4 ms·
Actively developed open source projects are a moving target, thus it'd be good to indicate which versions were reviewed or tested. If a vulnerability were late
by justin_oaks 5y ago
Actively developed open source projects are a moving target, thus it'd be good to indicate which versions were reviewed or tested.
If a vulnerability were later found in a version that was checked then it would be good for the OpenSSF to review how it was missed. Hopefully that'll let them be better in the future.
I also like the idea of them documenting their methodology. Open source the process of finding vulnerabilities in open source projects!
- buitreVirtual 5y agoThat's the idea!
- scovetta 5y agoI love this, yes. Root cause analysis ("How did this thing happen in the first place, does it exist anywhere else, and how can we prevent it from happening again?") should be a core part of our work in Alpha-Omega, and we should include this information in our publications. To the larger point -- the idea of "open sourcing the process for finding vulnerabilities in open source" captures a lot of the work already being done in OpenSSF, but there's a lot more we can do. (If you're interested in helping us with this, we'd love to have you!)