Open-source code and frameworks can be found in most modern software applications, as developers find great value in using functionality that has already been written. Open source has little or no upfront monetary cost and saves developers valuable time to work on higher-value projects.

But among the problems with open source are that the code could have undiscovered or unpatched vulnerabilities or licenses that in some way hinder their use in business applications.

RELATED CONTENT: 
A managed open-source approach can improve the health of your open-source supply chain
What does it take to commit 100% to open source

At best-in-class development organizations like Google and Amazon, internal catalogs of “known good” open-source components are created and maintained, so developers are free to use them without worrying about licensing or vulnerabilities.

Unfortunately, most organizations creating software today — that’s basically all organizations — don’t have the resources of a Google or Amazon. And they’ve seen that allowing developers to go into the wilds of GitHub to find a project they can use could leave them at risk of using unmaintained or insecure code, or violating license terms or corporate policy.

Donald Fischer is the CEO at managed open source company Tidelift, which was created to give any organization the ability to have a catalog of vetted open-source packages they can use and trust. Fischer was the early product manager for Red Hat Enterprise Linux, and his co-founders came out of Red Hat and are using a similar model at Tidelift to help organizations ensure the open source components they use to build applications are enterprise-ready. 

The main thing that Red Hat and other vendors of true open-source software sell is believable promises about the future state of these open-source projects, Fischer said. It’s like an SLA that’s laid on top of the software you can download for free. “They’re not the selling software, they’re selling the assurance that somebody’s going to keep the code up to a certain standard going forward,” Fischer explained. “And that’s exactly what we’re doing for this broader universe of software application development components.”

Tidelift is able to do this because it pays the individual open-source project maintainers and teams. “When we pay the maintainers upstream, the work gets done once and all Tidelift customers benefit from it. With Tidelift, we’re all essentially sharing the cost of doing that baseline, generic work, instead of everyone buying a tool and trying to do it themselves,” he said.

Many organizations are currently using code scanning tools to help them assess the quality of their open source components. Tidelift is more than a code scanner—it can not only analyze the health of the code, but also give customers the thing they really want—components that are secure and well-maintained. When organizations run their own scanning tools and are alerted to a flaw, in many cases they didn’t write that code, and their only recourse is to go to the community and hope it gets patched or remediated in a timely manner. Tidelift takes on not only the detection of security and maintenance issues, but also the remediation of any problems that are uncovered. “You can only do that well if you are collaborating with the independent maintainers of this universe of packages, because you need all this esoteric knowledge of each of these individual packages.”

Tidelift has multi-tenant SaaS service software that attaches to a customer’s development life cycle — typically in the same place continuous integrations tools would run, Fischer pointed out — so every time a software build is made, Tidelift looks at dependencies that are getting pulled in and makes sure they meets whatever baseline hygiene standards apply to the customer. “We’ll make sure the packages that are going into your build work, and if not, we’ll throw a flag. We can throw a red flag that blocks the build, or a yellow flag that’s sort of an FYI that you might want to reconsider using that package.”

When alerts do crop up, Tidelift partners with an open source maintainer who has the expertise in that particular project and is being paid by Tidelift, to fix the problem in a very timely manner.

Payment follows the Spotify music model; the more that software package is used by Tidelift’s customers, the more the maintainer will get paid. If Tidelift has customers using a package for which Tidelift does not yet have a maintainer, it’s posted on their website with a current going rate so maintainers can self-discover it. Or, they will reach out to a maintainer and see if they want to join the system.

To shift catching these problems left, Fischer said you can’t just rely on code-scanning tools. He advised creating a master catalog of open-source projects that developers can choose from at the outset of their work, and make sure they’re maintained. Tidelift, Fischer added, lets you start with a catalog of thousands of open-source projects that you can count on being good today and good tomorrow, based on hygiene and quality.

 

Content provided by SD Times and Tidelift