GitHub Fund Boosts Maintainer Confidence and Security Processes

Key Quotes

"From a personal perspective, so it was always like I felt I had no idea about security at all and I really felt like maybe I missed something and then I got to the training and it was like seeing other people had similar problems and similar issues and then I was thinking oh my god we didn't do anything you know not so many things wrong so we are actually on the right track and this feeling that we are not so bad with security that was incredible and then we had a couple of impactful sessions which made me think twice about the processes we had."

Christian explains that the training provided validation and perspective, alleviating his personal insecurity about his security knowledge. He found reassurance in realizing that others faced similar challenges, which helped him re-evaluate his project's security practices and adopt new processes like pre-commit reviews.

"For me one of the things I was kind of scared about is that like what about the things I don't know I don't know like we talk about this a lot in security and stuff like that so the sessions helped me a lot in a lot of things I didn't know a lot of things I kind of know but was like I should get to that eventually so now I got into them so so now I've improved a lot of things like a lot of things and I'm still like moving applying all those things through my other projects and other projects I'm involved and trying to create like good documentation too so when I start a new project I start like the right way and all the stuff and yeah it's it's being awesome and also having a place to like ask them questions without being judged you know."

Christian highlights how the training addressed his fear of unknown unknowns in security by exposing him to new concepts and reinforcing existing knowledge. He emphasizes the practical application of this learning across multiple projects and the value of a non-judgmental environment for asking questions.

"For me it was amazing because usually when you are working for a company and inside a company you do have like a security team I don't know like you're even like working in years in companies I was not like the one responsible for being aware if like for example if something goes wrong so there is there was always a team responsible for that so then me as a backend engineer was doing the things just following their rules and that was it but the thing is that when you are working in an open source project and you are the one that needs to think about all these and i and at least in my perspective i was aware about a lot of tooling but not about process so for example yes like the incident response plan or we had like some really silly process before for example we didn't know that you could open an issue that you shouldn't open an issue for security like public and so I don't know there was like from the since day zero there was like a public issue related to security there and it was like exposed to everyone and then when I started thinking about the process and everything and then okay how can I put this with tooling so for me it was like really mind blowing and it opened a lot of doors and also I could feel a bit more safe about what I need to like go deeper afterwards because it's quite intense right it's like two weeks but it's like a lot of content so at least now I feel more confident about what I need to tackle and what is missing."

Camila contrasts her experience in corporate environments with open-source projects, noting the shift in responsibility for security from a dedicated team to the individual maintainer. She found the training particularly impactful for understanding security processes, such as incident response plans and secure issue reporting, which were previously overlooked.

"This community is uh you know the pillar of the program I would say so we we have all the content and of course we can listen to it we could also listen to it on youtube or contact the trainer directly but the community it it brings it to a next level so for me it was building up confidence but also learning from others so as Michael said we are building a library he's building end user applications so the different perspectives so they helped a lot and I mean we could ask all these stupid questions in a protected environment so to say I mean I'm coding like for 25 years now and when I go somewhere and say hey I have a question and I feel maybe I should know this already probably I hold myself back but not in this community right and what I've seen and that some people actually came to us and said hey did you think about this and we were like no but do you have any ideas on how to fix that and they helped us it's it's really it's really fantastic to be amongst you know all these unbelievable great fantastic contributors to open source and everyone helps each other out there are no stupid questions."

Michael emphasizes the crucial role of the community within the program, stating it elevates the learning experience beyond just content. He highlights how the diverse perspectives of other maintainers and the safe space for asking questions significantly contributed to his confidence and practical problem-solving.

"The first sessions were all about getting the baseline right -- checking licenses, checking dependencies, and we did a couple of these things, but there we also had stuff to do there. So, in the first week, I guess we did a lot of the foundational, very obvious stuff that the checklist that we have all had to go through. And I guess the biggest topic of the 'you don't know what you don't know' topics for us was how to how GitHub Actions work internally and what potential security issues GitHub Actions may introduce when not handled correctly, when not handled right. So we did a lot of work going through all of our pipelines and all of the different repositories for the app, for the documentation, for the core application. We broke a lot of stuff and had to refine over time, but I guess now we are in a quite good space, maybe not perfect, but at least we know the way forward and what we can improve further."

Michael describes the initial focus of the training on foundational security checks like licenses and dependencies. He identifies the deep dive into GitHub Actions as a significant learning area, revealing potential security vulnerabilities in their implementation and leading to extensive work refining their pipelines.

"Well, I'm actually I'm a little bit late to the AI party so I knew my chatbots and everything but I was never so excited or I considered it so important but then I was in the training and first had a session about fuzzy testing and everything so and I found it quite interesting because I didn't know about this quite well and then afterwards I had a training about AI and how it could be used for security and for some reason it got me more and more interested because I felt that something changed today so like we have AI around and of course security also changes with AI and then suddenly I had this idea okay when I can use AI to make fuzzy tests and find the vulnerabilities so the opposite side the hackers the bad actors they can also use AI and then it was like I was sitting on my chair and I was almost falling down of it because I was thinking oh my god it's our AI versus their AI and this was so mind blowing for me