Name: News and Advice on the World's Latest Innovations | ZDNET
Brand: zdnet.com
SKU: zdnet-com-222
Availability: OnlineOnly

critic

News and Advice on the World's Latest Innovations | ZDNET

preview

/&gt;We can make open-source software safer and more secure when we all work together.Eric S. Raymond, one of open-source's founders, famously said, "" which he called "Linus's Law." That's true. It's one of the reasons why open-source has become the way almost everyone develops software today. That said, it doesn't go far enough. You need expert eyes hunting and fixing bugs and you need coordination to make sure you're not duplicating work.&nbsp; &nbsp; So, it is more than past time that started the . This cross-industry group brings together open-source leaders by building a broader security community. It combines efforts from the , , and other open-source security-savvy companies such as , GitLab, Google, IBM,&nbsp; Microsoft, NCC Group, OWASP Foundation, Red Hat, and VMware. &nbsp; Since open source has become vital to technology and affects all users, the open-source supply chain of contributors and dependencies must have its security verified from start to finish. It will start doing that by unifying existing open-source security initiatives , and the Open Source Security Coalition. &nbsp; Jamie Cool, GitHub's VP of Product Management, Security, said in a statement:&nbsp; GitHub founded the Open Source Security Coalition in 2019 to bring together industry leaders around this mission and ensure the consumption of open source software is something that all developers can do with confidence. We look forward to this next step in the evolution of the coalition, and serving as a founding member of the Open Source Security Foundation.Microsoft, once an open-source enemy, is also throwing its resources behind the new foundation. Mark Russinovich, 's Chief Technology Officer, blogged, "As open source is now core to nearly every company's technology strategy, securing open-source software is an essential part of securing the supply chain for every company, including our own. As with everything open source, building better security is a community-driven process."Russinovich also spelled out what you can expect to see from the OpenSSF:Helping developers to better understand the that exist in the open-source software ecosystem and how those threats impact specific open source projects. Providing the best security tools for open source developers, making them universally accessible, and creating a space where members can collaborate to improve upon existing security tooling and develop new ones to suit the needs of the broader open source community. Providing open-source developers with best practice recommendations, and with an easy way to learn and apply them. Additionally, we have been focused on ensuring best practices will be widely distributed to open source developers and will leverage an effective learning platform to do so. Creating an open-source software ecosystem where the time to fix a vulnerability and deploy that fix across the ecosystem is measured in minutes, not months. , a leading Linux and cloud company, agrees. Chris Wright, Red Hat's CTO said, "Now, more than ever, is the time for us to join together with other leaders to help ensure key projects are secure and consumable in our products, across enterprises, and as part of the hybrid cloud. We are excited to help found this Open Source Software Foundation." "We believe open source is a public good and across every industry, we have a responsibility to come together to improve and support the security of open-source software we all depend on," concluded Jim Zemlin, The Linux Foundation's executive director. "Ensuring open-source security is one of the most important things we can do and it requires all of us around the world to assist in the effort. The OpenSSF will provide that forum for a truly collaborative, cross-industry effort." &nbsp; Moving forward, the Foundation's governance, technical community, and its decisions will be done in a transparent way. In addition, all resulting specifications and projects will be vendor-agnostic. The OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open-source security for all.&nbsp; &nbsp; The group will use an open governance structure model. This includes a Governing Board (GB), a (TAC), and a separate oversight for each working group and project. OpenSSF intends to host&nbsp;&nbsp;on GitHub. &nbsp; Related Stories:

/&gt;We can make open-source software safer and more secure when we all work together.Eric S. Raymond, one of open-source's founders, famously said, "" which he called "Linus's Law." That's true. It's one of the reasons why open-source has become the way almost everyone develops software today. That said, it doesn't go far enough. You need expert eyes hunting and fixing bugs and you need coordination to make sure you're not duplicating work.&nbsp; &nbsp; So, it is more than past time that started the . This cross-industry group brings together open-source leaders by building a broader...

public

Steven Vaughan-Nichols

Steven J. Vaughan

ZDNet is a business technology news website published by CBS Interactive, along with TechRepublic. The brand was founded on April 1, 1991, as a general interest technology portal from Ziff Davis and evolved into an enterprise IT-focused online publication owned by CNET Networks.

News and Advice on the World's Latest Innovations | ZDNET

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS