Security scorecards for open source projects

Re:Security scorecards for open source projects by jart on Monday November 09, 2020 @07:01PM (#25041433)

The usage example in the README gives Kubernetes a 10/10 on security. Would it score that highly if the tool took into consideration all of its dependencies? https://github.com/kubernetes/kubernetes/blob/master/vendor/...

[ Parent | on HN ]

Re:Security scorecards for open source projects by spydum on Monday November 09, 2020 @08:57PM (#25042111)

Probably not. I think the intent is for big shops to quantify the risk of adopting an open source project. This is just a way to codify how teams justify whether a project is "mature enough" for adoption.

[ Parent | on HN ]

Re:Security scorecards for open source projects by toomuchtodo on Monday November 09, 2020 @09:27PM (#25042290)

Appears to be an open source alternative to Black Duck Software.

https://www.blackducksoftware.com/

[ Parent | on HN ]

Re:Security scorecards for open source projects by abharya on Monday November 09, 2020 @10:35PM (#25042596)

The goals are different. Our goal is to help both open source developer improve their project so that it is more secure for the community in the long term. It also gives the consumer this information for free, rather than paying / subscribing to a service.

[ Parent | on HN ]

Re:Security scorecards for open source projects by kimsterv on Wednesday November 11, 2020 @01:48PM (#25061453)

there's an open issue related to this: https://github.com/ossf/scorecard/issues/27

[ Parent | on HN ]