David A. Wheeler's weblog.
I m currently scheduled to be a guest on FLOSS Weekly on Wednesday, 2020-12-16, at 12:30pm Eastern Time (9:30am Pacific, 17:30 UTC). The general topic will be about Linux Foundation work on improving Open Source Software security. Please join the live audience or listen later. I expect it will be interesting. I expect that we ll discuss the Open Source Security Foundation (OpenSSF) , the Report on…
It s here! You can now see the Report on the 2020 Free and Open Source Software (FOSS) Contributor Survey ! This work was done by the Linux Foundation under the Core Infrastructure Initiative (CII) and later the Open Source Software Foundation (OpenSSF) , along with Harvard University.
If you develop software, please consider taking the free trio of courses Secure Software Development Fundamentals on edX that I recently created for the Linux Foundation s Open Source Security Foundation (OpenSSF) . The trio of courses is free; if you want to get a certificate to prove you learned it, you can pay to take some tests to earn the certificate (this is how many edX courses work). Here…
If you contribute to Free/Open Source Software, please take the FOSS Contributor Survey ! This survey is a collaboration between the Linux Foundation s Core Infrastructure Initiative and the Laboratory for Innovation Science at Harvard. Some of the questions are specific to those who write software; if you contribute, but don t write software, just skip those questions. The goal is to get a better…
The Linux kernel has earned the CII Best Practices gold badge. The CII Best Practices badge has three badge levels: passing, silver, and gold. Gold badges are especially hard to get, and I congratulate them! More info here: Linux kernel earns CII best practices gold badge
On 2019-06-24 parts of the Internet became inaccessible because Verizon failed to implement a key security measure called Resource Public Key Infrastructure (RPKI) . Here s a brief story about the 2019 failure by Verizon , with follow-on details . What s shocking is that Verizon is still failing to implement RPKI. Verizon s continuing failure continues to make it trivial for both accidents and…
Modern software systems contain many components, which themselves contain components, which themselves contain components. Which raises some important questions, for example, when a vulnerability is publicly identified, how do you know if your system is affected? Another issue involves licensing - how can you be confident that you are meeting all your legal obligations? This is getting harder to…
Announcing - a newly-available security paper I wrote! It s titled Initial Analysis of Underhanded Source Code (by David A. Wheeler, IDA Document D-13166, April 2020) . Here s what it s about, from its executive summary: It is possible to develop software source code that appears benign to human review but is actually malicious. In various competitions, such as the Obfuscated V Contest and…
Sadly, attackers have been exploiting the COVID-19 pandemic (caused by Coronavirus SARS-CoV-2) to cause problems via computers around the world. Modern Healthcare notes that hospitals are seeing active attacks, emails where a sender (pretending to be from the Centers for Disease Control and Prevention) asks the receiver to open a link (which is actually malware), other scams claim to track…
On April 1, 2020, I started working at the Linux Foundation! My new title is Director, Open Source Supply Chain Security . I ll be working to improve the security of open source software. I look forward to working with many others on this important problem. So please wish me luck and stay tuned for more.
The Linux Foundation and the Laboratory for Innovation Science at Harvard have just released a new report: “Vulnerabilities in the Core: Preliminary Report and Census II of Open Source Software” by Frank Nagle, Jessica Wilkerson, James Dana, and Jennifer L. Hoffman, 2020-02-14 . Just click on “Download Report” when you get there. A summary is available from Harvard . Here s a quick introduction to…
Software and mathematics are often difficult for others to visualize. Computer hardware engineers can often have cool props to distribute during their talks, but software developers and mathematicians work with ideas of the mind - no physical objects involved. This can sometimes make it difficult to explain important ideas like open source software (OSS). The idea of people collaborating to…
In case you weren’t aware of it, there is now a 2019 version of the CWE Top 25 list . This list attempts to rank what are the most important kinds of software vulnerabilities (what they call weaknesses ). Their new approach is to directly use the National Vulnerability Database (NVD) to score various kinds of vulnerabilities. There are a number of limitations with this approach, and they discuss…
One of my hobbies is playing with Metamath , a tiny language that can express theorems in abstract mathematics, accompanied by proofs that can be verified by a computer program. I find it absolutely fascinating. I m happy to announce that the 2019 hardcover version of the so-called Metamath book is now available! You can even watch me unbox a proof copy . If you re thinking about getting your own…
GitHub just made a change that I think will make a big improvement to the security of open source software (OSS). It’s now possible to privately report vulnerabilities to OSS projects on GitHub via maintainer security advisories ! This wasn’t possible before, and you can blame me (in part), because I m the one who got this ball rolling. I also want to give a big congrats to the GitHub team, who…
For those who know their computer history, wild things are going on regarding Linux this year. Linux is already in widespread use. For years the vast majority of smartphones run Android , and Android runs on Linux, so most smartphones run on Linux. As of November 2018 100% of all top 500 supercomputers worldwide run on Linux . Best estimates for servers using Linux are around 66.7% , and Linux is…
A malicious backdoor has been found in the popular open source software library bootstrap-sass . Its impact was limited - but the next attack might not be. Thankfully, there are things we can learn and do to reduce those risks but that requires people to think them through. See my essay Subversion of boostrap-sass for more about that!
No one thing creates secure software, so you need to do a set of things to make adequately secure software. But no one has infinite resources; how can you have confidence that you are doing the right set? Many experts (including me) have recommended creating an assurance case to connect the various approaches together to an efficient, cohesive whole. It can be hard to start an assurance case,…
Sometimes people want to do something, find a standard, and do not realize the downsides of using that standard. I have an essay in that genre titled Don’t Use ISO/IEC 14977 Extended Backus-Naur Form (EBNF) . The problem is that although there is a ISO/IEC 14977:1996 specification, in most cases you should not use it. If you have to write a specification for a programming language or complex data…
I ve kicked off the Railroader project to maintain a security static analysis tool for Ruby on Rails that is open source software . If you are developing with Ruby on Rails, please consider using Railroader . We would also really love contributions, so please contribute! A security static analysis tool (analyzer) examines software to help you identify vulnerabilities (without running the…