Lawmakers worry about a second Heartbleed

Two Republicans on key House committees are looking for more information about the challenges surrounding the cybersecurity of open-source software.

Reps. Greg Walden (R-Ore.) and Gregg Harper (R-Miss.), respectively the chairs of the House Energy and Commerce Committee and its Subcommittee on Oversight and Investigations, want information from Linux Foundation Executive Director Jim Zemlin about the cybersecurity risks of open-source software.

In a letter to Zemlin, the lawmakers specifically cited the widespread "Heartbleed" programming vulnerability that allowed attackers to access web servers, eavesdrop on communications, steal data and impersonate services and users that led to companies and government agencies' scrambling to review their operations and patch the defect.

"While the extent of OSS adoption clearly demonstrates the value that the ecosystem provides, its pervasiveness also creates widespread, distributed and common points of potential risk across organizations when OSS vulnerabilities are found," they wrote.

The lawmakers also raised concerns over the ability of the "globally-located volunteers" who create and maintain OSS while balancing full-time employment and compensation challenges to quickly address vulnerabilities.

They asked whether Linux's Core Infrastructure Initiative has conducted a comprehensive study into which aspects of open-source software are most critical to the global information infrastructure and, if not, what CII would need in order to do so.

They also asked for statistics surrounding open-source software usage, as well as an appraisal of the stability and sustainability of the open-source software ecosystem, plus suggestions for bolstering it.

"OSS adoption will continue to grow, making the sustainability and stability of the OSS ecosystem even more vital," they wrote.

The lawmakers requested a response by April 16.