3 ms·
The usage example in the README gives Kubernetes a 10/10 on security. Would it score that highly if the tool took into consideration all of its dependencies? ht
by jart 6y ago
The usage example in the README gives Kubernetes a 10/10 on security. Would it score that highly if the tool took into consideration all of its dependencies? https://github.com/kubernetes/kubernetes/blob/master/vendor/modules.txt https://github.com/kubernetes/kubernetes/blob/master/vendor/...
- spydum 6y agoProbably not. I think the intent is for big shops to quantify the risk of adopting an open source project. This is just a way to codify how teams justify whether a project is "mature enough" for adoption.
- toomuchtodo 6y agoAppears to be an open source alternative to Black Duck Software. https://www.blackducksoftware.com/ https://www.blackducksoftware.com/
- abharya 6y agoThe goals are different. Our goal is to help both open source developer improve their project so that it is more secure for the community in the long term. It also gives the consumer this information for free, rather than paying / subscribing to a service.
- kimsterv 6y agothere's an open issue related to this: https://github.com/ossf/scorecard/issues/27 https://github.com/ossf/scorecard/issues/27