U.S. Open-Source Software Security Initiative Workshop

该项目正在支持一个虚拟研讨会，以研究如何提高开源软件生态系统的安全性。这是一个仅限受邀者参加的研讨会，重点关注四个核心主题领域：（1）开发人员对信任安全的看法&;（2）内存安全编程语言;（3）软件依赖管理;（4）保护开源软件的行为和经济激励。研讨会包括邀请演讲，小组讨论和技术分离会议。该项目的新奇在于将来自美国政府、学术界、私营部门和开源软件社区的利益相关者聚集在一起，并同时研究技术和激励方面。据我们所知，至少在过去20年里，没有采取过这样的主动行动。该项目更广泛的意义和重要性是通过投资公共和私营部门都依赖的共享开源软件基础设施和应对全球软件社区的挑战来使美国受益。该研讨会直接支持由白宫管理和预算办公室领导的美国开源安全倡议“加强和投资安全和透明的开放源码软件开发”，该倡议涉及关于改善国家网络安全的白宫第14028号行政命令。该研讨会旨在围绕投资于开放源码软件安全的可能方法产生想法和广泛讨论。该项目的一项具体产出是一份报告，总结了关于在这四个专题领域取得进展的结论和建议。这些建议可能包括USG研究与开发（R D）投资（包括潜在的重大挑战奖），采购实践，政策和法律的问题，以及其他机制，通过这些机制可以提高开源软件的安全性。该奖项反映了NSF的法定使命，并已被认为是值得通过使用基金会的智力价值和更广泛的影响审查标准进行评估的支持。

This project is supporting a virtual workshop to examine ways to improve the security of the open-source software ecosystem. This is an invitation-only workshop focusing on four core topic areas: (1) Developers' Perception of Trust & Safety; (2) Memory-Safe Programming Languages; (3) Software Dependency Management; and (4) Behavioral and Economic Incentives to Secure Open-Source Software. The workshop consists of a combination of invited talks, panels, and technical breakaway sessions. The project's novelty is in bringing together stakeholders from the U.S. Government, academia, private sector, and the open-source software community, and examining both the technical and incentive aspects in tandem. To our knowledge, such an initiative has not been undertaken, at least in the last 20 years. The broader significance and important of the project are to benefit the United States by investing in the shared open-source software infrastructure that the public and private sectors both rely on and addressing challenges spanning the global software community. The workshop is in direct support of the U.S. Open-Source Security Initiative “Enhance and Invest in Secure and Transparent OSS Development”, led by the White House Office of Management and Budget, which addresses the White House Executive Order 14028 on improving the nation cyber security. The workshop is designed to generate ideas and broad discussion around possible approaches to invest in the security of open-source software. One concrete output of the project is a report summarizing findings and recommendations on making progress on these four topic areas. These recommendations may cover USG Research and Development (R&D) investment (including potentially a grand challenge prize), acquisition practices, policy and legal issues, and other mechanisms through which open-source software security may be improved.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.