CRob is joined by Michael Lieberman, CTO and co-founder of Kusari, about the importance of supply chain security in the open source ecosystem. They discuss Michael’s journey in open source, his contributions to projects like SLSA and GUAC and the future of supply chain security.
Michael Lieberman soundbite (00:01)
I think for the downstream consumers, it’s one thing to do the security. It’s another thing to have folks who are consuming the software know, yes, I feel confident that they’re actually doing the right things because I’m getting signed in an atttested documentation that I can tie back to the maintainers.
CRob (00:18)
Hello, everybody. I’m CRob. I do security stuff on the internet, amongst other things, and I also am a community member and chief security architect for the Open Source Security Foundation. And one of the amazing things I get to do is host “What’s in the SOSS?” podcast, where I talk to interesting people, whether they’re developers or leaders, policy people in and around the open source software ecosystem.
And today we have a pretty cool treat, my friend Michael Lieberman from Kusari. I’ve had the chance to work with Michael for a couple of years within the OpenSSF, and we’re going to talk today about supply chain security and other topics. But before we do that, Michael, why don’t you introduce yourself to the audience?
Michael Lieberman (01:07)
Sure. Yeah. So I’m Michael Lieberman, and I’m CTO and co-founder of a startup called Kusari, focused in supply chain security, but also very much focused in building and using open source.
And in addition to that, I also wear multiple hats in the community as a CNCF TAG security lead, which is the technical advisory group for security for the CNCF as the name sort of suggests.
And then in addition to that in the OpenSSF, I’m a maintainer of some projects like GUAC and SLSA. And in addition to that, I’m also a TAC member and a governing board member.
CRob (01:47)
Now that we’ve got the today story for Michael told, could you maybe share with us, what’s your open source origin story?
Michael Lieberman (01:56)
Sure, so I’ve been using open source obviously, like, since college, you maybe even before that, actually, I remember learning my first programming language, was a very early version of Python. And you know, that was kind of my first introduction, I think, to open source. But as far as, like, my career is gone, using open source for a really long time, occasionally opening up an issue on whether it was prior to GitHub, you know, into some mailing list or that sort of thing.
More recently, when I was…got into the banking world, I was working at a big hedge fund called Bridgewater for a while where we were doing a lot in open source, but we were starting to become more open and contributing back, especially given that we were so security focused. We wanted to make sure that certain things we had seen would get addressed upstream.
And so that involved a lot of stuff on that end. And then as time sort of progressed, would say around the time of the pandemic started getting a lot more involved in, in open source, where I first was a regular member of the financial services end user working group, which is part of the CNCF or at least for the CNCF, I should say. And then eventually I became one of the chairs of that.
Folks in that group are very interested in security. And that’s how I got introduced to TAG Security, where I started working on the Supply Chain Integrity white paper that they had sort of best practices paper, I should say, that they wrote up and I contributed to. And then eventually the Secure Software Factory Reference Architecture, which I helped lead. But as part of this whole thing, there was a relatively new group called the OpenSSF, or Open Source Security Foundation.
And that’s kind of…how I got introduced there, because obviously CNCF, TAGv Security, security, that’s very much focused purely on cloud native, but then you had OpenSSF, which was focused more broadly just on open source security, and that’s kind of how I got introduced there.
CRob (03:54)
That’s pretty cool. And you’re unique in regards to some of our other guests in that you are leader of a startup. Can you maybe describe a little bit for the audience, what’s it like being a startup within this amazing open source ecosystem?
Michael Lieberman (04:10)
It can be very challenging to kind of get some signal above the noise, especially when you don’t have like…when I worked at the big banks, it was very easy to say, “Hey, I work at Big Bank X, you should listen to me,” compared to when you work at a startup and you’re like, “Well, I’m a founder of a startup. You should listen to me.” But I think the thing there is you sort of live and die by your contributions.
So when folks see that you are a good contributor to the community, that you are coming in with your expertise, but also trying to understand other things, and also just trying to do the chopping wood sort of work. It’s not just about, yes, I’ve worked on that for years and this is how it should be done. It should be also, hey, this is how it should be done. And let me show you, let me sit down and actually write down some of the documentation or let me work on a tool or open up a PR to show you how that sort of thing would work.
So it’s a little bit of everything and I will say it’s kind of hard to not get drowned out sometimes by just how much is going on. But with that said, I will say if you put in the time and effort, it can be very rewarding.
CRob (05:18)
But let’s talk about some of your contributions that I know you still, in addition to running your company and being involved in all these different organizations, you’re an active developer and participant in a couple of our biggest initiatives within the foundation, SLSA and GUAC. Could you maybe talk a little bit about SLSA first, and then let’s dive into dependencies with GUAC.
Michael Lieberman (05:38)
Sure. So my introduction to SLSA was kind of a funny one where I saw an article about this new set of practices that had been contributed to the OpenSSF by Google. And I immediately asked the question of like, what’s going on here? What is this thing? And everybody else said, “We just released it today. Like, give us a second!” But I got involved very early on because it seemed like, wow, this is actually hitting something that was not being hit prior, right?
A lot of other best practices that are out there were hitting like how to secure a thing, but not how do you prove that the data that says you are securing the thing is actually accurate? That’s really what SLSA is hitting, especially in the build process right now. So I got involved very, very early on. I became part of the steering committee.
And then as sort of things evolved, I became sort of an actual maintainer of the spec itself, where I contribute both to the content of the spec, as well as reviewing stuff and making sure that things line up with other pieces of the spec. So that’s kind of how I got involved with SLSA.
And then as part of some of that work, right, that was back when I was still working at the banks. And as I kind of continued on, it was very clear that when we look at software bill of materials or SBOMs and a lot of this other data like SLSA that’s like the information that’s coming out of SLSA there is not a lot to make sense of it. And what things do make sense of it often look at each of those things as a in a vacuum? So it looks at a SLSA attestation in a vacuum or an SBOM in a vacuum and so there was something that was missing there.
And after myself and my co-founders decided to create a startup, we quickly realized that maybe we should start working on a tool to start addressing stuff in that space. And a few of the other folks in the space — like Professor Santiago Torres from Purdue University, as well as some folks from Google, like Brandon Lum and Mihai, who also is a big contributor in OpenSSF — we all sort of kind of came together and we realized like, oh, we all want to build this thing.
And so why, given that we were all working together in some capacity in the open source already, we said, as opposed to all of us creating different tools and yada, yada, why don’t we all come together and build something? And so that’s kind of was the genesis of GUAC and GUAC became this tool and it’s now part of the OpenSSF. At the time, we had sort of created it outside of the OpenSSF, but once it kind of reached that critical mass, we decided to contribute it to the OpenSSF.
And for folks who are not super familiar, it’s essentially a way to analyze lots of SBOMs, lots of SLSA attestations, other supply chain metadata, enrich it with information like vulnerability data from open source databases like OSV, or to figure out license risk information from APIs like Clearly Defined, and all sorts of other stuff. And so it’s trying to help answer the questions of what is in your supply chain? What should you be worried about? Where’s the next Log4j? Where does that live? And what does it impact? Is it impacting one of my applications or all of my applications? So it’s really a graph of understanding everything that’s in your software.
CRob (09:03)
So this sounds really valuable to downstream consumers. How would like an open source maintainer or developer leverage an SBOM or GUAC? Would that be useful to them?
Michael Lieberman (09:13)
Sure, yeah. So it depends. So the way that we currently have it set up, and it’s evolving, is
GUAC right now has a good answer for when you have lots of SBOM. So for the end stream consumer, but also in addition to that, we’re having conversations, for example, with the Kubernetes ecosystem and some other ecosystems that their project actually consists of lots and lots of lots of different pieces.
And for them, one SBOM is not enough because they have hundreds potentially of sub-projects that they need to keep track of. And some of the questions they ask are, did I update this logging library in one Go project or did I update in all of them? And do I have a situation where this sub-project is using a completely different framework than this other one and that’s introducing just general risks to the project.
So that’s kind of where some maintainers are kind of coming at it from as well. But there are plans actually as of recently, we had some discussions to actually start working on some additional tools and integrating with additional tools like Protobom, like bomctl, that are also OpenSSF projects to also help answer the question of what happens when I have one or five SBOMs as opposed to when I have 500 or 5,000 SBOMs. And there’s a big gap right now between I have one and I have 5,000 and we’re looking to try and help bridge that gap with some of the upcoming work in the new year.
CRob (10:44)
Very nice. Speaking of upcoming work, you’ve been in this space for a while. What do you see coming down the road in the next few years around supply chain security or dependency management?
Michael Lieberman (10:56)
Sure. What I see is a lot more of the open source distributors, so like your Pi PI, your Maven Central’s, integrating a lot more of this stuff like SBOMs and SLSA into the ecosystem and I know a lot of them are already in the works for doing this. But I think for the downstream consumers, right, but it’s one thing to do the security, it’s another thing to have folks who are consuming the software know, yes, I feel confident that they were that they’re actually doing the right things because I’m getting signed in attested documentation that I can tie back to the maintainers and You know unless the maintainers are completely lying to me, in which case, well, now they can’t be trusted and yada, yada, there’s potentially public repercussions or whatever for those individuals, like there’s clearly incentive to do this.
And so what I see is finally folks looking at not just how to produce all of this stuff, but how to consume it to answer questions and address risk, which then I think will introduce what is really needed right now, which is a feedback loop of people are producing SBOMs, some of them are gonna be more accurate than others. But I think through analysis tools, whether it is GUAC or any other thing that’s out there, right, Like there’s OSV scanner and there’s a bunch of other, things, we’ll start to see that folks will find gaps in those SBOMs, in those SLSA statements, in the supply chain metadata and realize that it needs to be updated. That data will be updated or enriched and will be generating better SLSA and SBOMs in the future. That’s, I think, one big thing.
The second big thing I think we’ll see, which is maybe, maybe a bit more, I don’t want to sound myopic or anything like that, but I do think especially in the AI space in the next, whether it’s next year or the next couple of years, we will see something akin to a Log4j in that space where a lot of folks will be relying maybe either on a data set that everybody thought was good, but it turns out it’s been polluted in some way, poisoned in some way. Or a model itself that a lot of things rely on that has some critical vulnerability, whether it’s purposefully injected with some sort of malicious behavior, or if it’s just, hey, we realize that the way we train this led it to be potentially exploited in a particular way to get it to make certain decisions that we don’t want to allow.
I think we’ll see that in the future because it’s hard enough to track dependencies and understand your supply chain when you’re talking about software and software consists of code. But when you’re talking about AI models that are trained on terabytes or more of data here, it can be very difficult to know like, where does that needle live of this thing has somehow polluted the overall model?
CRob (14:02)
That’s really interesting food for thought. We’ll keep an eye on that as we go into the future.
But let’s move on to the rapid fire part of our talk. So I got a couple quick and easy questions. I just want the first thought that comes into your head. First question, mild or spicy food?
Michael Lieberman (14:26)
Spicy.
CRob (14:30)
Nice. I also love me some spicy food. Text editor, Vi or Emacs?
Michael Lieberman (14:38)
Vi, Vi.
CRob (14:41)
(Laughter) All right, well that’s not the most contentious question we’re going to have. But Vi, I also love me some Vi. What’s your favorite adult beverage?
Michael Lieberman (14:51)
Ooh, whiskey.
CRob (14:53)
Whiskey, very good. Very safe answer. Now the most controversial question. Tabs or spaces?
Michael Lieberman (15:01)
(Sighs) Spaces.
CRob (15:06)
Awesome. And then finally, what’s your favorite open source mascot?
Michael Lieberman (15:11)
You know, for as much as I love the goose, I will say I’m a big fan of Tag Security’s TrashPanda raccoon mascot.
CRob (15:20)
Very nice. That’s a good one. So as we close out, do you have any kind of words of advice for someone that’s getting into the cybersecurity or open source development space?
Michael Lieberman (15:32)
Sure, yeah. The advice I always give is just get involved, right? Just get started. And it doesn’t matter where you get started. And to be clear, I was the same way where I’d be scared to, you know, I’d be like, I think I found a bug in a potential piece of software. Should I bother them with this? I could be wrong. It’s like, obviously do your due diligence. Like don’t just come in and immediately start saying, hey, I found this thing.
And obviously, everybody is, everybody’s wrong and I’m right. It’s more like, well, I look through the documentation, I look to see if there was any open issues about a thing, I didn’t see it, I opened up an issue, right? And then when it comes to the open source community generally, or just cybersecurity community in general, just, I think the big thing is ask questions, introduce yourself. Folks wanna help, right? Because even if we were all like, I wanna say like, most of us are pretty nice in the community. You know, yes, we can get a little annoyed at things and yada yada, but most of us are pretty nice.
And what I say is even if we weren’t nice, it’s in our best interest to get help here because it’s…there’s so much stuff that needs to get done. And so just come in, introduce yourself and so on. There’s also like, you know, for folks who are, who think that they need lots of expensive training on a lot of this, you know, you don’t, at least especially when you’re starting.
There is a lot of free stuff out there. There’s, for example, the Linux Foundation has a ton of great free resources, like from a training perspective for cybersecurity. But in addition to that there’s also all sorts of other like, you know, charities as well. Like if you’re somebody who is from an underrepresented group or, or struggles financially that, you know, can help get you a leg up as well.
But, in addition to that, think the big thing is it just keeps going back to introduce yourself to the community because we can help point you in the right direction. There’s a lot of folks who will help mentor and help you out in whatever way you need, whether it’s pointing you in the direction of a great training course or helping mentor directly or even just pointing you to here’s a good book you should read that I think helped me out.
CRob (17:42)
That’s awesome advice. Thank you. And finally, do you have a call to action for our listeners, something you’d like to see them do?
Michael Lieberman (17:50)
Sure. First, I’ll talk a little bit more broadly and then I’ll go more specific. But I think more broadly again, especially for folks who are end users who work at end users, like, you know, your, your big banks, I know having worked at big banks for years and years and years, you can feel disincentivized to participate in the open source community. Push for this because as folks who will be listening to this will are inevitably aware, right, banks are using tons of open source.
A lot of the challenges they have is not being able to contribute back, not being able to work with the community to address issues. Push on your organizations to be more involved while highlighting the actual risks there of if we don’t get involved, this costs us more money because there’s a whole community that’s looking to help and help fix this. And so we need to need to be involved to kind of get our voices heard.
And then in addition to that, just generally, right? Like, be more involved in the open source community, be more involved in the security community, especially if you’re a security engineer, it’s much easier to be involved in open source just from like, hey, I created this really cool tool that has this new feature and this new feature could make us all lots of money. You know, security is not often seen as the thing that makes everybody a ton of money. So it can sometimes be like, yeah, yeah, yeah, yeah, we’ll work on that later. No, no. If you don’t take care of security, could potentially lose a lot of money. You could lose customer data. You could ruin your reputation, the reputation of others and cause serious damage. So more involved in the cybersecurity community is super important.
And then a bit more specific, a bit more self-serving, come join the GUAC community. We’re always looking for more contributors. We’re trying to find more end users, you know, one of our big challenges has been, turns out, you know, a lot of enterprises actually do use GUAC or have been making POCs of GUAC, but a lot of those large enterprises don’t come to the community, for example. And we’ll hear through the grapevine, such and such as using GUAC and they’re running into a bug. It’s like, well, we can’t fix it if we don’t know about it. So, so come join, come participate.
And again, as I mentioned earlier, contributions are not purely, like, I wrote, you know, a thousand lines of code for this new feature. It can just be open up an issue, fix a typo in our documentation. It can be helping write notes in the community meetings, right? Anything is helpful and appreciated.
CRob (20:19)
That’s awesome. Thank you very much, Michael. Appreciate your contributions to the community and thank you for joining us today.
Michael Lieberman (20:26)
Yep! Thank you for having me.
Announcer (20:28)
Like what you’re hearing? Be sure to subscribe to “What’s in the SOSS?” on Spotify, Apple Podcasts, AntennaPod, Pocket Casts, or wherever you get your podcasts. There’s a lot going on with the OpenSSF and many ways to stay on top of it all.
Check out the newsletter for open source news, upcoming events and other happenings. Go to openssf.org slash newsletter to subscribe. Connect with us on LinkedIn for the most up to date OpenSSF news and insight. And be a part of the OpenSSF community at openssf.org slash get involved. Thanks for listening, and we’ll talk to you next time on “What’s in the SOSS?”
Welcome to the December 2024 edition of the OpenSSF Newsletter! Here’s a roundup of the latest developments, key events, and upcoming opportunities in the Open Source Security community.
As 2024 comes to a close, we want to take a moment to express our deepest gratitude for the dedication, collaboration, and innovation you have brought to the OpenSSF community this year. Together, we achieved remarkable milestones—from expanding our global membership and launching impactful education initiatives to advancing critical security projects and fostering collaborations with public and private sectors. Your contributions have strengthened our shared mission to secure the open source ecosystem and build a safer, more reliable digital future.
As we look forward to 2025, we’re excited to continue fostering a vibrant and inclusive community, deepening collaborations, and driving meaningful change together. We appreciate your role in this journey.
Wishing you a safe and joyful holiday season!
In December, the Linux Foundation Europe and the OpenSSF hosted the Open Source Software Stewards and Manufacturers Workshop in Amsterdam, focusing on the implications of the EU Cyber Resilience Act (CRA). The event brought together industry leaders, community experts, and government officials to align on CRA obligations and foster collaboration for compliance.
Key outcomes included the formation of the Global Cyber Policy Working Group and three workstreams: CRA Readiness & Awareness, CRA Tooling & Processes, and CRA Standardization.
Details on how to participate and learn more:
Published as Regulation (EU) 2024/2847 in the Official Journal of the European Union, the Cyber Resilience Act (CRA) entered into force (EIF) on December 10, 2024. The CRA will fully apply three years later, on December 11, 2027. The CRA will obligate all products with digital elements, including their remote data processing, put on the European market to follow this regulation. This new blog series will cover the implementation of the CRA and its relevance to open source software.
In Part 1, we will provide a general overview of the CRA and highlight LF Europe and the OpenSSF’s current activities in relation to the implementation.
In Part 1, we provided a general overview of the CRA and highlighted OpenSSF’s current activities related to its implementation. In Part 2, we’ll take a closer look at the three-year implementation timeline and what lies ahead.
The Shaping the Future of Generative AI report, sponsored by LF AI & Data and CNCF, highlights how organizations prioritize security, cost, and performance as they adopt GenAI. Security remains a top concern, particularly in sectors like finance and healthcare, where privacy and regulatory compliance are critical.
The Open Source Security Foundation (OpenSSF) AI/ML Working Group plays a vital role in this landscape, focusing on initiatives like model signing with Sigstore to enhance trust and security in AI systems. This blog ties together insights from the report and OpenSSF’s ongoing efforts to address security challenges in GenAI adoption.
The Linux Foundation and Harvard released Census III, a groundbreaking study analyzing Free and Open Source Software (FOSS) usage and security challenges. Findings reveal trends like the rise of cloud-specific packages, increased reliance on Rust, and the critical role of a small group of contributors.
At the inaugural SOSS Community Day India, OpenSSF welcomed Honda and Guidewire Software as new members, expanding its growing global network to 126 organizations. The event highlights India’s thriving open source ecosystem and brings together leaders to collaborate on securing the software we all depend on.
On November 12, 2024, the software security community gathered in Salt Lake City for SigstoreCon: Supply Chain Day, co-located with KubeCon North America 2024. The one-day conference brought together developers, maintainers, and security experts to explore how Sigstore is transforming software supply chain security through simplified signing and verification of digital artifacts.
You’re invited to…
We want to get you the information you most want to see in your inbox. Have ideas or suggestions for next month’s newsletter about the OpenSSF? Let us know at marketing@openssf.org, and see you in 2025!
Regards,
The OpenSSF Team
In this episode, CRob talks to Tara Tarakiyee, FOSS technologist at the Sovereign Tech Agency, which supports the development, improvement and maintenance of open digital infrastructure. The Sovereign Tech Agency’s goal is to sustainably strengthen the open source ecosystem, focusing on security, resilience, technological diversity and the people behind the code.
Tara Tarakiyee soundbite (00:01)
You can actually hear the relief when we’re talking to maintainers about how can we sort of get this kickstarted? How can we get the ball rolling? Hopefully those maintainers can also show the benefits of investing in security, investing in resilience to people that depend on their software and get them to invest in it as well.
CRob (00:17)
Hello everybody, I’m CRob. I do security stuff on the internet. I’m a community leader and I’m also the chief architect within the Open Source Security Foundation. One of the coolest things I get to do as part of this role is to host “What’s in the SOSS?” podcast, where I talk to interesting people, maintainers, leaders and folks involved with upstream open source security and open source supply chain security.
Today, we have a real treat. We have Tara from the Sovereign Tech Agency, and they are here to talk about the amazing work within the upstream community for the last several years. So maybe could you introduce yourself and explain a little bit about the organization you’re working with?
Tara Tarakiyee (01:00)
Thank you. I work with the Sovereign Tech Agency. We are a GC that’s funded by the German government, specifically through the Ministry of Economy and Climate to essentially strengthen the open source ecosystem, which is our mission. And we do that by investing in the components of our open digital infrastructure that are, I’m sure as you know, like maintained by very few people, but relied upon by millions and millions, what we call the roads and bridges of our digital world.
CRob (01:33)
I like that. That’s nice phrasing. As I mentioned, you all went through a little bit of a rebranding recently. Could you maybe talk about the change for us?
Tara Tarakiyee (01:42)
Yeah. So we had the whole concept that was developed by our co-founders, Fiona Krakenbürger and Adriana Groh to provide like an investment fund to support this critical infrastructure. And that was sort of like our first, let’s say, vehicle of support for projects. But essentially, what we’re trying to do is meet the community where they are, providing what they need. And we know that, sure, investments are good, but support for something as complex as our post-request instruction needs to come in different forms and factors.
So since then, we’ve also introduced two other programs, what was called the Bug Resilience Program, which is now called the Sovereign Tech Resilience, as part of the rebrand, and also our Sovereign Tech Fellowship. We provide services. We work with the vendors in this space who have experience with vulnerability management, with reducing technical debt, with doing code reviews and providing audits, and also with setting up and running bug bounty programs. And we provide those vulnerability management services. to open source projects indirectly. So we pay for it, but the services go to the open source project.
And with the fellowships, we are looking for maintainers who are key people in their communities who support several projects that for them, like, it wouldn’t make sense to apply it through something like the Sovereign Tech Fund. Usually what we do with the Sovereign Tech Fund is these service agreements that are sort of like deliverable based.
With the fellowship, we’re providing like a different way of providing support for maintainers through our fellowship where we support maintainers who are key in their communities by providing either with a board contract or with a six-month fellowship, three-month fellowship.
Those are sort of the sort of a bundle of services that we’re providing and under the banner of the Sovereign Tech Agency. We all have the same mission. We’re still doing the same things. It’s just the name, name change was just to reflect that there’s like a big house now where all these different programs live in.
CRob (03:47)
Makes a lot of sense. Could you maybe just share a little about how the agency kind of executes on this mission? How does someone become aware of these programs and how does someone take advantage of them to participate?
Tara Tarakiyee (03:59)
For the fellowship, we issued a call on our website. Currently, the call is closed for this year as we sort of review through the application that came in. For the Sovereign Tech Fund, we are still accepting ongoing applications on our website. So if you go to sovereign dot tech, you will find our website, and there you can navigate to the apply section where you can learn about our criteria, what we look for in critical infrastructure, open source, and from there it will take you to our application platform.
CRob (04:32)
If one of the programs is open, are there any kind of limits on who can qualify to participate? Does it have to be an EU citizen or can it be anywhere from around the world?
Tara Tarakiyee (04:42)
Anyone in the world can apply as long as you’re maintaining open source critical infrastructure. The way we, it’s hard to define something as open source critical infrastructure, you know? So for us, we take four criteria. So we look at sort of the relevance of your open source project. Is it used in different places, in many places, by many people?
We also look at…sorry, that was prevalence…then relevance, is it used in particular sectors that are particularly important? Like it could be not be used by many people, but if it’s using like the energy sector or aviation or something that’s, like, highly critical, then that’s another factor that of balances that out.
And then we look at vulnerability. So, I mean, it’s not a nice question, but like what would happen if your software component would disappear tomorrow? Would like people panic? Like that’s probably a good sign that it’s infrastructure. But also we balanced the question out also by looking at different aspects of like, why is this not receiving funding?
Because I think that’s a fundamental thing for us. Like we exist to support infrastructure because in general, like those are things that are hard to fund. It’s something, it’s a resource that everyone depends upon, but very few people contribute to. And that’s, that’s sort of like our niche. So that’s also something we look at in vulnerability.
And finally, we do an evaluation, like, is this a software that’s in the public interest? So is it being used in applications where it’s generally good for society? So, based on our evaluation of these four criteria and also look at the activities, like is it more maintenance activities or generally like you want to develop new features? Would you occasionally fund or invest in new features? But that’s only when there’s like a strong sort of public interest argument for it and no one else would fund it. In general, we mostly focus on improving the maintainability and security of those critical software components.
CRob (06:35)
Thinking back, you all have been operating, whether it’s the fund or the agency, for a little over two years. And thinking back over that, are there any particularly interesting success stories or where you felt that the fund or the agency made a real difference?
Tara Tarakiyee (06:51)
I mean, it’s generally nice just to hear the feedback from the different projects. It’s hard for me to name, like, one particular example or pick a favorite. In general, think like, when I look back and see like projects where they struggled for a long time to get the people that depend on them interested in security. Even though, like, it’s a critical dependency for, like, many companies and stuff, but nobody wants to fund like a security team.
People would rather fund new features and, which just like sort of exacerbates the problem. Like it just creates more pressure on the maintainer and creates more technical debt and more potential for things to go wrong. You can actually hear the relief when we’re talking to maintainers about, yeah, like we’re interested in your security plans. Like how can you sort of get this kickstarted? How can we get maybe those other people also interested? Cause again, like it’s such a big lift sometimes and with some software that we can’t do it all on our own.
So we try getting the ball rolling and then hopefully those maintainers can also show the benefits of investing in security, investing in resilience to the people that depend on their software and get them to invest in it as well. I’m also very proud of our investments in, for example, Fortran, where it’s a technology that’s still very important. Like people hear about it and think like, remember it like maybe from their university days or reading about it on Wikipedia, but it’s still there. It’s still lots of code written in it.
I think Fortran developers deserve the ammenities that modern day developers have, like a good package manager having the developer tooling. So I was very proud of our investment there because, again, like, also considering the state of the world right now, Fortran is very vital in climate modeling and us understanding the world around us. So it’s a very critical time for investment in such technology.
CRob (08:50)
Excellent. Yeah, the older languages deserve the same love that the newer ones do. I totally agree. Getting out your crystal ball, it’s towards the end of 2024 here. What’s in the future for the Sovereign Tech Agency in your programs for next year? Any big plans or anything you’re very excited about to get to work on next year?
Tara Tarakiyee (09:09)
So for work, we learned a lot from the past two years. So I think now it’s time for us to also start exploring ways of bringing in more people into the field of open source. I think, like, a common concern is looking at open source technology, like, there are very few maintainers and not so many are able to come in. Like there’s a high barrier for entry. So maybe I think looking at ways of opening up the field and getting more people, because I mean, the door is open, but that doesn’t mean that people automatically come in. Like, people need help to be able to get into open source.
And also we work with some very complicated projects because their infrastructure, because they’re written in sometimes like high-performance languages that are harder to get into. So I don’t want to compare, but like it’s not maybe as easy as, like, web development where sometimes the languages are a bit more accessible and there are already like a plethora of resources existing to help people get into them.
So I think just getting more people through the door, getting more, let’s say communities that don’t have access to the resources to become open source developers, helping get to the door, get them to becoming the maintainers of the future, I would say, is, would be something I would be very interested in working on or a problem to tackle.
With open source, it’s important to consider that interoperability needs standards because that’s how you create sort of like a healthy technology ecosystem. Because you don’t want like sort of a monoculture where like one software becomes a dominant thing and then that just creates lots of issues. So you want to have a variety of implementations around the standard to solve a particular problem. That just creates healthier software.
I think exploring how maintainers interact with standards bodies that exist. Also, you have increasing regulation and standardization coming from governments. And finally, I think there are some not official standard bodies, but bodies that help certain technologies communities or programming languages sort of improve their work that the maintainers know about these, but most people don’t. And I think getting more involved in sort of supporting the work that happens there to create better specifications, move technologies forward and get more maintainers involved in the conversations about the technologies that they’re developing at standard bodies will be another area of interest for us.
CRob (11:42)
Very nice. Yeah, that’s an interesting vision. A docket of things that I think we’ll probably be working on together next year. Well, let’s move on to the rapid-fire part of the interview.
(Musical sound effect: Rapid fire, rapid fire!)
All right, I have a couple quick questions. I want you to just answer right off the top of your head. Spicy or mild food?
Tara Tarakiyee: (12:06)
Spicy, but I have a limit.
(Sound effect: Ooh, that’s spicy!)
CRob (12:12)
Excellent. From your perspective, what’s your favorite open source mascot?
Tara Tarakiyee (12:17)
Oh, I mean, have to give it to Penguin, like Linux Penguin.
CRob (12:22)
Tux! Very nice!
Tara Tarakiyee (12:24)
I do sometimes get jealous of the FreeBSD devil, because it’s slightly cooler.
CRob (12:28)
Absolutely! Thinking back on your career with interacting with open source, what was your first open source project you remember using?
Tara Tarakiyee (12:37)
I mean, the first one I actively used knowing it was open source was Firefox. I wa a big part of the Firefox community early on in university. So I think how I got my start into open source advocacy was by organizing. I think, back then we were throwing these Firefox launch parties in Jordan. And from there, I got into Linux.
CRob (13:02)
That’s awesome. Well, thank you for sharing. As we wind down, do you have any advice that you would want to share to either someone entering the open source development or security field or is currently a maintainer?
Tara Tarakiyee (13:15)
I think it’s important for people to start listening more to maintainers. From my experience, like for the past two years working with maintainers, they know what they want, know where the problems are. There are people who really care about all these critical pieces of infrastructure that we depend upon, and they do have a good sense of what the problems are.
It’s just that I think not that many people listen to them that someone who really cares about software development in a way that’s… I compare it a bit to being an artisan where it’s more about the craft of the software and you just want to create the best software ever and sometimes occasionally they create things that are very important and used in many places. Sometimes not accidentally, sometimes intentionally as well and then, yeah, when it gets to that scale.
I think my advice is also don’t be afraid to say you need help. I think many maintainers feel like they need to do it on their own or think that people don’t care about their issues, but there are people out there who care about giving the adequate support to maintainers and creating communities of care for them. Definitely don’t be afraid. My advice for maintainers is don’t be afraid to ask for help and people do care about the work that you do. And my advice for others is please listen to maintainers. They know what they’re doing.
CRob (14:42)
Excellent. That’s excellent advice. Thank you. And finally, do you have a call to action, whether it’s kind of personal, like you just mentioned about for maintainers or contributors, or kind of around the Sovereign Tech Agency?
Tara Tarakiyee (14:55)
We do see the significant need or the significant under supply of what level of resources we need to put into our digital infrastructure. And there’s a huge gap between how many resources we’re putting in right now compared to what’s actually needed to create like a healthy, vibrant system.
Like, we’re still far off at the moment that, and I don’t think that many people realize that. So my call to action would be, let’s take this problem more seriously. Let’s invest like real resources, solving, like, the very real problems. We can’t wait til the next Log4j to happen and then say, oh my God, this could have been avoided.
I’m sort of also…maybe because like I’ve been working, doing this work for like 15 years now, tired of like that cyclical nature of like something big happens, people start caring. And then two years later, things revert back. Yeah, let’s, let’s try to break that cycle a little and put, like, significant investment that’s more long-term into creating maintainable, like sustainable support systems for our open source infrastructure.
CRob (16:00)
Excellent. Thank you. I appreciate you coming in to share your wisdom and your experiences through the Sovereign Tech Agency. I wish you a great day.
Announcer (16:09)
Like what you’re hearing? Be sure to subscribe to “What’s in the SOSS?” on Spotify, Apple Podcasts, AntennaPod, Pocket Casts or wherever you get your podcasts. There’s a lot going on with the OpenSSF and many ways to stay on top of it all. Check out the newsletter for open source news, upcoming events and other happenings. Go to openssf.org slash newsletter to subscribe. Connect with us on LinkedIn for the most up-to-date OpenSSF news and insight and be a part of the OpenSSF community at openssf.org slash get involved. Thanks for listening, and we’ll talk to you next time on What’s in the SOSS?
Growing Member Base and Launch of SOSS Community Day India Continue to Advance Open Source Software Security
Delhi, India – December 10, 2024 – The Open Source Security Foundation (OpenSSF), a global cross-industry initiative of the Linux Foundation, helps individuals and organizations build secure software by providing guidance, tools, and best practices applicable to all software development. Today, the OpenSSF announced new members from the automotive and insurance technology industries at the first-of-its-kind Secure Open Source Software (SOSS) Community Day India. SOSS Community Day India brings together community members from across the security and open source ecosystem to share ideas and advance solutions for sustainably securing the software we all depend on, building a foundation for a more secure and innovative future.
New general member commitments come from Honda Motor Co., Ltd. and Guidewire Software, Inc. With support from these new organizations, the OpenSSF heads into the last month of 2024 with 126 members that together recognize the importance of backing, maintaining, and promoting secure open source software.
“We are excited to welcome our newest members and celebrate this milestone with the launch of the first SOSS Community Day in India,” said Arun Gupta, Vice President and General Manager of Developer Programs at Intel and OpenSSF Governing Board Chair. “India has an incredible open source ecosystem, and this event provides an opportunity to foster collaboration, address shared challenges, and ensure the security of the open source software powering the digital world. Together, we’re building a more secure and innovative future.”
SOSS Community Day India features a packed agenda with sessions led by top experts on topics like education, innovation, tooling, vulnerabilities, and threats. The event not only highlights the OpenSSF community’s ongoing work, but also provides an avenue to expand its reach through new partnerships and memberships, welcoming inquiries from potential collaborators. Participants will see how the OpenSSF community is driving improvements in open source software security and advancing its mission to create a more secure ecosystem for everyone.
“Honda is pleased to be able to participate in the OpenSSF project as OSS security becomes increasingly important. In addition to contributing to the OpenSSF community, we look forward to working to strengthen OSS security across the industry in the future.” Yuichi Kusakabe, Chief Architect – IVI software PF/OSPO Tech Lead, Honda Motor Co., Ltd.
“We’re excited to become a member of OpenSSF,” said Anoop Gopalakrishnan, vice president, Engineering, Guidewire. “This partnership reflects our continued commitment to advancing open source security and collaborating with like-minded innovators to create a more secure and resilient software ecosystem.”
###
About the OpenSSF
The Open Source Security Foundation (OpenSSF) is a cross-industry initiative by the Linux Foundation that brings together the industry’s most important open source security initiatives and the individuals and companies that support them. The OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all. For more information, please visit us at openssf.org.
About the Linux Foundation
The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects are critical to the world’s infrastructure, including Linux, Kubernetes, Node.js, ONAP, OpenChain, OpenSSF, PyTorch, RISC-V, SPDX, Zephyr, and more. The Linux Foundation focuses on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org
The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see its trademark usage page: www.linuxfoundation.org/trademark-usage. Linux is a registered trademark of Linus Torvalds.
Media Contact
Jennifer Tanner
Look Left Marketing
openssf@lookleftmarketing.com
Welcome to the November 2024 edition of the OpenSSF Newsletter! Here’s a roundup of the latest developments, key events, and upcoming opportunities in the Open Source Security community.
Catch up on the highlights from SOSS Fusion 2024, The Conference for Secure Open Source Software with the full YouTube playlist. Explore keynotes, technical sessions, and workshops from industry leaders like Dan Lorenc and Cory Doctorow. Discover actionable insights and tools to secure open source software.
📺 Watch now: SOSS Fusion 2024 YouTube Playlist
Join us for an insightful webinar, Policy, Security, and the Software Supply Chain, featuring security expert Abhisek Datta on November 27 from 2:00 PM – 3:00 PM. This event is hosted in the lead-up to SOSS Community Day, India, co-located with KubeCon + CloudNativeCon India 2024.
Mark your calendars and register today!
Hosted by the OpenSSF, this event will bring together open source security enthusiasts to connect, collaborate, and share knowledge. Whether you’re an industry leader or a passionate technologist, this is your opportunity to dive deep into the latest open source security trends, learn from experts, and network with the vibrant open source community. Don’t miss out—register today and be part of the conversation on securing open source software!
We are excited to invite proposals for the 2025 Virtual Tech Talk Series, providing a platform for in-depth discussions on critical initiatives to secure open source software within the OpenSSF community. These tech talks are designed to foster knowledge sharing, highlight innovative technical projects, and showcase efforts driving the future of open source security.
Have a topic or expertise you’d like to share? Submit your Call for Proposals (CFP) by December 13, 2024, to ensure ample time for review and planning. This is your chance to contribute, connect with peers, and inspire others in the field.
Kusari has tackled software supply chain challenges like transparency and inefficiencies by integrating OpenSSF tools such as AllStar, Scorecard, and GUAC, while adopting open standards like SLSA and OpenVEX. These solutions have enhanced their ability to manage risks and contribute actively to the OpenSSF community.
“Participating in open source communities allows us to shape the future of software supply chain technology,” says Parth Patel, Kusari’s Co-founder.
➡️ Read more about Kusari’s journey and the tools they use.
This year, the focus was on collective action across sectors to enhance cybersecurity resilience. Organizations prioritized OSS governance, developers adopted secure coding practices, and academic institutions prepared the next generation of professionals—all contributing to safer digital ecosystems.
OpenSSF supported these efforts with resources like Developing Secure Software (LFD121) and events like SOSS Fusion, which fostered collaboration and knowledge sharing.
➡️ Read more about how we worked together to stay secure and informed.
Minder, contributed by Stacklok, simplifies the integration and use of open source security tools through a policy-based approach that spans the entire software development lifecycle. With features like noise reduction, auto-remediation, and integration with OpenSSF tools such as Sigstore, Minder empowers organizations to strengthen their security posture.
➡️ Explore Minder and see how it enhances open source security.
The Open Source Security Foundation (OpenSSF) has enhanced its free “Developing Secure Software” course (LFD121) with hands-on labs and interactive activities. These new features provide developers with practical techniques to counter modern cyberattacks, improving engagement and knowledge retention.
With over 25,000 enrollments globally, this course offers a comprehensive learning experience covering secure design principles, implementation, and verification techniques. Developers can earn a completion certificate and access optional browser-based labs for an immersive learning experience.
➡️ Enroll in LFD121 and start building secure software today!
At SOSS Community Day Japan, OpenSSF celebrated its growing community with the addition of new members, including Arm, embraceable AI, Fujitsu, Ruby Central, and Trifecta Tech, furthering its mission to secure open source software.
In a recent press release, OpenSSF also announced new initiatives: Minder, a sandbox project simplifying security tool integration; bomctl, enhancing SBOM management; and Zarf, enabling secure software delivery in air-gapped environments.
➡️ Read more about our new members and initiatives.
Red Hat has partnered with OpenSSF and Google’s OSV.dev to make its security data available in the OSV format. This enhances transparency, accessibility, and integration with tools like OSV-Scanner, supporting better vulnerability management.
➡️ Learn more about this collaboration.
AI models bring transformative potential but also risks like deepfakes, bias, and misuse. Drawing from open source principles, we can address these challenges by fostering collaboration across industry, academia, and government, securing the AI supply chain, and building “secure by default” models.
OpenSSF’s work with agencies like CISA offers a roadmap for leveraging open source security principles to improve the safety and reliability of open foundation models.
➡️ Read how open source lessons can shape a secure AI future.
The Open Source Security Foundation’s (OpenSSF) logo features “Honk,” an armored goose holding a shield, embodying the foundation’s mission to protect open source software. Representing adaptability, resilience, and teamwork, Honk symbolizes the innovative approaches OpenSSF employs to enhance security in the open source ecosystem.
Discover the story behind Honk and how OpenSSF champions collaboration and defense in open source security.
➡️ Learn more about Honk and join the mission.
You’re invited to…
We want to get you the information you most want to see in your inbox. Have ideas or suggestions for next month’s newsletter about the OpenSSF? Let us know at marketing@openssf.org, and see you next month!
Regards,
The OpenSSF Team
Growing Member Base and New Initiatives Continue to Advance Open Source Software Security
TOKYO, JAPAN – October 30, 2024 – The Open Source Security Foundation (OpenSSF), a global cross-industry initiative of the Linux Foundation that focuses on sustainably securing open source software (OSS), is excited to announce new members from leading technology, security, and research firms. The OpenSSF is also thrilled to host Secure Open Source Software (SOSS) Community Day at Open Source Summit Japan 2024, bringing together community members, maintainers, and contributors from across the globe.
New general member commitments from Arm, embraceable AI and Fujitsu along with new associate member commitments from Ruby Central and Trifecta Tech further strengthen the support for open source software security. With backing from these new organizations, the OpenSSF heads into the final quarter of 2024 with a robust member base dedicated to promoting a strong, vibrant, and secure open source software ecosystem.
“The addition of our newest members to the OpenSSF highlights the growing global commitment to strengthening open source software security,” said Arun Gupta, Vice President and General Manager, Developer Programs at Intel and OpenSSF Governing Board Chair. “By joining forces, we can address security challenges, foster innovative solutions, and build a safer digital future for everyone. With the support of these new members, we are further enabled to drive forward our shared mission.”
To celebrate its growing community, the OpenSSF is hosting SOSS Community Day Japan at Open Source Summit Japan 2024. SOSS Community Day Japan is an opportunity for community members from across the open source security ecosystem to come together and share ideas. With an agenda packed with sessions led by industry experts, the event will cover critical topics like education, innovation, tooling, vulnerabilities, and threats, showcasing the ongoing efforts of the OpenSSF community to enhance open source software security.
“At Arm, we recognize that collaboration is key to advancing the security of the global software ecosystem. By joining OpenSSF, we look forward to contributing to its mission of raising the bar on open source software security and underscoring our dedication to fostering standardization across the industry to give developers the confidence and tools they need to innovate.”
— Andrew Wafaa, Senior Director and Fellow, Software Communities, Arm
“Security in the realm of AI is not just a feature; it’s the foundation of trust. As we empower enterprises with intelligent services, we prioritize safeguarding data and ensuring privacy, so our clients can innovate fearlessly.”
— Dr.-Ing. Christian Gilcher, General Manager, embraceable AI
“Fujitsu is proud to have achieved conformance with OpenChain ISO/IEC 18974, demonstrating our commitment to open source compliance and excellence. Our next step is to join the OpenSSF. We take our dedication a step further to enhance the security and trustworthiness of the global software supply chain. Open source software is a key driver of innovation, and we look forward to collaborating with the OpenSSF community to ensure the resilience and transparency of the technologies shaping our future.”
— Teppei Asaba, Senior Director, Mission Critical System Business Unit, Fujitsu Limited
“Joining OpenSSF aligns perfectly with Ruby Central’s commitment to advancing the security of open source ecosystems. By collaborating with OpenSSF and its community of forward-thinking organizations, we’re excited to bring our expertise from the Ruby ecosystem and work together on solutions that enhance the security and sustainability of open source software for all developers.”
— Marty Haught, Interim Open Source Lead, Ruby Central
“We are excited to join the OpenSSF as an associate member as we continue to actively contribute to the security of the open source software we all rely on. Trifecta Tech Foundation is a non-profit working on safer software for the underlying infrastructure of the Internet and vital systems for water, energy, and communication. We develop and maintain open source software and contribute to open standards for these essential systems. Our projects include memory-safe alternatives to critical pieces of software like sudo, the Network Time Protocol, and zlib.”
— Erik Jonkers, Chair, Trifecta Tech Foundation
In addition to welcoming new members, OpenSSF is excited to announce several new initiatives aimed at bolstering open source software security.
Minder: contributed by Stacklok, is now a sandbox project within OpenSSF. Minder simplifies the integration and use of powerful security tools like OSV, OpenSSF Scorecard, and Sigstore, allowing developers and security teams to establish policies on code repositories and dependencies, reducing risk before and after code is merged.
bomctl: A format-agnostic Software Bill of Materials (SBOM) tooling project introduced in September 2024, aimed at enhancing SBOM generation and management across various formats.
Zarf: created by Defense Unicorns, launched in July 2024, Zarf is a free, open source tool enabling continuous software delivery on systems disconnected from the internet, facilitating secure software distribution in air-gapped environments.
These new initiatives demonstrate the OpenSSF’s continued dedication to fostering innovation and providing tools to enhance open source software security across diverse use cases.
###
About the OpenSSF
The Open Source Security Foundation (OpenSSF) is a cross-industry initiative by the Linux Foundation that brings together the industry’s most important open source security initiatives and the individuals and companies that support them. The OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all. For more information, please visit openssf.org.
About the Linux Foundation
The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects are critical to the world’s infrastructure, including Linux, Kubernetes, Node.js, ONAP, OpenChain, OpenSSF, PyTorch, RISC-V, SPDX, Zephyr, and more. The Linux Foundation focuses on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit linuxfoundation.org.
The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see its trademark usage page. Linux is a registered trademark of Linus Torvalds.
Media Contact
Jennifer Tanner
Look Left Marketing
openssf@lookleftmarketing.com
For many years, the software supply chain has suffered from a lack of transparency and inefficient, unsustainable security management methods such as spreadsheets, emails, and word of mouth. The severity of these challenges was highlighted during incidents like Log4Shell, where the limitations of these approaches became evident — organizations struggled to identify where Log4J was used, and many applications continue to use vulnerable versions of this library years later. Meanwhile, the costs and regulatory requirements of attacks and vulnerabilities continue to increase. The founders of Kusari, driven by their passion and personal experiences with these problems, sought to create scalable and robust security solutions for their customers and users.
To address these challenges, Kusari created and co-developed the tool GUAC (Graph for Understanding Artifact Composition). GUAC integrates data from various OpenSSF tools and specifications to secure Kusari’s platform software and infrastructure. Kusari uses AllStar to enforce best practices for source code repositories and Scorecard to assess repositories for best practice adherence and highlight areas of concern. By adopting SLSA (Supply Chain Levels for Software Artifacts), Kusari follows Level 3 practices for building projects and generating provenance. OpenVEX is used to communicate the vulnerability status of software, while S2C2F (Supply-Chain Levels for Secure Commercial Facilities) ensures rules are followed for safely ingesting open source software. GUAC aggregates data from multiple sources like Scorecard, SLSA, OpenVEX, SBOM, OSV, and deps.dev to analyze supply chain risks and ensure compliance with S2C2F rules.
According to Parth Patel, Co-founder & Chief Product Officer at Kusari, “Working with OpenSSF projects is an invaluable part of building Kusari – both as a company and an enterprise platform. Participating in open source communities allows us to shape the future of software supply chain technology. The work we invest in OpenSSF communities pays off in having reliable software tools to build and integrate with the security ecosystem.”
The implementation of these tools has significantly enhanced Kusari’s ability to manage and mitigate software supply chain risks. The adoption of open specifications like SLSA, S2C2F, and OpenVEX allows Kusari to generate and consume supply chain data that is broadly supported in the community. Tools like AllStar, Scorecard, and Sigstore help enforce best practices in code, build, and delivery processes. GUAC enables Kusari to ingest and analyze standardized metadata from multiple OpenSSF tools, providing a clear understanding of supply chain risks and facilitating quick responses to security incidents.
Kusari engages with the OpenSSF community in various capacities, including as maintainers and users of AllStar, GUAC, and SLSA, and as TAC sponsors for GitTUF, SBOMit, and S2C2F. This engagement is a way for us to innovate and give back within the open source community. Kusari is committed to helping shape and develop the future of software supply chain security. You can regularly find us in meetings with the Supply Chain Integrity Working Group; come join in.
Open specifications and tools provide flexibility for integration and modification, ensuring better interoperability. Security has a long history of being closed and vendor-centric, but that’s changing. Collaboration is required to protect effectively against current and future threats. That’s why Kusari is passionate about being a creator, maintainer, contributor and user of open source security tools.
Striking a balance between vendor support and community-driven efforts is crucial for sustainable success in open source projects. Arun Gupta, vice president and general manager of Open Ecosystem Initiatives at Intel and OpenSSF governing board chair emphasizes, “It’s vital that we foster collaboration between vendors and the open source community in a collaborative manner that respects the community. This balance is key to achieving a secure software ecosystem.”
Kusari plans to adopt additional OpenSSF tools such as GitTUF as they mature and looks forward to developments from SBOMit.
Kusari’s integration of OpenSSF tools and specifications has significantly bolstered its software supply chain security, providing scalable and efficient solutions for managing vulnerabilities. Through active participation in the OpenSSF community, Kusari continues to contribute to and benefit from the evolving landscape of open source security.
