Open Source Security Foundation Joined by Microsoft and Others To Improve Linux Software -- Redmondmag.com

Open Source Security Foundation Joined by Microsoft and Others To Improve Linux Software

By Kurt Mackie
08/04/2020

Microsoft on Monday announced that it has joined the newly created Open Source Security Foundation, along with other industry partners, to improve the security of open source software.

Microsoft is a founding member of the Open Source Security Foundation, along with "GitHub, Google, IBM, JPMC, NCC Group, OWASP Foundation and Red Hat," the announcement added. The JPMorgan Chase banking chain is also listed as a founding member, per the Open Source Security Foundation's FAQ.

The Open Source Security Foundation is "hosted at the Linux Foundation" and brings together various Linux Foundation-initiated efforts. Those efforts include the "Core Infrastructure Initiative (CII)" and the "GitHub-initiated Open Source Security Coalition (OSSC)," among others. The OSSC members are joining the Open Source Security Foundation and the efforts of CII likely will get dissolved into the new foundation, the FAQ explained.

The aim of the new foundation is to "improve the security of open source software by building a broader community, targeted initiatives and best practices," Microsoft indicated. A list of current technical initiative being overseen by the foundation can be found at this GitHub page.

The open source software community has tended to critique proprietary software companies, such as Microsoft, because its code can't be independently checked. However, Microsoft's announcement by Mark Russinovich, Microsoft's chief technology officer, offered an alternative view, namely:

Open source software is ubiquitous, and thereby potentially more subject to frequent attack.
Open source software has no central authority checking software quality.
Open source software can have attackers masquerading as project maintainers.

"Given the complexity and communal nature of open source software, building better security must also be a community-driven process," Russinovich argued in explaining Microsoft's support for the new foundation.

Microsoft had already been working with the OSSC to identify security threats in open source software. It's also worked to speed the software fixing process. Additionally, Microsoft has developed security tools for open source developers, and it currently offers best-practices advice, Russinovich noted.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

Using Configuration Files to Control PowerShell Scripts, Part 2: Building Blocks

Learn how to use PowerShell's GUI capabilities to dynamically create configuration files that enhance script flexibility and usability.
U.S. House Leaders Unveil Bipartisan Strategy for AI Governance and Innovation

On Tuesday, U.S. House Speaker Mike Johnson and Democratic Leader Hakeem Jeffries received the final report from the bipartisan House Task Force on Artificial Intelligence, which outlines essential principles and recommendations to bolster American leadership in AI.
Using Configuration Files to Control PowerShell Scripts, Part 1: The Basics

Learn how to use JSON configuration files to make PowerShell scripts more dynamic, flexible and user-friendly.
Exchange Online Receiving Enhanced Message Trace

Microsoft has announced the public preview of its enhanced Message Trace feature in the Exchange admin center (EAC) for Exchange Online.
Major Microsoft Multifactor Authentication Vulnerability Revealed

A vulnerability in Microsoft’s multifactor authentication (MFA) system has been uncovered by cybersecurity firm Oasis Security, allowing attackers to bypass security measures and access sensitive data across services including Outlook, OneDrive, Teams and Azure.