Using CHAOSS Metrics, Models, and Software to Identify the Most Significant At-Risk Dependencies in Your Portfolio - Sean Goggins, CHAOSS Project and the University of Missouri
Talkat Open Source Summit North America 2022 · on Friday, 2022-06-24· at 14:00· Room 301/302 (Level 3), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
CHAOSS software enumerates every dependency across repositories, tracks version ages, and scores risk with the libya metric (example 0.53 years) so teams can rank fixes instead of chasing everything. An auger scanner collects dependency files, snapshots changes over time, and reveals cases with dependencies up to 10 years old across a portfolio (example dataset >10,000 projects). The claim is: update recency correlates with lower incident risk, enabling prioritization without full CVE integration.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:05Metrics Models and Software To Identify Your Most Significant at-Risk Dependencies in a Portfolio
- 1:39Direct Dependency
- 2:10Upstream Dependencies
- 2:31What Is a Transitive Dependency
- 3:49Transitive Dependencies
- 5:53Enumerate all of Your Dependencies
- 12:08Dependency Awareness
- 18:38How Do I Measure this for Dependencies
related talks
32mA Complex Web of Open Source Software Dependencies Risk
34mAssessing Project Risk Using CHAOSS Metrics
42mThe Role of Open Source Management Talent in Ensuring Software...
36mPanel Discussion: OSS Viability and Project...
25mDefining the Limits of Risk
43mFrom Data Tsunami to Actionable Insights
39mBuilding SaaS Services with CHAOSS Technology to Evaluate Community Health and Sustainability
33mData to Action: Build Healthy & Sustainable OSS Communities