Hey, I pushed a little further on the badge process for two of "my" projects today and then I decided to check out this "CPE" thing that is asked for promimently on the top of the Basics tab. (I've ho

Good news – we’re featured on the podcast “The ChangeLog” #215 (“Core Infrastructure Initiative Best Practices Badge with David A. Wheeler”). You can listen to it here: https://changelog.com/215/ Or u

I’d like to collect stories of any changes OSS projects have made to get a badge. If know of any, please edit this wiki page: https://github.com/linuxfoundation/cii-best-practices-badge/wiki/Impacts (

We have another badged project, “FrogPw”: https://bestpractices.coreinfrastructure.org/projects/279 While this project doesn’t have the same kind of use as (say) the Linux kernel, every project badged

All: I have *great* news!! The OWASP ZAP project just received the CII best practices badge! OWASP ZAP is a widely-used tool for scanning web applications to look for security vulnerabilities. I use i

Hi, I wanted to try some automated analysis on the CII badge project repos, however it seems that the current data doesn't contain any info on the repo type. While this can often be guessed (e.g. ever

We have some new holders of the CII best practices badge: - OPNFV: https://bestpractices.coreinfrastructure.org/projects/164 - Open Stack: https://bestpractices.coreinfrastructure.org/projects/246 - V

Currently users and potential co-developers can’t easily see if a project they’re looking at has a badge. In addition, if the badge is to be useful, people need to know that the badging project exists

Brandon Keepers has started working on badge entries for atom & dotenv. We used both to help develop the BadgeApp J. He had some interesting comments about the badges here: http://opensoul.org/2016/07

Would it make sense to propose badges which are impossible to attain for some projects due to mismatches in technology? I would like to explore some ideas related to the project build process, and som

tl;dr Too much information about how the software is architected and security relevant information is difficult to find or non-existent. This is an informal discussion about the possibility of adding

Here's some data to work from. Below is a short Ruby snippet to sum up the results for each criterion, followed by a CSV formatted result from when it was executed. Anyone who's interested can load th

Emily, David, all My name is Sona Sarmadi, I am one of the OPNFV security members. I am leading the LF Badging Program for OPNFV project, I have created some tasks in Jira for all criteria/items we ne

We have another project with a passing badge: GnuPG. Details here: https://bestpractices.coreinfrastructure.org/projects/197 That’s an important project that many depend on, so I’m very glad to see it

The badging project was designed for “FLOSS projects” - and we had expected only projects with *code* would be asking for a badge. However, project #180 takes an unexpected new direction: it’s a proje

In case you haven’t seen it… FLOSS weekly had a show where Emily & I talked about the best practices badge: https://twit.tv/shows/floss-weekly/episodes/389 There’s also a Linux.com article about the b

I got a nice email from Colin O'Dell, who got a badge for league/commonmark (a CommonMark implementation). The badge entry is here: https://bestpractices.coreinfrastructure.org/projects/126 In the ema

Hope you are ready for some more questions and comments. :) 1) One question asks for the CPE name and refers to https://nvd.nist.gov/cpe.cfm I looked all over that page and still was unable to find ho

Okay, this is a question about interpretations of the 'crypto_password_storage' question. The question I am referring to was this: If passwords are stored for authentication of external users, the pro