Dependencies

Make Developers' Lives Easier with Endor Labs & GitHub Advanced Security

Developers are bombarded with information every day. Constant context switching and information overload are among the biggest barriers to productivity. There are simply too many demands for their attention. One day the sales team will understand. Right?

Introducing The Top 10 Open Source Software (OSS) Risks

The Endor Labs Station 9 research team teamed up with over 20 CISOs and CTOs to identify the top 10 security and operational risks introduced through reliance on open source code.

Open Source Licensing Simplified: A Comparative Overview of Popular Licenses

Explore the different types of open source licenses and how they impact the use, modification, and distribution of open source software. From GPL to Apache, MIT and more, learn the key differences between permissive and restrictive licenses and how to choose the right one for your project.

What is reachability-based dependency analysis?

As software engineers, we (should) strive to write as little code as possible. This is understandable: new code has new bugs and will need maintenance in the future. One way of avoiding writing software is to reuse Open-Source Software (OSS) libraries, hosted on centralized code repositories, such as Maven or NPM.

What are Maven dependency scopes and their related security risks?

This article explores Maven dependency scopes: what are they, what are they used for, and how do they impact security risks?

Introducing the OpenSSF Scorecard API

The Scorecard API makes it easier to automate and enforce your dependency policies. Naveen is one of the key contributors to the Scorecard projects, in this article, he walks through how it works!

How Zero Trust principles can accelerate open source adoption in enterprises

Open source is a huge boost to productivity, and today we trust it implicitly even if we think we don’t. That comes with a lot of risk, a lot of friction, and doesn’t let us make the most out of open source software. Zero Trust principles can help us get open source adoption to its full potential.

The response is as dangerous as the vulnerability - Thoughts on the CSRB Log4j report

The recent report from the CSRB gives a step by step account of Log4j, from discovery to remediation, and uncovers a painful insight - sometimes the response is just as dangerous as the vulnerability.