Defining the Limits of Risk
summary
Argues that open‑source projects must be treated as providers and proposes measuring bus factor, average issue resolution time and other community metrics to quantify risk, not just code vulnerabilities. Describes using CHAOSS and GrimoireLab/remark‑lab style tooling to pull repo/org metadata into an automated pipeline, enrich metrics, and produce dashboards. Recommends adding repo/org info to SBOMs so metrics can be gathered; prototypes exist and produce actionable reports.
AI-written summary · about
chapters (4)
- 0:00Start
- 4:02Why Do We Want To Have a Healthy Providers Ecosystem
- 11:42How Can We Define Community Threats
- 22:46How Difficult Is It To Determine Who You Need To Be Talking to within Open Source Group That You Have Engaged with Before
related talks
34mAssessing Project Risk Using CHAOSS Metrics
35mThe Benefits and Pitfalls of OSS Project Metrics: Measuring Health and Risk in Open Source Communities
31mThe Value of OSS Management for Risk Mitigation
42mThe Role of Open Source Management Talent in Ensuring Software...
41mBuilding and Supporting Open Source Communities Through Metri...
27mThe OSS-ential Understanding of Community Health and Metrics
32mA Complex Web of Open Source Software Dependencies Risk
40mUnderstanding OSS Risk Beyond Code Vulnerabilities