Scaling Enterprise OSS Governance with OpenSSF Tools
- Time
- 2026-08-08 11:30 ~ 12:00
- Speaker
- Ryan Hsieh 謝文豪
- Room
- TR209
- Co-write
Abstract
Software supply chain security is critical, yet enterprises often struggle with implementation. This session explores the practical application of OpenSSF Scorecard and S2C2F in a corporate environment. We will cover quantifying open-source risk, navigating license compliance, and adopting phased rollout strategies to balance security with developer velocity. Gain actionable insights on bridging the gap between theoretical frameworks and real-world governance.
Speaker
Ryan Hsieh 謝文豪
我是一位對開源充滿熱忱的 TPM。目前我在國泰金控與夥伴一同推動 OSPO，在 OSRB 治理與 DevRel 社群經營之間建立橋樑。
目前正致力於開拓一條專屬於 PM 的開源之路，近期深耕研究 OpenSSF Scorecard, OSPS Baseline ,S2C2F 的相關國際專案。除了參與 2026 OSPOlogy Asia 委員會與 TODO Group，我也熱衷於將大型企業的實務帶回社群。
說到底，我熱愛我所做的事，也相信開源帶來更好的世界。此外，我也是個網球愛好者🎾
I’m a Technical Project Manager with a deep passion for open-source. At Cathay Financial Holdings, I work alongside squad to drive OSPO initiatives, bridging the gap between OSRB governance and DevRel community engagement.
I am currently on a mission to carve out a unique path for PMs in the open-source ecosystem. My recent focus has been on the practical implementation of international projects such as the OpenSSF Scorecard, OSPS Baseline, and S2C2F. Beyond my daily work, I serve on the OSPOlogy Asia 2026 Program Committee and contribute to the TODO Group, where I advocate for bringing real-world enterprise practices back to the community.
In the end, I love what I do and firmly believe that open collaboration builds a better world. Also, I’m a huge tennis lover! 🎾