OSS Dependency Health: Towards Maturity and Sustainability Risk Assessment Model
summary
A Risk Model implemented on top of CHAOSS GrimoireLab aggregates seven metrics into a 0–10 score and a red/yellow/green flag to rate dependency maintenance; applied to Kubernetes Go dependencies and nine ING repos it flags about half as low-maintenance, reveals single‑maintainer concentration (pony factor) and finds some libraries unsupported for six years. The proof‑of‑concept runs and visualizes results but needs to scale to audit 880,000 repositories monthly and to extend SBOM, licensing and participation metrics.
AI-written summary · about
chapters (9)
- 0:00Introduction to panel
- 2:29Trends in open source supply chains
- 4:39ING’s risk management challenges
- 6:24Community risk assessment model
- 12:06Initial insights from proof of concept
- 13:32Industry perspective on risk model
- 15:39Future steps and next steps
- 17:50Scaling the solution at ING
- 18:11Future of open source risk assessment
related talks
32mA Complex Web of Open Source Software Dependencies Risk
34mAssessing Project Risk Using CHAOSS Metrics
40mHow to Identify and Avoid Cracks and Bumps in your Digital Infrastructure? By Consi...
55mCI Pulled It, Prod Ran It: The Real Risk in Dependency, by GraphsIlkka Turunen
15mFrom SBOM to Dependency Stacks: Making Software Structure Visible
29mUnlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture
43mMeasuring Suc...
28mProduction, Consumption, and the Data: The Open Source Security Sandwich