DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
- Make sure our projects are keeping track of their dependencies, especially things that are EOL, especially things that are other Apache projects and EOL (example log4j v1)
- Track the dependencies across our projects so we can see the combined-graph for the latest version of each ASF project. Work centrally to encourage that dependencies are not insecure, or excessively dated.
- Facilitate direct funding efforts such as TideLift which provide direct financial support for developers to focus on matters such as security
- How does OpenSSF Alpha and/or Omega fit with ASF
- Look at the sponsored SOS rewards program
- Think about which ASF projects would benefit from being covered by IBB (they reached out to us to expand our current set)
- Looks at OpenSSF OSS Fuzz (high false positive rate - would benefit from manual triage by OSS Fuzz team before notifications are sent to maintainers). See also mail from GOSST.
WH Theme: Identify Critical projects / Help users pick secure projects
...
- See SBOM page
- Look at providing vulnerability data in a format that can be combined with SBOM such as VEX (CSAF) and/or OSV https://osv.dev/
- Look at EOL notifications CSAF as an example https://access.redhat.com/security/data/csaf/beta/2019/rhsa-2019_1862.json
- We have no way to know who is using our projects, nor do we want to capture that data (so is the current vulnerability notification system sufficient?)
...