Join Us in Adopting the Open Source Consumption Manifesto – Open Source Security Foundation
By Brian Fox (Sonatype, OpenSSF GB), Jeff Wayman (Sonatype), Jonathan Meadows (Chair, OpenSSF End Users WG), Christopher “CRob” Robinson (Chair, OpenSSF TAC) on behalf of the OpenSSF End Users Working Group By adopting a few common principles, software organizations can achieve real, measurable change in the security and health of their software supply chains. You are invited to adopt the new Ope
バグハント入門 (OSS編) - blog of morioka12
1. 始めに こんにちは、morioka12 です。 本稿では、バグハントの入門として、主に Web アプリケーションの OSS に焦点をおき、脆弱性の発見・報告・CVE ID の取得について紹介します。 1. 始めに 免責事項 想定読者 筆者のバックグラウンド 2. CVE とは 3. 探す対象の選び方 OSS Topic (Type) 特定の条件で絞る バグバウンティの OSS 4. 脆弱性の検証方法 アプローチ方法 5. 脆弱性の報告先 6. 報告書の書き方 CVSS CWE 7. 脆弱性発見から CVE ID の取得までの流れ 注意点 8. バグハント前のスキル準備 過去の CVE ID やレポート Web Security の場合 9. その他 その後のチャレンジ バグバウンティ入門 セキュリティエンジニアを目指す就活生の方へ OSS の開発者の方へ 10. 終わりに 免責事項
Open-source software vs. the proposed Cyber Resilience Act
By Maarten Aertsen NLnet Labs is closely following a legislative proposal by the European Commission affecting almost all hardware and software on the European market. The Cyber Resilience Act (CRA) intends to ensure cybersecurity of products with digital elements by laying down requirements and obligations for manufacturers. 🥳update, december 2023: The concerns expressed in this blog have been h
OSSセキュリティのための動員プラン - The Linux Foundation
ソフトウェアのサプライチェーンは複雑であり、物理的なサプライチェーンと同じように混乱や破損の影響を受けやすくなっています。民間部門は、物理インフラストラクチャ（港、送電網、電気通信ネットワークなど）と同様に、標準、共有サービス、およびソリューションを介してソフトウェア サプライチェーンの保護に絶えず投資し、不注意によるエラーと意図的な攻撃の両方のリスクを軽減しています。公的部門もシステムを堅牢にするために役割を果たすことができるし、また果たすべきです。公的部門と民間部門は、これらの脅威に対処する上で、より大きな課題に直面しており、市民とステークホルダー共通のセキュリティと安全性のニーズに応えるために、ともに協力しなければなりません。 本稿では、ソフトウェア サプライチェーンを強化するための3つの基本的な目標に対して、すぐに取り組むことができる10のイニシアチブの包括的なポートフォリオを提案
GitHub - 1Password/1password-teams-open-source: Get a free 1Password Teams membership for your open source project
Create a pull request and fill out the template with the requested details. Requirements To apply, you need to be a core contributor for an active open source project that is at least 30 days old. We’ll also accept applications from the organisers of community meetups and events, as well as some conferences. Projects need to use a standard open source license and must be non-commercial. If your co
GitHub - Open-Source-Security-Coalition/Open-Source-Security-Coalition
The coalition is guided by its seven key values: Openness and Transparency: We commit to encouraging all interested stakeholders to participate in the coalition and its working groups. The coalition’s work will be made publicly available. Maintainers First: We approach the work of contributing to improving the security of open source software with a strong respect for open source maintainers and d
OSV - Open Source Vulnerabilities
AlmaLinux 2722 View AlmaLinux vulnerabilities Alpine 3398 View Alpine vulnerabilities Android 881 View Android vulnerabilities Bitnami 3898 View Bitnami vulnerabilities crates.io 1348 View crates.io vulnerabilities Debian 9859 View Debian vulnerabilities GIT 32996 View GIT vulnerabilities Go 2151 View Go vulnerabilities Linux 13573 View Linux vulnerabilities Maven 4873 View Maven vulnerabilities n
The insider perspective on the event-stream compromise with Dominic Tarr (Changelog Interviews #326)
Adam and Jerod talk with Dominic Tarr, creator of event-stream, the IO library that made recent news as the latest malicious package in the npm registry. event-stream was turned malware, designed to target a very specific development environment and harvest account details and private keys from Bitcoin accounts. They talk through Dominic’s backstory as a prolific contributor to open source, his st
O'Reilly Media - Technology and Business Training
More than 5,000 organizations count on our digital courses and more to help their teams learn the tools and technologies that drive business outcomes. We can help yours too. New AI policy for O’Reilly authors and talent O’Reilly president Laura Baldwin shares the company’s ethical approach to leveraging GenAI tools and ensuring O’Reilly experts are compensated for their work. Read it now It’s time
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Open source: Almost one in five bugs are planted for malicious purposes
Why Open Source Matters - Guix | BitMEX Blog
GitHub - ossf/scorecard: OpenSSF Scorecard - Security health metrics for Open Source
Open-Source-Security-Coalition/publications/threats-risks-mitigations at master · Open-Source-Security-Coalition/Open-Source-Security-Coalition
https://events19.linuxfoundation.org/wp-content/uploads/2018/07/GitHub-Security-Alerts-OSLS-Presentation.pdf
Share and accept documents securely