Episode 298 - David A Wheeler discusses the OpenSSF

<p><a href="https://twitter.com/joshbressers" rel= "nofollow">Josh</a> and <a href= "https://twitter.com/kurtseifried" rel= "nofollow">Kurt</a> talk to David A. Wheeler about everything OpenSSF. The Open Source Security Foundation is part of the Linux Foundation, and there are 6 OpenSSF working groups. David does a great job explaining how the OpenSSF works and what the 6 working groups are doing. The working group are (in no particular order): Identifying Security Threats, Security Tooling, Best Practices, Vulnerability Disclosures, Digital Identity Attestation, Securing Critical Projects.</p> <h2>Show Notes</h2> <ul> <li><a href="https://dwheeler.com/" rel="nofollow">David A Wheeler</a></li> <li><a href= "https://opensourcesecurity.io/2016/11/22/episode-14-david-a-wheeler-cii-badges/" rel="nofollow">Episode 14 – David A Wheeler: CII Badges</a></li> <li><a href= "https://blog.sigstore.dev/sigstore-the-openssf-315d09f135f2" rel= "nofollow">Sigstore joins the OpenSSF</a></li> <li><a href="https://openssf.org/getinvolved/" rel= "nofollow">OpenSSF Technical Working Groups</a></li> <li><a href= "https://www.helpnetsecurity.com/2021/11/17/npm-registry-vulnerability/" rel="nofollow">NPM requires MFA</a></li> <li><a href="https://lish.harvard.edu/" rel= "nofollow">LISH</a></li> <li><a href="https://arxiv.org/abs/2005.09535" rel= "nofollow">Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks</a></li> </ul>