laurent

Open source security @Google

[OpenSSF @openssf]

Discover the power of Structured Results in the #OpenSSF blog: https://t.co/mYPtc5bcnt

Tailor your security approach with detailed insights for precise policy enforcement. 🛡️✨

[laurent @lsim99]

Amazing community collaboration: GitHub's Dependency review action now supports displaying and blocking PRs based on OpenSSF scorecard results https://t.co/IpdIPQBQqa

[Abhishek Arya @infernosec]

Announcing the general availability of the V3 https://t.co/7WpMoakTHL API (All your OSS transitive dependencies belong to you!). Lot of new features like batch support, purl support, querying capabilities for new things like name similarity, SLSA attestations, etc! Check it out at https://t.co/G5T6JsdTLK

[laurent @lsim99]

Why SBOMs for OSS (package) libraries can't report accurate information about dependencies https://t.co/jPHFmLGPz8

[laurent @lsim99]

Refining our notion of "critical projects" by augmenting the dependency graph with authorship information https://t.co/NNpjm7ZV0d
What other insights can we glean with dependency and git information? Let us know if you have ideas!

[Tidelift (now Sonar) @tidelift]

Tomorrow at 5pm PT! 📅

Sign up for the SLSA Bay Area meetup hosted by @Google and @github and hear @tidelift co-founder @luis_in_brief discuss Trusted Attestation and Compliance for Open Source (TACOS) 🌮

https://t.co/5B6hwrHd4O

[Abhishek Arya @infernosec]

Excited to announce the big milestone on #OSV: We have now enriched 30K vulns from NVD CVE DB and added first-class support for C/C++ ecosystem inside OSV-Scanner. Check out https://t.co/HPBRtjylD6! One-stop community DB and scanner for all your OSS vulnerability scanning needs!

[laurent @lsim99]

@colek42c @trishankkarthik @justincormack @torresariass @ffkiv @adityasaky SLSA for models, yes https://t.co/JZWiMBrGi9. We'll also talk about that at the SLSA Bay Area meet up on 16th Nov in SF https://t.co/SFc2rQAbzo

[Vijay Bolina @vijaybolina]

second, @Google is expanding our open source security work with the @openssf by releasing new tools to protect the overall integrity of AI supply chains. (3/3)

Sigstore for Models and Model Provenance.

https://t.co/E9ubvK1rT3

[laurent @lsim99]

Join us for the first SLSA Bay Area meet-up on Nov 16 in SF. You'll learn about the latest news on the #slsa standard for supply-chain and how to use it to secure your SDLC and AI pipelines. Register and propose a talk https://t.co/0YKtJcrF2I

[Marcela Melara, PhD @mas0mel]

5 days left to submit your papers or security-in-practice talks to the SCORED ‘23 workshop!

[Asra Ali @AsraEntr0py]

Excited to announce a new SLSA builder I've been working on with Google's Project Oak that helps enable a transparent release process in Confidential Computing!
https://t.co/BuhBZilZHU
@RBehjati

[JamieDavis @TheDavisJam]

The deadline for the SCORED'23 workshop on software supply chain security is in about 2 weeks. That's enough time to put together a nice submission!

https://t.co/hfFs8OhHdj

[Marcela Melara, PhD @mas0mel]

Reminder: The call for papers/talks for the 2nd ACM SCORED workshop on SW Supply Chain security is open until June 30!

Security-in-practice talks and short research papers welcome!

Call for papers/talks: https://t.co/EDFM6YC22e
Submission site: https://t.co/owgwRCtY1Q

[Mihai Maruseac @mihaimaruseac]

Each dep brings others. Understanding the supply chain is as difficult as understanding universe. Now we have a telescope: GUAC reaches its v0.1 release. Find more on Google's security blog and come and join us in solving swaths of supply chain problems: https://t.co/0N78ek6w6t

[Abhishek Arya @infernosec]

Thanks @github for featuring @theopenssf Scorecard project on ReadME blog-"In Scorecard we trust" by @snaveen(Endor) & Brian Russell(GOSST)."If you’re looking to start improving your software supply chain security, adopting Scorecard is a great first step" https://t.co/pYbXo66kGX

[Jonathan Metzman @metzmanj]

Nice way to earn glory for your fuzzer and more importantly 11k!

[Abhishek Arya @infernosec]

Announcing OSV-Scanner: a tool that gives OSS developers easy access to vulnerability info relevant to their project using https://t.co/sjkE85WfcD DB (16 ecosystems, 39K+ vulns). Also, integrated with Scorecards vulns check to give vulns in dependencies - https://t.co/UOtRGkoOvn

[Abhishek Arya @infernosec]

Excited to welcome another builder to higher SLSA level compliance. Check out the #SLSA community blog post going into the details on how @googlecloud build can help you with SLSA L3 compliance - https://t.co/gEe1s3sjH7

[laurent @lsim99]

Super excited to announce another milestone for SLSA: Google GCB level 3 provenance for your containers can now be verified via the open-source, community-developed https://t.co/NxPRixolXb. Check out the blog post https://t.co/xjURPREvyc!. Stay tuned, more coming up soon!