On #OpenSourceSecurity I had a chat with @brianfox.bsky.social about the sustainability letter from the open source package registries This one is a big deal. The costs for open source are paid by someone, if you don't know who, you need to read this letter opensourcesecurity.io/2025/2025-10...

Sustaining Package Repositories with Brian Fox

Brian Fox discusses the challenges and future of open source package repository infrastructure. We discuss the complexities of managing public registries, the impact of overconsumption, and the import...

opensourcesecurity.io

Yes all of this. Now it’s time to fix it.

Matt Coley@mattcoley.bsky.social · 11mo ago

I love reading these articles and thinking "Yup, that's us on the job. We're part of the industrial inefficiency complex" Artifactory set up but nobody uses it? 👍 CI jobs with zero caching? 👍 + they can recursively spawn other jobs? 👍 + they can trigger from simple "fix typo" commits? 👍

Free isn’t free: the infrastructure behind open source has real costs, and it’s time we aligned usage with responsibility. This morning we jointly launch a new blog and open letter on sustainable stewardship. www.sonatype.com/blog/from-ab...

From Abuse to Alignment: Why We Need Sustainable Open Source Infrastructure

Open source relies on shared infrastructure. Learn why sustainable stewardship is critical to keep ecosystems like Maven Central strong.

sonatype.com

Open-source malware doubles, data exfiltration attacks dominate 📖 Read more: www.helpnetsecurity.com/2025/04/03/o... #cybersecurity #cybersecuritynews #opensource @brianfox.bsky.social

Open-source malware doubles, data exfiltration attacks dominate - Help Net Security

A total of 17,954 open source malware packages identified in Q1 2025, according to Sonatype's Open Source Malware Index.

helpnetsecurity.com

www.thecvefoundation.org

CVE Foundation

FOR IMMEDIATE RELEASE April 16, 2025 CVE Foundation Launched to Secure the Future of the CVE Program [Bremerton, Washington] – The CVE Foundation has been formally established to ensure the long-term ...

thecvefoundation.org

Good news for Java developers! Central now validates OpenSSF sigstore signatures as part of publishing. If you’re already signing your artifacts with Sigstore, you’ll now get real-time validation feedback in the Central Publisher Portal. Read more details here: www.sonatype.com/blog/central...

📢 The @linuxfoundation.org, with Harvard's Laboratory for Innovation Science, has released Census III of Free and Open Source Software – Application Libraries. 🖥️ Key insights from OpenSSF help reduce FOSS vulnerabilities and secure supply chains. Read more: openssf.org/press-releas...