It’s Not Open Source, It’s You. Where Open Source Risk Comes From w/ Sonatype

**Brian Fox** (0:00)
I've been saying this for a long time, but it still surprises people. Log4j, as of today, between 35 and 38% of the downloads of Log4j will be of the vulnerable versions.

**Stephen Magill** (0:12)
Still?

**Brian Fox** (0:13)
Still.
It flatlined. There was a huge spike in the adoption of the newer versions in the weeks following, and we were pretty optimistic, but then it flatlined at about 60 to 68% of the good stuff, leaving somewhere on the road.

**SPEAKER_3** (0:27)
What do you attribute that to?

**Brian Fox** (0:29)
People don't understand what's in their software. They don't manage their supply chain.

**SPEAKER_3** (0:33)
When times are tough, engineering leaders need as much help as they can get.
Linear B helps dev teams continuously improve by providing correlated data, context, and automated workflows that helps streamline code delivery and improve developer experience. Learn more at linearb.io, and check out our free tool, GitStream. GitStream is helping developers everywhere merge their code faster by revolutionizing the pull request review process. Every pull request is different. It's time we start treating them that way. Download GitStream for free, and learn more at gitstream.cm. Now, on to today's episode.
I am back live from the Dev Interrupted Dome at DevOps Enterprise Summit, it's a lot of Ds, and I've had two incredible guests joining me today on the podcast. Welcome, first of all, Brian Fox, you are the CTO of Sonatype.

**Brian Fox** (1:22)
Thanks for having me.

**SPEAKER_3** (1:23)
Really stoked to have you here. We've got a really exciting State of Software Supply Chain Report to Dev Ivan, too, that I know Sonatype has just released your eighth edition, is that correct?

**Brian Fox** (1:31)
That's correct, yep.

**SPEAKER_3** (1:32)
Fantastic. And I know your colleague, Stephen Magill, the VP of Product Innovation at Sonatype, just did a plenary discussion on this as well.

**Stephen Magill** (1:40)
That's right, yeah, thank you.

**SPEAKER_3** (1:42)
This is gonna be great. We're gonna dig in, get some detail, give the audience some context into some of the exciting stuff that's been happening, it does, but before we get into it, I do wanna give the audience a chance to get to know you both a little bit.
So, Brian, why don't we start off with you? How did you end up at Sonatype? You're the CTO, what's your background?

**Brian Fox** (1:57)
My background is in software development. I did a lot of open source Java for a long time. I was pretty involved in the Apache Maven project for a number of years. I was the chair of the project for a while as well, so I'm still involved in the day-to-day of the Apache Software Foundation. I'm also a governing board currently at the Open Source Security Foundation as well.

**SPEAKER_3** (2:20)
So you have a lot of free time, I take it?

**Brian Fox** (2:21)
Yep, lots of free time.

**SPEAKER_3** (2:22)
Yeah, you're never busy. Well, thank you for making time to come on the podcast. We're excited to have you here.
And Stephen, what about yourself? VP of Product Innovation is a cool title. How'd you get it?

**Stephen Magill** (2:31)
Yeah, yeah.
So yeah, I love the product innovation role. I'm basically leading a research team that's developing new technology and capabilities can feed into Sonatype's products, but also doing community research like for the Software Supply Chain Report that we're gonna be talking about today. I ended up at Sonatype after I founded a company called MuseDev that Sonatype acquired a couple years ago. And yeah, I've always respected what Sonatype does and their role in the community and the products that they produce. Even before I joined Sonatype, I was collaborating with them on the report. Going back as far as 2019, I've been sort of at least an outside consultant on the research.

**SPEAKER_3** (3:10)
You've been a partner for a while and it just made sense it sounds like. How big is Sonatype now?

**Brian Fox** (3:16)
Probably over 700 employees at this point.

**Stephen Magill** (3:19)
That's fantastic.

**Brian Fox** (3:19)
It's getting quite large.

**SPEAKER_3** (3:20)
It's a huge testament to your work.
And I'm guessing that as you've seen that organization grow, you've had challenges that have come with it. Has there ever been anything that you've seen either at DevOps Enterprise Summit or within the industry where you're identifying, okay, here's something we need to work on within our engineering team, or here's a goal for us around maybe DoraMetrics or something else that you're taking away?

**Brian Fox** (3:42)
Yeah, I mean, every organization has its challenges. Always. Scaling. You know, we grapple with all of those things. Fortunately, I spend my time looking more at the industry trends, trying to help other people get better. You know, and usually we're dogfooding and following our own best practices, but I think the challenges with managing the supply chain start to come in when you get bigger, when you get towards where we are, but certainly much, much larger organizations have a much harder time dealing with it as well.