5 ms·

Hi! I'm leading one of the working groups for the OpenSSF (Identifying Security Threats) and I understand your point here. I hope I speak for everyone, that we

Hi! I'm leading one of the working groups for the OpenSSF (Identifying Security Threats) and I understand your point here. I hope I speak for everyone, that we want the larger community to be directly involved, and not have this be an organization "run by corporations". (I'd go so far as to say that this initiative cannot be successful without strong community support.) If you or anyone else is interested in participating or learning more, please drop me a line at michael /dot/ scovetta {at} microsoft.com.

nwellnhof 6y ago
Then why is there no obvious way to get in touch with you on your website? Are we supposed to search for random forum posts of your members? I once applied for a grant with the Core Infrastructure Initiative, the predecessor of the OpenSSF. It took me about half a day to write and submit a proposal, only to never hear back. After a couple of weeks, I tried to contact the Linux Foundation through their contact form and ask about my grant application, without success. Then I tried to contact some responsible people directly. I never got a single reply. That's just shameful. Organizations like the Linux Foundation are antithetical to core idea of Open Source which is, well, openness. But maybe Microsoft can bring some change into these encrusted institutions. BTW, I'm the maintainer of the XML parser and XSLT engine in your latest web browser. Bet you never even heard of me. There are quite a few security-related issues that still need work.
- caniszczyk 6y ago
  It's because all the work is happening in the open on GitHub in Working Groups if you want to get in touch with people, it's literally describe in the FAQ + "Community" top level button that takes you to https://github.com/ossf https://github.com/ossf Also, the LF not only helps fund the development of Linux through Linus and other fellows, it hosts a plethora of other open source organizations, like LetsEncrypt which I'm sure you use on a daily basis without knowing.
  - _msw_ 6y ago
    Disclosure: I work at Amazon on cloud infrastructure, and I am a technical advisor on FOSS related topics from time to time. Chris, I think that the feedback on the CII grant process deserves to be acknowledged and addressed if possible. I wasn't directly part of the day-to-day efforts of CII, but I (as an individual providing one's opinion and advice) supported the original charter of directly funding security related development of critical software libraries that are often unnoticed like libxml2, OpenSSL, etc. I am disappointed that CII didn't achieve this objective for more software (there were a few grants that were awarded and completed, but over time this seemed to end, from the public updates I read at the time). I think that it is still a good one to have.
    - caniszczyk 6y ago
      Matt, the CII grant program became problematic for a number of reasons and that OpenSSF is certainly aiming to avoid replicating those mistakes and making entirely new mistakes instead (to not only focus on grants and truly help define what critical software is). The CII was before my time at the LF so I don't have much to share outside of it was in the mind of the OpenSSF founders to do better.
      - _msw_ 6y ago
        I imagine the folks where were directly involved in CII (so, not me) would have loved to have had an opportunity to share their experiences and perspective during the closed-door formation phase of OpenSSF.
        caniszczyk 6y ago
        All of the Working Groups (WGs) that will be doing the work are forming now in the OPEN so this is the perfect time for anyone to get engaged as the organization gets off the ground: https://github.com/ossf https://github.com/ossf FYI: the majority of the work was born out of a closed source effort that you weren't involved in: https://github.blog/2020-07-09-what-we-learned-from-building-an-industry-coalition/ https://github.blog/2020-07-09-what-we-learned-from-building...

nwellnhof 6y ago

Then why is there no obvious way to get in touch with you on your website? Are we supposed to search for random forum posts of your members? I once applied for a grant with the Core Infrastructure Initiative, the predecessor of the OpenSSF. It took me about half a day to write and submit a proposal, only to never hear back. After a couple of weeks, I tried to contact the Linux Foundation through their contact form and ask about my grant application, without success. Then I tried to contact some responsible people directly. I never got a single reply. That's just shameful. Organizations like the Linux Foundation are antithetical to core idea of Open Source which is, well, openness. But maybe Microsoft can bring some change into these encrusted institutions. BTW, I'm the maintainer of the XML parser and XSLT engine in your latest web browser. Bet you never even heard of me. There are quite a few security-related issues that still need work.

caniszczyk 6y ago
It's because all the work is happening in the open on GitHub in Working Groups if you want to get in touch with people, it's literally describe in the FAQ + "Community" top level button that takes you to https://github.com/ossf https://github.com/ossf Also, the LF not only helps fund the development of Linux through Linus and other fellows, it hosts a plethora of other open source organizations, like LetsEncrypt which I'm sure you use on a daily basis without knowing.
- _msw_ 6y ago
  Disclosure: I work at Amazon on cloud infrastructure, and I am a technical advisor on FOSS related topics from time to time. Chris, I think that the feedback on the CII grant process deserves to be acknowledged and addressed if possible. I wasn't directly part of the day-to-day efforts of CII, but I (as an individual providing one's opinion and advice) supported the original charter of directly funding security related development of critical software libraries that are often unnoticed like libxml2, OpenSSL, etc. I am disappointed that CII didn't achieve this objective for more software (there were a few grants that were awarded and completed, but over time this seemed to end, from the public updates I read at the time). I think that it is still a good one to have.
  - caniszczyk 6y ago
    Matt, the CII grant program became problematic for a number of reasons and that OpenSSF is certainly aiming to avoid replicating those mistakes and making entirely new mistakes instead (to not only focus on grants and truly help define what critical software is). The CII was before my time at the LF so I don't have much to share outside of it was in the mind of the OpenSSF founders to do better.
    - _msw_ 6y ago
      I imagine the folks where were directly involved in CII (so, not me) would have loved to have had an opportunity to share their experiences and perspective during the closed-door formation phase of OpenSSF.
      - caniszczyk 6y ago
        All of the Working Groups (WGs) that will be doing the work are forming now in the OPEN so this is the perfect time for anyone to get engaged as the organization gets off the ground: https://github.com/ossf https://github.com/ossf FYI: the majority of the work was born out of a closed source effort that you weren't involved in: https://github.blog/2020-07-09-what-we-learned-from-building-an-industry-coalition/ https://github.blog/2020-07-09-what-we-learned-from-building...