Ubuntu 20.04 LTS Moves Ahead With Python 2 Removal - But Sticks Around For Derivatives
Google Cloud Rolls Out "N2D" VMs Built Atop AMD EPYC 7002 "Rome" CPUs
Linux Looking To Sunset The Calxeda ARM Server Support
Phoronix Test Suite 9.4 M3 Released With More Improvements For Benchmark Result Analysis
Linux-driven i.MX8M Nano module is smallest yet - LinuxGizmos.com
Linux-driven i.MX8M Nano module is smallest yet - LinuxGizmos.com
Firefox 73.0.1 Released With Fixes for Linux, Windows Crashes - BleepingComputer
The Linux Foundation and Harvard’s Lab for Innovation Science Release Census for Open Source Software Security
New analysis identifies most widely used software and uncovers critical questions for the future of securing one of the world’s greatest shared resources
SAN FRANCISCO, Calif., February 18, 2020 – The Linux Foundation’s Core Infrastructure Initiative (CII), a project that helps support best practices and the security of critical open source software projects, and the Laboratory for Innovation Science at Harvard (LISH), today announced the release of ‘Vulnerabilities in the Core,’ a Preliminary Report and Census II of Open Source Software.`
This Census II analysis and report represent important steps towards understanding and addressing structural and security complexities in the modern day supply chain where open source is pervasive, but not always understood. Census II identifies the most commonly used free and open source software (FOSS) components in production applications and begins to examine them for potential vulnerabilities, which can inform actions to sustain the long-term security and health of FOSS. Census I (2015) identified which software packages in the Debian Linux distribution were the most critical to the kernel’s operation and security.
“The Census II report addresses some of the most important questions facing us as we try to understand the complexity and interdependence among open source software packages and components in the global supply chain,” said Jim Zemlin, executive director at the Linux Foundation. “The report begins to give us an inventory of the most important shared software and potential vulnerabilities and is the first step to understand more about these projects so that we can create tools and standards that results in trust and transparency in software.”
Working in collaboration with Software Composition Analysis (SCAs) and application security companies, including developer-first security company Snyk and Synopsys Cybersecurity Research Center (CyRC), the Linux Foundation and Harvard were able to combine private usage data with publicly available datasets and develop a methodology for identifying more than 200 of the most used open source software projects, 20 of which are detailed in the findings. For the detailed methodology and list, including elaboration on each project, please read the report.
“FOSS was long seen as the domain of hobbyists and tinkerers. However, it has now become an integral component of the modern economy and is a fundamental building block of everyday technologies like smart phones, cars, the Internet of Things, and numerous pieces of critical infrastructure,” said Frank Nagle, a professor at Harvard Business School and co-director of the Census II project. “Understanding which components are most widely used and most vulnerable will allow us to help ensure the continued health of the ecosystem and the digital economy.”
With FOSS constituting 80-90 percent of all software, it is more important than ever that we understand what FOSS is most used and where it could be vulnerable to attack. The increasing importance of this has been underscored with US government agencies pushing for deeper insights into the software building blocks that make up various packages and devices via a software bill of materials (SBOM). For example, in April 2018, the leaders of the US Congress House of Representatives Energy and Commerce Committee sent a letter to the Linux Foundation, acknowledging the critical importance of FOSS and exploring the opportunities and challenges related to FOSS.
The increasing importance of FOSS throughout the economy became critically apparent in 2014 when the Heartbleed security bug in the OpenSSL cryptography library was discovered. By some estimates, the bug impacted nearly 20 percent, or half a million, of secure web servers on the Internet. It was the impetus for the Core Infrastructure Initiative, which has raised millions of dollars for open source security in just the last six years.
“Open source is an undeniable and critical part of today’s economy, providing the underpinnings for most of our global commerce. Hundreds of thousands of open source software packages are in production applications throughout the supply chain, so understanding what we need to be assessing for vulnerabilities is the first step for ensuring long-term security and sustainability of open source software,” said Zemlin.
Partner Quotes
Snyk
“The Snyk security team understands how complex and challenging it is to sustain a database with highly actionable, accurate, and timely vulnerability information,” said Snyk’s Co-founder, Danny Grander, a veteran security researcher who leads Snyk’s security team.
“We’ve worked closely with the Linux Foundation for many years on important research and security initiatives to help mitigate the risk involved in application development. Our team is proud to contribute Snyk’s proprietary, enriched data to the new Census II report, recognizing that industry-wide efforts like this are beneficial to improving the security and viability of open source.”
Synopsys
“Considering the ubiquity of open source software and the essential role it plays in the technology powering our world, it is more important than ever that we take a collaborative approach to maintain the long term health of the most foundational open source components,” said Tim Mackey, principal security strategist for the Synopsys Cybersecurity Research Center. “Identifying the most pervasive FOSS components in commercial software ecosystems, combined with a clear understanding of both their security posture and the communities who maintain them, is a critical first step. Beyond that, commercial organizations can do their part by conducting internal reviews of their open source usage and actively engaging with the appropriate open source communities to ensure the security and longevity of the components they depend on.”
About the Linux Foundation
Founded in 2000, The Linux Foundation is supported by more than 1,000 members and is the world’s leading home for collaboration on open source software, open standards, open data, and open hardware. Linux Foundation’s projects are critical to the world’s infrastructure including Linux, Kubernetes, Node.js, and more. The Linux Foundation’s methodology focuses on leveraging best practices and addressing the needs of contributors, users and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.
About the Laboratory for Innovation Science at Harvard
The Laboratory for Innovation Science at Harvard (LISH) is spurring the development of a science of innovation through a systematic program of solving real-world innovation challenges while simultaneously conducting rigorous scientific research. To date, LISH has worked with key partners in aerospace and healthcare, such as NASA, the Harvard Medical School, the Broad Institute, and the Scripps Research Institute to solve complex problems and develop impactful solutions. More information can be found at https://lish.harvard.edu/
###
The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see its trademark usage page: www.linuxfoundation.org/trademark-usage. Linux is a registered trademark of Linus Torvalds.
Media Contact
Jennifer Cloer
reTHINKit Media
for Linux Foundation
503-867-2304
jennifer@rethinkitmedia.com
The post The Linux Foundation and Harvard’s Lab for Innovation Science Release Census for Open Source Software Security appeared first on The Linux Foundation.
Open Source Software Supply Chain Security
While innumerable strategies, frameworks, and “best practices” guides have emerged, few of which agree and some of which outright contradict each other, general consensus has grown around the need for increased diligence regarding the “software supply chain.”
As cybersecurity incidents have continued to grow in magnitude, frequency, and consequences, both public and private sector attention has turned to questions of what, if anything, organizations may do to better manage the risks of today’s modern, connected world.We explore the security and reliability issues currently affecting the software supply chain, and identify where and how changes may be made to improve it overall.
Download NowThank you for your interest in the Core Infrastructure Initiative’s Census efforts! We are always looking for new partners to join us in our mission to strengthen the security and health of key open source projects. To get more involved, please enter your name and preferred email address, then check any boxes below that apply:
input[type=text] {
width: 100%;
padding: 12px 20px;
margin: 8px 0;
box-sizing: border-box;
border: 1px solid #000;
outline: none;
background-color: #fff;
}
input, select, textarea{
color: #000;
}
textarea:focus, input:focus {
color: #000;
}
input[type=button], input[type=submit], input[type=reset] {
border: none;
color: #fff;
padding: 16px 32px;
text-decoration: none;
margin: 4px 2px;
cursor: pointer;
}
label{
color: #000;
}
textarea {
width: 100%;
height: 150px;
padding: 12px 20px;
box-sizing: border-box;
border: 2px solid #000
border-radius: 4px;
background-color: #000;
resize: none;
}
First Name
Last Name
Email*
GitHub
Please select one of the options below:
I am a part of a company that would like to partner with CII to share data on FOSS usage.
I am a developer that would be interested in participating in the FOSS Contributor survey.
I would like to receive the results and findings of the developer survey when they are available.
I would like to receive the CII Census final report when it is available.
document.getElementById('txtUrl').value = window.location.href;
(function($) {
$("#myform").on("submit", function(e) {
e.preventDefault();
$.ajax({
url: $(this).attr("action"),
type: 'POST',
data: $(this).serialize(),
beforeSend: function() {
$("#myform").toggle();
$("#message").html("Thank you for your submission.");
},
success: function(data) {
$("#message").hide();
msg = $(data).find("p");
$("#response").html(msg);
}
});
});
})(jQuery);
jQuery("#loginbtn").click(function() {
//jQuery("#myform").toggle(); // toggle will show hidden element and vice versa
});
The post Open Source Software Supply Chain Security appeared first on The Linux Foundation.
Improving Trust and Security in Open Source Projects
A proposal to build and operate a program called the Trust and Security Initiative (TSI) and a set of recommendations for other security issues that need investment and help.
If you open the news on any given day and read about the latest data breach, you are reminded that software security is hard.When you take a step back and think about the volume of emerging technology and think about industry trends such as increasing the velocity of software releases and the reuse of code and services, you could be forgiven for holding your hands up and concluding that things are trending in the wrong direction for us to ever have secure software.
Read MoreThank you for your interest in the Core Infrastructure Initiative’s Census efforts! We are always looking for new partners to join us in our mission to strengthen the security and health of key open source projects. To get more involved, please enter your name and preferred email address, then check any boxes below that apply:
input[type=text] {
width: 100%;
padding: 12px 20px;
margin: 8px 0;
box-sizing: border-box;
border: 1px solid #000;
outline: none;
background-color: #fff;
}
input, select, textarea{
color: #000;
}
textarea:focus, input:focus {
color: #000;
}
input[type=button], input[type=submit], input[type=reset] {
border: none;
color: #fff;
padding: 16px 32px;
text-decoration: none;
margin: 4px 2px;
cursor: pointer;
}
label{
color: #000;
}
textarea {
width: 100%;
height: 150px;
padding: 12px 20px;
box-sizing: border-box;
border: 2px solid #000
border-radius: 4px;
background-color: #000;
resize: none;
}
First Name
Last Name
Email*
GitHub
Please select one of the options below:
I am a part of a company that would like to partner with CII to share data on FOSS usage.
I am a developer that would be interested in participating in the FOSS Contributor survey.
I would like to receive the results and findings of the developer survey when they are available.
I would like to receive the CII Census final report when it is available.
document.getElementById('txtUrl').value = window.location.href;
(function($) {
$("#myform").on("submit", function(e) {
e.preventDefault();
$.ajax({
url: $(this).attr("action"),
type: 'POST',
data: $(this).serialize(),
beforeSend: function() {
$("#myform").toggle();
$("#message").html("Thank you for your submission.");
},
success: function(data) {
$("#message").hide();
msg = $(data).find("p");
$("#response").html(msg);
}
});
});
})(jQuery);
jQuery("#loginbtn").click(function() {
//jQuery("#myform").toggle(); // toggle will show hidden element and vice versa
});
The post Improving Trust and Security in Open Source Projects appeared first on The Linux Foundation.