Post #3446764

2026-06-28 10:50 UTC

@bagder@mastodon.social @icing@chaos.social i tried to piece together the 4 recent initiatives (Akrites, Lighwell, Athena, Patch the Planet) comparing them across several dimensions including OSS project role in governance which is not great, to say the least. https://tzafaar.codeberg.page/other/oss-security-initiatives-comparison.html

Replies (3)

@icing@chaos.social 2026-06-28 11:17

@aristot73@infosec.exchange "patch the planet" delivered no patches to the #curl project (I know, the press reported they do). We just got a zip with their findings and nothing else.

Open ##3597577
@andrewnez@mastodon.social 2026-06-28 13:19

@aristot73@infosec.exchange @bagder@mastodon.social @icing@chaos.social would be good to document how each effort works with upstream (if at all)

Open ##3614416
@zmanion@infosec.exchange 2026-06-28 15:00

@aristot73@infosec.exchange @bagder@mastodon.social @icing@chaos.social Given the history of some of the people and organizations, I'm confident at least Akrites and Lightwell will engage thoughtfully with upstream (the others maybe too, I'm not familiar with them). I'm more concerned with the technical processes at scale. We automate discovery, what about verification, reporting/notification, tracking comms and embargoes (if there are any at all), testing, reviewing, documentation (CVE, etc).

Open ##3614417