{"id":67477,"date":"2022-09-26T09:01:35","date_gmt":"2022-09-26T09:01:35","guid":{"rendered":"https:\/\/www.cryptocabaret.com\/?p=67477"},"modified":"2022-09-26T09:01:35","modified_gmt":"2022-09-26T09:01:35","slug":"openssf-on-a-mission-to-improve-security-of-open-source-software","status":"publish","type":"post","link":"https:\/\/www.cryptocabaret.com\/?p=67477","title":{"rendered":"OpenSSF: on a mission to improve security of open source software"},"content":{"rendered":"

OpenSSF: on a mission to improve security of open source software<\/span>
\nGaurav Kamathe<\/a><\/span>
\nMon, 09\/26\/2022 – 03:00<\/span><\/p>\n

\n

Open source software (OSS), once a niche segment of the development landscape, is now ubiquitous. This growth is fantastic for the open source community. However, as the usage of OSS increases, so do concerns about security. Especially in mission-critical applications\u2014 think medical devices, automobiles, space flight, and nuclear facilities\u2014securing open source technology is of the utmost priority. No individual entity, whether developers, organizations, or governments, can single-handedly solve this problem. The best outcome is possible when all of them come together to collaborate.<\/p>\n

The Open Source Security Foundation<\/a> (OpenSSF) formed to facilitate this collaboration. OpenSSF is best described in its own words:<\/p>\n

\n

The OpenSSF is a cross-industry collaboration that brings together leaders to improve the security of open source software by building a broader community with targeted initiatives and best practices.<\/p>\n<\/blockquote>\n

Vision<\/h2>\n

The technical vision of OpenSSF is to handle security proactively, by default. Developers are rightly at the center of this vision. OpenSSF seeks to empower developers to learn secure development practices and automatically receive guidance on them through the day-to-day tools they use. Researchers who identify security issues can send this information backward through the supply chain to someone who can rapidly address the issue. Auditors and regulators are encouraged to devise security policies that can be easily enforced via tooling, and community members provide information on the components they use and test regularly.<\/p>\n

Mobilization plan<\/h2>\n

OpenSSF drafted a mobilization plan based on input from open source developers and leaders from US federal agencies. The result is a set of high-impact actions aimed at improving the resiliency and security of open source software. Based on this plan, 10 streams of investments have been identified, including security education, risk assessment, memory safety, and supply chain improvement. While discussion of these issues is widespread, OpenSSF is the platform that has collected and prioritized these concerns over others to ensure a secure open source ecosystem.<\/p>\n

Working groups<\/h2>\n

Because the 10 streams of investments are quite diverse, OpenSSF is divided into multiple working groups. This strategy allows individual teams to focus on a specific area of expertise and move forward without getting bogged down with more general concerns. The working groups have something for everyone: Developers can contribute to security tooling, maintainers can handle software repositories, and others can contribute by educating developers on best practices, identifying metrics for open source projects, or identifying and securing the critical projects that form the core of the OSS ecosystem.<\/p>\n<\/p>\n

\n
More on security<\/div>\n
\n
The defensive coding guide<\/a><\/div>\n
10 layers of Linux container security<\/a><\/div>\n
SELinux coloring book<\/a><\/div>\n
More security articles<\/a><\/div>\n<\/p><\/div>\n<\/p><\/div>\n

Industry participation<\/h2>\n

Multiple software vendors have become members of OpenSSF in their own capacity. These vendors are important players in the IT ecosystem, ranging from cloud service providers and operating system vendors to companies hosting OSS repositories, creating security tooling, creating computing hardware, and more. The benefit is getting inputs from a variety of sources that others might not be aware of and then collaboratively working on those issues.<\/p>\n

Getting involved<\/h2>\n

There are a variety of ways to participate in the OpenSSF initiative based on your expertise and the amount of time you can set aside for it:<\/p>\n