Bridging the Gap: Open Source Security and Web Development

In this episode, Dan Applequist of Samsung explores the intersection of open source security and web development. Drawing from his extensive experience with the World Wide Web Consortium (W3C) and initiatives like Open Source Security Foundation (OpenSSF) and C2PA, Dan discusses the challenges and opportunities of uniting the open source security community with web developers. Emphasis is placed on the critical importance of mobile security, considering the sensitive information on mobile devices and industry best practices such as OWASP guidelines. The conversation also highlights the importance of security education, referencing resources like OpenSSF Security 101 and OWASP's global meetups. Additionally, media authenticity through protocols like C2PA and the role of organizations such as the BBC in this domain are discussed. The episode concludes with recommendations for developers to enhance their security practices through continuous learning and community engagement.   00:00 Introduction 00:25 Dan's Role at Samsung and Open Source Contributions 00:45 Web Standards and Privacy Initiatives 04:20 Bridging Web Development and Open Source Security 08:08 Challenges in Web and Mobile Security 09:26 The Importance of Mobile Security 11:40 Threat Models and Security Concerns 12:05 Protecting Yourself and Your Data 12:38 Web Security Best Practices 13:46 Challenges for Web Developers 15:28 Open SSF and W3C Collaboration 17:36 Expanding Security Education 19:44 The Importance of Media Authenticity 22:25 Final Thoughts and Future Discussions   Resources: W3C SWAG Group: https://www.w3.org/community/swag/ - and GitHub repo https://github.com/w3c-cg/swag with meeting minutes Last year's W3C / OpenSSF/ OWASP / OpenJS "Secure the Web Forward" workshop: https://www.w3.org/2023/03/secure-the-web-forward/ (includes videos of all talks and workshop report) W3C Ethical Web Principles https://www.w3.org/TR/ethical-web-principles/ W3C Privacy Principles https://www.w3.org/TR/privacy-principles/ W3C Security & Privacy self-check https://www.w3.org/TR/security-privacy-questionnaire/ Guest: Dan Appelquist is Open Source Strategist at Samsung Open Source Group. He is a web & mobile industry veteran and long-time participant and leader in open source and open standards. He has been co-chair of the W3C Technical Architecture Group for the last ten years. He was an early web pioneer and "dot-com CTO." He's led efforts at Vodafone, Telefónica, Samsung and the UK Government relating to open standards and the open web. You may find him on the Fediverse at @[email protected].