In conjunction with Thursday’s White House meeting in which tech companies discussed the security of open source software, Google proposed three initiatives to bolster national cybersecurity.
The meeting was arranged last month by US National Security Adviser Jake Sullivan, amid the scramble to fix the Log4j vulnerabilities that preoccupied so many people over the holidays. Sullivan asked the invited companies — a group that includes Amazon, Apple, Google, IBM, Microsoft and Oracle — to share ideas on how to improve the security of open source projects.
Google’s chief legal officer, Kent Walker, said in a blog post that just as government and industry have worked to support legacy, shoddy systems and software, the Log4j overhaul — which is still in progress — has demonstrated that open source software needs the same attention as critical infrastructure.
“For too long, the software community has been comfortable in assuming that open source software is generally secure due to its transparency and assuming that ‘many eyes’ have been watching to discover and solve problems,” Walker said. “But in reality, while some projects have a lot of eyes on them, others have little or none at all.”
He noted Google’s various efforts to be part of the solution, and outlined several potential public-private partnerships that were mentioned at the meeting:
- To select the list of important open source projects
- To create basic standards for security, maintenance, source, and testing
- To create a maintenance market, to match volunteers with projects in need
All ideas are commendable, if not particularly radical, unexpected, or novel.
Knowing which open source projects have the most reach is certainly important to understanding where bugs will have the greatest impact. Google software engineers have already been thinking about defining “critical importance” in the context of the program, so work is in progress. In fact, there is a program to establish the degree of importance for other programs.
As for the core criteria, the Open Source Security Foundation is already in place, and we already have frameworks like Supply Chain Levels that Google devised for the software business. So this is also a work in progress.
Walker’s description of an organization to connect projects with volunteer helpers working in companies is much like any of the many open-source sustainability efforts, only without the specific monetary component of GitHub or Patreon sponsors.
“Many leading companies and organizations do not realize how many parts of their critical infrastructure rely on open source,” Walker said. “This is why it is imperative that we see more public and private investment in keeping this ecosystem healthy and secure.”
That’s what everyone keeps saying, even though it’s not often pushed.
strength in union
Mike Hanley, GitHub’s chief security officer, also had something to say on the matter: “First, there must be a collective industry and community effort to secure the software supply chain,” he said in a blog post. “Second, we need better support for open source maintainers to make it easier to secure their projects.”
Katie Mousoris, founder of Luta Security, said in her speech record In a phone interview, Google, as part of what it describes as one percent security, has done a lot of good work in terms of its own product security and security related to its software ecosystem. But she said that this work is purely voluntary.
“If the US government is interested in securing open source, it needs to be more serious in terms of providing support to the open source community other than volunteering, philanthropic work from one percent security like Google, Microsoft and other elites, and the top providers that have been invited to The White House today.
Moussouris suggested that we need to adopt a model that more closely resembles the global basic income of the developer community, in part because it is difficult to determine which projects are important and which are not.
“The open source community definitely needs some form of universal basic income, because there are projects that start out as hobbies by one individual, and anticipating popularity becomes very difficult,” she said.
She said these projects often exist without much attention until a vulnerability appears and people realize that there is only one supervisor. While the government should value the contributions of large companies like Google and its peers, “it cannot count on volunteer philanthropy, labor and donations from security giants at 1 percent if it is going to solve this problem,” she said.
When asked whether licensing software that imposes financial support obligations on large users of open source projects might help, Moussouris was not certain that licensing was the ideal approach to making open source more sustainable and more secure. But it has expressed support for the transfer of revenue from the haves to the have-nots as a general goal.
“If the idea is to pay more of those who take advantage of open source and more of that dividend money towards those who build open source — like in the moderators, and those who do it for free, or for very little financial support — if the goal is Putting more of those profits derived from open source back into the hands of maintainers, I support that.”
Moussouris added that getting money from maintainers of open source software can be complicated. It is often not easy to decide who to pay or how to pay. “You can’t just cut a check from the government to an individual, and that’s true all over the world,” she said.
Another issue not mentioned among Google’s proposals is the need for specific security skills in the bug fixing process. Moussouris noted the lack of root cause analysis using Log4j which allowed the development of multiple variants beyond the initial fix. She said the Log4j developers did not understand the scope of the reported vulnerability.
“This is a problem that will not be solved by getting more developers into it [the problem] These are different job roles. “So this is a gap in what everyone here is talking about in terms of support.” ®