https://www.msbiro.net/tags/openssf/ Recent content in OpenSSF on Cloud Native & Open Source: A Team Lead’s Working Journal https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- 0.165.0 en-us Thu, 02 Apr 2026 08:00:00 +0000 https://www.msbiro.net/posts/actui-security-hardening-dependabot-openssf-scorecard/ Thu, 02 Apr 2026 08:00:00 +0000 https://www.msbiro.net/posts/actui-security-hardening-dependabot-openssf-scorecard/ Back from KubeCon EU 2026 with a free Copilot Pro+ subscription, I turned my attention to the security posture of apple-container-tui. Here's how I added Dependabot and OpenSSF Scorecard using GitHub Actions, spec-kit, and the GitHub CLI. https://www.msbiro.net/posts/investing-in-the-future-12-5-million-to-fortify-open-source-security/ Fri, 20 Mar 2026 05:45:00 +0000 https://www.msbiro.net/posts/investing-in-the-future-12-5-million-to-fortify-open-source-security/ A major coalition of tech giants including Microsoft, Google, AWS, and GitHub has announced a $12.5 million investment to strengthen open-source security. Managed by OpenSSF and Alpha-Omega, this funding aims to scale security defenses using AI and support overworked maintainers. Discover why this is a pivotal moment for the OSS ecosystem. https://www.msbiro.net/posts/evaluating-oss-security-fresh-editor-s2c2f/ Sat, 27 Dec 2025 16:37:11 +0000 https://www.msbiro.net/posts/evaluating-oss-security-fresh-editor-s2c2f/ Holiday hacking from the couch: evaluating Fresh editor's security using OpenSSF Scorecard, Semgrep, and cargo audit. A practical guide to applying the S2C2F framework for secure OSS adoption without killing developer productivity. Learn how to vet unknown open-source tools in an afternoon before bringing them to corporate environments. https://www.msbiro.net/posts/openssf-sbom-whitepaper/ Fri, 03 Oct 2025 16:30:03 +0000 https://www.msbiro.net/posts/openssf-sbom-whitepaper/ This article explores the OpenSSF white paper 'Improving Risk Management Decisions with SBOM Data,' highlighting how Software Bill of Materials (SBOMs) provide critical visibility into software components, vulnerabilities, and licensing. It covers 13 practical SBOM use cases, the SBOM lifecycle from creation to consumption, and key OpenSSF tooling for managing SBOMs in cloud-native environments to enhance security, compliance, and supply chain risk management. https://www.msbiro.net/posts/openssf-opensource-project-security-baseline/ Wed, 26 Feb 2025 11:30:03 +0000 https://www.msbiro.net/posts/openssf-opensource-project-security-baseline/ The OpenSSF Open Source Project Security Baseline is a new initiative providing a structured set of security checks across three levels that open-source projects can implement to demonstrate a strong security posture. This practical framework helps maintainers improve software security and certification, fostering safer open-source ecosystems. Learn about the baseline, its levels, and how to get involved. https://www.msbiro.net/posts/the-value-of-community-contributions-exploring-cncf-openssf/ Wed, 01 Nov 2023 16:44:03 +0000 https://www.msbiro.net/posts/the-value-of-community-contributions-exploring-cncf-openssf/ This post explores the importance and impact of contributing to open-source community foundations, focusing on the Cloud Native Computing Foundation (CNCF) and the Open Source Security Foundation (OpenSSF). It shares personal experiences of involvement, the benefits of stepping outside one’s comfort zone, and practical links to join projects, events, and working groups. Gain insights into how participation fosters ecosystem growth and professional development.