#openssf — Public Fediverse posts

NVIDIA's #OpenSecureAI Alliance Launches With 35+ Members and Three Notable Absences
The membership is notable as much for who is absent as who signed on: Microsoft, IBM, Cisco, Palantir, Dell Technologies, and HPE are in, while OpenAI, Google, and Anthropic, the three labs most identified with frontier closed models, are not
The alliance is being established with support from the #LinuxFoundation’s #Akrites initiative and the Open Source Security Foundation, or #OpenSSF
https://www.storagereview.com/news/nvidias-open-secure-ai-alliance-launches-with-35-members-and-three-notable-absences

🎉【COSCUP 開源政策軌 議程集錦！】🎉

🔐【開源也有資安責任——企業治理與供應鏈安全專題】🔐

你知道你部署的每一個容器映像檔，平均預裝了多少個你的應用程式根本用不到的套件嗎？你知道歐盟《網路韌性法》（CRA）的漏洞通報義務即將在 2026 年 9 月生效嗎？
開源不是免費的午餐，它帶來自由，也帶來責任。🌐

今年的開源政策軌，我們邀請到多位講者，從 AI 開源生態、電信雲供應鏈安全到企業開源治理框架，一次講清楚：

▸ From Code Contributor to Industry Power – How Open Source Becomes Taiwan’s AI Strategy
👤 Marie Gigarel（英文議程）
▸ Securing the Open Source Telco Cloud: SBOMs, Supply Chains, and Compliance at Scale
👤 Brian Su + Terry Shih（英文議程）
▸ 從 OpenSSF Scorecard 到 S2C2F，企業內部推動開源治理的實戰框架是什麼？
👤 Ryan Hsieh 謝文豪
▸ 開源是免費的嗎？從 CNCF 大使視角看人才、企業、政策三方困境
👤 梯口 tico88612
▸ 以 CRA 為例討論產品資安合規下的開源議題——法規來了，開源人準備好了嗎？
👤 李婉萍
▸ Your Container Images Are a Liability: The Supply Chain Debt Nobody Is Paying Down
👤 Hrittik Roy + Parth Goswami （英文議程）

📅 8/8~8/9（日）10:00 起
📍 研陽大樓 TR209 教室（二樓）
完整議程：https://coscup.org/2026/track/526

🌟 如果你在企業裡推動開源、負責資安合規、或關心 AI 生態系的未來，這天的場次是為你量身打造的！💬🤝

#COSCUP2026 #OCF #OpenSourcePolicy #開源政策 #OpenSource #SBOM #SupplyChainSecurity #CRA #OpenSSF #S2C2F #CNCF #企業開源 #供應鏈安全 #資安合規 #AI #FOSS #FLOSS #開源人年會 #TechEvent #Taiwan

[Перевод] Принципы безопасности для пакетных репозиториев

Безопасность публичных репозиториев и собственных хранилищ артефактов не теряет своей актуальности с возросшим количеством атак на цепочку поставки. Оценивать важно, оценивать нужно. В феврале 2024 года в сообществе Open Source Security Foundation (OSSF) были опубликованы Принципы безопасности пакетных репозиториев, которые не потеряли своей актуальности и сегодня. Команда CodeScoring подготовила перевод и делится с сообществом. Авторы оригинала: Jack Cable (CISA) , Zach Steindler . Предложить улучшения можно в репозитории рабочей группы.

https://habr.com/ru/companies/codescoring/articles/1055254/

#безопасность_репозиториев #пакетные_репозитории #цепочка_поставки_по #open_source_security #openssf #тайпсквоттинг #вредоносные_пакеты #sbom

Just published: #Nvidia is now listed as an official adopter of #openbao an #openssf source fork of #IBM / #HashiCorpVault. It's among signs of growing interest in the project amid mounting global #digitalsovereignty concerns, OpenBao backers say. https://www.techtarget.com/searchitoperations/news/366644831/Nvidia-adopts-OpenBao-open-source-fork-of-HashiCorps-Vault

Open energy models are critical infrastructure — and security matters.
The Openmod Tracker now integrates OpenSSF Scorecards, helping assess security risks across 220+ open energy system modelling tools. You can explore scores for maintenance, CI testing, licensing, and more directly in the dashboard.
When you can see the security holes, you can act on them.

❤️‍🩹 Check your tool’s health: https://openmod-tracker.org
🔗 OpenSSF: https://github.com/ossf/scorecard
#OpenSource #EnergySystemModeling #OpenSSF

For folks who are thinking about locally patching open-source software to fix what they think is a bug (_especially_ if they think it's a security vulnerability), I think that's a path to https://www.xkcd.com/424/

#InfoSec #CVE #OpenSource #Mythos #Glasswing #OpenSSF

The AI Cyber Challenge (AIxCC) results are in and the work continues through new #OpenSSF projects like OSS-CRS and FuzzingBrain.

Read the blog by Helen Woeste (OSTIF):

https://openssf.org/blog/2026/05/12/hack-to-the-future-the-impact-and-legacy-of-the-darpa-aixcc-challenge/

The CPS project has just officially secured the #OpenSSF Gold Badge.

CPS is the first project within the LFN community to hit this milestone. This badge proves that security and quality are baked into the DNA of the project.

Read the full story: https://openssf.org/blog/2026/05/07/the-road-to-gold-how-cps-set-a-new-standard-for-security-and-quality-in-open-source/

In the latest What's in the SOSS?, Sally Cooper sits down with Brandt Keller from Defense Unicorns to talk about Zarf, @CloudNativeFdn-ecosystem #OpenSSF Sandbox Project built to package, transfer, and deploy software in air-gapped environments.

https://openssf.org/podcast/2026/05/05/whats-in-the-soss-podcast-60-s3e12-packaging-transferring-and-deploying-software-in-air-gapped-environments-with-zarf/

@BrideOfLinux I enjoyed your article – thanks. Discovered three months after publication via <https://vermaden.wordpress.com/2026/05/04/valuable-news-2026-05-04/>.

Just one thing:

＂… Isn’t this exactly what the Open Source Security Foundation was established to handle in the wake of OpenSSL’s difficulties?＂

I 'm not certain. The roadmap at <https://openssf.org/about/> begins:

＂The OpenSSF strategy is outlined across three key areas:

We will be a Catalyst for Change, we will Educate and Empower the Modern Developer, and we will be an Ecosystem Leader. …＂

There's much more than a roadmap – and I didn't attempt to digest the charter (it's difficult to read, with the watermark) – it's difficult to tell why the OSSF was established, and so on. I don't doubt that the Foundation does great work, there's just a lot to take in. @openssf

In the case of sudo: I imagine that the media was a catalyst for change. Some time between mid-February and 3rd March, the plea for sponsorship disappeared:

― <https://web.archive.org/web/20260215044031/https://www.millert.dev/>

― <https://web.archive.org/web/20260305141311/https://www.millert.dev/>.

(I recall reading the article in The Register, which was discussed in Reddit <https://old.reddit.com/r/programming/duplicates/1qwsvh9/sudos_maintainer_needs_resources_to_keep_utility/>, and so on.)

Cc @millert @governa

#sudo #OpenSSF

We're still beaming with pride since at #KubeCon + CloudNativeCon Europe in April we were celebrated by the #OpenSSF because we earned all five available badges in the #SecuritySlam: Cleaner, Chronicler, Inspector, Mechanizer, and Defender: https://openssf.org/blog/2026/04/10/security-slam-2026-celebrating-our-security-champions-and-project-milestones/

#OpenSSF warns of hackers impersonating Linux Foundation leaders on Slack, tricking developers into installing malware that can compromise entire systems.

Read: https://hackread.com/openssf-malware-slack-linux-foundation-figures/

#CyberSecurity #Malware #LinuxFoundation #Scam

In our latest OpenSSF Tech Talk, OpenSSF members dismantled the AI "black box."

Read the recap to learn about the SAFE-#MCP threat catalog, how to secure the 3,000+ open source dependencies in the typical AI stack, and more!

https://openssf.org/blog/2026/04/08/openssf-tech-talk-recap-securing-agentic-ai/

#OpenSSF #AgenticAI

The #OpenSSF Ambassador Program is now accepting applications for its first cohort. We are looking for 10-15 advocates to lead local initiatives, mentor developers, and represent the Open Source Security Foundation worldwide.

https://openssf.org/community/openssf-ambassadors/

The #OpenSSF March newsletter is live! Featuring:

- New funding from AWS, Google, Microsoft, and others to secure AI 💰
- Launch of the OpenSSF Ambassador Program
- The new Gemara Model for GRC engineering

Read more: https://openssf.org/newsletter/2026/03/26/openssf-newsletter-march-2026/

Subscribe: https://openssf.org/newsletter/#newsletter

📣 We're launching the OpenSSF Ambassador Program!

Applications are now open on a rolling basis. Help us create a future where software is universally trusted and secure.

Learn more: https://openssf.org/blog/2026/03/23/introducing-the-openssf-ambassador-program/

#OpenSSF

The #OpenSSF Mentorship Program 2026 cycle is here! Whether you're a student looking to learn or a pro ready to lead, join us.

🎧 Inside Scoop: Check out the latest What’s in the SOSS? Podcast to hear how mentees become project maintainers. https://openssf.org/podcast/2026/03/17/whats-in-the-soss-podcast-56-s3e8-empowering-new-maintainers-inside-the-openssf-mentorship-program/

Huge updates in the world of Open Source Security! 🔐

The #OpenSSF February Newsletter is out, and it is packed with resources for developers and security teams.

Stay ahead of the curve and check out the full breakdown here: https://openssf.org/newsletter/2026/02/26/openssf-newsletter-february-2026/

Maintainers: make your project’s security visible.

Start with the #OpenSSF Baseline and earn your badge:

🔗 https://openssf.org/blog/2026/02/25/getting-an-openssf-baseline-badge-with-the-best-practices-badge-system/

Now live: ROI for Open Source Software Contribution

The data is clear:
• 2 to 5x ROI
• Faster security response
• Less technical debt

Read the report: https://openssf.org/resources/roi-for-open-source-software-contribution/

#OpenSSF

AI is reshaping open source software and expanding the attack surface.

Join our Tech Talk on Securing Agentic AI to explore practical approaches to managing risk, trust, and control in AI-driven systems.

Plus, learn how to build your skills with #OpenSSF training.

Register: https://openssf.org/resources/tech-talks/tech-talk-securing-agentic-ai-in-practice-from-openssf-guidance-to-real-world-implementation/

We're participating in the #SecuritySlam, concluding March 20, just in time for (the award ceremony at) #KubeCon: https://securityslam.com/slam26/participating-projects

This is not a traditional hackathon. Rather, "The Slam" has 5 key objectives that center around the Open Source Project Security Baseline which was created by and for maintainers, and distributed by the #OpenSSF: https://securityslam.com/slam26/

To register: https://securityslam.com/slam26/register

Modern compilers offer powerful annotation features that improve memory safety, correctness, diagnostics, and performance, but they’re often underused.

This #OpenSSF's new Compiler Annotations for C & C++ guide explains how to use them effectively.

🔗: https://openssf.org/blog/2026/02/12/fill-out-all-the-margins-%f0%9f%93%96-openssf-releases-compiler-annotations-guide-for-c-and-c/

🔍 VEX promises clarity in vulnerability management, but adoption is still uneven.

This #OpenSSF community paper looks at:
• What’s working (and what isn’t)
• CSAF vs OpenVEX vs SPDX vs CycloneDX
• Tooling gaps, trust, and regulation
...and more.

🔗: https://openssf.org/blog/2026/01/08/signal-in-the-noise-an-industry-wide-perspective-on-the-state-of-vex/