search

jupyter / security

BSD 3-Clause "New" or "Revised" License
18 stars 7 forks source link

openSSF program #75

Open fcollonval opened 4 months ago

fcollonval commented 4 months ago

Hey dear security team,

I was made aware of the OpenSSF program in the course of Google Summer of Code. There are two actions I'm trying to set up for JupyterLab:

I'm sharing the knowledge as it can help improving our security practices.

fcollonval commented 4 months ago

FYI I opened the following PR on JupyterLab: https://github.com/jupyterlab/jupyterlab/pull/16012

rpwagner commented 4 months ago

@fcollonval this is a great suggestion, I'll make a comment here and then a similar one over in the JupyterLab repo.

In addition to the badge, the OpenSSF Best Practices Working Group maintains a set of guides, including the Concise Guide for Developing More Secure Software. One of the simplest things we could do is to adopt the practices in the Concise Guide that apply to Project Jupyter Subprojects. We wouldn't be able to do that right away, but it would give us a direction and a way to track our progress.

Also, OpenSSF is part of the Linux Foundation, so this has adoption by a wider open source community and may help if Project Jupyter does transition to the LF.