State of the Software Supply Chain 2021 • Hacker News Board

Re: State of the Software Supply Chain 2021

#11

Post by stephen-magill » Wed, Sep 15, 2021, 2:55 PM UTC

phkahler wrote: post #8

Interesting read. One thing seems to be missing, and that is any notion of participating in upstream development. In open source you don't have to just be a consumer, you can actively participate in the development of dependencies to varying degrees. They do point to people near the edge vs on the edge as having better practices, and I'd think that's because they at least follow and understand what's going on vs just…

This is something we studied in last year's report. Based on a survey similar to the one described in Chapter 4 we found that a mix of features measuring participation in the open source community was associated with positive security outcomes. It makes sense that if you follow the projects you're using closely then you would be more aware of security advisories and fixes for those projects. My favorite part was the term we used for this mix of features: Open Source Enlightenment :-)

Re: State of the Software Supply Chain 2021

#12

Post by nixpulvis » Wed, Sep 15, 2021, 2:56 PM UTC

stephen-magill wrote: post #10

livealight wrote: post #6

Earlier quoted context omitted.

Yeah oddly the outcome of MTTU is a maintained transitive tree seems to be a better indicator of security status than any other more complex framework. How to do it effectively is a matter on to itself

This is exactly right. Low MTTU and keeping up-to-date across the transitive dependency tree makes it less likely that vulnerabilities creep in due to those transitive dependencies. I think there's also a certain aspect of "faster is better" akin to what we see in Forsgren et al's Accelerate / State of DevOps research. If you have the team structure, development discipline, and release infrastructure required to upda…

What if your discipline is more like Debian or others who make a point to update more dependencies at the same time on a slower cadence?

Re: State of the Software Supply Chain 2021

#13

Post by stephen-magill » Wed, Sep 15, 2021, 3:35 PM UTC

nixpulvis wrote: post #12

stephen-magill wrote: post #10

Earlier quoted context omitted.

This is exactly right. Low MTTU and keeping up-to-date across the transitive dependency tree makes it less likely that vulnerabilities creep in due to those transitive dependencies. I think there's also a certain aspect of "faster is better" akin to what we see in Forsgren et al's Accelerate / State of DevOps research. If you have the team structure, development discipline, and release infrastructure required to upda…

What if your discipline is more like Debian or others who make a point to update more dependencies at the same time on a slower cadence?

I think that works provided the cadence isn't too slow. We see an average of 8 to 12 project versions per year being published depending on ecosystem. That matches nicely with the 28 day average MTTU for 2021 in the Maven ecosystem. I wouldn't want to see projects releasing less frequently than that. But I think the right answer also depends on where in the dependency chain your project tends to live. Projects near the "leaves" should aim to update faster so that downstream consumers aren't blocked waiting on them to remediate issues. Projects more toward the base of the tree might update every month or so and not worry about releasing a new version every time a transitive dependency changes, as that would be too much version churn.

Re: State of the Software Supply Chain 2021

#14

Post by nixpulvis » Wed, Sep 15, 2021, 3:47 PM UTC

stephen-magill wrote: post #13

nixpulvis wrote: post #12

Earlier quoted context omitted.

What if your discipline is more like Debian or others who make a point to update more dependencies at the same time on a slower cadence?

I think that works provided the cadence isn't too slow. We see an average of 8 to 12 project versions per year being published depending on ecosystem. That matches nicely with the 28 day average MTTU for 2021 in the Maven ecosystem. I wouldn't want to see projects releasing less frequently than that. But I think the right answer also depends on where in the dependency chain your project tends to live. Projects near t…

I would really love to see these stats broken out by the type of update. Non-breaking changes (UI, interface, or otherwise) and transparent updates (filling some security holes, UI tweaks / alignment, performance, etc), though I wouldn't quite know how to mechanically label updates myself.

Basically, I'm advocating for slower user facing releases in general. We're getting overwhelmed on the flip side here.