Secure Open Source

What your project should include

The SOS Fund has a very limited set of solid rules:

• The software must be open source/free software, with a license that is OSI-certified and/or FSF-approved
• The software must be actively maintained

How we’ll make our decision

We have a series of factors we consider when evaluating an application. For example:

• How commonly used is the software?
• Is the software network-facing or does it regularly process untrusted data?
• How vital is the software to the continued functioning of the Internet or the Web?
• Is the project known for something besides the code we are relying on?
• Does the software depend on closed-source code, e.g. in a web service?
• Are the software’s maintainers aware of and supportive of the application for support from the SOS fund?
• Has the software been audited before? If so, when and how extensively? Was the audit made public? If so, where?
• Does the software have existing corporate backing or involvement?

The answers to such questions are often not “yes” or “no”, but matters of degree, and so Mozilla will take the entire picture into account when assessing projects.

How to apply

At this time, candidates for an award are chosen by Mozilla. If you have a suggestion for a project which you think meets the criteria above, and where an audit might particularly benefit the project and the Internet community, please fill out the form through the link below.

FAQ

We’ve been asked how this project compares to the Core Infrastructure Initiative of the Linux Foundation. Here’s a short answer:

We believe our model of support is different from and complementary to CII’s. We view CII as focused on necessary, deeper-dive investments into the core OS security infrastructure, like in OpenSSL. This is important work. Focusing on more point-in-time solutions, the SOS Fund’s audit and remediation methodology targets a different class of OSS projects with lower-hanging fruit security needs, using an open public-facing application form. To have substantial and lasting benefit in tackling such a significant issue as open source security, we need a broad range of solutions, including investment, audits, education, best practices, and a host of others. We believe the SOS Fund, alongside CII and other efforts, can help catalyze industry momentum to strengthen open source security.

If you have further questions, please feel free to contact us at sosfund@mozilla.com.

A little bit more

• 

  Selection Committee

  Meet the Mozillians and Open Source experts who will be making the decision on your application.

• 

  Past Recipients

  Take a look at some of the previously funded projects and the people behind them.