Google has just given open source software a major boost with the launch of dedicated security and support teams.
The “Open Source Maintenance Crew” will be new team of developers will work on security issues related to open source projects, such as configuring updates.
The announcement came at the White House Open Source Security Summit, where Google joined the Open Source Security Foundation (OpenSSF) and the Linux Foundation to discuss issues surrounding open source security.
Why the move?
Back in December 2021, White House national security adviser Jake Sullivan sent a letter to the CEOs of US tech companies after the Log4Shell vulnerability in Apache's popular open source java logging framework Log4j was identified.
The vulnerability was used to install malware, for cryptomining, to add the devices to the Mirai and Muhstik botnets, to drop Cobalt Strike beacons, to scan for information disclosure, or for lateral movement throughout the affected network according to a blog post by Microsoft.
“This problem of securing open-source software is not just about money, for many critical open-source projects it is about the amount of people involved and how much time they can spend on the work,” said Principal Engineer of Open Source Security at Google, Abhishek Arya.
“Even with more funding, we need capacity to direct that money to the right goals. This is a people problem as well as a money problem.”
He added: “To meaningfully address this challenge, Google resourced the ‘Open Source Maintenance Crew' with the idea that an entity such as OpenSSF could administer the group and serve as a matchmaker for critical projects.”
The move comes as open source adoption is building momentum and support within the IT community, with use cases like online collaboration fuelling its popularity.
The recent 2022 State of Open Source Report, conducted by OpenLogic, surveyed 2,660 professionals and their organizations which use open source tools, finding over a quarter (27%) said they had no reservations at all about such tools, while only 13.9% were concerned about them being unsecured and untested.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba