you know
in the last talk you have heard about all these so and also enforce them you know we have a death
room we have a talk yesterday about cra you know or this policy actually are coming to affect us
it's not that like oh we are just a bunch of people who love coding and have fun no like we
also care about especially when you're making a living with coding policies were affectual because
it's kind of policies trying to protect the customers if you are creating a product that you
are distributing them so that would actually you have to have a look at least as what's going on so
you know in us we have the you know the espon bill or you know that that's the real name but we just
call it espon bill a lot of times and cra you know we have a lot of section about cra is coming
you know because it's going to be effective in a few years so a i ag i hope you have heard
about those terms a i ag prd so these things are happening now so that's why we care so we have to
protect the python users not just those people that i talk about that are using python but also
you and me who may be developing in python we don't want to get caught in those policies that you
know we don't want to do anything that actually we have to be liable so we have to protect everybody
so before i jump into what we are doing so i'm going to talk a little bit about
what are the most common open source issues so hopefully you you are now you are aware you're
trying to like avoid those issues but also you can it's kind of like a homework that when you
you know maybe after the talk you can kind of link back of what we are doing is related to which
one which problem that we are solving so this ten risk actually is uh you know i i didn't develop
them myself i copied from somewhere so the reference there you can have a look at the book post so
top ten risk so now you can evaluate right have you made those mistakes hopefully you or you know
how you can avoid those mistakes so first of all known uh vulnerability so uh you know have you
been using a software that actually got a security issues evolved but you haven't upgraded
have you you know sometimes sometimes there's like compromise of legitimate packages so let's say if
you are a maintainer of a very important package that everybody used if your account got hacked and
someone puts some malicious code in your code base then everybody's using that package so um yeah you
you feel very bad if you are doing that so that's one of the risks you want to avoid name confusion
attacks how many times like you forgot to type the s at the end of pandas so you install panda in
stuff pandas then you know you can be vulnerable to that attack if you're typing the name wrong um
so uh unmaintained software you know i've done that before i you know i was a data scientist trying
a lot of things so i found this library that this model is quite cool install it and try but
it doesn't work because it hasn't been updated for four years so um yeah unmaintained software so
so risk outdated software is similar you know outdated we should always keep your
software up to date because there may be some security patches um and tracking dependence this is
again like i know that a lot of us are you know using a very good package manager but for people
who are maybe new they don't know you know maybe or they are again like learning python that's the
first program language they don't know that like managing the dependencies is very important
especially when you're writing some code that need to be in production so a license risk this is
not actually like cyber security risk but again like how many times before you pip install something
you have checked what license they have because some license they may not be copy you know they
they you may have to be open source if you are using them even though they're open source so
license could be again like is another topic that i can give another like talking like you know about
but you know check the license all the time immature software sometimes you know again if you
are just trying different things someone may write a soft you know a package that you could
pip install but maybe it's immature because it's not production ready it's just someone's like
experiment a prototype so uh and unapproved changes uh so have have you like give everybody push
right to the main branch so avoid those because you know maybe you give a junior death like push
the main branch and they may erase everything so yeah that's not good um and uh you know oversized
dependency we always have this problem you know python we have so many package available and um so
yeah that that may be a problem that your dependency is too big so um now so we have so many problems
that we want to avoid we have to get extra power to solve this problem so uh i know that like a lot
of times we are just relying on volunteers to help out and really appreciate all the volunteers
who help out that that's why we can survive for so long but uh security is so important so hiring
someone to full time and take care of it is actually a very good thing that we could do so that that's
what we could do right now so i would like to introduce you to these two amazing gentlemen
that is helping like full time now working in python software foundation to um to do work on
security for python so uh seph seph is a security developer in restaurant so this row is actually
funded by alpha omega project so thank you for that you can see his beautiful face there yes
and the next gentleman i want to introduce you is mike so mike is uh you know papi safety and
security engineer so this row is funded by aws so again like he's working probably working a lot
with uh you know together with packages so maybe they are trying to you know maybe you are using
the packages that like mike has put some effort in so thank you very much um so this is what uh what
has been done like well it's to be honest this is a few months ago i i put this together a few
months ago so maybe not most updated one but like you can look at seph's block for the most
updated work anyway so um so now like you know python releases so when you use python you have
to actually get your c python right so c python usually just go to you know the official python
website and download c python but how do you know this version of the c python is actually
the real c python instead of maybe someone hack our website and put a malicious c python there
uh the best way to ensure that it's legitimate is to sign it right so sixth door again like
someone mentioned it in the last talk already uh is a new mechanism that you can you know use
a certificate to sign the release so it's kind of very easy to verify to sign and uh it's keeler
so it's more secure and um so everything's locked so you can check so there's a transparency
law so you can check like who signed it and when is this go sign and you fully trust this c python
is the right c python that you're supposed to be using oops i skipped some size okay so uh so all
these like new uh you know from from certain time that is like you know c python release has been
signed so um it's not just like the newest release of course they are signed but also like all these
versions upward they are all signed so you can always verify them um sorry it's a bit hard to see
but uh you know all these you can see who has signed it you who are the release manager and you
know you have you can check all those logs and you know check the the you know the e-short and
like check check off stuff so okay so yeah you can actually write some this this is you know i hope
you're familiar with that it's kind of like a yaml file that you could probably use your you know
c i c d to check it to check whether your python that you're using in your c i c d pipeline is the
right python so um also what if i found an issue right what if i have discovered a security problem
actually in python we have a response team that's really great um so it's not just uh staff or
mic themselves but also like it's it's a team help out so uh so if you found something about c
python hopefully it's not happened that often uh you know it applies to both supporter or the
n of live version or pib then you can actually file those reports so uh the team will work with you
to handle it so how how do they work so first of all um they would work with you if you are the
reporting so you are the reporter so they will work with you privately so privately is the key
because you don't want to shout out to the whole world oh we have an issue with python and it's not
secure no you don't want this so so we'll work with your privately right so after that like when a you
know after that of course i the developers you know call developers work and then we'll try to find a
patch and then okay so now it's patch now there's new release right so okay we have a solution now
has been solved now it will be publicly announced now we can tell the world say like okay we had a
problem but now has been solved so everybody please use the newer version of python which this issue
has been resolved right so this is usually how it works so first step you know instead of posting it on
you know your social media you report it to the response team don't post it on social media
write a blog post report it and then after when you know it can be go public then you can write
blog posts saying how awesome you found a bug or something like that right so um this is a really
good news so python software foundation has also become a cna so what is cna so cna is actually a
organization that can give out the cve numbers so we what are cve numbers so cv numbers actually are
a unique identified identify each security issue that has been reported so for example you know cve
that that example there you can see that like first of all there's four digits of the year and then
there's like five digits of unique identifiers so you would see that um when people you know talking
about oh is this new patch solving this issue so instead of this issue which we don't know what is
that issue and naming thing is hard we just use a number saying like this cve 2022 4h 5 64 issue
has been resolved right so we can clearly say that this you know this new version is not affected by
that so that's a good thing um so yeah this help to discuss and you know communicate and make everybody
easy to identify where the problem is and where has been resolved so um by becoming a cna which
means that we the finance software foundation is taking is taking this security issues very seriously
now we can assign cv id's to any issues that you have reported about c python and pip so if we see
that that is actually a issues that you found will give it a cve so we would actually be very quick
to respond and make sure that everything got resolved um so that's the that's the c is the you
know cna is hard we are so glad that now we are thought a 4t that we can give our cve's um the
next thing is that actually knowing the cve's we how can we keep a lock keep a database of what cve
has been discovered and what has been been affected and that kind of thing so uh of course we will
have a database we'll store all those data um you know we have a pi ta advisory database um so it
will store what it will store right it will store the c python from the cve's so the so all these
security issues affecting c python will be stored there um so you so there are also some packages
there sometimes they have problems but we won't give cve's for the packages they kind of work
by themselves so um but people that you can kind of check it check those packages on pi bi so if it's
known then it will be there um also all these uh the the pi pa advisory database this information is
now also synced with uh osv from our bloody database so osv from our bloody database is not just
limited to python it's also including other vulnerabilities in other software so if your
application is not just python it's also have other components you can actually use osv to check
everything so um yeah so that's good you can use both um so it's there's more visibility so people
can easily find the issues in python ecosystem in the osv and also vice versa we can also see
other issues as well so it's good so um but that's not it so that's the thing that we have been
doing at the organizational level so that's something that maybe as an individual developer you don't
have to put too much work in it but um let's let's go to this section which i have listed
what you can do as a developer as a user or as a company so uh first of all we want you to help us
to secure our community um if you are maintainers of python project first rule of thumb enable two
f a everywhere you know this is always like very important you know you don't want someone to hack
into any of your you know github pi bi or email account to you know gain access of these things
that you're publishing and someone may be using right um so you should learn about how to develop
a better like saver software you know open ssf we have some free guys that you can follow talk to
me afterwards at the booth or something um use tools like you know scorecard and sex store um you
know the these are the tools that again open ssf has uh you know associated with and then we have
actually these are you know i won't talk in detail talk to me about how to use those tools after
also subscribe to the pi bi blog for security features those are the official announcements
but saft also got a very very good blog i highly recommend you follow him he's
lovely you have a lot of you know very useful information that's given out on his blog um
but as a user maybe you're using python project you can be a maintainer and use at the same time right
so uh as a user you should keep your dependency locked and up today you know don't be someone like
me you know five seven years ago that just just duct tape everything no keep your dependency
locked and make sure they use the good um package manager um subscribe for advisories uh you see the
email coming from that email after you have subscribed to that mailing list you would be first
notified if there's any information that you should know um so pay up that it may be a good tool to
check your dependencies but again like if you're your application is not just python so obviously
would have everything that you need to know so if you are working well so if well i assume that most
of us are working in the company um so if you're using python in the company or any open source
project i think uh there's more you can do you can convince your company to become a member of
open ssf so contribute to all this open source security work or support python software foundation
we want to hire more people to help so uh you know the most easy way is like if your company has a
big budget then you can maybe support us to hire another person that would be great um so also
educate the employees so if you for example if you're like kind of a lead or a manager maybe you
can encourage your teammate to study to learn more about security so you know on a limit foundation
we have a lot of free courses it's a very good you know resource that you could maybe use also
follow best practice like just make sure your team don't duct tape things together make sure that
the product is production ready follow good practice make sure that it's safe and then
it's it's better in the long run so maybe you'll be easier for you to get ready to be
complianced to when cra coming to effect or something like that right so uh last thank you so
much for alpha omega and aws to support python software foundation so we can hire two amazing
gentlemen that we have today um and it would be great if we can have a third person so please if
you if your company have like want to support please point them our way um so yeah thank you so much
this is the end and this is the link to the slide and i'm happy to talk to you afterwards i have
coffee with me or anything or message me um i'll be here um today so