The Linux Foundation launches Project Alpha Omega, a new initiative to harden the security of critical open source applications. It will invest, including Microsoft and Google. The initial investment was estimated at $5 million.
The Linux Foundation takes a proactive approach, which is essentially aimed at preventing security-related bugs from occurring or quickly identifying them. The project will provide technical assistance, use manual code review and any tools to identify critical vulnerabilities. In addition, Alpha Omega will provide mentoring for software maintainers.
The complexity of modern software requires more than just writing core code with security in mind. Security is becoming an integral part of CI/CD pipelines. However, the fundamentals of security are not taught in college or computer science education, and for this reason, the Linux Foundation created the Open Source Security Foundation (OpenSSF) with the goal of educating developers in vulnerability disclosure, security tools, security best practices, identifying security threats to open source projects, protecting critical projects.
This course will enable software developers to build and maintain systems that are much harder to successfully attack, mitigate damage from successful attacks, and accelerate response to latent vulnerabilities.
Alpha Omega will liaise with the maintainers of the selected projects to provide individualized assistance as well as to help implement best practices. But due to the limited allocation of resources, a maximum of a couple of dozen projects will be supported. They will be selected based on the findings of the OpenSSF working group, experts and the OpenSSF criticality score, as well as analysis of the Harvard Census.
In 2021, the Linux Foundation OpenSSF and the Harvard Lab for Innovative Science (LISH) published the results of a survey demonstrating the need for more work on security in open source software, including Linux. At the end of 2020, Google developed a special rating to evaluate open projects in terms of their importance to the industry.
bbabo.Net