Senate Bill Addresses Open Source Software Protection

[dcontesti]

Members of the US Senate Homeland Security Committee have introduced a bill that aims to enhance open-source software security. The Securing Open Source Software Act would direct the Cybersecurity and Infrastructure Security Agency (CISA) to develop a framework for assessing open source software risk. It would also direct the Office of Management and Budget to publish guidance to help agencies secure open source software.

https://www.fedscoop.com/open-source-risk-framework-bill/

[denbesten]

"Enhance open-source software security" and "publish guidance to help agencies secure open source software" are not the same thing.

To accomplish the former file vulnerability reports, submit patches, sponsor bug-bounties, etc.  The latter is just ordinary vulnerability management, for which a CISA already has a directive.  For those of us in private industry, stay up to date on patching and keep tabs on the software's reputation.