implications of open source software use (or let's talk open source)
Post on 16-Apr-2017
167 Views
Preview:
TRANSCRIPT
Let’s Talk Open Source
or…
Implications of Open Source Software Use
Gail C. Murphy University of British Columbia
Tasktop Technologies@gail_murphy
A restrictive license has been chosen given unpublished work, and descriptions of others work
2
Who Are You?
Let’s Talk Open Source
Code multiple days a week
Ü
Mostly Organize Coding
Ü
Something Else
Ü
3Let’s Talk Open Source
Here’s My Plan
Integral and Critical!
Managing Useá
Implications„
4
The Take-Aways
Let’s Talk Open Source
Open source: does not mean
free
Open source: use requiresknowledge
Open source: the fabric on which
software development occurs
STARTKeynote Presentation Template
Welcome to the best experience ı have in this presentation
Where a variety of sections, easy and to understand is demonstrated !
Integral and Critical
6
Supply of Open Source Components
Let’s Talk Open Source: Integral and Critical
suppliers total components
>105K >834K
( Java) central repository GitHub project dependences2015 State of the Software: Supply Chain Report (Sonatype)
7
Why Use Open Source Components?
Let’s Talk Open Source: Integral and Critical
build products (and other components) faster
higher-quality components
lower cost to (re)use
ongoing updates
8
Use of Open Source Components
Let’s Talk Open Source: Integral and Critical
17.2 Billion Requests Served
Java components in 2014
to >106K organizations
2015 State of the Software: Supply Chain Report (Sonatype)
9
What Happens When Open Source Components Fail?
Let’s Talk Open Source: Integral and Critical
https://xkcd.com/1354/
10
What Happens When Open Source Components Fail?
Let’s Talk Open Source: Integral and Critical
https://xkcd.com/1354/
11
What Happens When Open Source Components Fail?
Let’s Talk Open Source: Integral and Critical
https://xkcd.com/1354/
12
What Happens When Open Source Components Fail?
Let’s Talk Open Source: Integral and Critical
Economist, Apr 12, 2014
13
Even When Better Versions of Components Exist…
Let’s Talk Open Source: Integral and Critical
CVE-2007-6721CVSS 10Exploitability 10
since identification…
11,236 organizations have downloaded the vulnerable component 214,484 times
2015 State of the Software: Supply Chain Report (Sonatype)
14
Even When Better Versions of Components Exist…
Let’s Talk Open Source: Integral and Critical
2015 State of the Software: Supply Chain Report (Sonatype)
of 240,757 component downloads by large
financial or technology firms in 2014…
were of known defective part
and or those with a defective part, the defects were older than 2013
7.5%
66%
15
Availability Matters Too
Let’s Talk Open Source: Integral and Critical
16
The Take-Aways: Integral and Critical
Let’s Talk Open Source: Managing Use
Open source: the fabric on which
software development occurs
STARTKeynote Presentation Template
Welcome to the best experience ı have in this presentation
Where a variety of sections, easy and to understand is demonstrated
Managing Use
á
18
Murphy, Personnel Correspondence, 2016
Interviews with Engineering Leaders
SME
4 1 2
19
Interviews with Engineering Leaders
Let’s Talk Open Source: Managing Use
Open beforeClosed
Investigate open source - who else is using? - how many contributors? - support model? - security profile?
Know they might need to fork Some place committers on project
Murphy, Personnel Correspondence, 2016
20
Need for Controls
Let’s Talk Open Source: Managing Use
21
The Take-Aways: Managing Use
Let’s Talk Open Source
Open source: does not mean
free
STARTKeynote Presentation Template
Welcome to the best experience ı have in this presentation
Where a variety of sections, easy and to understand is demonstrated
Implications
„
STARTKeynote Presentation Template
Welcome to the best experience ı have in this presentation
Where a variety of sections, easy and to understand is demonstrated
Analysis of 1000s of GitHub Projects
24
What Kind of Component You Are Depending On?
Let’s Talk Open Source: Implications
Guava
Vault
Junit0%
25%
50%
75%
100%
4 32 256 2048Number of user projects
Rs:
Rat
io o
f use
r pro
ject
s ha
ving
soc
ial i
nter
actio
ns
Palyart, Murphy, Masrani 2016, in progress
25
Set Your Expectations
Let’s Talk Open Source: Implications
0
500
1000
1500
4 32 256 2048Number of user projects
Med
ian
invo
lvem
ent t
ime
Palyart, Murphy, Masrani 2016, in progress
26
Set Your Expectations
Let’s Talk Open Source: Implications
Technical dependence before social interaction
Social interaction before technical dependencePalyart, Murphy, Masrani 2016, in progress
27
Set Your Expectations
Let’s Talk Open Source: Implications
1
10
100
1000
10000
Social before technical Technical before social
Num
ber o
f con
trib
utio
ns
Palyart, Murphy, Masrani 2016, in progress
STARTKeynote Presentation Template
Welcome to the best experience ı have in this presentation
Where a variety of sections, easy and to understand is demonstrated
Survey about Software Licenses
29
Know the Impact of Choosing an Open Source Component
Let’s Talk Open Source: Implications
John has been working on ToDoApp, his own personal task managementapplication. ToDoApp is going to be a desktop-based application that willbe used exclusively by John on his own computer. To make sure he does notlose any of his very special tasks, John is planning to use a lightweightlibrary called LightDB to persist ToDoApp’s data.If LightDB is distributed under the following licenses, would John beallowed to use it as part of ToDoApp?GNU GPL 3.0 GNU LGPL 3.0 MPL 2.0
UnsureNoYesUnsureNoYesUnsureNoYes
Almedia, Murphy, Wilson, Hoye, 2016, under submission
30
Know the Impact of Choosing an Open Source Component
Let’s Talk Open Source: Implications
If LightDB is distributed under the following licenses, would John beallowed to use it as part of ToDoApp?GNU GPL 3.0 GNU LGPL 3.0 MPL 2.0
YesYes
Yes 375respondents
Almedia, Murphy, Wilson, Hoye, 2016, under submission
31
Know the Impact of Choosing an Open Source Component
Let’s Talk Open Source: Implications
As the lead developer of a new product at GreatSoftware Inc., Laura decided touse an existing authentication library she found on the web called SafeAuth.She realizes that SafeAuth could be improved using a stronger cryptographicalgorithm when storing users’ information. The product is going to be releasedunder a commercial software license, but Laura would like to release theimproved version of SafeAuth as open source.If SafeAuth is distributed under MPL, would Laura and her team be allowed to release the improved version of SafeAuth as open source.GNU GPL 3.0 GNU LGPL 3.0 MPL 2.0
UnsureNoYesUnsureNoYesUnsureNoYes
Almedia, Murphy, Wilson, Hoye, 2016, under submission
32
Know the Impact of Choosing an Open Source Component
Let’s Talk Open Source: Implications
If SafeAuth is distributed under MPL, would Laura and her team be allowed to release the improved version of SafeAuth as open source.GNU GPL 3.0 GNU LGPL 3.0 MPL 2.0
NoNo
Yes 375respondents
Almedia, Murphy, Wilson, Hoye, 2016, under submission
33
The Take-Aways: Implications
Let’s Talk Open Source
Open source: use requiresknowledge
Illustration copyright Nenov Brothers Images
/Shutterstock
35
The Take-AwaysLet’s Talk Open Source
Open source: does not mean
free
Open source: use requiresknowledge
Open source: the fabric on which
software development occurs
@gail_murphy
top related