Tech Giants Fund Initiative To Prevent Future Heartbleeds

Can more funding prevent Heartbleed vulnerabilities in future open-source software? A new Core Infrastructure Initiative at the Linux Foundation is attempting to find out.

More than a dozen major technology companies are backing the project. Participating firms will contribute $100,000 each per year for three years to the foundation. At launch, supporters include Google, Microsoft, Amazon, IBM, Facebook, Dell, Cisco, Intel, Rackspace and Fujitsu. A total of $4 million has reportedly been raised so far.

On its Web site, the Foundation said the project, "inspired by the Heartbleed OpenSSL crisis," will fund those Linux-based open source projects that the organization considers on the critical path for core computing capabilities.

Steering Group, Advisory Board

The widely used OpenSSL certainly qualifies on that score, since it is employed for the secure transmission of passwords and other data. A major flaw -- which allowed the encryption to be broken without leaving a trail -- was made public on April 7, two years after the error was inadvertently written into OpenSSL.

Overseeing the funds will be the foundation and a steering group, the latter which will consist of representatives from the tech companies, key open-source developers and others. The committee will select projects and developers, approve funding, oversee project roadmaps, and work to add additional members. There will also be an advisory board of key developers and industry stakeholders.

The funds are expected to be used for fellowships for key developers to devote their full-time efforts to the designated open-source project, as well as for security audits, computing and test infrastructure, travel, face-to-face meeting coordination, and other expenses. For the OpenSSL project, funds will also be used to improve responsiveness to patch requests.

'Smart and Not Too Late'

The foundation noted in an FAQ on its Web site that the shared code used in some open-source projects had...

Comments are closed.