Marek Przybyszewski

The EU-FOSSA project developed by European institutions is aiming at improving the security of Open Source Software. The next iteration of the project, EU-FOSSA 2, is continuing in 2017-2019 with a higher budget of 2.6 M€ and a novelty, the bug bounties. Information about the planning and status of the project will be given during this talk.

The EU-FOSSA project is aiming at improving the security of Open Source Software. The first iteration of the project was executed during 2015-2016. This project:

• developed a methodology to perform code reviews at the EU institutions,
• performed an inventory of Open Source Software used in the European Commission,
• reviewed code of Apache HTTP Server Core and KeePass, with the help of an external company.

In the new iteration of the project, running during 2017-2019 with a total budget of 2.6 M€, we explore the possibility of using public money to fund bug bounties. This way the European institutions intend to improve the security of major Open Source Software to reduce the risk of a new major incident like Heartbleed. We also intend to convince everyone that this should become a permanent activity of the European Union.

We are also planning other activities, like more active communication and direct collaboration with open source communities. The peak of activities is expected during Q3/2018 - Q2/2019. The timing of FOSDEM18 is a perfect opportunity to inform everyone interested in the project about the status and the activities planned.

EU-FOSSA: Pilot Project for auditing of Open Source Software at the European Institutions

Recent discoveries of vulnerabilities in critical information infrastructure have drawn the broader public's attention to the need to understand how governance and quality of the underlying software code relates to basic safety and public trust in applications that are used on a day-to-day basis.

During this presentation we would like to bring your attention to an ongoing pilot project looking for a systematic approach towards ensuring that widely used critical software can be trusted. This project has been conceived at the European Parliament and entrusted for execution to the European Commission, with a total budget of 1 million euro. If it proves to be successful, it might become a permanent action of the European Institutions during the years to come.

It has been conceived in three parts: – Comparative study of the European Institutions' and open source communities’ software development practices and a feasibility study of performing a code review of open source projects for European Institutions. – Definition of a unified methodology to obtain complete inventory of open source software and technical specifications used within the European Parliament and the European Commission and the actual collection of data. – Exemplary code review of selected open source software and/or library, particularly targeting software considered critical, that is exploitation of which could lead to a severe disruption of public or EU services and/or unauthorised access.

This presentation will focus on areas where collaboration with the open source communities is crucial and where we might be looking for exchange of ideas or direct involvement in the project's execution.