Are open source and embedded software development on a collision course?
Download as PPTX, PDF1 like150 views
The document discusses the intersection of open source software (OSS) and commercial support, highlighting the prevalence of OSS in organizations and the associated legal risks and compliance challenges. It emphasizes the importance of having clear policies, support mechanisms, and the necessity for organizations to audit their code for legal obligations. Additionally, it calls for implementing safety and security measures, including monitoring vulnerabilities and utilizing static analysis tools.
![20© 2017 Rogue Wave Software, Inc. All Rights Reserved.
MISRA recommends SCA
“In order to ensure that the source code written does conform to the
[MISRA] subset it is necessary to have measures in place which
check that none of the rules have been broken.
The most effective means of achieving this is to use one or more
of the static checking tools that are available commercially.”
- Section 4.3.1](https://image.slidesharecdn.com/osscollisioncourse-october2018clean-181102125940/85/Are-open-source-and-embedded-software-development-on-a-collision-course-19-320.jpg)
Are open source and embedded software development on a collision course?
- 1. 1© 2017 Rogue Wave Software, Inc. All Rights Reserved. Are open source and embedded software development on a collision course? Rod Cope, CTO RogueWave Software
- 2. 2© 2017 Rogue Wave Software, Inc. All Rights Reserved. Presenter Rod Cope CTO Rogue Wave Software rod.cope@roguewave.com Twitter: @rodcope
- 3. 3© 2017 Rogue Wave Software, Inc. All Rights Reserved. Agenda 1. Introduction 2. Using OSS 3. License risk 4. MISRA, OWASP 5. Safety & security 6. Q & A
- 4. 4© 2017 Rogue Wave Software, Inc. All Rights Reserved. Introduction
- 5. 5© 2017 Rogue Wave Software, Inc. All Rights Reserved. Open source is everywhere GitHub 5 million+ OSS projects 80+ Licenses approved by OSI 98% of organizations use OSS https://guides.github.com/activities/contributing-to-open-source/ https://opensource.org/licenses/alphabetical http://www.roguewave.com/programs/open-source-support-report
- 6. 7© 2017 Rogue Wave Software, Inc. All Rights Reserved. 67% of developers are not sure if there’s a policy for source code, or don’t know what it is. http://www.roguewave.com/resources/white-papers/software-security-begins-with-flaw-free,-standards
- 7. 8© 2017 Rogue Wave Software, Inc. All Rights Reserved. Using OSS
- 8. 9© 2017 Rogue Wave Software, Inc. All Rights Reserved. Support the implementation Self-support Committer support Community support Commercial support
- 9. 10© 2017 Rogue Wave Software, Inc. All Rights Reserved. Why use commercial support Missing skillset Time constraints People change jobs
- 10. 11© 2017 Rogue Wave Software, Inc. All Rights Reserved. Commercial support example The original implementation was not built for scale. We’ll help you build a workaround. We’re experiencing heavy latency and heavy resource utilization with ActiveMQ. The person who built this left.
- 11. 12© 2017 Rogue Wave Software, Inc. All Rights Reserved. Support the selected software 80% of support issues are either a lack of product knowledge, or something in the environment outside of the package. http://www.roguewave.com/programs/open-source-support-report
- 12. 13© 2017 Rogue Wave Software, Inc. All Rights Reserved. What can organizations do? Detect critical areas Investigate knowledge gaps Implement a plan
- 13. 14© 2017 Rogue Wave Software, Inc. All Rights Reserved. Legal risk
- 14. 15© 2017 Rogue Wave Software, Inc. All Rights Reserved. Free comes with restrictions Organizations may be at risk of violating legal obligations.
- 15. 16© 2017 Rogue Wave Software, Inc. All Rights Reserved. Open source related legal action • Versata v. Ameriprise • XimpleWare v. Versata and Ameriprise • Oracle v. Google • Jacobsen v. Katzer • Welte v. Fantec
- 16. 17© 2017 Rogue Wave Software, Inc. All Rights Reserved. Audit code Identify packages Bill of materials (BOM) Obligations
- 17. 18© 2017 Rogue Wave Software, Inc. All Rights Reserved. MISRA, OWASP, etc.
- 18. 19© 2017 Rogue Wave Software, Inc. All Rights Reserved. Maintain compliance
- 19. 20© 2017 Rogue Wave Software, Inc. All Rights Reserved. MISRA recommends SCA “In order to ensure that the source code written does conform to the [MISRA] subset it is necessary to have measures in place which check that none of the rules have been broken. The most effective means of achieving this is to use one or more of the static checking tools that are available commercially.” - Section 4.3.1
- 20. 21© 2017 Rogue Wave Software, Inc. All Rights Reserved. Analysis tools Identify bugs and vulnerabilities Compliance checkers
- 21. 22© 2017 Rogue Wave Software, Inc. All Rights Reserved. Safety & security
- 22. 23© 2017 Rogue Wave Software, Inc. All Rights Reserved. Vulnerabilities
- 23. 24© 2017 Rogue Wave Software, Inc. All Rights Reserved. Remediation Establish processes Research issues Scan all code
- 24. 25© 2017 Rogue Wave Software, Inc. All Rights Reserved. Community updates Monitor and implement community updates.
- 25. 26© 2017 Rogue Wave Software, Inc. All Rights Reserved. Critical security announcements OPENUPDATE SIGN UP: roguewave.com/openupdate
- 26. 27© 2017 Rogue Wave Software, Inc. All Rights Reserved. Monitor and test implementation
- 27. 28© 2017 Rogue Wave Software, Inc. All Rights Reserved. Q & A
- 28. 29© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Editor's Notes
- #4: Shorten titles
- #8: Source: http://www.roguewave.com/resources/white-papers/software-security-begins-with-flaw-free,-standards Risks of embracing OSS include: Late releases Over budget projects Casualties to life and limb Blending newly-written, legacy, and open source code With a complex – and lengthy – supply chain for most embedded development, each software contributor needs to better understand the landscape, the true costs, risks, and how to make the right decisions for when – and how – to use open source software. Knowing how to manage and support open source software, as well as making sure that licenses, standards compliance, and critical safety and security issues are addressed has taken on a life of its own.
- #26: To stay ahead of the best practices and ongoing updates in open source software, an organization needs to have one or two employees dedicated to that task. However, most organizations don’t have the resources to maintain that role, so there needs to be a process, exercising extreme caution around monitoring and implementing community updates. Some open source updates aren’t as critical as other updates, but it’s a risky game to wait to see what matters. As there are such a high number of updates with open source software, not all of the issues get a lot of media coverage and internet searches fall short of true discovery. This means that organizations can sit for months – or longer – exposed and unaware that a crucial update is available. These updates should be taken as high priority when tracking open source software updates and announcements.