Don't Start Over, Start Left: Choosing the Right Open Source...
Talkat Open Source Summit Europe 2023 · on Tuesday, 2023-09-19· at 15:40· Room 3F (3JAUREGIA - Floor 3), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
An experimental pipeline pulls GitHub data into an automated SCA scoring engine, applies a quantile transform to normalize skewed metrics, and composes practice scores (popularity, contributors, security) into 0–100 metrics. Real examples: SQLAlchemy 82 vs Pony 61 for popularity and 70 vs 47 for contributors, and detection of flask‑restplus abandonment via flat commits and issues versus rising fork activity. Policies can pipeline fail on license or low security scores before a component is ever added.
AI-written summary · about
chapters (9)
- 0:00Open source security challenges
- 3:33Choosing open source components
- 7:12Shift left in development
- 10:42Security testing lifecycle
- 16:18Evaluating open source factors
- 20:10Automating component assessment
- 27:43Project quality metrics
- 33:03Open source policies
- 35:10Conclusion & Q&A
related talks
43mDon't Start Over, Start Left: Choosing the Right Open Source...
25mHow do you trust your open source software?
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
27mHow Do You Trust Your Open Source Software?
31mAssessing Open Source Software Projects in the Software Supply Chain
36mEstimating Security Risk Through Repository Mining
40mDiscovering Emerging Open Source Communities Through...
50mHow Do You Trust Open Source Software?