3 ms·
I think you miss the point then. The things it's looking for are indicators security practices are even in place. If you wanted vuln scanning, many solutions fo
by spydum 6y ago
I think you miss the point then. The things it's looking for are indicators security practices are even in place. If you wanted vuln scanning, many solutions for that today exist. This is almost like a reputation score. The higher it is, the more likely vulnerabilities will be addressed in the future (or outright prevented).
I like the idea, I think it will just be tough to work out the right heuristics.
- prepend 6y agoHaving a quantitative, ordinal scale gives the wrong picture I think. Since 10/10 sounds good, but doesn’t actually mean something is safe. Also the name is “scorecard” that again connotes that a high score is good. I don’t get a 10/10 on my assignment because I did my homework, said hello to the teacher each morning, and was polite to my classmates. Those are all positive things and if I wanted to measure students they may be a part of the grade. But if I only graded on these factors that’s not terribly useful. Process measures are good when it’s not possible to measure outcome, but I think in this situation more outcome measures could be factored in.
- abharya 6y agoThese are just some initial metrics we picked for v1. Please suggest more by filing by a github issue here - https://github.com/ossf/scorecard/issues https://github.com/ossf/scorecard/issues Over time, we will add more real time metrics such as open vulnerabilities, etc