The Cathedral, the Bazaar, and the Coffee House
summary
Claims that open source is ubiquitous and risky: 99% of audited codebases contain OSS, with 82% containing outdated or abandoned components and 73% showing at least one license issue. Cites Log4j, Elasticsearch/Kibana (2021) and Akka (2022) license shocks and a Tidelift finding that maintainers cite money as a top problem. Recommends creating and funding an OSPO, hiring developers (including docs/testers), using CHAOSS/Apache Kibble/X‑Labs metrics, and forming inter‑company “coffee house” collaborations to share dependency analysis and reduce mitigation costs.
AI-written summary · about
chapters (10)
- 0:00Introduction and history
- 1:31Shipping industry risks
- 4:45Open source project risks
- 7:21Sustainability and licensing
- 10:22Transitive dependency risks
- 12:02Cathedral vs. bazaar models
- 14:17OSPO as a mitigation strategy
- 17:30Managing external projects
- 21:18The coffee house concept
- 23:40Q&A session
related talks
24mThe Cathedral, the Bazaar, and the Coffeehouse
36mSOS Sustainable Open Source
39mSOS: Sustainable Open Source
05mThe Cathedral, The Bazaar and the Coffee House
19mResponsible consumption of open source
41mManaging the risk and growth of using Open Source Software
47mThe TRUE Cost of Open Source
32mSOS: Sustainable Open Source