Don't Start Over, Start Left: Choosing the Right Open Source...
summary
An SCA-driven evaluation workflow that extracts GitHub metrics and trends identifies risky choices early: a 500,000 lines of code base contains 30,000 LOC tied to Pony ORM, and automated scoring via a quantile transformation ranks SQLAlchemy higher by popularity 82 vs 61 and contributor activity 70 vs 47, so switches or abandonment (flask-restplus flat commits after Jan 2020; fork to flask-restx) would have been flagged and pipelines can fail on policy (e.g., strong copyleft).
AI-written summary · about
chapters (9)
- 0:00Open source security challenges
- 3:33Choosing open source components
- 7:12Shift left in development
- 10:42Security testing lifecycle
- 16:18Evaluating open source factors
- 20:10Automating component assessment
- 27:43Project quality metrics
- 33:03Open source policies
- 35:10Conclusion & Q&A
related talks
43mDon't Start Over, Start Left: Choosing the Right Open Source...
32mExemplars, Laggards, and Hoarders: A Data-driven Look at Open Source Software Supply Chains
31mAssessing Open Source Software Projects in the Software Supply Chain
40mOpen Source Is Not the Same Anymore
40mUnderstanding OSS Risk Beyond Code Vulnerabilities
25mHow do you trust your open source software?
49mQuantifying the Probability of Flaws in Open Source
29mA journey of the thousand binaries