A Complex Web of Open Source Software Dependencies Risk
summary
CHAOSS Risk working group defines concrete dependency measurements and tools: a cumulative age heuristic LibYear (age-of-dependencies heuristic) that can include transitive deps, plus an inventory of upstream dependencies and sustainability risk scoring so OSPOs can triage across portfolios (example use case: 11,000 projects). Metrics integrate known-vuln crosschecks and the OSSF Scorecard checks; CHAOSS publishes metric defs and implementations on chaos.community and GitHub so organizations can rank, filter, and prioritize which libraries to update or fund.
AI-written summary · about
chapters (3)
- 0:00A Complex Web of Open Source Software Dependencies and Risk Overarching work of CHAOSS Risk Working group
- 8:03Dependency Metrics: Libyear
- 9:11Libyear What is the age of the project's dependencies compared to current stable releases?
related talks
29mUsing CHAOSS Metrics, Models, and Software to Identify the Most Significant At-Risk Dependencies in Your Portfolio - Sean Goggins, CHAOSS Project and the University of Missouri
20mOSS Dependency Health: Towards Maturity and Sustainability Risk Assessment Model
34mAssessing Project Risk Using CHAOSS Metrics
42mThe Role of Open Source Management Talent in Ensuring Software...
25mDefining the Limits of Risk
31mThe Value of OSS Management for Risk Mitigation
36mPanel Discussion: OSS Viability and Project...
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard