Microsoft, Google and IBM Among First Members of Open Source Security Group

Microsoft has joined a high-powered group of tech giants in a new industry foundation aimed at improving the security of open source software.

The Open Source Security Foundation counts Microsoft as a founding member, along with "GitHub, Google, IBM, JPMC, NCC Group, OWASP Foundation and Red Hat," according to a Monday announcement. The JPMorgan Chase banking chain is also listed as a founding member, per the Open Source Security Foundation's FAQ.

The Open Source Security Foundation is "hosted at the Linux Foundation" and brings together various Linux Foundation-initiated efforts. Those efforts include the "Core Infrastructure Initiative (CII)" and the "GitHub-initiated Open Source Security Coalition (OSSC)," among others. The OSSC members are joining the Open Source Security Foundation and the efforts of CII likely will get dissolved into the new foundation, the FAQ explained.

The aim of the new foundation is to "improve the security of open source software by building a broader community, targeted initiatives and best practices," Microsoft indicated. A list of current technical initiative being overseen by the foundation can be found at this GitHub page.

The open source software community has tended to critique proprietary software companies, such as Microsoft, because its code can't be independently checked. However, Microsoft's announcement by Mark Russinovich, Microsoft's chief technology officer, offered an alternative view, namely:

  • Open source software is ubiquitous, and thereby potentially more subject to frequent attack.
  • Open source software has no central authority checking software quality.
  • Open source software can have attackers masquerading as project maintainers.

"Given the complexity and communal nature of open source software, building better security must also be a community-driven process," Russinovich argued in explaining Microsoft's support for the new foundation.

Microsoft had already been working with the OSSC to identify security threats in open source software. It's also worked to speed the software fixing process. Additionally, Microsoft has developed security tools for open source developers, and it currently offers best-practices advice, Russinovich noted.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.


  • 2022 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Datto Goes Private as Its Acquisition by Kaseya Is Finalized

    Kaseya's $6.2 billion acquisition of Datto, in the works for two years, is now complete, taking Datto from a publicly traded company to a private one.

  • Nebula

    Microsoft Expands on AI Face Standardization Rules and Guidelines

    Microsoft on Tuesday announced Version 2 of Microsoft's "Responsible AI Standard" document, which includes a disclosed a use-case approval process for its Azure Face API, Computer Vision, and Video Indexer customers, was released this week.

  • Road with Ocean Image

    Metaverse Standards Forum Created in the Spirit of Cooperation

    More than 30 tech organizations have come together to form the Metaverse Standards Forum, which will work towards standardizing requirements for future metaverse tech.