On #OpenSourceSecurity I had a chat with @brianfox.bsky.social about the sustainability letter from the open source package registries This one is a big deal. The costs for open source are paid by someone, if you don't know who, you need to read this letter opensourcesecurity.io/2025/2025-10...

Yes all of this. Now it’s time to fix it.

Free isn’t free: the infrastructure behind open source has real costs, and it’s time we aligned usage with responsibility. This morning we jointly launch a new blog and open letter on sustainable stewardship. www.sonatype.com/blog/from-ab...

Open-source malware doubles, data exfiltration attacks dominate 📖 Read more: www.helpnetsecurity.com/2025/04/03/o... #cybersecurity #cybersecuritynews #opensource @brianfox.bsky.social

Good news for Java developers! Central now validates OpenSSF sigstore signatures as part of publishing. If you’re already signing your artifacts with Sigstore, you’ll now get real-time validation feedback in the Central Publisher Portal. Read more details here: www.sonatype.com/blog/central...

📢 The @linuxfoundation.org, with Harvard's Laboratory for Innovation Science, has released Census III of Free and Open Source Software – Application Libraries. 🖥️ Key insights from OpenSSF help reduce FOSS vulnerabilities and secure supply chains. Read more: openssf.org/press-releas...