Open-Source Maturity in a 160-year-old organization: Technical and Legal hurdles
summary
A 160‑year‑old financial firm uses concrete practices: inventory every repo, generate an SBOM (SPDX) per application, run dependency scanners in CI/CD (OWASP Dependency‑Check and commercial tools), and enforce a single dependency proxy (GitLab/Artifactory) with a blocklist. Risk metrics cited: 22,700 CVEs in 2022 (~68/day), 88% of components dormant, 75% with a high vuln; past failures include Apache Struts (Equifax, ~$1.4B) and SolarWinds. Legal side turns licenses into machine rules and recommends OSSF Scorecard health gating plus an enterprise policy and automated governance.
AI-written summary · about
chapters (19)
- 0:00Open source in fintech
- 2:09Legal benefits of open source
- 4:00Engineering advantages
- 6:32Licensing and property rights
- 9:00IP risks in open source
- 11:49Commercializing open source
- 14:47Security vulnerabilities
- 17:57TCO of open source
- 18:19SBOMs for dependencies
- 20:24Automated vulnerability scanning
- 22:07Evaluating dependency health
- 23:11Centralizing dependency ingress
- 24:14Legal compliance for fintech
- 26:21Law as code in governance
- 28:47Legal and engineering collaboration
- 29:09Enterprise open source policy
- 30:30Automated governance
- 31:15Lawyers in tech development
- 32:19Lessons from open source journey
related talks
30mA Lawyer and an Engineer Walk Into a Bar and Talk Open Source
52mOSS Security Maturity: Time to Put on Your Big Boy Pants!
41mManaging the risk and growth of using Open Source Software
30mDevSecOps: Understanding Open Source Software risk in your applications
38mApplication Security in the age of Open Source
43mThe Burden of Knowledge: Dealing With Open Source Risks
28mGoverning Open Source in the Enterprise: OSPO Strategies for Innovation and Compliance
33mThe Cathedral, the Bazaar, and the Coffee House