What are you Risking by Ignoring Technical Debt?
summary
Claims that matter: 85% open source in modern apps, about half of libraries have known vulnerabilities. Tools and fixes named: sonar cube, nexus iq, black duck, sonatype, sonarlint, nexus iq firewall. Concrete practices: establish OSS governance, tune scanner rules to cut noise, push IDE and pipeline scans, create a cleanup cadence — dedicate every fourth or fifth sprint to paying down debt and track/triage scanner findings into tickets.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:43Agenda
- 4:10How Do We Get into Debt
- 13:51How Did I Get into Debt
- 20:43How Do We Get out of Debt
- 24:42Invest Wisely
- 26:03Enterprise Software Development Governance Group
- 34:22How Do I Get My Company To Invest in Paying for Technical Debt
- 37:39Open Discussion
- 40:07Is There a Way To Quantify the Cost of Technical Debt
related talks
30mDevSecOps: Understanding Open Source Software risk in your applications
25mOWASP Top 10 Risks for Open Source Software
37mIt’s Not Open Source, It’s You. Where Open Source Risk Comes From
29mA journey of the thousand binaries
01h 01mThe Technical Debt Prevention Clinic
38mApplication Security in the age of Open Source
39mOpen source security: who’s responsible?
33mThe Cathedral, the Bazaar, and the Coffee House