We all depend on open source. We will defend it together (akrites.org)

Article summary

A group of companies, including Amazon Web Services, Google, and Microsoft, have launched Akrites, a coordinated effort to address the growing issue of vulnerabilities in open source software. The initiative aims to create systems and deploy tooling to leverage the collective power of the community to make everyone safer. Akrites will work upstream to fix projects at the source, supporting maintainers and providing a single, predictable partner for security incident response. The goal is to prevent leaks and ensure that fixes reach everyone in a timely fashion.

Main themes

• Open source security
• Vulnerability remediation
• AI-powered vulnerability discovery
• Collaboration and coordination
• Maintainer support

What commenters say

• The involvement of large corporations in Akrites raises concerns about their true commitment to open source security and their potential to undermine the initiative for their own interests.
• The focus on open source software neglects the importance of securing closed-source software, which can also have significant vulnerabilities and impact.
• The use of AI in vulnerability discovery has created a new landscape for security, and Akrites is a necessary response to address the growing number of vulnerabilities being found.
• Some commenters question the effectiveness of Akrites, given the potential for companies to prioritize their own interests over the security of open source software, and the lack of transparency and accountability in the initiative.
• Others argue that the collaboration and coordination facilitated by Akrites are essential for addressing the scale and speed of vulnerability discovery, and that the initiative has the potential to make a positive impact on open source security.
• There are concerns about the potential for Akrites to become a means for large corporations to exert control over open source projects, and for the initiative to prioritize the interests of its corporate members over those of the broader open source community.