Machines Making Software
summary
Research of 60,000 dev teams and Sonatype telemetry show concrete numbers: Maven Central sees 376B download requests (2020 projection) across 6M components, the average enterprise pulls ~373,000 Java packages yearly and relies on ~3,500 projects and 11,000 releases. Vulnerability timelines matter: Equifax class exploits in three days, average org finds vulns in a week and takes another week to remediate, only 7% fix within a day. High performers use SCA and SBOMs, deploy 15× more frequently and are 26× faster at remediation.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:16Software Supply Chains
- 2:31Open Source Usage
- 5:51Faster is Better
- 13:36Best Open Source Projects
- 20:44Dynamics of the Research
- 29:47Tertiary Benefits
related talks
55mCI Pulled It, Prod Ran It: The Real Risk in Dependency, by GraphsIlkka Turunen
42mMagic of Automation and Everyday Chores
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
18mDevOps Tools for Java Developers
40mEmbracing Security - A Changing DevOps Landscape
21mWhy Building Your Ship (Application) with Raw Materials is a Bad Idea!
31m54,000 Tales - A Data-driven Discussion of Exemplar Development and DevSecOps Practices
39mWe Are All Equifax: The Data Behind DevSecOps