[关注] The Linux Foundation and Open Source Software Security Foundation (OpenSSF) Gather Industry and Government Leaders for Open Source Software Security Summit II

[will-ww]

Linux 基金会和旗下的 OpenSSF 的很多做法非常值得我们参考，构建一个安全的开源生态。

https://www.linuxfoundation.org/press-release/linux-foundation-openssf-gather-industry-government-leaders-open-source-software-security-summit/

The 10-Point Plan Summarized:

1. Security Education Deliver baseline secure software development education and certification to all.
2. Risk Assessment Establish a public, vendor-neutral, objective-metrics-based risk assessment dashboard for the top 10,000 (or more) OSS components.
3. Digital Signatures Accelerate the adoption of digital signatures on software releases.
4. Memory Safety Eliminate root causes of many vulnerabilities through replacement of non-memory-safe languages.
5. Incident Response Establish the OpenSSF Open Source Security Incident Response Team, security experts who can step in to assist open source projects during critical times when responding to a vulnerability.
6. Better Scanning Accelerate discovery of new vulnerabilities by maintainers and experts through advanced security tools and expert guidance.
7. Code Audits Conduct third-party code reviews (and any necessary remediation work) of up to 200 of the most-critical OSS components once per year.
8. Data Sharing Coordinate industry-wide data sharing to improve the research that helps determine the most critical OSS components.
9. SBOMs Everywhere Improve SBOM tooling and training to drive adoption.
10. Improved Supply Chains Enhance the 10 most critical OSS build systems, package managers, and distribution systems with better supply chain security tools and best practices.

[wangleo61]

王老师，这个厉害了 发件人: Will ***@***.***> 发送时间: Monday, May 16, 2022 10:17 AM 收件人: ***@***.***> 抄送: ***@***.***> 主题: [kaiyuanshe/ONES] [关注] The Linux Foundation and Open Source Software Security Foundation (OpenSSF) Gather Industry and Government Leaders for Open Source Software Security Summit II (Discussion #89) Linux 基金会和旗下的 OpenSSF 的很多做法非常值得我们参考，构建一个安全的开源生态。 https://www.linuxfoundation.org/press-release/linux-foundation-openssf-gather-industry-government-leaders-open-source-software-security-summit/ ― Reply to this email directly, view it on GitHub<#89>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AO5RA346S4V7ZXPFXOKQII3VKGV47ANCNFSM5WAAJHQQ>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>