News and Notes from the makers of Nexus | Sonatype Blog

Brian Fox

Brian Fox is a software developer, innovator and entrepreneur. He is an active contributor within the open source development community, most prominently as a member of the Apache Software Foundation and former Chair of the Apache Maven project. As the CTO and co-founder of Sonatype, he is focused on building a platform for developers and DevOps professionals to build high-quality, secure applications with open source components.

Gavel with government building behind it

A Clear Path Forward Toward More Secure and Maintainable Open Source Software

By Brian Fox on May 13, 2022 featured

7 minute read time

Sonatype CTO shares thoughts following conversations, led by OpenSSF, where industry and government came together to discuss securing open source software.

Read More...

Sonatype acquired MuseDev and full-spectrum software supply chain management

Why Sonatype is Acquiring MuseDev

By Brian Fox on March 16, 2021 Nexus Lifecycle

5 minute read time

Today, Sonatype acquired MuseDev, a developer-first source code analysis platform and unveiled the world’s first full-spectrum platform for strengthening cloud-native software supply chain

Read More...

The importance of Namespacing in Public Open Source Repositories

Why Namespacing Matters in Public Open Source Repositories

By Brian Fox on February 10, 2021 The Central Repository

8 minute read time

Sonatype's CTO explains why the Central Repository has always required namespacing and why all public open source repositories should too, following a new software way supply chain attack.

Read More...

Moving Java components into The Central Repository, following JFrog sunsetting Bintray and JCenter

Dear Bintray and JCenter Users - Here’s What You Need to Know About The Central Repository

By Brian Fox on February 04, 2021 The Central Repository

3 minute read time

If you're freaking out about moving Java components into The Central Repository, following JFrog sunsetting Bintray, don’t worry. We’re here for you.

Read More...

Making Developer’s Lives Easier as We Enter The New Frontier of Dependency Management

By Brian Fox on October 07, 2020 Nexus Lifecycle

4 minute read time

Sonatype's Advanced Development Pack will fundamentally change how teams manage code dependencies.

Read More...

Octopus Scanner Compromises 26 OSS Projects on GitHub

By Brian Fox on May 31, 2020 #OSSsecurity

3 minute read time

The Octopus Scanner malware compromised 26 open source projects hosted on GitHub in a new form of software supply chain attack targeting NetBeans projects.

Read More...

Microsoft Acquires npm: A Healthy Move for Critical Public Infrastructure

By Brian Fox on March 16, 2020 github

3 minute read time

Today, news broke that GitHub and its parent company Microsoft, acquired npm and its public repository of open source JavaScript packages.

Read More...

The Dot Zero Conundrum and the New Frontier of Securing Open Source

By Brian Fox on September 24, 2019 code quality

3 minute read time

Sonatype is combining a new type of behavioral analysis with machine learning and proprietary data, creating early warning capabilities to detect malicious releases of open source components.

Read More...

Removing Search Guard from the Central Repository

By Brian Fox on September 11, 2019 The Central Repository

2 minute read time

Due to an intellectual property dispute between two third parties, Sonatype is legally required to remove disputed artifacts related to Search Guard from the Central Repository and OSSRH until

Read More...

Software composition analysis

Container Security

CODE QUALITY ANALYSIS

Repository MANAGEMENT

Complete Platform

Book a Demo

For Professionals

For Industries

Content

CUSTOMER Portal

Integrations & Free Tools

About us

Contact Us

Sonatype Blog

Brian Fox

A Clear Path Forward Toward More Secure and Maintainable Open Source Software

Why Sonatype is Acquiring MuseDev

Why Namespacing Matters in Public Open Source Repositories

Dear Bintray and JCenter Users - Here’s What You Need to Know About The Central Repository

Making Developer’s Lives Easier as We Enter The New Frontier of Dependency Management

Octopus Scanner Compromises 26 OSS Projects on GitHub

Microsoft Acquires npm: A Healthy Move for Critical Public Infrastructure

The Dot Zero Conundrum and the New Frontier of Securing Open Source

Removing Search Guard from the Central Repository

Products

Free Tools

Solutions

Resources

Customer Portal

Company