<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Nicola!</p>
<p class="MsoNormal">Thanks for reaching out! (And for understanding that the metric dashboard is alpha quality, and on a good day, an approximation of the health of a project.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">So yes, many of the items don’t reflect reality.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For OpenSSL, the Scorecard data is gathered by this project (which I’m just a consumer of):</p>
<p class="MsoNormal"><a href="https://github.com/ossf/scorecard">ossf/scorecard: Security Scorecards - Security health metrics for Open Source (github.com)</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph">For example, the SECURITY.md, it
<a href="https://github.com/ossf/scorecard/blob/main/checks/security_policy.go">appears</a> that project is just looking for a file with that name in either the root for the .github folder. Similarly for the others, but I will go through OpenSSL today to make
sure it’s at least *<b>technically</b>* working correctly.<o:p></o:p></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><o:p> </o:p></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph">As we move this project forward, we want to be able to pull out metrics on non-GitHub projects as well. I’ll also add a note to the dashboard page itself about the content being alpha
quality, etc.<o:p></o:p></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><o:p> </o:p></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph">But to the larger going forward point, yes, on behalf of the working group, we would greatly appreciate additional insight and thoughts into how we can make this useful and reflect
reality – the intent isn’t to make *<b>any</b>* project look “bad”, especially due to our implementation.<o:p></o:p></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><o:p> </o:p></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph">Thanks again!<o:p></o:p></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><o:p> </o:p></p>
<p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph">Mike</p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="mso-element:para-border-div;border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="border:none;padding:0in"><b>From: </b><a href="mailto:nic.tuv@gmail.com">Nicola Tuveri</a><br>
<b>Sent: </b>Tuesday, May 4, 2021 3:12 AM<br>
<b>To: </b><a href="mailto:openssl-project@openssl.org">OpenSSL Project</a>; <a href="mailto:otc@openssl.org">
otc@openssl.org</a><br>
<b>Cc: </b><a href="mailto:Michael.Scovetta@microsoft.com">Michael Scovetta</a><br>
<b>Subject: </b>OpenSSF Security Metrics Initiative</p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi,<br>
<br>
I wanted to point out to the OMC and to openssl-project a new initiative from the [Open Source Security Foundation](<a href="https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.openssf.org%2F&data=04%7C01%7Cmichael.scovetta%40microsoft.com%7Caa7009fae37b409b8be808d90ee461ae%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637557199518547959%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=IZnS4v%2Fis0bWmwKiMoqUvP5w%2FCxDYTnf5LkGnYIrdbE%3D&reserved=0">www.openssf.org</a>):
the Security Metrics Initiative.<br>
<br>
A more detailed description is available at <<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fopenssf.org%2Fblog%2F2021%2F05%2F03%2Fintroducing-the-security-metrics-project%2F&data=04%7C01%7Cmichael.scovetta%40microsoft.com%7Caa7009fae37b409b8be808d90ee461ae%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637557199518557915%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=2NhTSK5Wq0wrbl2dOYEXEuDP4XhNNrPjYvhx7iTb624%3D&reserved=0">https://openssf.org/blog/2021/05/03/introducing-the-security-metrics-project/</a>>.<br>
It should be remarked that the <<a href="https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fmetrics.openssf.org%2F&data=04%7C01%7Cmichael.scovetta%40microsoft.com%7Caa7009fae37b409b8be808d90ee461ae%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637557199518557915%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Vv3u%2FW1306qjsMY0CMgaknp7%2BGRw2rKGLZlVPa9g2M8%3D&reserved=0">metrics.openssf.org</a>>
service is to be considered alpha, and that changes in the API, in data sources might occur at this stage, and that there might be inaccuracies in the reported data.<br>
<br>
Here is a direct link to what the initiative reports for the OpenSSL project:<br>
<<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmetrics.openssf.org%2Fgrafana%2Fd%2Fdefault%2Fmetric-dashboard%3ForgId%3D1%26var-PackageURL%3Dpkg%253Agithub%2Fopenssl%2Fopenssl&data=04%7C01%7Cmichael.scovetta%40microsoft.com%7Caa7009fae37b409b8be808d90ee461ae%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637557199518567873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=FHJmwJsN8fDLMX2Em4tXQsIwaTQPlOum8esW7Tie%2FeQ%3D&reserved=0">https://metrics.openssf.org/grafana/d/default/metric-dashboard?orgId=1&var-PackageURL=pkg%3Agithub/openssl/openssl</a>>.<br>
<br>
In particular it seems we score quite low on the OpenSSF Scorecard (30.8% as I am writing this mail) and, also for the data coming from the OpenSSF Best Practices Badge Program, it looks like the project has many negative marks.<br>
<br>
It should also be noted that the description field in the project information for `github:/openssl/openssl` reports:<br>
<br>
> This is a historical badge entry for the OpenSSL project before the Heartbleed vulnerability was reported, circa February 2014. Please note that the OpenSSL project's status has changed substantially since then. For the current state of OpenSSL, see the current
OpenSSL badge entry. [...]<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt">So maybe it is not too alarming that many of the negative marks are coming from unexpected entries: e.g. it seems at the moment it reports we don't have/use static/dynamic analysis, we don't have vulnerability
reporting, code review, CI Tests or Pull Requests.<br>
<br>
Nonetheless given this tool might soon be used to pick among alternatives when making critical infrastructure design choices, or affect funding decisions or resource planning, it might be a good thing for the OMC to get proactive and reach out to straighten
the record for current OpenSSL releases, to offer suggestions on alternative metrics to be considered, on redefining criteria for existing metrics, and possibly incorporate feedback from the Security Metrics initiative to adapt plans regarding future roadmap
for OpenSSL.<br>
<br>
I finish reporting in this email the last paragraph from the Security Metrics Initiative announcement, as it might be of interest for all subscribers to openssl-project:<br>
<br>
> Your [feedback](<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fossf%2FProject-Security-Metrics%2Fissues&data=04%7C01%7Cmichael.scovetta%40microsoft.com%7Caa7009fae37b409b8be808d90ee461ae%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637557199518567873%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=1YYtuiuTGuWh2msSmCfMxIgwUHXpjRloT3VXvCOUxZE%3D&reserved=0">https://github.com/ossf/Project-Security-Metrics/issues</a>)
is most welcome, and if you're interested in learning more or joining this effort, please reach out to [Michael Scovetta](mailto://<a href="mailto:michael.scovetta@microsoft.com">michael.scovetta@microsoft.com</a>) or join us at our next [working group](<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fossf%2Fwg-identifying-security-threats&data=04%7C01%7Cmichael.scovetta%40microsoft.com%7Caa7009fae37b409b8be808d90ee461ae%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637557199518577822%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=pbDTWeCEOv0hgAN8arvQp2kbhzmAdW%2BEVwn3iMa%2FDRk%3D&reserved=0">https://github.com/ossf/wg-identifying-security-threats</a>)
meeting.<br>
<br>
<br>
<br>
Best regards,<br>
<br>
Nicola Tuveri<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>