Subject: [IPP] Fwd: [info] GitHub's report on open-source security

From: Ira McDonald via ipp <[email-masked]>
Date: Mon, 7 Dec 2020 18:03:45 -0500

*GitHub's report on open-source security*

Dec 4, 2020

GitHub has released its "2020 State of the Octoverse" report
<https://octoverse.github.com/>; one piece of that is a report on security
[PDF] <https://octoverse.github.com/static/2020-security-report.pdf>. There
are several interesting conclusions there, including that a surprising
number of security vulnerabilities are planted deliberately. "Analysis on a
random sample of 521 advisories from across our six ecosystems finds that 17%
of the advisories are related to explicitly malicious behavior such as
backdoor attempts. Of those 17%, the vast majority come from the npm
ecosystem. While 17% of malicious attacks will steal the spotlight in
security circles, vulnerabilities introduced by mistake can be just as
disruptive and are much more likely to impact popular projects. Out of all
the alerts GitHub sent developers notifying them of vulnerabilities in
their dependencies, only 0.2% were related to explicitly malicious
activity. That is, most vulnerabilities were simply those caused by
mistakes."

https://lwn.net/Articles/838965
_______________________________________________
ipp mailing list
[email-masked]
https://www.pwg.org/mailman/listinfo/ipp