#ostif — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #ostif, aggregated by home.social.
-
RE: https://mastodon.social/@FreeBSDFoundation/116676767603367392
2026 Open Source Security and Risk Analysis Report – Software Governance in the AI Era – Black Duck Software, Inc.
https://www.blackduck.com/content/dam/black-duck/en-us/reports/rep-ossra.pdf
― a direct link to the freely-available report that's mentioned in the joint statement from Apereo Foundation, Open Source Initiative (OSI), Open Source Technology Improvement Fund (OSTIF), and FreeBSD Foundation.
"The “Open Source Security and Risk Analysis” (OSSRA) report has been the industry’s definitive look at the state of open source code for a decade. Each year, we analyze anonymized findings from commercial codebases audited by the Black Duck Audit Services team, and this provides an unmatched, real-world view of how open source is used—and sometimes misused—across every major industry. This year’s findings document a pivotal moment: The explosion of AI-assisted development has fundamentally altered the risk landscape for software and the baseline for compliance with new regulatory initiatives such as the EU Cyber Resilience Act (CRA) and the Digital Operational Resilience Act (DORA). …"
-
RE: https://mastodon.social/@FreeBSDFoundation/116676767603367392
2026 Open Source Security and Risk Analysis Report – Software Governance in the AI Era – Black Duck Software, Inc.
https://www.blackduck.com/content/dam/black-duck/en-us/reports/rep-ossra.pdf
― a direct link to the freely-available report that's mentioned in the joint statement from Apereo Foundation, Open Source Initiative (OSI), Open Source Technology Improvement Fund (OSTIF), and FreeBSD Foundation.
"The “Open Source Security and Risk Analysis” (OSSRA) report has been the industry’s definitive look at the state of open source code for a decade. Each year, we analyze anonymized findings from commercial codebases audited by the Black Duck Audit Services team, and this provides an unmatched, real-world view of how open source is used—and sometimes misused—across every major industry. This year’s findings document a pivotal moment: The explosion of AI-assisted development has fundamentally altered the risk landscape for software and the baseline for compliance with new regulatory initiatives such as the EU Cyber Resilience Act (CRA) and the Digital Operational Resilience Act (DORA). …"
-
@cybervegan in fairness to the four signatories, the statement is suitably:
― terse
― professional
― non-aggressive.I'm not the target audience, but I can see how the statement might grab the attention of individuals and groups who are targeted.
There is, amongst other things, an element of https://xkcd.com/2347/ (xkcd: Dependency) – without explicitly stating "Don't fuck this up.".
-
@cybervegan in fairness to the four signatories, the statement is suitably:
― terse
― professional
― non-aggressive.I'm not the target audience, but I can see how the statement might grab the attention of individuals and groups who are targeted.
There is, amongst other things, an element of https://xkcd.com/2347/ (xkcd: Dependency) – without explicitly stating "Don't fuck this up.".
-
#AWS Teams with #OSTIF on #OpenSource #Security Audits
"Last year, AWS committed to investing $10 million over three years alongside the Open Source Security Foundation (OpenSSF) to fund supply chain security. AWS will be directly funding $500,000 to OSTIF as a portion of our ongoing initiative with OpenSSF."
https://aws.amazon.com/blogs/opensource/aws-teams-with-ostif-on-open-source-security-audits/
-
#AWS Teams with #OSTIF on #OpenSource #Security Audits
"Last year, AWS committed to investing $10 million over three years alongside the Open Source Security Foundation (OpenSSF) to fund supply chain security. AWS will be directly funding $500,000 to OSTIF as a portion of our ongoing initiative with OpenSSF."
https://aws.amazon.com/blogs/opensource/aws-teams-with-ostif-on-open-source-security-audits/
-
The OSTIF-sponsored git source code audit by X41+Gitlab is refreshingly brief without losing necessary technical detail. It's also quite aesthetically pleasing, which I've found helpful with my ADHD attention span.
I'm inspired. What are your favorite reports and whitepapers? I'll take both eloquent and eye-catching.
-
#Git patched two critical severity security #vulnerabilities that could allow attackers to execute arbitrary code (#RCE) after exploiting heap-based #bufferoverflow weakness. X41 & GitLab found the vulnerabilities as part of an audit sponsored by #OSTIF
https://bit.ly/3Xoalrc -
#Git patched two critical severity security #vulnerabilities that could allow attackers to execute arbitrary code (#RCE) after exploiting heap-based #bufferoverflow weakness. X41 & GitLab found the vulnerabilities as part of an audit sponsored by #OSTIF
https://bit.ly/3Xoalrc
