Am I too biased against Google's intentions now?
They say
> We also pledged to provide $100 million to support third-party foundations, like OpenSSF, that manage open source security priorities and help fix vulnerabilities.
So really this is just, we are spending another 10B on this line of business and we'll throw out a token 100 mil to the community.
> First, organizations continue to depend on vulnerable legacy infrastructure and software, rather than adopting modern IT and security practices. Too many governments still rely on legacy vendor contracts that limit competition and choice, inflate costs, and create privacy and security risks.
> Second, nation-state actors, cybercriminals and other malicious actors continue to target weaknesses in software supply chains and many vendors don’t have the tools or expertise to stop them.
Pretty much it's "we're better at security than most other vendors, and we want to get in on those sweet government and corporate contracts".
They're probably not wrong, I would bet Google is better at security than most companies are. One way of reading "legacy vendor contracts" is "legacy-vendor contracts" :)
> We are also pledging, through the Google Career Certificate program, to train 100,000 Americans in fields like IT Support and Data Analytics, learning in-demand skills including data privacy and security.
Let's take a guess at whose systems they'll be getting trained on :)
IMO - Every word of that blog post should be taken as code for "this should keep the US government off our back for a while and probably help us win contracts."
100 mil isn't peanuts, not even for Google.
Regardless of what their intentions actually are those two are not necessarily in conflict with each other.
(I realize my post is a wishy-washy nothing-statement that could mean anything, so to make it a little more concrete: I'd roughly guess like 70/30 self-interest/PR:altruism/"herd security".)