<story><title>Open Source Security Foundation</title><url>https://openssf.org/</url></story><parent_chain></parent_chain><comment><author>kimsterv</author><text>Honk! I represent Google on the OpenSSF, and help lead our Google Open Source Security Team. We&amp;#x27;ve kicked off several projects inside the OpenSSF, and contribute to several other related efforts.&lt;p&gt;Here&amp;#x27;s a non-exhaustive list:
Security Scorecards (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ossf&amp;#x2F;scorecard&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ossf&amp;#x2F;scorecard&lt;/a&gt;): auto-generated security checks for OSS, Criticality Score (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ossf&amp;#x2F;criticality_score&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ossf&amp;#x2F;criticality_score&lt;/a&gt;): auto-generated criticality score for OSS, Package Feeds (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ossf&amp;#x2F;package-feeds&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ossf&amp;#x2F;package-feeds&lt;/a&gt;): watches package registries for updates, malware analysis tools, SLSA (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;slsa-framework&amp;#x2F;slsa&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;slsa-framework&amp;#x2F;slsa&lt;/a&gt;): proposal for a supply chain integrity framework, Sigstore&amp;#x2F;Cosign (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;sigstore.dev&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;sigstore.dev&amp;#x2F;&lt;/a&gt;): code signing made easy!&lt;p&gt;We are also investing and exploring different efforts for improving security of critical OSS projects, and making it sustainable! If any of these projects sound interesting, come join us in the OpenSSF Working Groups!&lt;p&gt;*edited formatting</text></comment>
<story><title>Open Source Security Foundation</title><url>https://openssf.org/</url></story><parent_chain></parent_chain><comment><author>scovetta</author><text>I work at Microsoft and lead one of the OpenSSF working groups (&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ossf&amp;#x2F;wg-identifying-security-threats&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;ossf&amp;#x2F;wg-identifying-security-threats&lt;/a&gt;). We&amp;#x27;re always looking for folks to join the conversation and contribute to any working groups. There is a public calendar for those meetings, and there is a recording of our last town hall at &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;openssf.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;openssf.org&lt;/a&gt; under the Community menu at the top.&lt;p&gt;I&amp;#x27;m also looking to hire a software&amp;#x2F;security engineer to join our team at Microsoft, to improve security tooling and analysis around open source. This work will align&amp;#x2F;contribute to OpenSSF projects. If you like having one foot in software development and the other in security, please take a look: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;careers.microsoft.com&amp;#x2F;us&amp;#x2F;en&amp;#x2F;job&amp;#x2F;1009857&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;careers.microsoft.com&amp;#x2F;us&amp;#x2F;en&amp;#x2F;job&amp;#x2F;1009857&lt;/a&gt;</text></comment>