abharya

8 ms·

1. 1.▲
   Guide to coordinated vulnerability disclosure for open source projects(github.com)

   5 points by abharya 6y ago|0 comments
2. 2.▲
   by abharya 6y ago

   There is no exclusive focus, we are just starting somewhere where we can see the various metrics. Plan is to expand to non-github projects and other places (like custom issue trackers), but this is not straightforward as it sounds. Ideas we
3. 3.▲
   by abharya 6y ago

   Thanks for your feedback, we do want to fix this. And we do agree that there are several critical packages missing that don't use all metrics on github, plus non-github projects. Capturing this in https://github.com/oss
4. 4.▲
   by abharya 6y ago

   Thanks for feedback, adding it for analysis in https://github.com/ossf/criticality_score/issues/23
5. 5.▲
   by abharya 6y ago

   We are working on this problem, it is not simple. Identifying dependency trees reliably across languages is not straightforward [only nice for package manager ones]. Follow https://github.com/ossf/criticality_score&#x2F
6. 6.▲
   by abharya 6y ago

   filed https://github.com/ossf/criticality_score/issues/23
7. 7.▲
   by abharya 6y ago

   coreutils is in the top 200 list, c_top_200.csv:coreutils, https://github.com/coreutils/coreutils,C,90,0,240,5,2.2,50,1... There will always be edge cases and scenarios we are not taking into account, please provide fee
8. 8.▲
   by abharya 6y ago

   It is definitely difficult especially with critical dependencies. We are looking for any criteria to identify these in automated fashion. Parallely, for ones we know about those are we are trying to run our automated tools on. E.g. glib, ca
9. 9.▲
   by abharya 6y ago

   That is a bug, will be fixed soon.
10. 10.▲
    by abharya 6y ago

    The issue with the mirror is we don't get the important stats to make decisions. E.g. number of contributors, issue changes due to custom issue tracker. We are still thinking on how to add information from such cases in automated fashi
11. 11.▲
    by abharya 6y ago

    This is still an early project to start somewhere. We are working on this problem as well. Trying to identify dependency trees and which smaller projects are the most widely used (indirect deps) and will impact the most on the critical proj
12. 12.▲
    by abharya 6y ago

    Filed https://github.com/ossf/criticality_score/issues/20 , we will fix this, have an idea on the issue.
13. 13.▲
    by abharya 6y ago

    We have to start somewhere. It is understandable that this is not complete, so welcome your ideas to discover such projects. Please think of any metrics/ways to find such projects.
14. 14.▲
    by abharya 6y ago

    They are there: cplusplus_top_200.csv:llvm-project, https://github.com/llvm/llvm-project,C++,48,0,2573,5,652.3,2... c_top_200.csv:postgres, https://github.com/postgres/postgres,C,124,0,50,5,41.1,52,1
15. 15.▲
    by abharya 6y ago

    The list captures projects written in the Java language, not for Java ecosystem. See why it is critical here - https://github.com/bazelbuild/bazel/wiki/Bazel-Users
16. 16.▲
    by abharya 6y ago

    Yes correct. Right now, we are query-ing projects hosted on Github, but will be expanding to our source control system in the near future.
17. 17.▲
    by abharya 6y ago

    That is not true, check out this as an example - https://groups.google.com/g/wg-securing-critical-projects/c/... . We are just trying to help, so please provide constructive feedback and any ideas on metrics w
18. 18.▲
    by abharya 6y ago

    Thanks, fixed in https://github.com/ossf/criticality_score/commit/fddcc093c7e...
19. 19.▲
    by abharya 6y ago

    World is not perfect. In case of gcc, it is only a mirror on github [ https://github.com/gcc-mirror/gcc ], so we dont get all the metrics, we do plan to improve this part [but this will be slow to clone repo, know their
20. 20.▲
    by abharya 6y ago

    It does seem to be popular w.r.t user downloads and other github metrics. E.g. https://sourceforge.net/projects/gnucash/files/stats/timelin... Wikipedia - "As of July 2018, SourceForge shows a count
21. 21.▲
    by abharya 6y ago

    As per Github (see languages section on bottom right), Cpython is 63% Python, and 29% C code, so its api returns Python as main language. cpython is in top 10 in python_top_200.csv
22. 22.▲
    by abharya 6y ago

    - Other metrics such as how many contributors and organizations are involved, how many user feature requests and bugs getting reported, those are all important project importance and not just "dependency count". some projects can
23. 23.▲
    by abharya 6y ago

    These are just some initial metrics we picked for v1. Please suggest more by filing by a github issue here - https://github.com/ossf/scorecard/issues Over time, we will add more real time metrics such as open vuln
24. 24.▲
    by abharya 6y ago

    The goals are different. Our goal is to help both open source developer improve their project so that it is more secure for the community in the long term. It also gives the consumer this information for free, rather than paying / subs
25. 25.▲
    by abharya 6y ago

    Yes, we will automate score capturing over all projects in real-time in the future. https://github.com/ossf/scorecard/issues/12 The work to capture current vuln state is tracked in https://github.c
26. 26.▲
    by abharya 6y ago

    We are still thinking of ways to capture scores for various open source projects in an automated fashion and/or work with GitHub to display this kind of information as part of their user interface. Right now, project maintainers need t