Skip to main content

HeroDevs Allies with Commonhaus Foundation to Support Open Source Software

HeroDevs this week revealed it has joined the Commonhaus Foundation as the founding member of the Open Source Sustainability Initiative (OSSI) after establishing partnerships with the open source Hibernate, Jackson, and Quarkus communities to provide commercial support for older versions of these frameworks.

OSSI is a framework administered by the Commonhaus Foundation through which governance of open source software projects is provided.

HeroDevs COO Rob Nalen said the provider of end-of-life support services for open source software sees a clear need to work more closely with maintainers of open source projects that don’t have the resources required to support enterprise IT organizations that for one reason or another are not able to upgrade to the latest version of an open source software framework in a timely manner.

The alliance between HeroDevs and the Commonhaus Foundation, in effect, buys enterprise IT teams, especially if they operate in highly regulated industries, the time they need to eventually make that transition, he added. Over time, HeroDevs also plans to extend the level of support it provides across the other projects that are governed by the Commonhaus Foundation, noted Nalen.

Enterprise IT organizations have for many years now included massive amounts of open source software in their applications. The average enterprise application today has 911 open source components, said Nalen. Unfortunately, they now face a significant dilemma in the age of artificial intelligence (AI). The latest generation of frontier AI models are now able to discover thousands of vulnerabilities in legacy software that, if exploited, could wreak havoc.

The challenge is that once those vulnerabilities are publicly disclosed, it’s also been shown that malicious actors can use AI tools to reverse engineer an exploit in a few hours.

In some cases, DevOps teams might decide to use an AI coding tool to create custom software of their own that replaces the function they once relied on an open source component to provide for. The issue then becomes the amount of time and effort that will need to be allocated to maintaining those custom components. Alternatively, HeroDevs is making a case for relying on an external service provider to maintain open source software on behalf of enterprises that would rather dedicate their limited resources to building and deploying new applications or adding features to an existing one.

Of course, there may not be a single right answer given the volume of dependencies that exist in applications. The decision to replace a component versus relying on an external service provider to support and maintain it will be heavily influenced by just how critical it is to the business. The one thing that is certain is that even in the age of AI coding, it would take possibly years to replace every single open source component that needs to be maintained and secured.

As such, the real issue is determining what to prioritize given the high probability that any number of applications are about to be compromised in the weeks and months ahead.



from DevOps.com https://ift.tt/vmICOgx
Labels:

Comments

Post a Comment

Popular posts from this blog

Rochelle Walensky on the Rocky Road to Normal

Rochelle Walensky on the Rocky Road to Normal By David Wallace-Wells from NYT Opinion https://ift.tt/0A5Wx6r internal-sub-only-nl, Coronavirus (2019-nCoV), Vaccination and Immunization, Rumors and Misinformation, Centers for Disease Control and Prevention, Walensky, Rochelle
Post a Comment
Read more

LocalStack Acquires WonderTwin AI to Gain SaaS App Emulation Platform

LocalStack this week revealed it has acquired WonderTwin AI , a provider of an emulator of software-as-a-service (SaaS) applications that is used to build custom applications for those platforms. Colin Neagle, vice president of marketing for LocalStack, said the emulators WonderTwin AI has developed will be integrated into the company’s namesake emulation platform that application development teams currently rely on to emulate cloud services provided by Amazon Web Services (AWS). LocalStack and WonderTwin AI make it possible for application developers working on a local machine to build applications that are designed to be deployed on some type of external cloud platform using a local sandbox to test and validate integrations without having to connect to a service or build against a live application programming interface (API). That issue has been especially critical in an era where more code will soon be generated by AI coding agents that may for one reason or another circumvent the...
Post a Comment
Read more

Microsoft Brings the Azure SDK for Rust to General Availability

Microsoft has moved the Azure SDK for Rust out of beta and into general availability, giving Rust developers a stable, production-ready way to connect to core Azure services. The release covers Core, Identity, Key Vault (Secrets, Keys, and Certificates), and Storage (Blobs and Queues), built around the same design patterns already used in the .NET, Java, JavaScript, Python, Go, and C++ SDKs. The announcement came as part of Microsoft’s May 2026 Azure SDK release, and was detailed separately in a post from Ronnie Geraghty, product manager for the Azure SDK. He framed the milestone with a simple scenario: a Rust service that signs in with Microsoft Entra ID, retrieves a signing key from Key Vault, pulls work items from a Storage Queue, and writes the results to Blob Storage. Every piece of that chain is now stable. That stability matters more than it might sound. A beta SDK is fine for experimentation, but most engineering teams won’t put it in front of production traffic. W...
Post a Comment
Read more