Open Source Security Team News Today

Google expands its bug bounty programme to encompass generative AI and takes steps to grow its commitment to supply chain security as it relates to the emerging technology

Sigstore is an open source project launched by Linux Foundation with the goal of providing free and stable services for all developers to easily sign, verify and protect their software projects. While code signing is a valuable tool to prevent hackers from co-opting patching systems and delivering malware, it is difficult to implement in open source projects given the complexity of key management.  

Here's a comprehensive look at some of the lesser-known, but no less serious, types of software supply chain attacks.

SBOMs should be connected with vulnerability databases to fulfill their promise of reducing risk, Google security team says.

The GitHub Advisory Database is now open to community contributions to help further the security of open source software.

The Linux Foundation and OpenSSF project, with backing from Microsoft and Google, aims to improve security of 10,000 open-source projects.

Developers can earn anything from $500 to more than $10,000 for their security work

The sigstore project, which is free to use for all developers, counts Google, Purdue University and Red Hat as founding members.