Secure Open Source Rewards (SOS.dev) program launched to help protect critical upstream software

guest · Aug 18, 2022

SOS.dev initiative will combat software supply chain attacks by encouraging researchers to suggest security improvements to key projects
August 18, 2022

A new program is aiming to reward developers and security researchers who make improvements to critical infrastructure based on open source technology.

The Secure Open Source Rewards (SOS.dev) scheme will be broader than current bug bounty programs, according to its backers.
The program will “harden critical open source projects” and help protect against application and software supply chain attacks by encouraging researchers and developers to suggest security improvements.
Click to expand...

Rewards range from $505 for small improvements up to $10,000 or more for “complicated, high-impact and lasting improvements that almost certainly prevent major vulnerabilities”.

Secure Open Source Rewards are looking for supply chain security improvements, improvement that give higher OpenSSF Criticality Scorecard results, adopt software artifact signing and verification, and other best practise measures.
Other improvements will be added to the aims as SOS.dev evolves.
Click to expand...

Andrew Martin, CEO at ControlPlane and CISO at OpenUK, added: “Supply chain security starts with the initial contributor and the security of their coding practices, computing environment, and build systems.

“Organizations need to be aware of all the components in development and production systems, including open source.
Click to expand...

SOS.dev is run by the Linux Foundation with sponsorship from the Google Open Source Security Team, with $1 million of initial funding.
Click to expand...

Log in or Sign up

Secure Open Source Rewards (SOS.dev) program launched to help protect critical upstream software

guest Guest

Log in or Sign up

Secure Open Source Rewards (SOS.dev) program launched to help protect critical upstream software

guest Guest

Useful Searches