Simon Willison’s Weblog

Subscribe

Saturday, 6th August 2022

Microsoft® Open Source Software (OSS) Secure Supply Chain (SSC) Framework Simplified Requirements. This is really good: don’t get distracted by the acronyms, skip past the intro and head straight to the framework practices section, which talks about things like keeping copies of the packages you depend on, running scanners, tracking package updates and most importantly keeping an inventory of the open source packages you work so you can quickly respond to things like log4j.

I feel like I say this a lot these days, but if you had told teenage-me that Microsoft would be publishing genuinely useful non-FUD guides to open source supply chain security by 2022 I don’t think I would have believed you.

# 4:49 pm / microsoft, open-source, security, supply-chain

2022 » August

MTWTFSS
1234567
891011121314
15161718192021
22232425262728
293031