Security Fails at the Handoff: Rethinking Shared Responsibility in Opensource

Speaker: Autumn Nash

Room: HC 108

Time: Sat 2:00 pm – 2:30 pm

Format: Lecture (30 Min + Q&A)

Difficulty: Introductory / Some experience required

Track: Security / Privacy

Presenter Location: In-person

Experience: umpteenth time speaking

Description:

The shared responsibility model is widely referenced in Linux and open‑source security — but rarely understood the same way by everyone involved. Security failures often arise not from missing tools or unpatched systems, but from broken handoffs between policy, platform, and people.

Unless you’ve worked inside open‑source projects, the way maintainers handle security issues, CVEs, patches, and distro maintenance can feel mysterious. This leads to false assumptions about who is responsible for what.

This talk examines where security intent gets lost as governance teams define policies, open‑source politics collide, platform teams translate requirements into systems, and engineers live with the operational consequences. Attendees will gain a practical mental model for open‑source security ownership:

What belongs upstream

What a distribution provides

What ultimately falls on *you*

By improving handoffs and clarifying responsibility, teams can reduce risk more effectively than by adding yet another security tool.

Target Audience:

Anyone working with open‑source security

Engineers

Platform teams

Security practitioners