Open Source: The Risks of Building Dependencies on Open Source Libraries

Open Source is generally recognized as providing benefits such as high quality, low cost, reliability, and transparency.  A somewhat dated 2008 report by Gartner found that 85 percent of commercial software products use open source libraries — it’s likely that that number hasn’t declined and that the amount of dependencies that applications have on Open Source libraries has  only grown.

But building applications with dependencies on Open Source libraries comes with risks.

Issues and risks related to Open Source licensing have been widely discussed and are fairly well understood.  What’s often forgotten though is that, really like any software, Open Source libraries have the potential of having security vulnerabilities and bugs, and users of that software need to keep abreast of the potential risks involved in using it.

While security patches to Open Source libraries are often released very shortly after a vulnerability in the software is identified, the problem is that applications that are integrated with and dependent on those libraries often have a long lag before the library used is updated.  In many cases, because the libraries continue to “work”, they aren’t examined in more detail and aren’t updated.

The risk here is not so much with the fact that Open Source libraries have been used.  Rather the risk is one of complacency and of not being able to keep current with updates that occur for the dependent libraries.

Rami Sass, Co-Founder and CEO of White Source, said that “often, no one is assigned to continually monitor the open source for updates. In our study, 98.7% of the open source libraries with vulnerabilities were not updated. This presents considerable security and business risks for both vendor and customer when the product is shipped.  If you don’t stay on top of open source updates, you risk missing critical security fixes that are most likely out there.”

Pini Cohen, EVP and Senior Analyst from STKI, said that “there is a clear disconnect between what is expected from development teams and what they can realistically do. They often lack the expertise and time to continually ensure compliance with open source licenses and monitor open source libraries for future security vulnerabilities and bugs. To properly manage open source for security and compliance, a lot of the adoption and ongoing management should be automated.”