Introduction to the OpenSSF  ## Metadata - Author: [[OpenSSF]] - Full Title: Introduction to the OpenSSF - Category: #articles - Document Note: --- tags: - #OpenSSF - #OpenSourceSecurity - #LinuxFoundation Author: Ram and Manish Adhikari Source: YouTube - Introduction to the OpenSSF Reference: https://www.youtube.com/watch?v=MNA0pT_SUlY date created: 2025-05-31 15:00 --- # Title: Introduction to the OpenSSF — Comprehensive Overview and Insights ## Table of Contents:  - 📝 [Summary](#-summary) - 📖 [Main Content](#-main-content) - 🗒️ [Notes with Timestamps](#-notes-with-timestamps) - 🗣️ [Paraphrase](#-paraphrase) - 📰 [Newsletter Blurb](#-newsletter-blurb) - ✅ [Action Items](#-action-items) - 🧪 [Hypotheses](#-hypotheses) - 📊 [Methodology](#-methodology) - ❓ [Questions](#-questions) - 🔮 [Future Research](#-future-research) - 💡 [Implications](#-implications) - 🧠 [Learning Styles Assessment](#-learning-styles-assessment) - 📊 [Accessibility Assessment](#-accessibility-assessment) - 🌍 [DEIB Assessment](#-deib-assessment) - ✅ [Logical Validity](#-logical-validity) - 🔍 [DARVO Analysis](#-darvo-analysis) - 🔍 [SEO Evaluation](#-seo-evaluation) - 🎯 [Conclusion](#-conclusion) ### References: - Ram & Manish Adhikari. "Introduction to the OpenSSF." YouTube, 2025. https://www.youtube.com/watch?v=MNA0pT_SUlY - OpenSSF official website: https://openssf.org - Linux Foundation Training Portal --- ## 📝 Summary: This live stream introduces the Open Source Security Foundation (OpenSSF), part of the Linux Foundation, focusing on improving open-source software security through community collaboration, funding, education, and tooling. Ram hosts a detailed conversation with Manish, a DevOps engineer, discussing OpenSSF’s role in addressing security vulnerabilities, supporting key open-source projects like Rust and Python, and providing educational resources and tools such as Scorecard and Allstar. The session covers OpenSSF’s engagement with policies like the EU Cyber Resilience Act and emphasizes community contribution opportunities, especially for beginners. --- ## 📖 Main Content: The video starts with an introduction by Ram and Manish discussing their backgrounds and motivations for exploring OpenSSF. They explain how OpenSSF serves as a vendor-neutral hub for security efforts across various open-source projects under the Linux Foundation’s umbrella. Manish shares his experience with open source primarily as a user of tools like Linux, Docker, and Kubernetes. Ram highlights security gaps in open source, such as undisclosed vulnerabilities and difficulty connecting maintainers with fixers. OpenSSF helps bridge these gaps through funding initiatives like Alpha Omega, which supports projects including the Rust Foundation and Python Software Foundation by funding dedicated security engineers. The conversation explores OpenSSF’s projects spanning the software development lifecycle: code analysis (Scorecard, Allstar), supply chain security (SLSA, SBOMs, Salsa), and artifact provenance. Ram demonstrates how OpenSSF tools assess and improve repository security, encouraging community adherence to best practices voluntarily. Educational offerings through the Linux Foundation’s training portal provide free courses starting with basics and advancing to specialized topics in open source security. OpenSSF actively fosters community engagement, including working groups and events, inviting contributors to participate, including in emerging areas like AI security. The stream concludes with upcoming live events and calls for involvement, highlighting OpenSSF as an accessible entry point for security-minded open source contributors. --- ### 🗒️ Notes with Timestamps - [00:07](https://www.youtube.com/watch?v=MNA0pT_SUlY&t=7s) Introduction to OpenSSF, its purpose, and participant backgrounds. - [03:16](https://www.youtube.com/watch?v=MNA0pT_SUlY&t=196s) OpenSSF as Linux Foundation’s vendor-neutral security initiative for open source. - [10:01](https://www.youtube.com/watch?v=MNA0pT_SUlY&t=601s) Funding support through Alpha Omega for Rust and Python security engineers. - [13:20](https://www.youtube.com/watch?v=MNA0pT_SUlY&t=800s) Community building, education, and projects like Scorecard for repository security assessment. - [19:29](https://www.youtube.com/watch?v=MNA0pT_SUlY&t=1169s) OpenSSF projects cover the full software lifecycle: coding, building, deploying, monitoring. - [21:54](https://www.youtube.com/watch?v=MNA0pT_SUlY&t=1314s) Security best practices: Git TUF, SBOMs for container visibility, build transparency. - [26:53](https://www.youtube.com/watch?v=MNA0pT_SUlY&t=1613s) Artifact provenance and attestation concepts for trust in software supply chains. - [29:11](https://www.youtube.com/watch?v=MNA0pT_SUlY&t=1751s) Tools like Scorecard and badges encourage engineers to follow security best practices. - [34:43](https://www.youtube.com/watch?v=MNA0pT_SUlY&t=2083s) Free beginner courses (e.g., LFD121) offered by Linux Foundation for open source security. - [37:26](https://www.youtube.com/watch?v=MNA0pT_SUlY&t=2246s) OpenSSF’s resources, YouTube channel, Slack community, and ongoing work including AI security. - [42:13](https://www.youtube.com/watch?v=MNA0pT_SUlY&t=2533s) Announcement of upcoming Cryptic network security tool and in-person live streams. --- ## 🗣️ Paraphrase:  1. *Original:* "OpenSSF was formulated a few years ago to maintain a vendor-neutral home for specific security aspects around various projects." *Paraphrased:* A few years back, OpenSSF was created as an unbiased, vendor-independent foundation to centralize and manage security concerns across many open-source projects. 2. *Original:* "The OpenSSF provides tools like Scorecard that attach to GitHub repos to evaluate and score their security posture, helping consumers make informed decisions." *Paraphrased:* Tools such as Scorecard, offered by OpenSSF, integrate with GitHub repositories to analyze and rate their security health, enabling users to assess which projects are safe to use. --- ## 📰 Newsletter: This week, dive into a deep introduction to the Open Source Security Foundation (OpenSSF), a Linux Foundation initiative dedicated to securing open-source software ecosystems. Discover how OpenSSF funds vital security work for major projects like Rust and Python, offers practical tools like Scorecard to assess repository health, and provides free courses to boost your security knowledge. Whether you're a developer, DevOps engineer, or open-source enthusiast, learn how OpenSSF is shaping security best practices and creating welcoming paths for contributors. Explore resources, join the community, and safeguard your projects! Watch here: [Introduction to the OpenSSF](https://www.youtube.com/watch?v=MNA0pT_SUlY) --- ## ✅ Action Items: - Share OpenSSF resources and tools with your developer community to improve open source security awareness. - Encourage adopting OpenSSF security tools like Scorecard and Allstar in WordPress projects and plugins. - Promote participation in OpenSSF working groups and training, especially for new contributors. - Advocate for vendor-neutral, collaborative security approaches aligned with OpenSSF principles. - Monitor policy developments like the EU Cyber Resilience Act to guide open source security compliance. - Support funding mechanisms that sustain security efforts in key open source projects. - Incorporate OpenSSF education materials into developer training curricula. --- ## 🧪 Hypotheses: - OpenSSF’s vendor-neutral platform accelerates adoption of security best practices across diverse open source projects. - Community education initiatives by OpenSSF measurably improve security posture in small to medium open source projects. - Integrating OpenSSF tools within WordPress development pipelines reduces vulnerabilities over time. - Exposure to OpenSSF’s training improves contributor retention and engagement in security-related open source roles. --- ### 📊 Methodology: - Survey open source maintainers before and after using OpenSSF tools to assess security improvement. - Track usage metrics of OpenSSF educational courses among WordPress developers. - Analyze vulnerability trends in projects before and after applying OpenSSF recommen - Summary: Made with Restream Studio. Livestream on 30+ platforms at once via https://restream.io Often asked question ― What can be wrong with open source, that I need to secure it? This session will provide answers. Along with a comprehensive overview of the vital work being done by the OpenSSF to address these critical challenges head-on. We will explore the landscape of key OpenSSF projects and initiatives, designed to identify, fix, and prevent security vulnerabilities in open source software. Learn how the OpenSSF community is working collaboratively to build a more secure open source supply chain for everyone. Whether you're a developer, security professional, or simply sit downstream in open source ―― understanding the OpenSSF is crucial in navigating the future of software security. Join us for a live stream introducing the Open Source Security Foundation (OpenSSF), a cross-industry collaboration dedicated to improving the security of the open source software ecosystem. As open source adoption accelerates globally, so too do the associated security risks, creating widening "chasms" that malicious actors can exploit. This increasing reliance on open source components means that vulnerabilities can have a significant "blast radius" across diverse applications and industries. Tune in to learn how you can benefit from and contribute to a more secure open source world. - URL: https://www.youtube.com/watch?v=MNA0pT_SUlY Hello everyone, welcome to yet another live stream. My name is Ram. I'll be your host today. And this one is uh is a stream that I thought of um very late. Uh there there hasn't been a lot of opportunity for me to think about or empathize with a lot of the audience. And sometimes it's just been uh you know let's uh let's do something and uh let's talk to people about specific security technologies and things like that. But this time um I thought you know I should sit down and try and actually tell people what it is that the open SSF does and how they do it and why they do it and discuss with people about you know what their impressions are of the open SSF and honestly what they think about it and you know give people an opportunity to learn about the open SSF. um starting from what open SSF stands for. So volunteering uh in this sort of uh difficult task is Manish. Uh say hi to Manish everyone. Hello Manish. Hello. Hello. Manish joins us from amidst the beautiful Himalayas in the in in Nepal. Uh where specifically are you joining us from today Manish? I'm from the Sri Kandu. Ah okay. So um I met Manish at a recent DevOps days Kathmandu event. Uh he works on DevOps and security and all of these fun things and uh yeah like I said he sort of volunteered himself into this difficult position today. Manish, do you want to quickly introduce yourself to our audience first? Okay. Hello everyone, it's me Manishadikari. I'm from Nepal and I have completed my bachelor and I have been working as a devops engineer and doing lots of research on the basis of a security how we can implement in the devops. So as much as I would like to get a new knowledge from uh him. So I have joined this session to know lot about the open SSF which will be very beneficial for me and my future tech. Thank you. Cool. Um so have you let's start with this. Have you heard of the open SSF before? Yeah, I did some research. So it uh it is a security basis open uh source where uh people from the different community uh gives their opinion opinion on the basis of a security um how we can implement in the opensource softwares. Yeah, sounds about right. So that's what that's was my explore. Now I want to hear from you as much uh I can learn from you. Yeah. So I mean it's it's not far from um you know you know the truth. Um the open SSF is part of uh the Linux Foundation and uh at the Linux Foundation there's tons of projects and uh wherever there's a lot of open-source code there's you know open source security issues. So the open SSF was formulated a few years ago. Um and the idea is to maintain a vendor neutral home for specific security aspects around various projects. Um so yeah I'll uh that's like a very quick introduction about the open SSF. What's your experience with open source though? Um the reason I ask is it's uh easier for me to make the story relatable if I know um what your um open source leanings are. So as per the question uh in the field of opensource uh you can think me as a very beginner whether I have worked uh there uh some kind of opensource software like maybe it's not opensource devops uh activities Mhm. So in that case I may be some kind of a mid experience. Got it. So you you I'm not necessarily saying are you a consumer um even if you're a consumer of open source like I use I don't know Linux or I use Kubernetes at work or I use some other open source software I don't know so um I I'm I'm sure you've consumed some open-source software at various points and things like that right so most of us are like that. We might all not necessarily be contributors. A lot of us might just be consumers for example. Okay. So um any sort of any particular software that comes to mind um when I say what open-source software do you consume a lot? So as like told before that uh in my field as a deops so I have to use a lot like a Linux platform for that and uh dock of kubernetes and other related tools. Mhm. Right. So um so so here's the thing. Um when you use open-source software, what can happen is there might be some some that you're not aware of. There might be some security issues that you need help with. There might be not there might be I think there will be some security um vulnerabilities that get discovered in some other part of the world but not necessarily communicated to you. Um and same goes with um you might have certain vulnerabilities uh which you may or may not know how to fix but then somebody else does but you don't know how to get in touch with them or you don't know how to derive their work and apply to you things like that. So there's a fundamentally there the discovery of solutions in the security space might or might not exist and uh there are like a thousand problems like that about security in the open-source space that don't necessarily get worked on. Yeah. Uh so the open SSF is sort of responsible for this gap and make sure that this gap is plugged and therefore all of the aspects of security especially for open source software is addressed in some form or the other. Okay. How does open SSF work uh with opensource communities and projects? That's a good question. Um there's many channels for how the open SSF interacts um with specific communities. Uh I I'll give you examples of like one or two. Um there was this um there was this initiative called the Alpha Omega initiative and what they did as part of Alpha Omega was they put out a certain quantum of funding where they would fund an engineer to work on specific issues for specific open-source tools. Um I know of two uh places where they successfully completed work like that. So the first one that I know of was uh with the Rust Foundation. Um so Rust as you know is a uh popular Rust as you know is like an open-source uh language right? So it's owned by the Rust Foundation basically. Um, so the Rust programming language had some very um, how do I say very gnarly and deep type safety issues and memory safety issues. So, uh, it was a big priority for the community to get those fixed, but they didn't necessarily have sufficient funding in order to find and fund engineers who will work on these specific initiatives. So the open SSF through the Alpha Omega program put uh some money into that and uh they helped uh the Rust Foundation work on this. Similarly um there there were donations made uh through Alpha Omega which is again one of the open SSF initiatives to invest some money that can go into the Python software foundation for example and uh they hired a person to work full-time in resolving Python security issues. Um and a third example was the Eclipse Foundation. So there's a there's this whole notion called uh software supply chain security which has started to become like a big thing for open-source consumers and things like that. And so the open SSF has worked um with the Eclipse Foundation in order to improve um their security posture essentially and do better um supply chain security. So they so the the best way to work uh with the open SSF is through you know I mean demonstrated success is uh through these foundations and getting them to take a look at your project and seeing if some uh funding opportunity opens up and uh plugging the holes either through paying maintainers or finding some engineers to actually do something. Okay. Can you say what are the some most common security risks in open SSF today? So there's there's many areas that uh the Open SSF works with. So I'll just give you um I I'll show you a few things about what they actually work on um so so it's more clear. Um I hope my screen is uh visible. Yes. So the open ssf website is open sssf.org. Um I I should have probably said this in the beginning but open ssf stands for opensource security foundation. So the open is just open and then open-source security foundation. So there's S, SS and F. Uh SSF stands for source security foundation. Um so the the way the open SSF works is there's two three different uh kinds of activity that constantly happen. A there's bringing the community together and doing a lot of the wrangling around building and maintaining a community etc. And then there's educating the community constantly about you know here's some uh security issues here's how to fix them here's how we approach uh certain kinds of security etc. And then there's the whole thing about having projects which is like uh uh being the like I said vendor neutral home for a lot of the projects that they host. So uh projects are a big part of um the open SSF and what they do. So they use a lot of these projects um to tackle certain specific security issues. So for example, uh scorecard, which is one of my um favorite projects in the ecosystem because it's just, you know, so convenient and so easy to use and and scorecard basically attaches itself to any uh GitHub repo for example. Um and then scorecard will say how good or bad your repo actually is. Uh so as somebody who consumes open source you can go check out the repo and say okay this is a secure repository for me to use or this is a very unsecure repository for me to use I can't use it at all. So whatever you think of you can always make a decision based on what scores you receive from scorecard. So projects like these are a very fundamental part of um the open SSF and that's mainly how they you know keep their work active and things like that. Okay. How do they prioritize the security issue? So the open SSF by itself doesn't you know work on specific priorities and things like that. Um so there's a there's a couple of areas where the open SSF is invested in security at large. So there's uh there's a lot of work that they do with US governments, government agencies and with the United Nations and things like that. And then there's a bunch of things that they do in EU there. Hopefully in future there'll be like some stuff they do as part of the the subcontinent as well. But at the moment it's focused on like uh the US and the EU where there's a massive policy framework in place about digital assets and opensource and cyber security and things like that. And the opens sort of cuts across all of these different areas and sits at the intersection so to say. And so right now uh some of the big priorities are participating in what is known as the cyber resilience act of the EU uh and then also working with like the government the US government sorry on what they can do in terms of advancing policy and open source and keeping that open source safe and uh things like that. So these are two very broad umbrella sort of areas that the foundation is invested in uh as work. So these might not necessarily be individual CVEes for example and fixes and things like that but it's a much broader brush stroke uh in terms of what kind of security work they're doing. [Music] Okay. So for the beginners um is there any opensource tools or project that uh can be explored? Yes. Um I'm glad you asked. There are so many tools and projects. So I'll show you this. So if you go to the open sssf.org page um you see all these people waving uh past that here on top there's a projects menu. Um so here you can check all of the projects. So the way I like to think about it is there's there's a software development life cycle right? So there's uh writing code on the one hand and then there's uh building it into an artifact things like that and then there's deploying it uh and keeping it in production etc. And then there's so many stages in between all of this uh where this sort of build and deploy life cycle repeats itself. Now the I I like to think of it as the open SSF has a project for every single one of these stages and more. So um there's as you can see there's like so many different projects. Uh all of these are open source. I'll take like a minute to go through all of them very quickly so that you know it it it makes some sense as you as you start working through it. Um much like other foundations uh the open SSF follows like a sandbox incubation graduation um sort of uh flow for all of their projects. But it's basically like all of them are open source all of them are free for you to explore. um you can you know check them out and and and do things. So there's one set of tools that focus on u code which is like the first step. So if you've written some code um there is there are there are a couple of projects that will go in that will check your code and showcase how certain best practices and certain vulnerabilities or certain scanning stuff and all. So it's a combination of some static scans um so and then some dynamic scans as well and then all of that will result in like a a numerical score or some kind of alerts and things like that. So Allstar for example is like um it's a it's it sits on GitHub. uh it'll take a look at your source code and then it'll tell you um how well or how badly your code is performing overall um and how good or bad your code bases in terms of what the problem is. Here's how you can fix it and here's where it occurs in the code that sort of thing. Um very similar to scorecards which we saw uh in some some manner. Uh and so the combination of scorecards and baseline which is another uh project that's you know being worked on uh it'll provide like here's the minimum that you need to do in terms of being secure and being uh resilient and keeping your code uh clean and your uh your adherence uh to certain best practices etc. So uh these three four projects will really help in that early stage of here I am writing code can how good or bad this is. Okay. And then you sort of move a little up the order where you go past the coding or the programming phase of things into um I want to start building and I want to start deploying and here's how I do ops and things like that. So there's uh there's things that you do uh like git tough for example is it marries uh the git protocol that you have with certain best practices uh that are a part of a very old the update framework or tough project and then it'll help you set very crucial permissions and things like that so that you know a lot of attacks that happen to um through exfiltration of your secrets, excfiltration of your project information etc doesn't happen or doesn't recur and things like that. So um that's the sort of next stage in my opinion where after you've written code a lot of things sit around in the periphery of your code and there's some open source open SSF projects that sit there. The next stage is building uh your code into an artifact. And uh the big thing there are these uh things known as Sbombs or software bill of materials. Often times, and I'm sure you've experienced this when you use containers, what happens is you don't necessarily know everything that's inside your container. So there might be pieces of the final container image that gets deployed that you don't necessarily have awareness about and so uh you know the open SSF has certain projects that will help in that area and uh it'll help people add that kind of important security by specifying all of the things that have gone into certain builds and being able to create a whole system around the information about a build and making people, you know, aware of, okay, here's what's inside this image and here's what's here's what's, you know, inside these containers, etc. So if you're deploying like a fleet of 50 containers, then it can tell you equivocally what's inside every single one of them, which is very critical in terms of visibility and awareness. And so there's projects that can help you do that. Um, and then once you build this information about various projects, you have to process them in some way. So uh you can you can create policies for example and you can tell how you want um you know certain things deployed and then you can um you can you can keep all of this information in graphs for example and so there's so many projects that help with that. So Guac for example is a very popular project within the open SSF for the reason that there's a lot of data generated about builds for example and nobody knows what to do with them. Uh so guac provides that uh critical functionality of automation and uh creating representations of how different uh pieces within let's say a container image are related and how uh certain libraries and dependencies are formed. And so it it provides all of that information contextually so people can make informed decisions about you know what is wrong uh with a certain code base just by um knowing what has gone into them for example. So um again lot of stuff around sbombs and data formats etc. Um a and so the other thing um I wanted to highlight are stuff having to do with here's an image and how do I verify that it's right. So code signing um or adding signatures to images is a very important uh piece of the security puzzle. It it helps validate who's doing something. And so there's concepts known as attistations and provenence in the world of security. Um attestations are about proving that the immutable artifact in question is in fact made from a genuine source. And so that proves that you know it comes from a genuine source. And so that's the provenence of the artifact. So, uh, it tells people where certain things came from and who's responsible for building them and where was it built, etc. And so, you can add signatures to communicate that and build that kind of trust. Um and so in addition to this thing called salsa here um it's it's very important to secure not just the code that you write and what you put out but also where it gets built and how it gets built and make sure you communicate that information and that is the functionality that salsa provides and so um like I said in every single piece piece of the software development life cycle. There's some open SSF project that can um sit and help you. And and again, all of these are open source. You can check them out. They're all linked from um this project page under under all projects. I'll open one for example. So if you go to scorecard there is a landing page that explains what scorecard is but also there's you know enough information to take you to the actual scorecard repo on GitHub and uh you know point to all the documentation and all of the information that is required uh for you to start using scorecard in your projects. So that's about some of the projects like a very very short introduction to be honest but uh obviously each of these are are are quite detailed. Uh six door is our only graduated project at the moment. Uh we have a handful that are incubating and uh another handful that are in the sandbox. Um, obviously there's like a pre- sandbox uh stage as well. Not sure what that call it but um yeah it's uh it's available. So how does it ensures that it's recommended and standards are adopted only ecosystem. Uh-huh. That's right. how they ensure. [Music] So it falls on the engineers to make sure that you know people are following certain things. Um let's see um for example there's a TensorFlow project. Um I think it's uh very popular in the world right now. And if you look at it um here is an open SSF scorecard score. Here is an open SSF best practices badge. So it's it's incumbent on the engineers that are working on these code bases to use these tools. the open SSF doesn't force or enforce certain things on these communities but I think communities that want to secure things and keep you know keep their code bases secure and want to communicate this sense of security to any potential downstream users then the open SSF has ways um so I guess there's like an old adage um god helps those who help themselves or something like that. So, um if if you're open to being secure, the the Open SSF provides certain frameworks for you to be able to do that. Um and and for example, like this information is uh publicly available where you can go in and take a look at all of the different checks that scorecard has. And this is linked from your repo. And uh it'll provide what the problems are. For example, this is pin dependencies are you know a problem and uh so it'll give you details about where the problem is and in your individual scan it'll tell you where it can be fixed as well. So it'll point you to the documentation about um how to fix this and uh where to look for a fix etc. Um and then like static analysis is also a part of um this check. And so um the the reason there's no uh 10 on 10 score for example for static analysis is because uh static analysis tool was not run on all commits for this repo. So it'll tell you why there are problems and obviously the documentation will show you how you can fix it and things like that. So this is an example of you know how you can make use of things to um improve your uh improve your scores for example. Oops sorry. So that's how enforcement happens. Uh it's not like somebody at the open SSF is looking at all of these and saying hey do this or do that. um it provides all of the foundational aspects that are necessary and then you know it's like I said uh it's incumbent on uh engineers working on the project or people in the community working on the project to make sure that it adheres to the best practices etc. So it's like a contribute. Yeah that's right. Okay. So how can open SSF uh projects benefits from the smaller open source project how do we benefit from what I mean I mean uh how can a smaller opensource project benefit from what opensource offers So the open SSF is um you know always available to make projects more secure for example um if you're a smaller project and you want to project security for example the best way to do it is um to try and adopt certain open source opens of best practices is for the opensource codebase and you know being secure is important um not just having like tons and tons of features and around with them etc and so if smaller projects want to be uh and want to showcase more security I guess they can start adopting things from the open SSF and that's a good place to start okay that's great So what would you suggest? Which one should a beginner use? Yeah. So I'm kind of glad you asked. Um so one of the things at the open SSF is tons and tons of courses. U so education is a big part of the open SSF and we take it very seriously. Uh so there's a one two three four five six seven courses uh around open source and security etc. And I would say start with LFD121. So it's and all the seven are free courses. Uh these are all provided as part of the Linux Foundation training. If you don't know, Linux Foundation has a massive training um repertoire of courses and uh some of them are paid uh but a lot of them are free as well. Um and so the open SSF has hosted all of its training material as part of uh the LF training uh stuff and uh there's a there's a lot of courses that take you from the very basics of how you approach security for open source and then build to uh different kinds of understanding. So for example, uh there is a scorecard specific course. There's a six store specific uh course. Um so but then there's also stuff like uh here's how you do better supply chain security with sbonds and signatures. So that it all sort of builds up into more courses and the idea is you have an understanding of security, you have an understanding of open source um at the end of it. So you might start as an absolute beginner to security and you might start as an absolute beginner to open source but nonetheless as you start exploring the course and things like that more information becomes available to you and that is where I would recommend that anybody new to all of this start. Okay, that's great to start from the beginning. So I think that's a good CTA and you know I'd like to pause here. This is obviously a lot of information um for people who are who are watching remotely. So yeah, unless you had further questions, I think you know we can we can uh we can stop here. Um obviously in terms of resources there's the opensf.org website. Um there's the open sssf YouTube channel where a lot of great content gets posted all the time. Um so I would say you know check us out on YouTube and um subscribe. I guess I don't want to sound like like a Tik Tocker or an Instagram smash that sub or whatever, but I think if you're if you're interested in like security topics and things like that, start there. Um obviously we have like a Slack um etc. um which you can join. Um all of it is linked from the opens.org website. uh there's a lot of projects that require help. Um so you can you know consider open SSF a good place to start with your open source contributions um that requires you know a lot of help. So um take a look at all of the different projects and the working groups. There's um I'll tell you this, there's stuff that's as boring as like security stuff drill downs that happen, but there's also like AI and security um which I think you know is a big draw for people as it is that um anything AI is better than anything regular I guess. uh but there's also like a lot of AI security conversations that are going on that people can start to you know speak about and participate in and um share thoughts basically. So I what I'd what I'd love for people to do is, you know, obviously take the courses and speak to people and things like that, but also take a look at all of the work that's going on in various working groups and things like that and see where you can participate. So um a lot of open source work is, you know, less glamorous. Um, we're always looking for contributors and it'll be wonderful to have more and more people participate from the community, especially if you're a practitioner and you consume open source and you want it to be a little more secure. Okay. As a contributor, so people do lots of a thing. So by giving a small contribute uh in a big project that can be a good choice. Yeah, I I I think so too. Okay, that's great. I think I understand many more about the open source. So I will be contributing in this field to in the different opensource softwares. Sure. Yeah, that I look forward to it. But I guess uh that's all we had for today. Um thank you so much everyone for joining us. Uh thank you so much Manish for you know taking the time and participating from you know again the beautiful uh valleys of Nepal. I I I live in a tropical part of the world. Uh we live next to the ocean so I don't get to see mountains at all and every time I visit Kathmandu I'm fascinated. It's it's like uh I can't get enough of the mountains and the views and things like that. So yeah. So it's my pleasure that you call me and uh uh to do a live stream about and talk about open SSF. So I it was a great opportunity for me to gain a new knowledge. So from today onwards I will be a contributor in the open source. So thank you for uh having me in this live stream. Hey absolutely man. Thank you so much for making the time. Um we have a few more streams coming up. So our next stream is on the 3rd of June. Uh that one's about a very specific open-source tool that uh helps around security. It's called Cryptic and it's made by uh Tarun uh who decided to you know open source it and so he's going to showcase a few nifty things about how it can do some network security uh stuff and then the week after that I'm going to try and do my first in-person live stream. Uh, so lots of firsts this time. Uh, what I mean by in person is so far all of my guests have been remote, but I might do uh I'm planning to do one with, you know, another person in the same room, and I don't know how that's going to work out, but we won't know until we've tried, right? So, I'm going to try that. Uh, that's on the 15th uh of June or the 14th 14th of June, the Saturday. So I'll I'll you know follow the open SSF socials. We'll post all the information there. We'd love to see you as part of an as part of the audience then as well. Okay. But thank you so much for Yes. Manish. Okay. I will be joining in that day too as audience to thanks. Okay. Thanks so much everyone for tuning in., Introduction to the OpenSSF, OpenSSF, 01jwkz5bvj1pp5rxgh1wvr8khk.