Evaluating Business Risk for Open Source Cloud Native Projects
summary
Compares projects under neutral foundations (CNCF, Linux Foundation, Apache) versus company-controlled ones and shows concrete failure modes: OpenSSL runs on roughly $2,000 donations before Heartbleed, MongoDB/Elastic move to the SSPL license change, MySQL→MariaDB and OpenOffice→LibreOffice forks. Advises checking trademark ownership, contributor and employer diversity counts, existence of governance.md and adopters.md, clear security and release policies, code of conduct, and whether leadership selection is employer‑neutral to estimate business risk.
AI-written summary · about
chapters (17)
- 0:00Intro
- 2:02Why do we care about risk?
- 4:58Business Risk Licensing Example
- 7:22Business Risk Governance Examples
- 9:59Determining Neutrality for Foundations?
- 11:25Neutral Foundations
- 12:10Company Originated
- 13:10Governance is about People
- 16:03Leadership
- 19:11Adopters
- 20:09Security
- 21:37Minimum Documentation
- 23:20Awesome Community
- 25:25Responsiveness
- 26:54Contributor Risk
- 27:52Resources
- 28:38Final Thoughts on Risk
related talks
29mNavigating Open Source Risk: A Strategic Approach
24mNavigating Open Source Project Risk
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
33mThe Cathedral, the Bazaar, and the Coffee House
54mWho Pays for Open Source? A Case for Open Governance & Enterprise Contributions
39mTalking with Management About Open Source
23mInvesting in Open-Source
27mBeyond Open Source Risks With the CRA and NIS2