Hi! I'm Gabriela, I have graduated in software engineering and have been working with it since then.
Here https://gabibguti.github.io/ I have put up a small portfolio (and it is forever a work in progress).
I currently work as a software engineer at Google within GOSST team. If you wanna learn more about GOSST, keep on reading!
GOSST was created as a response to the current scenario of increasing attacks on supply chain projects. The team counts with experienced open-source contributors and works along with the Open Source Security Foundation (OpenSSF) to develop and spread solutions to make open softwares safer at scale. You can read more about Google initiatives on open source on this blogpost.
More specifically, I'm part of a sub-team responsible for our direct contact with the Open Source community. We work around critical open source projects to help increase security, in any aspect or concern that might be relevant. As a team, our goal is to:
- Build individual analyses and approaches for each project.
- Evaluate and suggest solutions or enhancements that would better fit the repository and not overcharge the maintainers.
- Welcome and conduct discussions about our suggestion or about any security solutions the maintainers prefer, as we can surely provide specific help according to their demands.
- If possible and wanted, implement the changes ourselves and create PRs to contribute with the discussed improvements.
- Collect any kinds of feedback, as we work closely with OpenSSF and any complains would be kindly heard.
In regard to the GOSST/OpenSSF security solutions that help securing the supply-chain, we can name:
- Scorecard: automated checks to evaluate and suggest security practices on your own project or your dependencies
- SLSA (pronounced "salsa"): a check-list of standards and controls to prevent tampering, improve integrity, and secure packages and infrastructure in your projects, businesses or enterprises
- Sigstore: a new standard for signing, verifying and protecting software
- OSS-FUZZ: a tool for fuzzing at scale and find bugs in critical projects, now fuzzing 800+ projects in 6 languages
- OSV: a precise, human - and machine - readable database of vulnerabilities that maps affected software versions across open source ecosystems