figures
Blog

Practicing Security in Open Source Communities

Guest Writer
31.05.2021
image 2 Min read
Open Source & Code Security

Open source projects are the embodiment of the core philosophy: ‘free internet and technology for everyone around the globe’. They can be created, changed and distributed to anyone by anyone and for any purpose.

Contributing to an open source projects is an endorsement of this philosophy, that promotes digital literacy in technological and non-technological communities.

It does have a dark side though, which can be packed into a single word: Vulnerabilities. The technical debt of unseen dependencies might completely offset the time-saving benefits of utilizing open source code, if scanning & testing can’t be achieved quickly, or worse – if it’s not even considered.

How can you, as an open source code user or contributor, help make this practice safer?

#1: Open source communities must take security seriously

Because of the fact that open source code is transparent, there is always an expectation that developers and contributors will find bugs, vulnerabilities, and issues in the software, which is faster than how it happens in proprietary software.

That is not always the case, but still, this expectation is given with trust as well as a responsibility on the OS community. And the community must promote a good security culture to be able to keep this trust and continue to benefit from continuous usage and involvement.

Relying on the community for security is not enough, security needs to be taken into account from the beginning and validated with testing constantly. Using Application Security Testing (AST) tools is an easy and reliable way to improve the security of any OS project.

#2: Transparency matters

Is my project truly secure?

Be transparent about vulnerabilities in your project. Open source projects usually have more chances to find and fix vulnerabilities than proprietary software.

Still, make sure your project is frequently tested and share the findings of the test, especially BEFORE the vulnerabilities were fixed. Knowing that your project is serious about security and reports problems ASAP is integral to building the community’s trust in your project.

#3: Be clear & honest about your goals

What is your software and how it can be used? Understand, present, and create a good community around your project that will satisfy the needs of end-users for your software.

#4 Security doesn’t have to be hard to achieve

Yes, security testing of your software can be complicated and feel like not the top priority, compared to new features. However, to help your project in the long term and the OS community in general, it must be done.

Today, Open Source Security solutions make it easy for you to continuously test your application for vulnerabilities, with nearly no effort or security expertise. That’s what we call “Safer Together”.

Keep the capabilities. Lose the vulnerabilities. Contact us to implement end-to-end code security, to let your teams code worry-free.

Originally published by Neuralegion

Comments

0 comments

There’s more to see

slider item
Open Source & Code Security

Keep the Capabilities, Lose the Vulnerabilities: Snyk’s Open Source Security Solution

anastasia axelrod 13.01.22

Open source code is only as safe & reliable as your ability to scan it. Dependencies don’t only jam production – they might also pose real security risks. This is what makes an automated Open Source Security solution so vital to your cloud security stack. In this demo, our solution architect Steven Puddephatt will walk […]

Read more
slider item
Open Source & Code Security

Demo: Inside Snyk’s Open Source Security

Steven Puddephatt 11.10.21

Open source code is only as safe & reliable as your ability to scan it. Dependencies don’t only jam production – they might also pose real security risks. This is what makes an automated Open Source Security solution so vital to your cloud security stack. In this demo, our solution architect Steven Puddephatt will walk […]

Read more
slider item
Open Source & Code Security

Report: State of CNAS, Q2 2021

Admin Globaldots 16.06.21

As companies embrace cloud native technologies as part of their digital transformation, security becomes key to delivering software products faster and error-free. This latest survey by Snyk: Evaluates the latest cloud-native development trends. Demonstrates how Cloud Native App Security (CNAS) fits into CI/CD. Reveals what still keeps some companies from moving to cloud-native platforms.  Fill […]

Read more

Unlock Your Cloud Potential

Schedule a call with our experts. Discover new technology and get recommendations to improve your performance.
Contact us
figure figure figure figure figure