OpenSSF Blog
openssf.org · Company blog · on HN since 2020
The Open Source Security Foundation, part of the Linux Foundation, posts about funding and programs for securing open source software.
What HN saysCommenters link it for Alpha-Omega hiring and the foundation's launch and FAQ, and debate how it relates to the Linux Foundation and regulation.
51HN people shared it
24linked it in comments
38stories submitted
1.2Kstory points
3 months agolast shared
2020people per year2026
Most-shared posts
- 1Open Source Security Foundation14 people · 242 points · first shared 2020 · 72 comments on HN
- 2Open Infrastructure Is Not Free: A Joint Statement on Sustainable Stewardship7 people · 29 points · first shared 2025 · 7 comments on HN
- 3Social engineering takeovers of open source projects4 people · 836 points · first shared 2024 · 361 comments on HN
- 4The Open Source Software Security Mobilization Plan3 people · 35 points · first shared 2022 · discussion on HN
- 5OpenSSF Funds Python and Eclipse Foundations and Acquires SOS.dev3 people · 7 points · first shared 2022 · discussion on HN
- 6Open Source Security Foundation raises $10M3 people · 3 points · first shared 2021 · discussion on HN
- 7OpenSFF’s Allstar aims to fix vulnerabilities in open source projects3 people · 3 points · first shared 2021 · discussion on HN
- 8Open Source Security Foundation: The Alpha-Omega Project3 people · 1 points · first shared 2022 · discussion on HN
- 9Members3 people · first shared 2020
- 10OpenSSF: Scanning open source packages for malicious behavior2 people · 3 points · first shared 2022 · 4 comments on HN
- 11OSSF(Part of the Linux Foundation) Announces Security Education Courses2 people · 1 points · first shared 2020 · discussion on HN
- 12Linux Foundation Launches Initiative to Prepare for Cybersecurity Legislation1 people · 5 points · first shared 2025 · discussion on HN
- 13Enhancing Open Source Security: Introducing Siren by OpenSSF1 people · 4 points · first shared 2024 · discussion on HN
- 14OpenSSF and CISA Join Forces to Secure Open Source Software1 people · 4 points · first shared 2024 · discussion on HN
- 15RubyGems, PyPI, Maven, Cargo, NPM, PHP package maintainers working together1 people · 3 points · first shared 2022 · discussion on HN
What HN people wrote when they linked it
kheels · 2022-06-01
Project Alpha-Omega is hiring. We're currently looking for the following roles:
-Lead Program Manager
-Security Researcher/Analyst
-Software Security Engineer
About the project:
Partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code – and get them fixed – to improve global software supply chain security.
-Remote
-Application at https://openssf.org/
gostsamo · 2021-05-29
Issue is that .net is a language oriented foundation, not a cyber security one. Sending the project there looks like an ad for a Microsoft initiative and not something done with the best interest of HIBP in mind. Just an example, there is foundation literally called Open Source Security Foundation.1 If I write a python security tool and it is useful for the community, I'd think first of transferring it to them, not to the Python foundation.
1. https://openssf.org/
hansjorg · 2020-08-03
Maybe this should link to https://openssf.org or the press release (https://openssf.org/press-release/2020/08/03/technology-and-enterprise… rather than to the GitHub project?
Highlights from the FAQ:
> OpenSSF is focused on improving the security of open source software (OSS) by building a broader community with targeted initiatives and best practices. It will start with a focus on metrics, tooling, best practices, developer identity validation and vulnerability disclosures best practices.
> OpenSSF will be supported by Linux Foundation membership dues with targeted organization contributions to support initiatives
> The founding members are GitHub, Google, IBM, JPMorgan Chase, Microsoft, NCC Group, OWASP Foundation and Red Hat, among others.
amouat · 2026-06-26
No, not really, and I don't think you need to be snarky.
It may be an industry body, but it runs multiple community conferences and projects which support Open Source. A notable example in this case being the OpenSSF https://openssf.org/
The LF is not perfect, but I would expect them to come from an OSS and community angle on this.
transpute · 2022-09-24
https://news.ycombinator.com/item?id=32956218#32957137
> FWIW, while this specific act may not be enforcing significant regulation, software developers need to understand that there's a ticking clock.
There are several initiatives from LF's OpenSSF and startup Chainguard.
Sept 2022, "Concise Guide for Evaluating Open-Source Software",
https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs…
Sept 2022, "Show off your Security Score: Announcing Scorecards Badges", https://openssf.org/blog/2022/09/08/show-off-your-security-score-annou…
jacques_chester · 2022-07-06
brasic is also welcome to participate in the OpenSSF Securing Software Repos working group, where we collectively discuss these kinds of efforts across multiple ecosystems. The best place to get started is the OpenSSF "Get Involved" page: https://openssf.org/getinvolved/
dwheeler · 2022-01-19
If you're interested in learning how to develop secure software, I recommend checking out the free set of 3 courses from the Open Source Security Foundation (OpenSSF) on "Secure Software Development Fundamentals": https://openssf.org/training/courses/
They're hosted on edX. Like many edX courses, if you want to prove you learned the material you can pay to try to pass various tests and get a certificate, but you do not need to pay if you just want to learn the material.
Full disclosure: I'm the author. But hopefully you'll like it anyway :-).
mikeyouse · 2022-01-13
It's in that verge article;
"The summit will also include the Apache Software Foundation — the owner and maintainer of the Log4j library — and Oracle, owner of the Java software platform on which the Log4j library runs. GitHub and the Linux Open Source Foundation will also be represented."
Which makes sense -- they host the Open Source Security Foundation (https://openssf.org/) which is meant to be working on exactly this type of problem.
scovetta · 2021-03-27
I work at Microsoft and lead one of the OpenSSF working groups (https://github.com/ossf/wg-identifying-security-threats). We're always looking for folks to join the conversation and contribute to any working groups. There is a public calendar for those meetings, and there is a recording of our last town hall at https://openssf.org under the Community menu at the top.
I'm also looking to hire a software/security engineer to join our team at Microsoft, to improve security tooling and analysis around open source. This work will align/contribute to OpenSSF projects. If you like having one foot in software development and the other in security, please take a look: https://careers.microsoft.com/us/en/job/1009857
sbmthakur · 2021-02-05
Nice write-up. Did not know about Open Source Security Foundation (OpenSSF).
https://openssf.org/
jwcrux · 2020-11-13
I've been in touch with folks from the Open Source Security Foundation [0] who is interested in making this a centralized service.
I'm a big believer that functions like this should be centralized under a foundation like that, and have really close connections to package manager maintainers so that we can work together towards solving the problem.
[0] https://openssf.org/
anontrot · 2025-04-16
Try if you can find some help here https://openssf.org/
raincole · 2026-04-15
> SAN FRANCISCO – March 17, 2026 – The Linux Foundation, the nonprofit organization enabling mass innovation through open source, today announced $12.5 million in total grants from Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI to strengthen the security of the open source software ecosystem.
https://openssf.org/tag/google
"But that's Linux, how small libraries get audit budget..." fortunately LLM has eliminated the need to have small libraires in your dependency chain.
bikenaga · 2026-03-01
OpenSSF statement (September 23, 2025): https://openssf.org/blog/2025/09/23/open-infrastructure-is-not-free-a-…
ISSOtm · 2025-12-01
Is it really that low an impact? A lot of the work performed in CI is duplicated (`apt update && apt install texlive-full` f.ex.), and thus there'd be a benefit to running it less often.
Consider also https://openssf.org/blog/2025/09/23/open-infrastructure-is-not-free-a-… :
> Automated CI systems, large-scale dependency scanners, and ephemeral container builds, which are often operated by companies, place enormous strain on infrastructure. > These commercial-scale workloads often run without caching, throttling, or even awareness of the strain they impose.
...which implies that the load isn't negligible.
arusahni · 2025-10-27
The PSF and several other organizations that provide public package registries wrote an open letter [1] announcing a joint effort to make this situation more sustainable. I'll be interested to see where it goes.
[1]: https://openssf.org/blog/2025/09/23/open-infrastructure-is-not-free-a-…
michaelw · 2025-09-23
Original joint statement on the OpenSSF blog: https://openssf.org/blog/2025/09/23/open-infrastructure-is-not-free-a-…
phi-go · 2025-09-12
There is one, though, focused on security: https://openssf.org/projects/criticality-score/
pabs3 · 2025-08-15
SMEs and start-ups have reduced requirements under the CRA too.
https://openssf.org/blog/2025/02/20/does-the-eu-cra-affect-my-business… https://www.cra-guide.com/2025/06/09/cras-impact-on-small-and-medium-s…
politelemon · 2022-02-04
...software supply chain attacks
Direct link to Alpha Omega project: https://openssf.org/community/alpha-omega/
And some of their working groups: https://github.com/ossf
I'm going to watch this space with interest. Anything that helps make security easy, especially to automate, understand, enforce, mitigate, will make it gain widespread developer acceptance.
walterbell · 2021-10-17
There are stakeholders who want Real Name digital signatures for git commits to "critical" open-source software and every dependency. There is already a numerical score for OSS which determines whether bug fixes will be funded by Google and others,
https://openssf.org/press-release/2021/10/13/open-source-security-foun…
woodruffw · 2021-03-28
If you go to the full members page[1], you will notice that the major Linux distributions are represented: SuSE, Canonical, and Red Hat. It's certainly a corporate interest group, but it would be incorrect to say that large open source projects are not represented.
Edit: it should also go without saying that Google et al. are already responsible for a significant portion of the open source ecosystem. For better or worse.
FD: My employer is a (much, much smaller) member of the OpenSSF.
[1]: https://openssf.org/about/members/
caniszczyk · 2020-12-10
The OpenSSF released a bunch of free courses on security: https://openssf.org/press-release/2020/10/29/open-source-security-foun…
JoachimS · 2020-08-04
OWASP as organization is one of the members of OpenSSF:
https://openssf.org/about/members/