Exemplars, Laggards, and Hoarders - A Data-driven Look at Open Source Software Supply Chains
In a year long collaboration with Gene Kim and Dr. Stephen Magill, we objectively examined and empirically documented software release patterns and cybersecurity hygiene practices across 54,000 commercial development teams and open source projects.
In this session, we will present evidence on the outcomes of that research, highlighting organizational and technology practices that enable exemplar open source teams to deliver 50% more commits, release new code 2.4x faster, and remediate security vulnerabilities 2.9x faster, all while delivering a level of value that makes them standouts in terms of popularity and adoption.
Stephen Magill is a Principal Scientist at Galois, Inc. and a world-recognized expert on programming languages and program analysis, with work ranging from development of high-level languages to static analysis of low-level systems code. He has a Ph.D. in Computer Science from Carnegie Mellon University, and his work has been widely published. Stephen has led several research and development projects, including serving as principal investigator on a number of DARPA programs. Prior to Galois, Stephen was a research scientist at the Institute for Defense Analyses Center for Computing Sciences and a researcher at the University of Maryland. Stephen also serves on the University of Tulsa Industry Advisory Board and numerous program committees and funding panels.
Derek E. Weeks is the world's foremost researcher on the topic of DevSecOps and securing software supply chains. For the past five years, he has championed the research of the annual State of the Software Supply Chain Report and the DevSecOps Community Survey. He currently serves as vice president and DevOps advocate at Sonatype, creators of the Nexus repository manager and the global leader in solutions for software supply chain automation. Derek is also the co-founder of All Day DevOps, an online community of 65,000 IT professionals. In 2018, Derek was recognized by DevOps.com as the "Best DevOps Evangelist" for his work in the community.
Stephen Magill
Principal Scientist, Galois, Inc.
Derek Weeks
Vice President, Sonatype