Navigating Open Source Project Risk
summary
Open source risk assessment focuses on concrete signals: governance docs, release cadence, security policy, contributor diversity and ownership. Examples include OpenSSL Heartbleed: roughly $2,000/year in donations and a single maintainer, and license shifts such as MongoDB/Elastic moving to SSPL and effectively leaving OSI‑approved open source. Watch for many unanswered PRs, single‑company control, trademark ownership, forks (MySQL→MariaDB, OpenOffice→LibreOffice), and whether leadership is elected or allocated.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:50Openssl
- 4:13Licensing Changes
- 5:45Governance Issues
- 7:16Neutral Foundations
- 10:11Project Governance
- 11:42Leadership
- 13:54Security
- 15:20Documentation
- 16:40Community
- 19:20Contributors
- 20:21Resources
- 20:31Final Thoughts
- 21:32Questions
related talks
29mNavigating Open Source Risk: A Strategic Approach
30mEvaluating Business Risk for Open Source Cloud Native Projects
29mUnderstanding Corporate Open Source Strategy
25mOWASP Top 10 Risks for Open Source Software
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
27mBeyond Open Source Risks With the CRA and NIS2
36mSOS Sustainable Open Source
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance