Finding LibRaska: The Open Source Library that Props up our Infrastructure

### Overview This panel session, titled after the well-known comic trope of hidden software infrastructure dependencies ('Finding LibRaska' / Nebraska), explores the ongoing challenge of identifying, measuring, and securing critical open source software projects. Organized under the umbrella of the OpenSSF (Open Source Security Foundation) Securing Critical Projects Working Group, the panelists discuss why defining and prioritizing critical open source components is complex, the shortcomings of current metrics, and how to direct proactive security resources such as audits and funding to the projects that underpin vital infrastructure.

### Key Topics - **Defining Criticality**: Criticality varies widely depending on context, functionality, and ecosystem. The panel notes that reaching consensus on a single definition is notoriously difficult because one organization's vital dependency may be completely irrelevant to another. - **Limitations of Current Metrics**: Many common metrics (e.g., GitHub stars, simple lines of code, or basic commit activity) fail to accurately reflect importance or risk. Academic research frequently falls into the trap of using GitHub as a single source of truth, ignoring non-GitHub ecosystems or embedded systems. - **Graph Instability and Cross-Ecosystem Challenges**: Dependency graphs change constantly, meaning a snapshot of critical packages taken on Monday can differ significantly by Friday. Package ecosystems (such as Python or Node.js) provide explicit dependency metadata, whereas ecosystems like C/C++, Fortran (e.g., BLAS), embedded environments (Yocto, FreeRTOS), and medical devices lack transparent dependency data. - **Telemetry and Private Dependency Data**: Private organizations and infrastructure operators often cannot disclose their software dependencies publicly due to security and competitive concerns, complicating the collection of representative ecosystem telemetry. - **Balancing Quantitative and Qualitative Evaluation**: While automated scoring and dependency counts are helpful, the panel emphasizes the necessity of qualitative curation, advisory councils, and direct input from maintainers.

### Technical Details - **Initiatives and Research Mentioned**: - *Census II*: Research identifying widely used open source repositories and analyzing ecosystem-specific differences. - *Roads and Bridges*: Nadia Eghbal's Ford Foundation publication categorizing open source software types (frameworks, libraries, databases) and maintenance dynamics. - *Project OCEAN*: Research out of the University of Vermont (UVM) Complex Systems Center focused on open source complex ecosystems and networks. - *OpenSSF Criticality Score & Package Analysis*: Google projects analyzing package behavior and automated signals of importance. - *Software Identifiers & Transparency*: Emerging efforts around Software Bills of Materials (SBOMs) and GitBOM to catalog software components across complex supply chains. - **Structural Signals**: Panelists discussed structural metrics such as 'truck factor' (cognitive distribution of knowledge across developers), transitive dependency depth, issue resolution turnaround times, contributor organizational diversity, and runtime CPU time (e.g., processing time spent in math libraries like BLAS).

### Takeaways - **Avoid Perfectionism**: Waiting for the perfect, comprehensive list of critical software delays necessary security investments; security teams should start with strong common denominators and iteratively refine their scope. - **Broaden Beyond Modern Web Stacks**: High-risk sectors such as medical devices, utilities, power plants, and industrial embedded systems require more engagement and tailored analysis, as they lack modern package manager telemetry. - **Community and Working Group Participation**: The OpenSSF Securing Critical Projects Working Group invites industry, academia, and maintainers to collaborate via their fortnightly working group meetings, GitHub repositories, and Slack to help guide audits, frameworks, and curated critical lists.