The Linux kernel has achieved a significant milestone in open source software security. It has been authorized as a CVE Numbering Authority (CNA) by the CVE Program. Being a CNA enables the Linux kernel team to manage the vulnerabilities with more accuracy and higher quality in the future. As Linux Foundation Fellow Greg Kroah-Hartman pointed…
We are thrilled to announce the first event Secure Open Source Software (SOSS) Fusion Conference 2024, a two-day conference hosted by the OpenSSF in Atlanta, GA. Set to take place on October 22-23, 2024, at The Hotel at Avalon, this event is dedicated to Securing Open Source Software (SOSS). The event registration is now open,…
The Open Source Security Foundation (OpenSSF) is participating in the Biden-Harris Administration’s first-ever Consortium Dedicated to AI Safety, led by the US Department of Commerce. We join over 200 leading artificial intelligence (AI) stakeholders in supporting the development and deployment of trustworthy and safe AI along with other Linux Foundation (LF) projects including LF AI…
Today, the OpenSSF Securing Software Repositories Working Group released v0.1 of Principles for Package Repository Security, a framework for package repositories to assess their current security capabilities and to help roadmap future improvements.
Time is of the essence to mitigate vulnerabilities like the recent Leaky Vessels in order to reduce the chance of the vulnerabilities being exploited by attackers. As noted in Leaky Vessels: Docker and runc container breakout vulnerabilities, “Snyk security researcher Rory McNamara, with the Snyk Security Labs team, identified four vulnerabilities — dubbed "Leaky Vessels"…
Today the Linux Foundation announced the launch of the Post-Quantum Cryptography Alliance (PQCA), an open and collaborative initiative to drive the advancement and adoption of post-quantum cryptography. The OpenSSF looks forward to closely collaborating with PQCA, so that high-assurance implementations of post-quantum algorithms will be widely adopted along with the application of other best practices…
The CVE-2023-6246 vulnerability in glibc can allow an attacker to escalate their local unprivileged access to the full root privilege level. CVEs like this highlight the significance of the initiatives that OpenSSF has been championing like Memory Safe Languages, Tools, and Coordinated Vulnerability Disclosure.
As the Open Source Security Foundation (OpenSSF), our core mission is to safeguard the open source software (OSS) ecosystem and make it more secure. In 2023, we embraced a significant opportunity to further this mission by working with the US government, including its Open-Source Software Security Initiative (OS3I).
The Linux Foundation’s recent research report, titled Maintainer Perspectives on Open Source Software Security, provides valuable insights into the views and practices of OSS maintainers and core contributors. Insights were derived from survey data, and the report features a foreword from Cisco’s Stephen Augustus, a maintainer, contributor, and one of open source’s most active participants.
Are you going to FOSDEM - the biggest open source event in Europe? It can be very overwhelming for anyone new to the event. If you are interested in open source security and policy, there are be some events and talks that you do not want to miss. Here is a survival guide that I…
