Backslash introduced a new, free resource for vibe coders, developers and security teams - the Backslash MCP Server Security Hub.
The world's appetite for open source software is voracious. In the last year, businesses around the globe significantly increased their use of open source and although they readily acknowledge growing concerns about open source-related security and operational risks, the effective management of open source is not keeping pace with the increase in use.
Those are among the key takeaways from the 2017 Open Source 360° Survey results from Black Duck's Center for Open Source Research and Innovation (COSRI).
Nearly 60 percent of respondents said their organizations' use of open source increased in the last year citing:
■ cost savings, easy access, and no vendor lock-in (84 percent)
■ ability to customize code and fix defects directly (67 percent)
■ better features and technical capabilities (55 percent)
■ the rate of open source evolution and innovation (55 percent)
Additionally, in terms of open source's positive impact on business, survey respondents highlighted accelerated innovation (55 percent) and quality improvement (44 percent).
Even as their organizations are embracing open source to accelerate application development and increase development agility, respondents expressed concern about:
■ license risk/loss of intellectual property (66 percent)
■ exposure to internal applications to exploitation from open source vulnerabilities (64 percent)
■ exposure of external applications to exploitation because of open source vulnerabilities (71 percent)
■ unknown quality of components (74 percent)
■ failure of development teams to adhere to internal policies (61 percent)
Despite those high levels of concern, nearly half of survey respondents indicated their organizations have no formal policies for selecting and approving open source. And just 15 percent indicated they have automated processes in place to manage their open source use.
Respondents gave their organizations decidedly middling marks in areas of managing and securing their open source, with slightly more than half reporting:
■ being in compliance with associated licenses (54 percent)
■ being aware of known security vulnerabilities (55 percent)
■ knowing where and which open source versions are currently integrated and deployed (54 percent)
■ conforming to internal policies (44 percent)
"Companies are using a tremendous amount of open source for sound economic and productivity reasons, but today most companies are not effective in securing and managing it," said Black Duck CEO Lou Shipley. "This is surprising for a number of reasons. Today open source comprises 80 percent to 90 percent of the code in a modern application and the application layer is a primary target for hackers. This means that exploitation from known open source vulnerabilities represents the most significant application security risk most organizations face."
The Open Source 360° survey results show that open source vulnerability tracking and remediation remain primarily manual processes carried out by internal resources (53 percent). Only 27 percent of respondents reported automatic identification and remediation tracking of known open source vulnerabilities.
Other notable findings from the 2017 Open Source 360° survey include:
Methods for tracking use of open source:
■ Information provided by developers (54 percent)
■ Manual design/code reviews (36 percent)
■ Scans to inventory open source in use (33 percent)
Methods for reviewing code for open source use:
■ Don't review code for open source (38 percent)
■ Internal tools to scan for open source (27 percent)
■ Third-party tools to scan for open source (28 percent)
Most important elements to a successful open source policy:
■ A structured process for review and approval of open source use requests (42 percent)
■ A whitelist/blacklist of approved open source components, specific to use cases 39 percent
■ A whitelist/blacklist of approved open source licenses, specific to use cases (39 percent)
Prevalent areas for open source usage:
■ Build applications used within our organization (77 percent)
■ Build applications used by our customers 69 percent
■ Build and run our IT operations infrastructure (69 percent)
Prevalent technology areas for open source use:
■ Development Tools/Software Development Lifecycle (57 percent)
■ Containers/DevOps/Virtualization/Cloud Computing (53 percent)
■ Systems Management/Operating Systems (52 percent)
Open Source Contribution: (66 percent) of companies surveyed contribute to open source projects.
Methodology: The COSRI survey comprised 819 respondents primarily from the US and EMEA, 74 percent of whom were software developers, IT operations/professionals, systems architects, development managers, and security professionals. This year's Open Source 360° Survey conducted by Black Duck's COSRI is the successor to the former Future of Open Source Survey, co-presented for many years by Black Duck and North Bridge.
Industry News
Google's Gemma 3n is the latest member of Google's family of open models. Google is announcing that Gemma 3n is now fully available for developers with the full feature set including supporting image, audio, video and text.
Google announced that Imagen 4, its latest text-to-image model, is now available in paid preview in Google AI Studio and the Gemini API.
Payara announced the launch of Payara Qube, a fully automated, zero-maintenance platform designed to revolutionize enterprise Java deployment.
Google released its new AI-first Colab to all users, following a successful early access period that had a very positive response from the developer community.
Salesforce announced new MuleSoft AI capabilities that enable organizations to build a foundation for secure, scalable AI agent orchestration.
Harness announced the General Availability (GA) of Harness AI Test Automation – an AI-native, end-to-end test automation solution, that's fully integrated across the entire CI/CD pipeline, built to meet the speed, scale, and resilience demanded by modern DevOps.
With AI Test Automation, Harness is transforming the software delivery landscape by eliminating the bottlenecks of manual and brittle testing and empowering teams to deliver quality software faster than ever before.
Wunderkind announced the release of Build with Wunderkind — an API-first integration suite designed to meet brands and developers where they are.
Jitterbit announced the global expansion of its partner program and new Jitterbit University partner curricula.
Tricentis unveiled two innovations that aim to redefine the future of software testing for the enterprise.
Snyk announced the acquisition of Invariant Labs, an AI security research firm and early pioneer in developing safeguards against emerging AI threats.
ActiveState expanded support of secure open source to include free and customized low-to-no vulnerability containers that facilitate modern software development.
Pythagora launched an all-in-one AI development platform that enables users to build and deploy full-stack applications from a single prompt.
Cloudflare announced that Containers is in public beta.
The Linux Foundation, the nonprofit organization enabling mass innovation through open source, announced the launch of the Agent2Agent (A2A) project, an open protocol created by Google for secure agent-to-agent communication and collaboration.