Exemplars, Laggards, and Hoarders: A Data-driven Look at Open Source Software Supply Chains
summary
A year‑long study analyzes 36,000 Java projects, 3.7 million releases, 86,000 applications and surveys (6,200+ OSS contributors, 652 and 5,500 commercial devs) and reports concrete outcomes: exemplars commit 50% more, release 2.4× faster and remediate 2.9× faster; median MTTR for security patches is six months with 5% taking ≥3.5 years; projects with more dependencies often have better hygiene because they have larger teams; unmanaged apps show ~21% vulnerable components.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:09Use of Open Source
- 1:48How this translates into your enterprise
- 2:35Research weve done
- 2:58What did we do
- 3:58Open Source Ecosystem
- 4:58Research
- 5:08Does this trend hold an open source
- 5:49Metrics
- 8:14Dataset
- 9:27Component Attributes
- 10:12Component Attributes Visualization
- 12:44Security Relevant
- 16:00Update Hygiene
- 17:12Popular Projects
- 21:02Consumers of Open Source
- 22:56Exemplars Behavior
- 26:29Vulnerability Defect Density
- 27:27Takeaways
- 30:22Download the Report
- 31:38Panel Discussion
related talks
45mExemplars, Laggards, & The Cautious: A Data-driven Look At High-velocity Software...
41mManaging the risk and growth of using Open Source Software
38mBetter, Faster, Stronger: How the Global Acceleration of OS Development Is Changing
39mSOS: Sustainable Open Source
49mQuantifying the Probability of Flaws in Open Source
45mPanel Discussion: Managing Open Source...
47mThe TRUE Cost of Open Source
49mTrustworthy Open Source: The Consequences of Success