News
Microsoft, Google and IBM Among First Members of Open Source Security Group
- By Kurt Mackie
- August 04, 2020
Microsoft has joined a high-powered group of tech giants in a new industry foundation aimed at improving the security of open source software.
The Open Source Security Foundation counts Microsoft as a founding member, along with "GitHub, Google, IBM, JPMC, NCC Group, OWASP Foundation and Red Hat," according to a Monday announcement. The JPMorgan Chase banking chain is also listed as a founding member, per the Open Source Security Foundation's FAQ.
The Open Source Security Foundation is "hosted at the Linux Foundation" and brings together various Linux Foundation-initiated efforts. Those efforts include the "Core Infrastructure Initiative (CII)" and the "GitHub-initiated Open Source Security Coalition (OSSC)," among others. The OSSC members are joining the Open Source Security Foundation and the efforts of CII likely will get dissolved into the new foundation, the FAQ explained.
The aim of the new foundation is to "improve the security of open source software by building a broader community, targeted initiatives and best practices," Microsoft indicated. A list of current technical initiative being overseen by the foundation can be found at this GitHub page.
The open source software community has tended to critique proprietary software companies, such as Microsoft, because its code can't be independently checked. However, Microsoft's announcement by Mark Russinovich, Microsoft's chief technology officer, offered an alternative view, namely:
- Open source software is ubiquitous, and thereby potentially more subject to frequent attack.
- Open source software has no central authority checking software quality.
- Open source software can have attackers masquerading as project maintainers.
"Given the complexity and communal nature of open source software, building better security must also be a community-driven process," Russinovich argued in explaining Microsoft's support for the new foundation.
Microsoft had already been working with the OSSC to identify security threats in open source software. It's also worked to speed the software fixing process. Additionally, Microsoft has developed security tools for open source developers, and it currently offers best-practices advice, Russinovich noted.
About the Author
Kurt Mackie is senior news producer for 1105 Media's Converge360 group.