Disclosure: I work at Amazon on cloud infrastructure, and I am a technical advisor on FOSS related topics from time to time.

Chris,

I think that the feedback on the CII grant process deserves to be acknowledged and addressed if possible. I wasn't directly part of the day-to-day efforts of CII, but I (as an individual providing one's opinion and advice) supported the original charter of directly funding security related development of critical software libraries that are often unnoticed like libxml2, OpenSSL, etc.

I am disappointed that CII didn't achieve this objective for more software (there were a few grants that were awarded and completed, but over time this seemed to end, from the public updates I read at the time). I think that it is still a good one to have.

Matt, the CII grant program became problematic for a number of reasons and that OpenSSF is certainly aiming to avoid replicating those mistakes and making entirely new mistakes instead (to not only focus on grants and truly help define what critical software is).

The CII was before my time at the LF so I don't have much to share outside of it was in the mind of the OpenSSF founders to do better.

I imagine the folks where were directly involved in CII (so, not me) would have loved to have had an opportunity to share their experiences and perspective during the closed-door formation phase of OpenSSF.

All of the Working Groups (WGs) that will be doing the work are forming now in the OPEN so this is the perfect time for anyone to get engaged as the organization gets off the ground: https://github.com/ossf

FYI: the majority of the work was born out of a closed source effort that you weren't involved in: https://github.blog/2020-07-09-what-we-learned-from-building...