Every project is a software project

One thing that came up when discussing the Open Source Project Security Baseline with a colleague was the distinction between software projects and other projects (design, documentation, etc). Mike astutely pointed out that every project is a software project in some sense. Whether or not the project is producing software, it is consuming software: applications, git forges, issue trackers, and so on.

The specific context of our conversation was supply chain security. Projects that don’t produce a single line of code can still be the victim of supply chain attacks.

Then again, it’s pretty rare that a project doesn’t produce a single line of code. Even if a project exists to write documentation, create visual art, or do something else that isn’t producing a piece of software, there’s probably at least some tooling it has created to make life a little easier. Fedora Magazine, for example, has a small script for converting SVG files to JPG.

It’s a good reminder that our audience is broader than we might think and we should act accordingly.

This post’s featured photo by James Harrison on Unsplash.