Linux Foundation announces open source best practices badge programme

The Linux Foundation has announced its plans to introduce a new badge programme designed to help identify open source projects that have made security a priority. The new effort, which is part of the Foundation’s Core Infrastructure Initiative (CII), aims to identify and fund critical open source projects in need of assistance.

“Despite its prevalence, trying to quickly determine the best maintained and most secure open source to use is a complex problem for both seasoned CIOs and nimble developers. The self-assessment, and the badges that will follow, are designed to be a simple, fairly basic way for projects to showcase their commitment to security and quality,” The Linux Foundation said in its statement.

[caption id=“attachment_1233057” align=“alignleft” width=“380”]  Representational image. Reuters[/caption]

The free Badge programme seeks input from the open source community on the criteria to be used to determine security, quality and stability of open source software.

More from Business

Hyundai India’s Rs 27,870 crore IPO oversubscribed by 2.28X, largely driven by institutional investors How Indian fintech startups are driving Malaysia’s UPI-like digital payments revolution

The criteria is also meant to encourage open source software (OSS) projects to take “positive steps with both in mind and to help users know which projects are taking these positive steps.” The first draft of the criteria is available on GitHub.

Established in 2014 in response to the Heartbleed vulnerability, CII is a multi-million dollar project that funds and supports critical elements of the global information infrastructure. Moving beyond funding projects, CII is introducing pre-emptive tools and programmes to help the open source ecosystem and the companies who support it deploy secure coding practices.

“By coming out early with some initial criteria, we hope that the community will quickly get involved and not only influence the questions, but also acknowledge how important it is for developers to be able to quickly assess the health of a project that they depend on,” said Emily Ratliff, Senior Director of Infrastructure Security at The Linux Foundation. “A free, credible badge system can fill this niche, ensuring that new projects depend only upon the healthiest open source projects, thus improving our global Internet infrastructure.”

Impact Shorts

More Shorts

Tata Harrier EV vs Mahindra XEV 9e: Design and road presence compared

As Trump weaponises tariff, Fed sees a bigger worry: Not jobs, but rising prices in America

Projects that follow best practices can still have vulnerabilities, other bugs, and other kinds of problems, but they should be a better position to prevent, detect and fix them.

Currently the criteria include general best practices combined with questions specific to security. The questionnaire asks if a project includes an OSS license; a public version-controlled source repository; a general mailing list; an automated regression test suite; and at least one static analysis tool applied to source code to look for vulnerabilities.