A journey of the thousand binaries
summary
Claims concrete statistics: 78% of code in codebases is open source and 85% contains open‑source components more than four years out of date. Practical tooling and outcomes include JFrog Xray + Artifactory analyzing binaries and Docker images, Frogbot surfacing prioritized alerts, Docker Desktop extension and scorecards for automated checks, dependency‑track and OSSF concise guide as vetting aids. Advice focuses on measurable signals — commit history, tests, issue backlog, exploitability — and using these tools to reduce noisy alerts and decide whether to patch, replace or accept a dependency.
AI-written summary · about
chapters (13)
- 0:00Dependencies journey
- 2:21Why dependencies matter
- 4:31Dependency types
- 7:22Libraries vs frameworks
- 9:08Costs and risks of dependencies
- 11:45Evaluating open source dependencies
- 13:33Key questions before adding
- 16:48Maintenance and community checks
- 19:42Security and licensing
- 21:09Dependency security tools
- 23:21Artifactory and X-ray
- 25:32Practical tools today
- 27:19FrogBot and Docker Desktop
related talks
30mDevSecOps: Understanding Open Source Software risk in your applications
32mExemplars, Laggards, and Hoarders: A Data-driven Look at Open Source Software Supply Chains
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
45mPanel Discussion: Managing Open Source...
31m54,000 Tales - A Data-driven Discussion of Exemplar Development and DevSecOps Practices
37mOpenSSF Best Practices for Everyone!
38mApplication Security in the age of Open Source
43mThe Importance of Developer Tooling to Make Open Source More Secure by Default