Security scorecards for open source projects

Re:Security scorecards for open source projects by spydum on Monday November 09, 2020 @08:55PM (#25042100)

I think you miss the point then. The things it's looking for are indicators security practices are even in place. If you wanted vuln scanning, many solutions for that today exist. This is almost like a reputation score. The higher it is, the more likely vulnerabilities will be addressed in the future (or outright prevented).

I like the idea, I think it will just be tough to work out the right heuristics.

[ Parent | on HN ]

Re:Security scorecards for open source projects by prepend on Tuesday November 10, 2020 @07:36AM (#25045264)

Having a quantitative, ordinal scale gives the wrong picture I think. Since 10/10 sounds good, but doesn’t actually mean something is safe.

Also the name is “scorecard” that again connotes that a high score is good. I don’t get a 10/10 on my assignment because I did my homework, said hello to the teacher each morning, and was polite to my classmates.

Those are all positive things and if I wanted to measure students they may be a part of the grade. But if I only graded on these factors that’s not terribly useful.

Process measures are good when it’s not possible to measure outcome, but I think in this situation more outcome measures could be factored in.

[ Parent | on HN ]

Re:Security scorecards for open source projects by abharya on Tuesday November 10, 2020 @01:14PM (#25049092)

These are just some initial metrics we picked for v1. Please suggest more by filing by a github issue here - https://github.com/ossf/scorecard/issues Over time, we will add more real time metrics such as open vulnerabilities, etc

[ Parent | on HN ]