OSTIF’s Favorite Bug- DragonFly!

This summer, over four engineer weeks, Trail of Bits and OSTIF collaborated on a security audit of DragonFly. A CNCF Incubating Project, DragonFly functions as file distribution for peer-to-peer technologies. Included in the scope was the sub-project Nydus’s repository that works in image distribution. The engagement was outlined and framed…

Continue ReadingOSTIF’s Favorite Bug- DragonFly!

OSTIF collaborates with the Envoy Team to further improve security posture.

Envoy, the open source edge and service proxy designed for cloud-native applications, worked with OSTIF and X41 D-Sec to help improve the project’s security posture. The multi-phased engagement, sponsored by Google, focused first on the triaging and closing of bugs, then upon further improving the core fuzzers that continually monitor…

Continue ReadingOSTIF collaborates with the Envoy Team to further improve security posture.

OSTIF completes Security Audit of Crossplane- improved across the board!

Crossplane underwent a successful third party security audit by ADA Logics with the support of Open Source Technology Improvement Fund (OSTIF). Used by firms such as JP Morgan, Time Warner, and MIT Lincoln Lab, the project is considered Incubating at CNCF. Over the first half of 2023, the multi-cloud control…

Continue ReadingOSTIF completes Security Audit of Crossplane- improved across the board!

OSTIF’s Security Audit of K-9 Mail is Complete!

Open Source Technology Improvement Fund (OSTIF), K-9 Mail, and 7ASecurity collaborated on a security audit of the Mozilla K-9 email application. K-9 is an open source email application and runs on most Android phone systems. Ideally, the application is reliable, intuitive, and secure to use. Not only critical to Android…

Continue ReadingOSTIF’s Security Audit of K-9 Mail is Complete!

OSTIF’s Security Audit of Notation-duly Noted!

During the Spring of 2023, OSTIF, ADA Logics, and The Notary Project collaborated on a security audit of the new Notation libraries. Notation is a CLI project to add signatures as standard items in the registry ecosystem and to build a set of simple tooling for signing and verifying signatures. …

Continue ReadingOSTIF’s Security Audit of Notation-duly Noted!

LIBLOUIS CONTINUOUS FUZZING IMPROVEMENTS BY ADA LOGICS AND OSTIF

Open Source Technology Improvement Fund (OSTIF) is thrilled to announce the results of security improvements via improved fuzzing capabilities on the Liblouis project by ADA Logics! Liblouis is a braille translator with expansive capabilities that runs on open source code. In 2021, the project onboarded to OSS-Fuzz to perform ongoing…

Continue ReadingLIBLOUIS CONTINUOUS FUZZING IMPROVEMENTS BY ADA LOGICS AND OSTIF

Our audit of in-toto is complete!

In collaboration with X41 and in-toto, OSTIF is pleased to announce the publication of our audit of in-toto’s source code. In-toto, which has implementations in Python and Go, is a framework software for supply chain security. Integrating security and transparency through the entire process of application, in-toto’s holistic view of…

Continue ReadingOur audit of in-toto is complete!