1.
15 YEARS IN OPEN SOURCE
COMPLIANCE
Jeff Luszcz
jeff@luszcz.com
@JeffLuszcz

2.
15 YEARS IN OPEN SOURCE COMPLIANCE
INTRODUCTION – JEFF LUSZCZ
 Founded Palamida in 2004
 One of the first Scanning tools to manage FOSS
 Designed compliance audit program and built out
Professional Services team to implement it
 Team helped everything from basic compliance,
M&A due diligence, and open source project
hygiene
 Everyone from sole proprietors to largest software
companies in the world
 Witnessed industry move from dozens of OSS
packages to 1000s of packages per BOM

3.
THINGS LEARNED ALONG THE WAY
 Compliance is still a personality driven process
 When influencers leave, a company’s compliance
process often falls apart
 Bus Factor=<1 at many companies
 Experience levels vary greatly across the industry
 BOM Inventory depends on who performed or what
process was followed. Same project could report 10
or 1000 libraries depending on tool or person.
 Analysis Paralysis is a double edged sword
 First reviews lead to either NO reviews or MORE
reviews
 Remediation is an ART not a Science

4.
WHAT IS HARD FOR COMPANIES?
 New code is valued over “maintenance” and no dev
cycles are earmarked for compliance*
 (*outside of post M&A work)
 Top level package licenses can be managed but inner-
package licensing is difficult to understand
 The typical BOM undercounts by 99%!
 Each layer (build, dev, deployed) is managed by
different teams who all are scared to call the lawyers
 “Here be dragons issues” like Old code with non-
standard licenses from dead people

5.
WHAT’S ON THE HORIZON
 The number of packages in a BOM has moved past where
humans can easily monitor using spreadsheets
 The build environment and tool chain are being ignored by
compliance teams at the same time targeted Supply Chain
Attacks are increasing
 We need to start requiring accurate BOMS in contracts with
real teeth
 “Internal Audit” is waking up to OSS issues
 Pressure building for new FOSS licenses / models
 OpenChain has a bright future! Well respected and
outside knowledge is growing

6.
THANKS!
CONTACT:
Jeff Luszcz
jeff@luszcz.com
@JeffLuszcz