Census III study spotlights ongoing open-source software security challenges

A Census III study from the Linux Foundation, OpenSSF, and Harvard highlights systemic FOSS security risks: prolonged backward incompatibility (e.g., ongoing Python 2 usage), the urgent need for standardized component naming to improve SBOM-driven supply chain security (e.g., PURL), the fragility of many critical projects due to low maintainer counts that undermine the “many eyes” myth, and growing adoption of memory-safe languages like Rust to reduce classes of vulnerabilities. The report urges better coordination, shared vocabulary, and prioritization of critical packages to strengthen open-source security at scale.