Slashdot Mirror

← Back to Domains

Domain: coreinfrastructure.org

Stories and comments across the archive that link to coreinfrastructure.org.

Stories · 3

  1. After 20 Years, OpenSSL Will Change To Apache License 2.0, Seeks Past Contributors (openssl.org)

    News · Encryption · · posted by EditorDavid · from the open-encryption dept. · 110 comments
    After nearly 20 years and 31,000 commits, OpenSSL wants to change to Apache License v2.0. They're now tracking down all 400 contributors to sign new license agreements, a process expected to take several months. Slashdot reader rich_salz shares links to OpenSSL's official announcement (and their agreement-collecting web site). "This re-licensing activity will make OpenSSL, already the world's most widely-used FOSS encryption software, more convenient to incorporate in the widest possible range of free and open source software," said Mishi Choudhary, Legal Director of Software Freedom Law Center and counsel to OpenSSL. "OpenSSL's team has carefully prepared for this re-licensing, and their process will be an outstanding example of 'how to do it right.'"
    Click through for some comments on the significance of this move from the Linux Foundation, Intel, and Oracle.
    • "The Linux Foundation is excited to see the OpenSSL project re-licensing under the Apache License. Using a standard and well-understood license is a huge benefit when incorporating a FOSS project into other projects and products... this license move will further help to ensure it remains one of the most important and relied-upon open source projects in the world."

      -- Nicko van Someren, Chief Technology Officer, the Linux Foundation
    • "Oracle is proud to extend its collaboration with the OpenSSL Foundation by relicensing its contributions of elliptic curve cryptography. OpenSSL is a critical component in both Oracle products and the infrastructure of the Internet, and we strongly believe the increased use of cryptography fostered by OpenSSL will benefit the entire enterprise software community."

      -- Jim Wright, Chief Architect of Open Source Policy, Strategy, Compliance and Alliances, Oracle
    • "Intel is thrilled to see OpenSSL moving to the standard Apache 2.0 license, improving license compatibility within the Open Source ecosystem. This will help defragment the open source cryptography ecosystem, leading to stronger and more pervasive use of crypto to improve privacy and security in the global technology infrastructure."

      -- Imad Sousou, Vice President and General Manager of the Open Source Technology Center, Intel

  2. Linux Foundation Project Will Evaluate Security of Open Source Software

    News · Opensource · · posted by Soulskill · from the if-boy-scouts-found-zero-days dept. · 37 comments
    An anonymous reader writes: The Core Infrastructure Initiative (CII), a project managed by The Linux Foundation, is developing a new free Badge Program, seeking input from the open source community on the criteria to be used to determine security, quality and stability of open source software. The first draft of the criteria is available on GitHub and is spearheaded by David A. Wheeler, an open source and security research expert who works for the Institute for Defense Analyses and is also coordinating the CII's Census Project, and Dan Kohn, a senior adviser on the CII.

  3. Linux Foundation's Census Project Ranks Open Source Software At Risk

    Linux · Bug · · posted by timothy · from the deserves-macarthur-award dept. · 47 comments
    jones_supa writes: The Core Infrastructure Initiative, a Linux Foundation effort assembled in the wake of the Heartbleed fiasco to provide development support for key Internet protocols, has opened the doors on its Census Project — an effort to figure out what software projects need support now, instead of waiting for them to break. Census assembles metrics about open source projects found in Debian's package list and on openhub.net, and then scores them based on the amount of risk each presents. Risk scores are an aggregate of multiple factors: how many people are known to have contributed to the project in the last 12 months, how many CVEs have been filed for it, how widely used it is, and how much exposure it has to the network. According to the current iteration of the survey, the programs most in need of attention are not previously cited infrastructure projects, but common core Linux system utilities that have network access and little development activity around them.