Community-driven threat intelligence. Human-verified supply chain threats from every major open source ecosystem.
NSF investing in secure open-source ecosystems
Open-source software is ubiquitous, supporting artificial intelligence, data science, cloud computing, telecommunications and scientific research tools. Despite these benefits, the number of open-source developers is relatively small, and many projects lack sufficient resources, slowing the pace of innovation and making maintenance difficult. In addition, weaknesses in open-source software, such as security flaws, supply chain risks or insider threats, can spread across many connected systems. In extreme cases, these weaknesses could lead to large-scale failures that affect national or global systems.
The Axios supply chain attack used individually targeted social engineering
The Axios team have published a full postmortem on the supply chain attack which resulted in a malware dependency going out in a release the other day, and it involved …
The Axios supply chain attack used individually targeted social engineering
The Axios team have published a full postmortem on the supply chain attack which resulted in a malware dependency going out in a release the other day, and it involved …
Open source and the software supply chain
Managing something as esoteric as resources for building software with a variety of contributions made by the open source community is more amorphic.
Open Source Business Model is Under Siege [Video Insights]
This post is about about the existential threat that Open Source Database companies, or any open source software infrastructure, are facing from cloud vendors like Amazon Web Services, Google Cloud, and Microsoft Azure. Watch the video as Paul Dix, Fou...
Open Source Business Model is Under Siege [Video Insights]
This post is about about the existential threat that Open Source Database companies, or any open source software infrastructure, are facing from cloud vendors like Amazon Web Services, Google Cloud, and Microsoft Azure. Watch the video as Paul Dix, Fou...
Path to Astra: critical capabilities and frontier safeguards
Astra is the first OpenAI model to meet the Critical cybersecurity capability threshold under the Preparedness Framework, with stronger safeguards for release.
AI creates asymmetric pressure on Open Source
How Open Source communities can adapt to AI-generated contributions without overwhelming Open Source maintainers
Patch the Planet: global response coordination as agents uncover critical vulnerabilities
Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.
AI-SLOP: Develop best current practises for Open Source maintainers · Issue #178 · ossf/wg-vulnerability-disclosures
Open source projects are increasingly facing a wave of low-quality, AI-generated vulnerability reports and contributions—commonly referred to as "AI-slop." This issue aims to develop best...
The crusade against open-source abuse | TechCrunch
There’s a dark cloud on the horizon. The behavior of cloud infrastructure providers threatens the viability of open source. Thankfully, several leaders have mobilized to propose multiple solutions.
AI CVE Slop: The Crisis Drowning Open Source Security
The proliferation of AI-generated vulnerability reports — commonly termed “AI slop” — has emerged as one of the most significant…
Open Source Infrastructure is Breaking Down Due to Corporate Freeloading
An unprecedented threat looms over open source.
34 Top Open Source Software Companies
Exploring open source companies for 2024? Discover the leading firms championing open-source solutions.
Lack of leadership in open source results in source-available licenses | TechCrunch
Cloud infrastructure providers -- such as Amazon -- continue to pose an existential threat to the future of open source.
