Alpha-Omega: What We've Learned From Funding Open Source Security Over the Past 3Years, What's Ahead
summary
Alpha-Omega reports raising about $23M and granting over $8M to open source security since 2022, pivots from mass scanning (top 2,000 PyPI projects) to cleaning the beach community interventions, funds staff roles (PSF security engineer, Eclipse security team) and audits that pair remediation, and spends ~60% on staffing. Projects funded include Homebrew integration of Sigstore/SLSA attestation for end‑to‑end verification. Future work emphasizes package repo economics, reproducible builds, and a rapid security review playbook.
AI-written summary · about
chapters (29)
- 0:00Alpha Omega's mission
- 1:05Funding open source security
- 2:51Scaling security across projects
- 4:38Community security approach
- 5:42Targeted funding impact
- 7:28Audits and project security
- 9:12Security ownership in open source
- 10:36Measurable security improvements
- 12:21Funding governance decisions
- 14:11Ecosystem-wide initiatives
- 15:36Collaborative oversight funding
- 16:59Shared learning across projects
- 18:27Open source security economics
- 21:35Growth vs security priorities
- 23:21Package manager fragility
- 25:48Sustainability business models
- 26:33Your dependencies are your problem too
- 28:42Compliance driving security
- 30:51Supply chain risk strategies
- 34:22Human element in security
- 37:33What's next for Alpha Omega and open source security
- 39:59Co-funding models
- 41:23Rapid security reviews
- 42:25Reproducible builds importance
- 43:48AI security in open source
- 45:12Package manager sustainability
- 46:37Open source incident response
- 48:16Common open source metadata
- 50:25Closing remarks
related talks
22mImproving Global Software Supply Chain Security with Alpha-Omega
55mReviewing another year of security partnership between the PSF & Alpha-Omega
44mSecurity Research with Open Source Software: Vol. Omega
22mKeynote: Securing the Open Source Ecosystem
43mFunding Security in Open Source: Insights From FreeBSD’s Audit Journ...- 44mSecurity Research with Open Source Software: Vol. Omega
16mMeet our Security Engineers
22mKeynote: Bringing Greater Trust and Security by Design to the Open Source Ecosys...