Centralisation Woes and FUD
-
Large-Scale Phishing Campaign Floods Open-Source Repositories with 144,000 Packages [Ed: Misleading title; this is not an "open source" problem but a repo or centralisation problem, or "install random stuff from the Net" problem]
The phishing packages used in this campaign have since been removed from the repositories, except in the case of NuGet, where the packages were unlisted from the repository’s search results. These unlisted packages are still available, but not easily accessible.
-
Adding giscus Comments [Ed: Alan Pope left Canonical. Now he's outsourcing part of his blog to proprietary software controlled remotely by Microsoft.]
I had a look around, and recently discovered giscus, a comment system which uses GitHub discussions for the backend...
-
Google Online Security Blog: Announcing OSV-Scanner: Vulnerability Scanner for Open Source [Ed: Google is outsourcing security tools to proprietary software managed by the NSA and Microsoft; that's a very negative sign]
Today, we’re launching the OSV-Scanner, a free tool that gives open source developers easy access to vulnerability information relevant to their project.
-
Google debuts OSV-Scanner – a Go tool for finding security holes in open source
Google this week released OSV-Scanner – an open source vulnerability scanner linked to the OSV.dev database that debuted last year.
Written in the Go programming language, OSV-Scanner is designed to scan open source applications to assess the security of any incorporated dependencies – software libraries that get added to projects to provide pre-built functions so developers don't have to recreate those functions on their own.