Google’s open-source security move may be pointless. In a perfect world, it should be.
One of the bigger threats to enterprise cybersecurity involves re-purposed third-party code and open-source code, so you'd
think Google's Assured Open Source Software service would be a big help.
Think again.
Here’s Google’s pitch: “Assured OSS enables enterprise and public sector users of open source software to easily incorporate the same OSS packages that Google uses into their own developer workflows. Packages curated by the Assured OSS service are regularly scanned, analyzed, and fuzz-tested for vulnerabilities; have corresponding enriched metadata incorporating Container/Artifact Analysis data; are built with Cloud Build including evidence of verifiable SLSA-compliance; are verifiably signed by Google; and are distributed from an Artifact Registry secured and protected by Google.”