For what it's worth, I reached out to the Open Source Security Foundation (OpenSSF) after their press release on "Securing Critical Open Source Projects" [0], because my open source project is on their "critical list" (Python top #200) [1].
After some clicking around, I was directed to the OpenSSF mailing list [2].
…where my request was left to rot, without any response.
Made me wonder whether this is just a PR stunt / corporate power grab.
After some clicking around, I was directed to the OpenSSF mailing list [2].
…where my request was left to rot, without any response.
Made me wonder whether this is just a PR stunt / corporate power grab.
[0] https://opensource.googleblog.com/2020/12/finding-critical-o...
[1] https://news.ycombinator.com/item?id=25381397
[2] https://groups.google.com/g/wg-securing-critical-projects