Palamida - Software Risk Management

Thoughts on FOSSology

admin — Fri, 25 Jan 2008 11:54:01 -0600

By now you've probably seen HP's FOSSology announcement. It's an initiative that they say will, "facilitate the study of Free and Open Source Software by providing free data analysis tools". It's a welcome addition to the open source world, and is evidence of the growth of a robust ecosystem of tools and information. Open source is how software is done today.

The Top 5 Most Overlooked Open Source Vulnerabilities for 2007

admin — Fri, 07 Dec 2007 19:32:20 -0600

For year-end 2007, we have compiled the Top 5 Most Overlooked Open Source Vulnerabilities encountered during 2007. We came up with this list after reviewing over 300 million lines of code and spending literally thousands of hours of analysis across a wide range of industries - including technology, financial services and government, among others.

Why Your Customers Care About Your Use of Open Source

admin — Tue, 12 Jun 2007 13:35:59 -0500

Beginning in 2006, some customers of my previous company started inserting contract provisions requiring us to identify all open source software in use within the networking service we provided. As the VP of Engineering at the time, I told them that I stood behind the total service offering, regardless of which parts were open source, which were commercially licensed, and which were built by us, so they needn't be concerned about this. In each case they agreed and removed the provision. It is now clear to me that they should not have done so. Here's why.

The False Positives of Vulnerability

admin — Thu, 03 May 2007 16:10:43 -0500

Jeff Jones writes an ongoing security blog for CSO Online. A recent post about scrubbing and verifying data from repositories such as National Vulnerability Database caught our attention.

Webcast - Informal Survey

admin — Fri, 03 Mar 2006 02:00:00 -0600

Last week, our CTO Ray Waldin participated in a webinar with Rob Jenkins from CollabNet and Eddie Correia from SD Times. The topic was "Two Steps to Centralized, Secure, and Auditable Source Code."

As part of the webinar, we conducted an online survey. Here are some of the more interesting results. (We're not for a minute suggesting these are in any way statistically valid):

How do you manage the use of open source in your code base today?

IP Ingredients

admin — Mon, 02 Jan 2006 18:50:00 -0600

Twice today... Maybe my new year's resolution is working...