Navigating Open Source Risk: A Strategic Approach
summary
Shows concrete risk signals: OpenSSL’s Heartbleed maintenance gap (≈$2k/year donations, single maintainer), companies relicensing with SSPL (MongoDB, Elastic) and costly forks (MySQL→MariaDB, OpenOffice→LibreOffice). Recommends checking governance docs, trademark ownership, release cadence, security embargoes, test automation, contributor and organizational diversity, and whether the project has many users. Advises quarterly health checks for critical stacks and flags roughly 30 strategic projects as the typical scoped audit.
AI-written summary · about
chapters (17)
- 0:00Start
- 2:36Risk and Strategy
- 4:42Business Risk Licensing Example
- 6:17Business Risk Governance Examples
- 7:32Determining Neutrality for Foundations?
- 8:27Neutral Foundations
- 8:55Company Originated
- 9:54Governance is about People
- 11:49Leadership
- 13:35Security
- 15:12Minimum Documentation
- 16:22Awesome Community
- 17:29Diversity Equity, and Inclusion
- 19:04Responsiveness
- 20:09Contributor Risk
- 21:35Resources
- 22:07Final Thoughts on Risk
related talks
24mNavigating Open Source Project Risk
30mEvaluating Business Risk for Open Source Cloud Native Projects
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
39mSOS: Sustainable Open Source
38mApplication Security in the age of Open Source
39mTalking with Management About Open Source
33mThe Cathedral, the Bazaar, and the Coffee House
49mOpen Source is Broken, and it’s Our Fault