6 ms·

OpenSSF: Open Source Security Foundation

128 points by PatrolX 6y ago

hansjorg 6y ago
Maybe this should link to https://openssf.org https://openssf.org or the press release (https://openssf.org/press-release/2020/08/03/technology-and-enterprise-leaders-combine-efforts-to-improve-open-source-security/ https://openssf.org/press-release/2020/08/03/technology-and-...) rather than to the GitHub project? Highlights from the FAQ: > OpenSSF is focused on improving the security of open source software (OSS) by building a broader community with targeted initiatives and best practices. It will start with a focus on metrics, tooling, best practices, developer identity validation and vulnerability disclosures best practices. > OpenSSF will be supported by Linux Foundation membership dues with targeted organization contributions to support initiatives > The founding members are GitHub, Google, IBM, JPMorgan Chase, Microsoft, NCC Group, OWASP Foundation and Red Hat, among others.
- charliebrownau 6y ago
  So we have another NGO with Globalists, Jewish, Bankers, SJWs and Diversity .. Whats the point supporting this shit ?
- dependenttypes 6y ago
  I was interested in it but when I saw the corporations supporting it I ended up with a sour taste in my mouth. Reading the rest of the comments it seems more like as an organization with the intention to support their own interests rather than to support the interests of the community.
  - cutemonster 6y ago
    Can't their interests be aligned with the oss developers? Google has project zero and Safe Browsing API which does helpful things to me, GitHub auto scans dependencies, and owasp guidelines are helpful I think
TACIXAT 6y ago
It is really interesting that major open source initiatives are now being ran by corporations. I feel this will be open source in the sense that it is being developed in the open, but not in the sense that they will foster an environment of community contribution. For example, the working group for vulnerability disclosure includes a lot of corporate players, and from what I can tell, not a single security researcher. Only one side of the disclosure process is represented in that working group. Realizing how allergic major companies are to GPL code really creates some skepticism when they speak about embracing open source.
- scovetta 6y ago
  Hi! I'm leading one of the working groups for the OpenSSF (Identifying Security Threats) and I understand your point here. I hope I speak for everyone, that we want the larger community to be directly involved, and not have this be an organization "run by corporations". (I'd go so far as to say that this initiative cannot be successful without strong community support.) If you or anyone else is interested in participating or learning more, please drop me a line at michael /dot/ scovetta {at} microsoft.com.
  - nwellnhof 6y ago
    Then why is there no obvious way to get in touch with you on your website? Are we supposed to search for random forum posts of your members? I once applied for a grant with the Core Infrastructure Initiative, the predecessor of the OpenSSF. It took me about half a day to write and submit a proposal, only to never hear back. After a couple of weeks, I tried to contact the Linux Foundation through their contact form and ask about my grant application, without success. Then I tried to contact some responsible people directly. I never got a single reply. That's just shameful. Organizations like the Linux Foundation are antithetical to core idea of Open Source which is, well, openness. But maybe Microsoft can bring some change into these encrusted institutions. BTW, I'm the maintainer of the XML parser and XSLT engine in your latest web browser. Bet you never even heard of me. There are quite a few security-related issues that still need work.
    - 6y ago
mintyc 6y ago
Such a shame these initiatives don't build on existing standards working groups but go away and reinvent a wheel instead. Take a look for instance at ETSI TC Cyber, or ETSI NFV Sec. Even more available in specific domains, such as intelligent transport systems (ISG WG5) Let's have one more standard promoting another agenda and set of priorities. Open standards should also promote consolidated standards.
- LockAndLol 6y ago
  What gave you the impression that they are reinventing the wheel?
  - kerkeslager 6y ago
    Did you take a look at the ETSI organizations mentioned in the comment you are responding to? > Take a look for instance at ETSI TC Cyber, or ETSI NFV Sec.
- JoachimS 6y ago
  OWASP as organization is one of the members of OpenSSF: https://openssf.org/about/members/ https://openssf.org/about/members/
- caniszczyk 6y ago
  This is more than just open standards, the problem with standards groups in general is that they haven't woken up on how to do modern open source development, they are slow moving.

128 points by PatrolX 6y ago

Maybe this should link to https://openssf.org https://openssf.org or the press release (https://openssf.org/press-release/2020/08/03/technology-and-enterprise-leaders-combine-efforts-to-improve-open-source-security/ https://openssf.org/press-release/2020/08/03/technology-and-...) rather than to the GitHub project? Highlights from the FAQ: > OpenSSF is focused on improving the security of open source software (OSS) by building a broader community with targeted initiatives and best practices. It will start with a focus on metrics, tooling, best practices, developer identity validation and vulnerability disclosures best practices. > OpenSSF will be supported by Linux Foundation membership dues with targeted organization contributions to support initiatives > The founding members are GitHub, Google, IBM, JPMorgan Chase, Microsoft, NCC Group, OWASP Foundation and Red Hat, among others.

charliebrownau 6y ago
So we have another NGO with Globalists, Jewish, Bankers, SJWs and Diversity .. Whats the point supporting this shit ?
dependenttypes 6y ago
I was interested in it but when I saw the corporations supporting it I ended up with a sour taste in my mouth. Reading the rest of the comments it seems more like as an organization with the intention to support their own interests rather than to support the interests of the community.
- cutemonster 6y ago
  Can't their interests be aligned with the oss developers? Google has project zero and Safe Browsing API which does helpful things to me, GitHub auto scans dependencies, and owasp guidelines are helpful I think

TACIXAT 6y ago

It is really interesting that major open source initiatives are now being ran by corporations. I feel this will be open source in the sense that it is being developed in the open, but not in the sense that they will foster an environment of community contribution. For example, the working group for vulnerability disclosure includes a lot of corporate players, and from what I can tell, not a single security researcher. Only one side of the disclosure process is represented in that working group. Realizing how allergic major companies are to GPL code really creates some skepticism when they speak about embracing open source.

scovetta 6y ago
Hi! I'm leading one of the working groups for the OpenSSF (Identifying Security Threats) and I understand your point here. I hope I speak for everyone, that we want the larger community to be directly involved, and not have this be an organization "run by corporations". (I'd go so far as to say that this initiative cannot be successful without strong community support.) If you or anyone else is interested in participating or learning more, please drop me a line at michael /dot/ scovetta {at} microsoft.com.
- nwellnhof 6y ago
  Then why is there no obvious way to get in touch with you on your website? Are we supposed to search for random forum posts of your members? I once applied for a grant with the Core Infrastructure Initiative, the predecessor of the OpenSSF. It took me about half a day to write and submit a proposal, only to never hear back. After a couple of weeks, I tried to contact the Linux Foundation through their contact form and ask about my grant application, without success. Then I tried to contact some responsible people directly. I never got a single reply. That's just shameful. Organizations like the Linux Foundation are antithetical to core idea of Open Source which is, well, openness. But maybe Microsoft can bring some change into these encrusted institutions. BTW, I'm the maintainer of the XML parser and XSLT engine in your latest web browser. Bet you never even heard of me. There are quite a few security-related issues that still need work.
  - 6y ago

mintyc 6y ago

Such a shame these initiatives don't build on existing standards working groups but go away and reinvent a wheel instead. Take a look for instance at ETSI TC Cyber, or ETSI NFV Sec. Even more available in specific domains, such as intelligent transport systems (ISG WG5) Let's have one more standard promoting another agenda and set of priorities. Open standards should also promote consolidated standards.

LockAndLol 6y ago
What gave you the impression that they are reinventing the wheel?
- kerkeslager 6y ago
  Did you take a look at the ETSI organizations mentioned in the comment you are responding to? > Take a look for instance at ETSI TC Cyber, or ETSI NFV Sec.
JoachimS 6y ago
OWASP as organization is one of the members of OpenSSF: https://openssf.org/about/members/ https://openssf.org/about/members/
caniszczyk 6y ago
This is more than just open standards, the problem with standards groups in general is that they haven't woken up on how to do modern open source development, they are slow moving.