54,000 Tales - A Data-driven Discussion of Exemplar Development and DevSecOps Practices
summary
Analysis of 54,000 development teams and projects plus a 6,000-person survey shows ecosystems where apps are 85–95% open source, organizations consume ~300,000 Java parts yearly drawn from ~2,700 suppliers, and researchers scan 3.7 million components across 36,000 open source projects. Top 20% “exemplars” update dependencies rapidly (often days; worst take 3+ years), projects with more deps tend to update faster because they have larger teams, and regular processes plus tooling and targeted upskilling drive safer, faster releases.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:25Software Supply Chain Report
- 1:59Panel
- 3:59Java Development
- 4:43Visibility
- 8:53Whats flowing
- 9:20The research
- 9:51How to tell which parts are good
- 14:49The report
- 16:07Bringing the right skills into the organization
- 24:23Can we move faster and stay secure
related talks
45mExemplars, Laggards, & The Cautious: A Data-driven Look At High-velocity Software...
45mPanel Discussion: Managing Open Source...
29mA journey of the thousand binaries
25mYour Application is Mostly Written by Strangers
35mMachines Making Software
30mDevSecOps: Understanding Open Source Software risk in your applications
37mThe Death Star and the Ultimate Vulnerability
45mDon’t be Afraid to Upgrade