The plan from the Linux Foundation and OpenSSF presents three goals to improve open-source software security during development and more effectively address vulnerabilities.
Recent vulnerabilities such as Log4j2 have called attention to the challenges of securing open-source software, which is used widely by tech companies and other industry enterprises. Google will release the security-vetted versions of open source software packages that it runs itself for industry and government use.
Maintainers of open source software (OSS) will gain additional security tools for their own projects, while the developers who use OSS and about 97% of software does will gain more data on security.
Funding pledged to secure open source software is an important start, but creative hackers and a proliferation of targets mean there are no guarantees.