How to Fall In Love With Open Source Code All Over Again

Just like in your romantic relationships, it all starts with trust — or persistent, dogged monitoring of your lover's actions through state-of-the-art tech. Whichever works.

Let's start with an open source metaphor.

Finding trustworthy open source code in the dev world is a little like finding true love on Craigslist. 

Sure, you could totally land the significant other of your dreams — a kind, attractive person with a trust fund who has a masters degree in, say, cooking breakfast. But, if you're not careful, you’ll end up chained to a twin-size in a Motel 8 just outside of Poteet, Texas for a few hours until housekeeping comes by.

Wow. Ok, basically: It's a shady world of code out there.

You already know you gotta go into the whole open source situation with your wits about you. You already know, too, that remaining vigilant requires energy. Lots of energy.

But what's the alternative? Dying alone? 

Well, here’s a fact for ya: 28% of mature DevOps practices confirmed an open-source-related breach in the past year. Does that stat surprise you? If those were your odds in the dating pool, you’d rethink your strategy real quick-like, right? You’d likely bring some support. Somebody you trusted. Somebody who you felt was particularly vigilant.  Somebody who... smells decently, showers, keeps up with themself?

As supreme experts of secure solutions (and not to brag, but also experts of dating, when we were out there, on "the market"), we can help you put yourself out there again — and make sense of code and code scanning.

Let's keep this absolutely tortured open source code metaphor going.

Valentine’s Day is right around the corner, after all.

The right automated tools can be exactly like having somebody at your side, pointing out threat assessments in real-time. So who are our picks to help you from having your proverbial hearts broken? These three highly vetted Innovation Partners...

Sonatype

Sonatype is basically like a friend who has an RV filled with cool gadgets right outside the restaurant where you're meeting your date. Like, imagine that scenario. You've got a really discreet earbud in. They're coaching you on the play-by-play... Sonatype’s Nexus Lifecycle product is able to continuously and dynamically identify risk, enforce policy and remediate any vulnerabilities across every phase of your SLDC. One of the best parts? The automation. Dynamic code-scanning from Sonatype keeps you from having to manually look over your shoulder time and time again. It's seamlessly automated, and produces some really sharp-dressed reports for those C-levels (who love charts, for whatever reason). Sonatype doesn’t just have your back on that first-open-source-dev date. They’re with you all the way through your operational marriage. That can save you money, speed up your development times, and prevent a whole host of problems.

Nucleaus

Nucleaus is basically like your easy-going sharp-eyed buddy who's always ready in a pinch to do some recon on your potential S.O. Got a hot date with some code you're not quite sure about? They'll be there in a minute to make the invisible threats visible and actionable by persistently scanning your code at an affordable cost. Key word: Affordable. Like "I'll help you move your entire apartment for a slice of pizza" affordable. As a code scanning tool, Nucleaus delivers value to their clients faster than fast, due to a highly streamlined startup process (within minutes as opposed to weeks or months) (and ain't nobody got time for months when it comes to security). They also reduce noise and simplify the remediation process, consolidating tickets to fix code issues one time across the entire code-based process, as opposed to multiple individual tickets. Nice.

Whitesource

What if you had an ex who was also your friend who was also surveilling you, waiting for you to make a mistake… but then they actually have your best interest at heart? To us, that actually sounds like 1) true love and 2) Whitesource's Chrome Integration, which — once you grant it permission — integrates with all the top repos and scrapes your browser's screen. As a whole, Whitesource automates the entire process of open source component selection, approval and management, including detection and remediation of security and compliance issues. It integrates with all stages of your SDLC to alert in real-time and help you fix code issues faster, even if it does kinda... seem like it's watching you while you sleep.

In conclusion:

Trusting, and falling in love again, with open source code isn't just an idyllic dream. You can actually create a better security posture and a seamless DevOps process with the right partner. This will help you drive down costs and speed up production. The Infinite Ranges approach? Understand your situation, understand your tolerance for risk, and understand your business metrics. Then, we can make a call as to what code-scanning tool best works for you.

When you have that dialed in, nothing can stop you from falling back in love with open source. (Plus, you’ll never be stuck in Room 11 wishing you’d learned how to pick a handcuff lock with your feet.) And that, my friends, is what Valentine’s Day is all about.