A complex web of open source software dependencies risk | Sean Goggins | CHAOSScon NA 2021
Channel: CHAOSS
Date: 2021-12-11

A complex web of open source software dependencies risk

Today, software project development is nearly impossible without the use of interdependent components. These interdependencies have such a strong impact that software projects often fail if an open-source project library malfunctions. This was observed in the NPM project, when an open-source project contributor deleted 11 lines of code that he had contributed to an open-source library causing many other projects dependent on this library to fail. This presentation will present a synthesis of the complexity of managing dependencies, and the relationship between open source software dependency metrics, quality assurance, and security. Members of the CHAOSS Risk working group will answer a simple yet a complex question: what are the categories of open source software dependencies, and what metrics can make these risks visible. Participants will gain insights into: 1. What to measure? And 2. How to measure dependency risks? To answer these questions we worked across Linux Foundation projects to identify various dependency issues, and develop a set of metrics based on: 1. Goal 2. Question 3. Metric Approach. The metrics we then implemented using the CHAOSS Project’s Augur software will demonstrate one approach for visualizing and assessing dependency risk across large project portfolios. The key takeaway is it is work measuring the riskiness of a piece of software you're using or dependent on.