3 ms·

LF OpenSSF "criticality score" for 100K Github repos, https://github.com/ossf/criticality_score https://github.com/ossf/criticality_score & https://docs.google.

LF OpenSSF "criticality score" for 100K Github repos, https://github.com/ossf/criticality_score https://github.com/ossf/criticality_score & https://docs.google.com/spreadsheets/d/1uahUIUa82J6WetAqtxCM_qgH-YJOagH84AFniIhlAbg/edit https://docs.google.com/spreadsheets/d/1uahUIUa82J6WetAqtxCM... > Generate a criticality score for every open source project. Create a list of critical projects that the open source community depends on. Use this data to proactively improve the security posture of these critical projects ... A project's criticality score defines the influence and importance of a project. It is a number between 0 (least-critical) and 1 (most-critical). It is based on the following algorithm by Rob Pike.. Top 20 projects, based on "criticality score" algo output, you can run the script on your favorite OSS project: > node, kubernetes, rust, spark, nixpkgs, cmsSW, tensorflow, symfony, DefinitelyTyped, git, azure-docs, magento2, rails, ansible, pytorch, PrestaShop, framework, ceph, php-src, linux

Tomte 4y ago
Oh fun! At my employer the "security team" misunderstands that criticality score and takes it as a "vulnerability score". Everything scoring high is a security risk, everything scoring low is secure.
- transpute 4y ago
  OMG :) OpenSSF will love that story! Straight into the documentation Hall of Fame. They can check out the Securing Critical Projects working group, https://github.com/ossf/wg-securing-critical-projects https://github.com/ossf/wg-securing-critical-projects
  - Tomte 4y ago
    They link to that page in their documentation. I can only assume that they misunderstand this: > 1. Identify critical open source software (OSS) projects. > 2. Secure those projects. Not as "those projects are widely in use, we should really make sure that they are looked at", but as "we have identified those projects as insecure and will secure them".

Tomte 4y ago

Oh fun! At my employer the "security team" misunderstands that criticality score and takes it as a "vulnerability score". Everything scoring high is a security risk, everything scoring low is secure.

transpute 4y ago
OMG :) OpenSSF will love that story! Straight into the documentation Hall of Fame. They can check out the Securing Critical Projects working group, https://github.com/ossf/wg-securing-critical-projects https://github.com/ossf/wg-securing-critical-projects
- Tomte 4y ago
  They link to that page in their documentation. I can only assume that they misunderstand this: > 1. Identify critical open source software (OSS) projects. > 2. Secure those projects. Not as "those projects are widely in use, we should really make sure that they are looked at", but as "we have identified those projects as insecure and will secure them".