The Wake-up Call They had downloaded over 200,000 open source components in the past year. And their open source policy…the one established to protect against license risks and security vulnerabilities? It covered about 3% of them. This is how Nigel Simpson, Director of Architecture at a major media and entertainment company, described his organization’s “huge” […]
If you are in the midst of creating (or even planning to implement) an Open Source Governance Policy for your organization, then you’ll want to get to know Nigel Simpson. Nigel has been leading an enterprise-wide working group with over 40 members — at a really big entertainment and media company — to define his […]
In two minutes, we can show you if there are any open source risks within your Java application. And it’s free. That’s right, at Sonatype, we could not be more in favor of the code reuse that occurs millions of times a day thanks to the availability of open source and third-party components. At the […]
Continuing our commitment to the open source community we are taking Nexus OSS to another level. After adding NuGet support in Nexus 2.9 for FREE in Nexus OSS (a long time paid feature of Nexus Professional) our engineering team is at it again. I remember when we created the issue tracker ticket to support npm in Nexus over a year ago. Node.js development and usage of npm registries was on the horizon and making its way into companies more and more. Tools like Grunt have only gotten more traction since then.
Major enterprises are embracing DevOps. The DevOps Enterprise Summit is bringing together top practitioners who are leading DevOps transformations in large, complex organizations. It is a three-day conference on October 21-23, where leaders share their lessons learned, spanning culture, technology and leadership.Speakers include leaders from Disney, Macy’s, Blackboard, Barclays, Nordstrom, Target, Microsoft, Ticketmaster, Salesforce.com, UK.gov, U.S. Department of Homeland Security, and more.
The NuGet package manager has become the standard for developing software on the Microsoft platform which includes.NET and the NuGet Gallery that has emerged as a large public open source package repository. Sonatype Nexus, on the other hand, is the standard repository or component manager software running on servers from small open source projects and teams to multi-national Fortune 500 companies.
I can honestly say that although referred to by the media as Shellshocked, I am neither shocked nor awed. I can’t say that I am a fan of the latest glorification of bugs like Heartbleed and Shellshock in a fashion similar to tropical storms, but if it gets more people to pay attention to the exponential growth of our reliance on software I can’t say I am too worked up about it either. One thing that is unarguable is that this just happens to be the latest (and if you are reading this before you have patched stop right now, patch, and then come back to finish).
We led an invasion last week armed with a flying drone, glowing lightsabers, and the latest knowledge on open source security vulnerabilities. Our mission? Lead, share, educate, moderate, and have some fun. Our coordinates? This year’s AppSecUSA 2014 event in Denver, Colorado. If you were there, you couldn’t miss us. If you weren’t there, don’t fret…they caught the entire thing on video.
This week, I will be attending AppSec USA in Denver with the rest of our Sonatype crew. While it will be my first time attending the event, I am really excited to be leading a panel discussion at the event this Thursday. If you will be at the event, please come by the session or the Sonatype booth (G10) and say hello. So what’s the panel discussion about?
Recently, Gartner published a new research report that says by 2016, “the vast majority of mainstream IT organizations will leverage nontrivial elements of open source software (directly or indirectly) in mission- critical IT solutions. However, most will fail to effectively manage these assets in a manner that minimizes risk and maximizes ROI.”