What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
On May 12, 2022, the Linux Foundation and the Open Source Security Foundation (OpenSSF) announced a ten-workstream plan to improve open-source software security. It set out proposed funding of approximately $150 million over two years and an initial pledge total of more than $30 million from six companies. Those were launch figures—not confirmation that the full amount was raised or that the plan’s targets were completed.
What happened at Open Source Software Security Summit II?
The Linux Foundation and OpenSSF said they convened more than 90 executives from 37 companies alongside government leaders from the National Security Council (NSC), Office of the National Cyber Director (ONCD), Cybersecurity and Infrastructure Security Agency (CISA), National Institute of Standards and Technology (NIST), Department of Energy (DOE), and Office of Management and Budget (OMB). The stated purpose was to agree on actions to strengthen the security and resilience of open-source software and its supply chains. The organizers described the May 12 meeting as following a January 13, 2022 summit led by the White House NSC. The Linux Foundation’s announcement records the event and its stated aims.
As an Amazon Associate I earn from qualifying purchases.
What was the Open-Source Software Security Mobilization Plan?
The plan grouped proposed actions around three broad goals: creating more secure open-source software, improving vulnerability detection and remediation, and reducing the time needed to patch vulnerabilities. The announcement described approximately $150 million in proposed funding over two years to advance solutions to ten identified problems. It was a mobilization plan, not a report of completed work.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe ten stated workstreams
- Security education: Establish baseline secure software development education and certification for professional open-source developers.
- Risk assessment: Create a public, vendor-neutral dashboard using objective metrics to assess the top 10,000 or more open-source components.
- Digital signatures: Accelerate adoption of signatures on software releases.
- Memory safety: Reduce vulnerability root causes by replacing the use of non-memory-safe languages.
- Incident response: Establish an OpenSSF incident-response team to help projects during critical vulnerability events.
- Better scanning: Help maintainers and experts find vulnerabilities faster through improved tools and expert guidance.
- Code audits: Conduct third-party reviews and remediation of up to 200 of the most critical open-source components per year.
- Data sharing: Coordinate industry-wide sharing to improve research into which open-source components are most critical.
- SBOMs everywhere: Improve software bill of materials (SBOM) tooling and training to encourage adoption.
- Improved supply chains: Strengthen the ten most critical open-source build systems, package managers, and distribution systems with better tools and practices.
The targets describe what the organizers proposed in 2022. The announcement does not establish that the dashboard, audits, or other outputs were later delivered. OpenSSF’s release also summarizes the plan’s broad goal categories.
#1 Best Overall
How much money was pledged, and what did the figures mean?
The announcement used several figures for different purposes. They should not be conflated: the approximately $150 million was the proposed scale of the plan, while more than $30 million was the initial pledge total announced by Amazon, Ericsson, Google, Intel, Microsoft, and VMware.
| Figure | What the May 2022 announcement said |
|---|---|
| Approximately $150 million over two years | Proposed funding scale for advancing the ten workstreams; not a statement that this amount had already been raised. |
| More than $30 million | Initial pledges attributed to Amazon, Ericsson, Google, Intel, Microsoft, and VMware. |
| $5 million | Microsoft CTO Mark Russinovich identified this as Microsoft’s commitment to OpenSSF. |
| More than $110 million and nearly 100 full-time-equivalent employees | Estimate of existing open-source security investment and effort, attributed to an informal stakeholder poll. |
The first three figures concern proposed or pledged support; the last describes an estimate of existing activity from an informal poll. The release does not provide a later accounting of how much was ultimately funded or spent.
Why did the organizers call for coordinated action?
Linux Foundation Executive Director Jim Zemlin framed the plan as a shared responsibility to improve cybersecurity resilience and trust in software. OpenSSF Executive Director Brian Behlendorf described its ten workstreams as starting points and called for further input and commitments to move from plan to action. Their comments reflect the announcement’s emphasis on coordination among companies, open-source communities, and government—not a comparison or endorsement of commercial security products.
Recommended Free Tools
What the 2022 announcement does—and does not—show
The release documents the summit, the proposed workstreams, and the launch-stage funding figures. It does not, by itself, establish whether every pledge was fulfilled, whether the proposed funding was raised, or whether each target was completed. Readers looking for implementation results need later reporting; the announcement is best read as a historical account of the plan and commitments made at its launch.
Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
