WhiteSource Blog

Plenty of examples of NPM packages being taken over: * https://www.whitesourcesoftware.com/resources/blog/npm-package-javascr… * https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 * https://blog.sonatype.com/npm-project-used-by-millions-hijacked-in-sup… * https://checkmarx.com/blog/attackers-write-bugs-as-well/ When was the last time you audited all of the libraries a SPA depended on? If it was during the last build, congrats, you're doing great. Lots of times it isn't automated and can be neglected, though.

Did he say anything about cloud providers/the SaaS loophole? I mean they do anything with GPL licensed software, as distribution does not happen. The AGPL addresses this issue, but it does not seem to be used much. https://www.whitesourcesoftware.com/resources/blog/the-saas-loophole-i…

I haven't used it myself but I'm pretty sure Whitesource Renovate is free tool that tries to do just that. https://www.whitesourcesoftware.com/free-developer-tools/renovate/

While having a long uptime sounds cool it is a signal that you don't patch that often. Maybe you patch your other stuff, but I would bet on even odds that you don't. So then that is the rest of the stack, eg systemd which has some mega flaws IIRC. You're leaving yourself open to having something exploited. Have a look at your ssh logs where "people" are constantly trying to get in. https://www.whitesourcesoftware.com/resources/blog/top-10-linux-kernel…

This is a legal issue which files under compliance. Many times enterprises that are looking to acquire a small company they will request code audit. This audit usually is requested after the agreement of sale. For legal reasons, this provides the safety that your company doesn't provide any compliance issues moving forward in your code. This process is just playing it safe so there wont be any legal issues moving forward. WhiteSource easily verifies license compliances on premises or using their Saas program. They provide a very timely report that will ease the process. https://www.whitesourcesoftware.com/open-source-license-compliance/

Y'all are talking about possibly three different things. "Source available" does not mean anything about a license at all. It literally just means the source is available... to someone. Open source generally means it must have a license that allows modifications and derived works. It is more than "source available" it means that a public license to use and redistribute the software is available. "source available" does not necessarily mean you have a free license to use or distribute the software, or modify it and distribute the modifications. "open source" does. The Open Source Institute has tried to standardize a definition. https://opensource.org/osd "copyleft" is sometimes used to mean something more than some "open source". Richard Stallman has promoted these sense of "copyleft". Like GNU license as opposed to apache. Both are open source -- nobody says apache license isn't open source right? Open source licenses that aren't "copyleft" are sometimes called "permissive". Here's one description of it that will suffice: > 3. Is the Apache considered copyleft? > Copyleft licenses require the derivative works or modified versions of existing software to be released under the same license. The Apache License doesn’t have any such requirements. It’s a permissive license. It permits you to release the modified parts of the code under any license of your choice. However, you are required to release all the unmodified parts of the software under the same license (the…

One thing that I think is usually absent from this is the fact that most copyleft licenses are being interpreted by the industry has having a SaaS loophole[1][2], which makes the economics of developing software much more attractive. On one hand you get to use all GPL'ed code for free, so your developers have to build much less things in house, whereas you also exploit the economics of rent vs sell as other commenters have explained. It's a double whammy for the software industry which would have high margins by just using a "sell" model anyway. That being said I believe the SaaS loophole plays a big part in this, a lot of code that is out there today would have to be re-written to be sold in a traditional model and still be compliant with copyleft software licenses and usually this is not mentioned in these discussions. [1] https://www.whitesourcesoftware.com/resources/blog/the-saas-loophole-i… [2] https://opensource.stackexchange.com/questions/11467/can-i-use-gpl-sof…