The National Science Foundation has awarded up to $12 million to eight research teams through the recently launched Safety, Security and Privacy of Open-Source Ecosystems, or Safe-OSE, investment.
NSF said Monday the initial cohort will address critical vulnerabilities in open-source software and its deployment pipelines, including code flaws, side-channel exploits and supply chain threats.
“Vulnerabilities in an open-source product can be exploited to attack users of the product. NSF is pleased to be investing in this portfolio to address critical risks before they can happen,” said Erwin Gianchandani, NSF assistant director for technology, innovation and partnerships.
Safe-OSE Awardees
Each project will receive up to $1.5 million over two years to bolster the resilience of critical open-source products and their continuous integration and deployment infrastructure. The teams will focus on fortifying systems used in artificial intelligence for cloud computing, medical records, national security, privacy infrastructure and other applications.
Awardees and their projects are:
- The HDF Group: Enhance HDF5 to boost support for science, industry and national security.
- Indiana University: Use AI to manage vulnerabilities and strengthen security in open-source cloud systems.
- Indiana University: Build a secure community infrastructure for the Open Medical Records System.
- The Tor Project: Strengthen privacy infrastructure to keep communications secure and anonymous.
- University of Colorado Boulder: Enhance safety, security and privacy in the Community Earth System Model.
- University of Colorado at Colorado Springs: Boost security in the TianoCore software ecosystem.
- University of Virginia: Enhance the Tock embedded operating system’s security to protect trusted computing systems.
- University of Wisconsin-Madison: Create scalable approaches to detect inconsistencies between Git commit messages and source code in open-source projects.
