Tidelift’s Post

View organization page for Tidelift, graphic
Tidelift

3,362 followers

What is a “bad” open source package? 😵 In Tidelift VP of Product Lauren Hanford’s latest blog post in ITPro Today, she answers this question. ✅ From the article: “A package may be considered bad if it is abandoned, deprecated, or declared end-of-life. Or it may not have published security policies or respond to security issues—often because there is only one maintainer.” “Bad packages not only create #security #risk that can impact your organization's revenue, data, and customers, but they also suck up valuable development time when you need to replace them, work around them, or deal with endless cycles of vulnerability remediation.” How can organizations reduce reliance on bad #oss packages? 🤔 Lauren offers 4 ways: 1. Evaluate packages before pulling them in for application development. 🕵️ The best way to avoid risk from bad packages is to ensure they don't make their way into your application in the first place. 2. Actively monitor the open source packages in use. 📊Open source packages are constantly changing, and so it is important to monitor and review updates after making the initial decision to use a package or version. 3. Identify and eliminate bad packages you've already adopted. ❌ 4. Reinforce at-risk packages to keep them from becoming bad. 💪 You can read more about how your organization can move away from using bad open source packages, including what questions to ask during each of the questions above 🔼, on ITPro Today: https://lnkd.in/gBqd3iJP

  • No alternative text description for this image

To view or add a comment, sign in

More Relevant Posts

Tidelift

3,362 followers

View Profile

Explore topics