Google has announced its joining of the OpenSSF (Open Source Security Foundation) initiative, formed by the Linux Foundation, aimed at enhancing the security of open-source software. As part of its participation, Google has created and will fund a separate team of engineers called the 'Open Source Maintenance Crew,' which will collaborate with maintainers of critical open projects on matters related to improving security.
The work will utilize the 'Know, Prevent, Fix' concept, which defines methods for managing metadata related to vulnerability remediation, oversight of fixes, notification of new vulnerabilities, maintaining a database of vulnerability information, tracking the linkage of vulnerabilities to dependencies, and analyzing the risk of vulnerabilities manifesting through dependencies.
Source: opennet.ru
