The Secret Life of Maven Central
summary
Maven Central is the hosted repository Sonatype runs on AWS that serves about 10 billion weekly requests and contains 8.8 million component versions (27 TB, 79,000 namespaces). It fronts Nexus and Fastly, scans every upload with commercial engines, rejects malware uploads but does not delete vulnerable versions, and scores packages by update cadence and security posture. Bomb Doctor generates SBOM-based scores and upgrade suggestions; a Log4j build was downloaded ~157 million times and many projects still pull vulnerable releases.
AI-written summary · about
chapters (7)
- 0:00Introduction to Maven Central
- 2:38History and scale
- 6:11Security threats
- 8:25Vulnerability management
- 11:20Evolution of cyber attacks
- 13:37Modernizing Maven Central
- 18:35Community and conclusion
related talks
53mThe Secret Life of Maven Central
38mThe secret life of Maven Central
29mThe Secret Life of Maven central
33mThe Secret Life of Maven Central
31mOpen Source Supply Chain Threat Landscape - A Moving Target
48mAn Introduction to the Newest Addition to the OWASP Top 10
45mOWASP A9: A Year Later - Are you still using components with known vulnerabilities?
18mSecuring Open Source in Nomura’s Software Supply Chain