Sonatype Blog » webinar

New Webinar: Security at the Speed of Development with Wendy Nather, 451 Research

Emily Blades — Mon, 15 Apr 2013 13:34:41 +0000

Tuesday, April 30, 2013 – 11:00AM-11:45AM EDT (GMT-0400)

We have a problem. Application development has become agile, component-based, and open-source-dependent. We’re delivering more software faster than ever before, but security approaches haven’t kept up. Every day we’re forced to make the dangerous choice between speed and security, putting Development and Security at odds. There has to be a better way.

Join Wendy Nather, Research Director, Security, at 451 Research and Sonatype CSO, Ryan Berg on Tuesday, April 30 at 11:00AM EDT (GMT-0400) to understand the challenges that are driving new approaches to application security. You’ll also hear how how some leading application security organizations have partnered with application development to achieve both speed and security using component lifecycle management.

If you register, you’ll also receive access to the recording after the event. So if something comes up and you can’t make it, you won’t miss out.

Reserve Your Seat

Join Us: Nexus Office Hours – Friday, March 22, 2013 1PM-2PM EDT

Emily Blades — Mon, 11 Mar 2013 15:36:40 +0000

Wondering what’s new in Nexus? Wishing you had a chance to ask some of our Nexus experts about Nexus best practices? Here’s your chance.

We’re pleased to announce that Sonatype will be hosting Nexus Office Hours each month starting in March! Our Nexus experts Brian Fox, Manfred Moser and Rich Seddon will demo the latest Nexus tips & tricks and will take real-time questions from you!

When: Friday, March 22, 2013 – 1:00-2:00PM EDT (GMT-0400)

Where: In a Google+ Hangout On Air! Once we begin, our hangout will broadcast live to the Nexus Office Hours event page on Google+, as well as our Sonatype YouTube channel.

How: Be sure to RSVP ‘Yes’ on the Nexus Office Hours event page, and this event will be automatically saved to your Gmail calendar and you will receive a reminder just before we start the hangout. Not on Google+? No worries, you can still view the broadcast on the event page or the Sonatype YouTube channel when the hangout begins.

We will be taking real-time questions submitted on the Nexus Office Hours event page, Twitter (please use hashtag #nexusofficehours) and on our YouTube page in the comments section of the broadcast.

**If you’d like to join our panel that day in the hangout, please leave us a comment on this page and the first 6 people will be invited in as the session starts. This event will be recorded and saved to Google+ as well as our YouTube channel.

RSVP Now

Join Us: SANS Webcast – The Hidden Risk of Component Based Software Development

Emily Blades — Wed, 30 Jan 2013 15:07:21 +0000

Sonatype has teamed up with SANS institute to bring you this informative webcast: Best Practices for Managing Software Development Risks

Eighty percent of a typical application is assembled from open source and proprietary components. Development teams turn to components to gain efficiencies and speed innovation. While the promise of components is significant, organizations must mitigate risk by properly managing components.

How do you accomplish this given the volume, complexity and diversity of today’s components?

Join us on Wednesday, February 6th from 1:00PM-2:00PM EST (GMT-0500) as Ryan Berg, Sonatype CSO, discusses how you can realize the benefits of component-based software development while mitigating security, licensing and quality risks.

Reserve Your Seat

Component Lifecycle Management with your Apache Maven Infrastructure

Jason van Zyl — Thu, 05 Jul 2012 12:57:28 +0000

The way software is being developed has changed over the last ten years, it has shifted from companies developing the vast majority of their own software to a software development approach that depends on open source components that are freely available. Today, the vast majority (upwards of 90%) of Java-based applications are assembled from components. Very little of these applications consist of code that companies build internally. The extent to which open source components are being used is not widely known within companies that have thousands of applications and hundreds of thousands of downloads from the Central repository.

In last week’s webinar I discussed the trends we’ve identified and the tools we’ve developed to address this challenge. Tracking down where components come from, managing your application to account for changes in components, and dealing with security and licensing issues that relate to your application’s dependencies is our focus. If you develop software using open source components, here’s a video of my webinar. If you are interested in learning more about our Insight products and starting to keep track of the components you consume, go to http://www.sonatype.com/insight.

Last Chance! Webinar: Manage Your Components at Build Time in Hudson & Jenkins

Emily Blades — Wed, 02 May 2012 11:32:15 +0000

Know What’s In Your Builds?

Join Brian Fox tomorrow, Thursday, May 3 at 11AM EDT (GMT-0400) for a 30 minute sneak preview of our latest innovation, Insight for CI. Brian will show you how Insight for CI will help you:

Gain visibility and control at build time in Hudson and Jenkins.
Find and fix license, security and quality problems quickly.
Set rules to notify you of problems, fail builds, or establish workflows.

If you register, you’ll also receive access to the recording after the event. So if something comes up and you can’t make it, you won’t miss out.

Reserve Your Seat

New Webinar: Manage Your OS Components At Build Time

Emily Blades — Mon, 16 Apr 2012 12:34:04 +0000

Join Brian Fox for a 30 minute sneak preview of Insight for CI on Thursday, May 3 at 11AM EDT (GMT-0400). Brian will show you how Insight for CI will help you:

Gain visibility and control at build time in Hudson and Jenkins
Find and fix license, security and quality problems quickly
Set rules to notify you of problems or to fail builds

If you register, you’ll also receive access to the recording after the event. So if something comes up and you can’t make it, you won’t miss out.

Reserve Your Seat

Webinar Replay Now Available: Nexus 2.0 Sneak Preview

Emily Blades — Mon, 05 Dec 2011 02:48:20 +0000

Thank you to everyone who made it to our Nexus 2.0 Sneak Preview webinar last week! We had a fantastic turnout and received tremendous interest from our users in the features that are coming in Nexus Pro 2.0, including:

Integrated security and licensing reports to discover problematic components
Improved availability with our new Nexus Availability Architecture
Ability to manage both Java and .NET components from a single repository

The webinar recording is now available here.

Special pre-release pricing is available for Nexus Pro 2.0. Check out the webinar or contact a representative for more information.

Answers to your Questions about Insight

Larry Roshfeld — Mon, 10 Oct 2011 21:20:55 +0000

We want to thank everyone that attended the webinar on Thursday, October 6 titled Open Source Goodness – Potential Risks = Insight. Unfortunately we didn’t have time to answer all the great questions during the event, so we’ve answered them here for everyone’s benefit. If you missed the webinar, you can register to view a replay here.

Q: What types of files/artifacts will Application Insight analyze?
A: Application Insight currently examines components based on the Zip algorithm, including JAR, WAR, EAR and ZIP formats. Other formats such as bin,iso,rpm are planned in the future.

Q: What development tools does Insight work with?
A: Sonatype is committed to making Development Insight available for all of the popular development tools, including: Eclipse IDE, Hudson CI, Jenkins CI, Bamboo CI, Nexus OSS repository, Sonatype Pro for Nexus, Maven 2.x, Maven 3.x, and Ant. Note: The tools presently supported are shown in bold.

Q: Can Insight identify open source code that has been copied and/or modified?
A: At this time Insight analyzes and identifies complete binary artifacts. We are working on ways to identify artifacts that have been slightly modified during development.

Q: What makes Insight different than source code ‘scanners’?
A: Insight is complementary to source code scanners – they solve different problems. Insight is designed to integrate easily into the software development process at every stage to ensure you only use the highest quality, most secure OSS components that meet your licensing standards. Source code scanners are typically used at the end of the development process to find snippets of open source code that may have been included in your applications.

Q: Can open source components be detected which are not installed but bundled with other software?
A: Yes, Application Insight analyzes all Java binaries in the target location, whether or not they are installed and being used.

Q: How would closed source Java components fit into this model? Is there a means to manage licensing and distribution, and push updates in this scenario?
A: Sonatype Insight supports both open and closed source components. We will work with our customers to add closed source components to the Insight Information Service as required so that they are recognized during analysis.

Q: Do you have customers that need this because of software certification for ISO9000 processes or FDA instrument certification?
A: We have spoken with a number of prospective customers of Sonatype Insight who are interested in using it to help with ISO9000 or other certifications. There is a consistent belief that Insight is a valuable addition to their existing processes.

Q: Can we choose which components are analyzed?
A: Yes, you can configure Insight to analyze a particular project, repository or production application.

Q: How can I receive a complimentary assessment of our open source consumption?
A: You can sign up for a complimentary assessment at http://www.sonatype.com/Request/Information/Open-Source-Usage-Report

Q: Can Insight be used to track Central downloads in general, not just associated with security or license risk?
A: Yes, Management Insight reports all downloads from the Central Repository, showing you how, when, and where those components were consumed.

Q: How is Insight offered? Can I run an instance in my company?
A: Insight is currently offered as a Software as a Service (SAAS) in combination with plugins for your development tools. We do not presently offer a stand-alone version, but are considering adding this capability in the future.

Q: What about a plugin for AnthillPro or their new DevOps platform?
A: We have received a number of requests for this, but it is not on our short-term roadmap.

Q: Does Insight work with other languages besides Java?
A: Today, Insight is focused on open source Java components. Future releases will extend to other programming languages.

Q: Is it possible to integrate Insight into the development cycle in order to push information to developers?
A: Yes, Development Insight enhances your existing tools so you’ll have the information and controls you need, when and where you need them to ensure the use of high quality components free of licensing or security risk. You can flexibly combine Insight plugins for popular IDEs, repositories, continuous integration servers, and build systems.

Q: Does Insight integrate with any continuous integration (CI) servers?
A: The Development Insight plugin for Hudson and Jenkins is available now to ensure problematic components don’t make it into your applications. The plugin inspects projects and alerts you to component licensing or security issues so you’ll find problems as soon as they are introduced.

Q: Is it possible to use Insight to evaluate open source components for issues before the component is added to a project?
A: Yes, the Development Insight plugin for the Eclipse IDE provides quality, license and security information for all components loaded in the IDE, whether or not they are part of a project.

Q: Do you need to use Apache Maven to use Insight?
A: No, Insight will analyze components independently of the build tool or dependency management methodology.

Next Webinar: Improving Your Java development with Apache Maven 3 and Hudson

Emily Blades — Wed, 01 Jun 2011 23:38:44 +0000

Next week, Jason will be presenting the webinar: Improving Your Java Development with Apache Maven 3 and Hudson. All registrants will receive access to the recording after the event so if something comes up and you can’t make it, you won’t be missing out. Be sure to register today!

Improving Your Java development with Maven 3 and Hudson

Tuesday, June 7, 2011 @ 10:30AM – 11:00AM EDT (UTC/GMT – 0400)

Presenter: Jason van Zyl, Sonatype CTO & Founder

Attend this webinar to learn about the advantages of upgrading to Apache Maven 3, including improved speed, greater stability and increased compatibility. Jason will also talk about the greatly improved support for Maven 3 within Hudson that is easy to configure and supports complex build scenarios with ease. We will cover the Eclipse IDE integration for both Maven and Hudson that improves developer productivity.

Register now!

Webinar replay for "Enterprise Repository Management" now available

hloney — Thu, 21 Apr 2011 15:30:00 +0000

If you missed our latest webinar “Enterprise Repository Management” you can view a recorded version of the webinar here.

Now that you’re primed with knowledge, jump in and see what a repository can do for your development workflow:

Download a free evaluation copy of Nexus Professional
Learn more about repository management
Contact a Sonatype representative for more information

If you have any questions about Nexus or repositories in general, we have engineers (not just sales guys) who would be happy to speak with you.