Rust, Python, Apache Foundations and Others Announce Big Collaboration on Cybersecurity Process Specifications

The foundations behind Rust, Python, Apache, Eclipse, PHP, OpenSSL, and Blender announced plans to create 'common specifications for secure software development,' based on 'existing open source best practices.'

From the Eclipse Foundation:
This collaborative effort will be hosted at the Brussels-based Eclipse Foundation [an international non-profit association] under the auspices of the Eclipse Foundation Specification Process and a new working group... Other code-hosting open source foundations, SMEs, industry players, and researchers are invited to join in as well.

The starting point for this highly technical standardisation effort will be today's existing security policies and procedures of the respective open source foundations, and similar documents describing best practices.

The governance of the working group will follow the Eclipse Foundation's usual member-led model but will be augmented by explicit representation from the open source community to ensure diversity and balance in decision-making. The deliverables will consist of one or more process specifications made available under a liberal specification copyright licence and a royalty-free patent licence... While open source communities and foundations generally adhere to and have historically established industry best practices around security, their approaches often lack alignment and comprehensive documentation.

The open source community and the broader software industry now share a common challenge: legislation has introduced an urgent need for cybersecurity process standards.


The Apache Foundation notes the working group is forming partly 'to demonstrate our commitment to cooperation with and implementation of' the EU's Cyber Resilience Act. But the Eclipse Foundation adds that even before it goes into effect in 2027, they're recognizing open source software's 'increasingly vital role in modern society' and an increasing need for reliability, safety, and security, so new regulations like the CRA 'underscore the urgency for secure by design and robust supply chain security standards.'

Their announcement adds that 'It is also important to note that it is similarly necessary that these standards be developed in a manner that also includes the requirements of proprietary software development, large enterprises, vertical industries, and small and medium enterprises.' But at the same time, 'Today's global software infrastructure is over 80% open source... [W]hen we discuss the 'software supply chain,' we are primarily, but not exclusively, referring to open source.'

'We invite you to join our collaborative effort to create specifications for secure open source development,' their announcement concludes,' promising initiative updates on a new mailing list. 'Contribute your ideas and participate in the magic that unfolds when open source foundations, SMEs, industry leaders, and researchers combine forces to tackle big challenges.'

The Python Foundation's announcement calls it a 'community-driven initiative' that will have 'a lasting impact on the future of cybersecurity and our shared open source communities.'

Read more of this story at Slashdot.