Improving Global Software Supply Chain Security with Alpha-Omega
summary
Alpha-Omega focuses funding and people on the Alpha: top 100–150 projects with contracts and resident security engineers while Omega: ~10,000 projects scanned with CodeQL and Semgrep plus fuzzers produces candidates that staff triage into real, fixable bugs. Program starts with a $5M fund, has spent ~20% on Node, Eclipse and Python, and is automating SBOM generation, funding security developer‑in‑residence roles, running audits, integrating sos.dev bounties, and hiring program managers, engineers and triage leads. Monthly reports track what actually works.
AI-written summary · about
chapters (15)
- 0:00Intro
- 1:19Alpha-Omega Mission
- 3:06Background: What is Alpha-Omega?
- 3:49Background: What Alpha-Omega Isn't
- 4:37Background: Alpha vs. Omega
- 5:55Omega Toolchain
- 6:37Alpha: Scaled Impact, Leveraged Effort
- 8:17Python Software Foundation
- 10:43Global Strategic Members
- 10:59Eclipse By the Numbers
- 12:44Eclipse Foundation Core Services
- 13:38Use of Alpha-Omega $400K Investment ECLIPSE
- 16:39Future: Secure Open Source Rewards (sos.dev)
- 17:52How to Contribute
- 19:37We're Hiring!
related talks
53mAlpha-Omega: What We've Learned From Funding Open Source Security Over the Past 3Years, What's Ahead
44mSecurity Research with Open Source Software: Vol. Omega
55mReviewing another year of security partnership between the PSF & Alpha-Omega- 44mSecurity Research with Open Source Software: Vol. Omega
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
36mSupply-Chain Security, Outside in: What Helping ~200 Projects Improve Their Security Looks Like
43mThe Importance of Developer Tooling to Make Open Source More Secure by Default
43mFunding Security in Open Source: Insights From FreeBSD’s Audit Journ...