Securing open source software: Whose job is it, anyway?

CISA announced a voluntary threat intelligence sharing program with the open source community, while major ecosystems (Rust/crates.io, PyPI, Packagist/Composer, Maven Central, and NPM) committed to measures like PKI and signing, Trusted Publishing expansion via OIDC, vulnerability scanning, MFA, Sigstore, provenance, and SBOMs. Framed by lessons from Log4j, the report emphasizes public–private collaboration and urges software manufacturers to fund and contribute to OSS, and to improve patch management, noting persistent high-risk vulnerabilities in commercial applications.