{"id":7355,"date":"2022-01-27T17:20:06","date_gmt":"2022-01-27T17:20:06","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/27\/aws-heroes-panel-spotlights-open-source-community-security-and-funding\/"},"modified":"2022-01-27T17:20:06","modified_gmt":"2022-01-27T17:20:06","slug":"aws-heroes-panel-spotlights-open-source-community-security-and-funding","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/27\/aws-heroes-panel-spotlights-open-source-community-security-and-funding\/","title":{"rendered":"AWS Heroes Panel spotlights open-source community, security and funding"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

There\u2019s been an evolutionary explosion in the size, shape and number of open-source projects over the past decade. In 2010, source code host site GitHub had 1 million<\/a> repositories. By 2018, it had risen to 100 million<\/a>. Today, the site\u2019s code search<\/a> shows 278 million repositories, and by the time you read this article that number could be over 300 million.<\/p>\n

The number of developers contributing to and accessing code from open-source projects has grown as well. GitHub alone has over 80 million users, and the wider community is probably a lot larger than that. Major projects, such as OpenStack<\/a>, receive billions of dollars in support from companies, including Red Hat Inc., IBM and Hewlett Packard Enterprise Inc. But thousands of small projects are unfunded and irregularly maintained, and critical vulnerabilities remain undetected.<\/p>\n

\u201cProjects that are used everywhere, by everything, with significant outsized impact on the industry are not getting funded, [because they] aren\u2019t flashy enough, aren\u2019t exciting enough,\u201d said Erica Windisch<\/a> (pictured bottom, left), architect for developer experience at Twilio Inc. \u201cBut a vulnerability in it brings everything and everybody down and has possibly billions of dollars of impact to our industry.\u201d<\/p>\n

Windisch spoke with\u00a0John Furrier<\/a>, host of theCUBE, SiliconANGLE Media\u2019s livestreaming studio, for an AWS Heroes Panel during the AWS Startup Showcase: Open Cloud Innovations<\/a> event. Windisch was joined by Liz Rice<\/a> (pictured top, left), chief open source officer of Isovalent Inc.;\u00a0Brian LeRoux <\/a>(pictured top, right), co-founder and chief technology officer of Beginner Corp.; and Casey Lee<\/a> (pictured, bottom, right), chief technology officer at Gaggle.Net Inc.\u00a0They discussed achieving real business outcomes with open source.\u00a0(* Disclosure below)<\/em><\/p>\n

AWS Heroes share knowledge and\u00a0success stories<\/h3>\n

Rice, LeRoux, Windisch and Lee are all AWS Heroes, a title given to leaders who share AWS knowledge and facilitate peer-to-peer learning within their communities.<\/p>\n

\u201cI\u2019ve been in this game for a while, and I tend to just put my fingers in a lot of little pies,\u201d Windish said.<\/p>\n

Those \u201clittle pies\u201d include\u00a0OpenStack, Docker, and OpenTelemetry. Her focus at Twilio is the developer as a user, and she is an advocate of\u00a0AWS\u2019 software developer kits<\/a>.<\/p>\n

At Gaggle, SDKs are used by developers, providing \u201ca nice on-ramp for developers to use the tools and languages they\u2019re used to, and then also go deeper as they need,\u201d Lee said.<\/p>\n

Lee is the creator of the GitHub tool Act<\/a>, and like the other panel members, he is very active in the open-source community.<\/p>\n

Rice chairs the Technical Oversight Committee at the Cloud Native Computing Foundation<\/a>, and as an ambassador for OpenUK<\/a>, she campaigns for use of open tech.<\/p>\n

\u201cThat means I get to see a lot of what\u2019s going on across a very broad range of cloud-native projects,\u201d she said. She is currently \u201cmost excited\u201d about the potential of eBPF<\/a> technology.<\/p>\n

As for LeRoux, the open-source project Architect<\/a>, which is built on top of AWS\u2019 Serverless Application Model<\/a>, is taking up most of his time these days. But he still makes time to \u201ckeep a hairy eyeball\u201d on what\u2019s happening in the Apache Foundation, where he is a member.<\/p>\n

LeRoux feels honored to be part of the open-source community. \u201cIt\u2019s real science,\u201d he said. \u201cWe get to verify each other\u2019s work and expand and build on human knowledge.\u201d<\/p>\n

As members of both the AWS startup ecosystem and the open-source community, the panel members understand the needs of business and open source. They are all active contributors, project founders and open-source advocates.<\/p>\n

Securing the software supply chain<\/h3>\n

The insecurities in open-source code were publicized in a 2020 study<\/a> that showed 91% of open source used in commercial applications was from code that had not been recently maintained. And the United States government\u2019s \u201cExecutive Order on Improving the Nation\u2019s Cybersecurity<\/a>\u201d\u00a0prompted a focus on security and compliance as companies were required to provide a software bill of materials, or SBOM, that detailed where code came from.<\/p>\n

Despite this, it took the Log4J vulnerability<\/a> for businesses to really pay attention to the potential risk of basing their infrastructure and applications on\u00a0open-source code. Part of the problem is that it is almost impossible for companies to track the provenance of the code embedded in their infrastructure and applications.<\/p>\n

\u201cEnumerating your dependencies is not trivial today,\u201d Rice stated. Creating a way to track open-source components is an ongoing effort, and the open-source and commercial communities will need to work in tandem to create a solution, she added.<\/p>\n

Companies sometimes compromise their security by using code from projects without a code of conduct, according to Windisch. This causes a conundrum where they are using the code, but because the project doesn\u2019t have a code of conduct, their employees are prohibited from maintaining it.<\/p>\n

\u201cSo you\u2019ve locked yourself into a place where you\u2019re depending on software that your employees are not allowed to contribute to,\u201d Windisch said.<\/p>\n

Lee believes that there needs to be a way to make it more clear \u201chow important this software is, how many people depend on it, and how many people are contributing to it.\u201d Projects such as the Open Source Security Foundation<\/a> have been created to do just this, but they are \u201cjust getting off the ground,\u201d Lee added.<\/p>\n

Sell services, not code: A new model for open-source funding<\/h3>\n

Finding a way to fund projects without compromise is an issue the open-source community has struggled with since its inception.<\/p>\n

\u201cWe know that there\u2019s a commercialization aspect that helps us fund these projects, but how we compose the open versus the commercial sources is still a bit of a tricky question and a tough one for a lot of folks,\u201d LeRoux said.<\/p>\n

The open-source project Backstage<\/a> is a good example of how open source and business can work together for mutual benefit, according to Rice. Sponsored by music streaming platform Spotify Inc., Backstage is currently going through the incubation process at the CNCF, and while the project is 100% open source, startups are emerging that offer a hosted managed version of Backstage, offering services around Backstage, or offering commercial plugins into Backstage, according to Rice.<\/p>\n

\u201cI think it\u2019s really fascinating to see those ecosystems building up around a project,\u201d she said. \u201cI\u2019m a big believer that you cannot sell the open-source code, but you can sell other things that create value around open-source projects.\u201d<\/p>\n

Being involved in open source benefits business<\/h3>\n

Companies need to get skin in the game and become involved in open source, according to LeRoux. Donating financially to a sustainable open-source project is a great way to start, and even tweeting about an open-source project is contributing to it. But to be considered an active member of the community, companies need to commit their employees\u2019 time to contributing and maintaining code.<\/p>\n

\u201cA lot of these enterprises could benefit a lot from getting more active with the open-source foundations that are out there,\u201d LeRoux stated.<\/p>\n

The saying \u201cA rising tide lifts all boats\u201d is apt for open source, according to Rice. \u201cWe can raise security; we can reduce the amount of dependency on unmaintained projects collectively,\u201d she said.<\/p>\n

Enterprise can also look to open source as a way to fill their skills gap by using the community as a hiring channel, LeRoux pointed out.<\/p>\n

\u201cThere\u2019s a lot of benefit to the larger organizations that can do this. They\u2019ll have a huge pipeline of really qualified engineers right out the gate without having to resort to cheesy whiteboard interviews,\u201d he said.<\/p>\n

Watch the complete video interview below, and be sure to check out more of SiliconANGLE\u2019s and theCUBE\u2019s coverage of the <\/span>AWS Startup Showcase: Open Cloud Innovations<\/span><\/a> event.<\/span> (* Disclosure: Amazon Web Services Inc. sponsored this segment of theCUBE. Neither AWS nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)<\/span><\/i><\/p>\n