Security scorecards for open source projects

Re:Security scorecards for open source projects by prepend on Tuesday November 10, 2020 @07:36AM (#25045264)

Having a quantitative, ordinal scale gives the wrong picture I think. Since 10/10 sounds good, but doesn’t actually mean something is safe.

Also the name is “scorecard” that again connotes that a high score is good. I don’t get a 10/10 on my assignment because I did my homework, said hello to the teacher each morning, and was polite to my classmates.

Those are all positive things and if I wanted to measure students they may be a part of the grade. But if I only graded on these factors that’s not terribly useful.

Process measures are good when it’s not possible to measure outcome, but I think in this situation more outcome measures could be factored in.

[ Parent | on HN ]

Re:Security scorecards for open source projects by abharya on Tuesday November 10, 2020 @01:14PM (#25049092)

These are just some initial metrics we picked for v1. Please suggest more by filing by a github issue here - https://github.com/ossf/scorecard/issues Over time, we will add more real time metrics such as open vulnerabilities, etc

[ Parent | on HN ]