OpenSSF Blog

Maybe this should link to https://openssf.org or the press release (https://openssf.org/press-release/2020/08/03/technology-and-enterprise-leaders-combine-efforts-to-improve-open-source-security/) rather than to the GitHub project?

Highlights from the FAQ:

> OpenSSF is focused on improving the security of open source software (OSS) by building a broader community with targeted initiatives and best practices. It will start with a focus on metrics, tooling, best practices, developer identity validation and vulnerability disclosures best practices.

> OpenSSF will be supported by Linux Foundation membership dues with targeted organization contributions to support initiatives

> The founding members are GitHub, Google, IBM, JPMorgan Chase, Microsoft, NCC Group, OWASP Foundation and Red Hat, among others.

I work at Microsoft and lead one of the OpenSSF working groups (https://github.com/ossf/wg-identifying-security-threats). We're always looking for folks to join the conversation and contribute to any working groups. There is a public calendar for those meetings, and there is a recording of our last town hall at https://openssf.org under the Community menu at the top.

I'm also looking to hire a software/security engineer to join our team at Microsoft, to improve security tooling and analysis around open source. This work will align/contribute to OpenSSF projects. If you like having one foot in software development and the other in security, please take a look: https://careers.microsoft.com/us/en/job/1009857

Is it really that low an impact? A lot of the work performed in CI is duplicated (`apt update && apt install texlive-full` f.ex.), and thus there'd be a benefit to running it less often.

Consider also https://openssf.org/blog/2025/09/23/open-infrastructure-is-not-free-a-joint-statement-on-sustainable-stewardship/ :

> Automated CI systems, large-scale dependency scanners, and ephemeral container builds, which are often operated by companies, place enormous strain on infrastructure. > These commercial-scale workloads often run without caching, throttling, or even awareness of the strain they impose.

...which implies that the load isn't negligible.

https://news.ycombinator.com/item?id=32956218#32957137

> FWIW, while this specific act may not be enforcing significant regulation, software developers need to understand that there's a ticking clock.

There are several initiatives from LF's OpenSSF and startup Chainguard.

Sept 2022, "Concise Guide for Evaluating Open-Source Software",
https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/Concise-Guide-for-Evaluating-Open-Source-Software.md#readme

Sept 2022, "Show off your Security Score: Announcing Scorecards Badges", https://openssf.org/blog/2022/09/08/show-off-your-security-score-announcing-scorecards-badges/

If you're interested in learning how to develop secure software, I recommend checking out the free set of 3 courses from the Open Source Security Foundation (OpenSSF) on "Secure Software Development Fundamentals": https://openssf.org/training/courses/

They're hosted on edX. Like many edX courses, if you want to prove you learned the material you can pay to try to pass various tests and get a certificate, but you do not need to pay if you just want to learn the material.

Full disclosure: I'm the author. But hopefully you'll like it anyway :-).

If you go to the full members page[1], you will notice that the major Linux distributions are represented: SuSE, Canonical, and Red Hat. It's certainly a corporate interest group, but it would be incorrect to say that large open source projects are not represented.

Edit: it should also go without saying that Google et al. are already responsible for a significant portion of the open source ecosystem. For better or worse.

FD: My employer is a (much, much smaller) member of the OpenSSF.

[1]: https://openssf.org/about/members/