News for hackers. Stuff that matters.

A comment on 'Securing Open Source Software Act' introduced to US Senate. Parent comment

Re:'Securing Open Source Software Act' introduced to US Senate by thayne on Friday September 23, 2022 @11:16PM (#32959441)
> haven't previously done much to make sure that that supply chain is robust

I'm doubtful that anything short of requiring thorough security/pen testing on everything in the dependency tree would have prevented log4shell. And if that is the goal here, who is going to pay for that? Most open source projects don't have that kind of funding.

[ Parent | on HN ]
Re:'Securing Open Source Software Act' introduced to US Senate by dllthomas on Friday September 23, 2022 @11:44PM (#32959570)
> everything in the dependency tree

With reasonable prioritization, we can probably do a lot to reduce the threat long before we get near everything.

> who is going to pay for that?

Well, this bill does seem to involve hiring FOSS devs, maybe that's partly what they'd do?

[ Parent | on HN ]