The Curious Engineer

All blogs / Security

FOSSA Blog

fossa.com/blog

Learn best practices and stay on top of new developments in open source license compliance, vulnerability management, and SBOM management.

SecuritySoftware / engineering practice

’21’22’23’24’25’26
Posts
287 from 24 Nov 2021 to 29 Oct 2026
Posting
weekly (30 in the last year)
Kind
company blog
Feed
https://fossa.com/blog/rss.xml

2026 26

  1. Announcing Context-Aware Remediation in FOSSA
  2. Open Source License Compliance for C and C++ Applications
  3. PHP2Shell: Finding and Fixing CVE-2026-109618 and CVE-2026-109619
  4. Generating and Managing C and C++ SBOMs
  5. Meeting the CRA's 2026 Reporting Requirements
  6. FOSSA and Nohau Partner to Bring Software Supply Chain Security and Compliance to the Nordics
  7. How FOSSA's First Hack House Reinvented Documentation
  8. CRA Product Classification Explained: Default, Important, and Critical
  9. EU CRA Compliance Timeline: Key Dates and Deadlines
  10. CISA Releases the 2026 SBOM Minimum Elements
  11. Summer 2026 Product Updates: Enhanced Reports
  12. The Underappreciated OSS License Compliance Risk from AI Coding Tools
  13. Allan Friedman: Practical Guidance for Managing VEX Workflows
  14. Responding to the Latest Mini-Shai-Hulud Supply Chain Attack
  15. Project Glasswing and the AI Vulnerability Math Problem
  16. Project Glasswing and Vulnerability Exploitation Velocity
  17. fossabot expands to all GitHub and GitLab tiers
  18. Spring 2026 FOSSA Product Updates
  19. Apr 7, 20263 minJava ecosystem support comes to fossabotfossabot now supports Java ecosystems, including Maven, Gradle and Kotlin codebases.FOSSA, fossabot, java, gradle, kotlin, mavenRead Article
  20. A Roadmap for Automating the SBOM Management Lifecycle
  21. Allan Friedman on SBOM Regulations
  22. Introducing Automated Malware Detection in FOSSA
  23. Feb 23, 20267 minAllan Friedman on 4 Stages of SBOM ManagementLeading SBOM and software supply chain expert Allan Friedman shares recommendations for SBOM programs at various stages of maturity.SBOM, Software SecurityRead Article
  24. Feb 5, 202610 minHighlights from ENISA's SBOM Implementation GuideSee highlights from ENISA's SBOM implementation guide, including the planning, execution, and monitoring phases of an SBOM program.ENISA, SBOM, CRARead Article
  25. Jan 9, 20268 minfossabot’s Strategic Updates Keep Getting Smarterfossabot's stategic updates adapt your app code to upstream library changes, now with an enhanced planner and improved CI signalsFOSSARead Article
  26. Jan 7, 20267 minGermany’s BSI SBOM Guidelines: What You Need to KnowSee technical details and important themes from Germany's influential BSI SBOM guidelines.SBOM, Software SecurityRead Article

2025 32

  1. Dec 10, 20253 minWhat’s New in CycloneDX 1.7Learn about the new features and improvements in CycloneDX 1.7, including new patent-related fields and expanded cryptography support.CycloneDX, SBOM, Software SecurityRead Article
  2. Nov 25, 20254 minComparing Declared and Discovered OSS LicensesOrganizations are successfully generating SBOMs for security, regulatory compliance, and business reasons, but struggle with their distribution.OSS, LicensesRead Article
  3. Nov 18, 20257 minSimplifying OSS License Analysis with FOSSA License ConcludedFOSSA's new license concluded feature simplifies the process of analyzing multiple declared and discovered licenses associated with a single dependency.Open Source, Licenses, FOSSARead Article
  4. Nov 12, 202516 minA Practical Guide to Common Platform Enumeration (CPE)Learn about Common Platform Enumeration (CPE), including its importance to software transparency and the SBOM ecosystem.CPE, Software Supply ChainRead Article
  5. Oct 31, 20257 minHeather Meeker on AI Coding Assistants and OSS License ComplianceLeading IP attorney and OSS license compliance expert Heather Meeker discuss the license compliance implications of using AI coding assistants.AI, Snippet Scanning, FOSSARead Article
  6. Oct 29, 20254 minFOSSA Welcomes SBOM Pioneer Allan Friedman as a Senior AdvisorDr. Allan Friedman, a globally recognized leader of the SBOM movement, has officially joined FOSSA as a Senior Advisor.FOSSA, SBOMRead Article
  7. Oct 24, 20256 minHow Open Source License Scanners WorkLearn about the two primary techniques OSS license scanners use to detect open source licenses.open source, licenses, complianceRead Article
  8. Oct 14, 20255 minThe Guide to SBOMs and FedRAMP ComplianceLearn about SBOM (software bill of materials) requirements in the FedRAMP Rev5 and the new FedRAMP 20x.SBOM, FedRAMPRead Article
  9. Oct 1, 20259 minAnnouncing fossabot: AI Agent for Strategic Dependency UpdatesAnnouncing fossabot, a new AI Agent for making strategic dependency updates, backed by a comprehensive accuracy, consistency, and correctness framework.FOSSA, fossabotRead Article
  10. Sep 30, 20254 minAutomating Dependency Updates at FOSSAFOSSA's path to automated updates and the importance of new technology to accomplish these challenging engineering tasks.FOSSARead Article
  11. Sep 29, 20254 minFOSSA Acquires EdgeBit: From Scanning to UpdatingFOSSA has acquired EdgeBit, which pioneered automated dependency updates using a world-class static analysis engine.FOSSARead Article
  12. Sep 23, 20253 minShai-Hulud Malware and FOSSA's Impact Assessment ToolLearn why the Shai-Hulud malware is a significant threat to the npm ecosystem, and see how FOSSA's Impact Assessment Tool can help mitigate the risk.malware, npm, securityRead Article
  13. Sep 18, 20254 minRewriting an NPM Package's Semver Based on Breaking ChangesSemantic versioning is a core pillar of responsible open source publishing, but what happens when it's incorrectly used?npm, open sourceRead Article
  14. Sep 3, 20256 minManage AI Coding Tool Risks with FOSSA Snippet ScanningFOSSA's new Snippet Scanning product helps organizations manage IP legal risks associated with AI coding tools.Snippet Scanning, AI, FOSSARead Article
  15. Aug 19, 20257 min4 Ways to Generate an SBOMSee four methods for generating an SBOM — from source code, from an ecosystem-specific tool, from a container, and from a binary file.SBOM, ToolsRead Article
  16. Aug 11, 20258 minComplying with SEBI SBOM RequirementsLearn about new SBOM (software bill of materials) requirements from SEBI, India's securities and commodities market regulator.SBOM, India, SEBIRead Article
  17. Jul 29, 20257 minAnalyzing 5 Major OSS License Compliance LawsuitsLearn about five lawsuits that have helped shape global enforcement of open source software licenses.open-source, licensesRead Article
  18. Jul 24, 20259 minThe SBOM Tool Buyer's GuideSee five important factors to consider when evaluating SBOM tools for your organization in this buyer's guide.SBOM, ToolsRead Article
  19. Mar 29, 202312 minHow to Find the Best SBOM Tool for Your OrganizationSee important criterial for evaluating SBOM tools and picking the best one for your organization.SBOM, ToolsRead Article
  20. Jul 9, 20257 minIntroducing Dynamic SBOM Sharing in FOSSALearn how FOSSA's Dynamic SBOM Sharing feature facilitates the secure exchange of SBOMs between SBOM distributors and consumers.SBOM, FOSSARead Article
  21. Jun 24, 20254 minOperationalizing Exceptions with Time-Based Ignore RulesLearn about FOSSA's Time-Based Ignore Rules, which help teams implement temporary exceptions to security, license compliance, and quality policies.Vulnerability Management, FOSSA, ComplianceRead Article
  22. Jun 10, 20255 minFOSSA Issue Diffs: Understanding Your Evolving Risk PostureLearn about FOSSA's new Issue Diffs feature, which makes it easy to compare licensing, security, and quality issues between software versions.product updates, fossaRead Article
  23. Jun 4, 20259 minUnderstanding the PURL Specification (Package URL)Learn about PURL — the Package URL Specification — including its utility for SBOM management and how it compares to other unique identifiers.PURL, SBOMRead Article
  24. May 28, 20258 minA VP of Engineering’s Perspective on FOSSA’s AI JourneyFOSSA's VP of Engineering Dave Bortz shares insight into the FOSSA engineering team's AI coding philosophy.AI, engineeringRead Article
  25. May 19, 20254 minWhen Builds Bite Back: The Surprising Pitfalls of Maven Environments and ReproducibilityLearn how Maven build environments can introduce non-determinism, and get guidance for managing Maven dependencies with FOSSA.Maven, buildsRead Article
  26. May 12, 20256 minRevisiting FOSSA Hack Week and Its Customer ImpactSee how FOSSA's hack week projects are already making a difference for our customers.FOSSARead Article
  27. May 5, 20253 minMay 2025 FOSSA Product UpdatesLearn about several recent FOSSA product updates, including container scanning and CycloneDX report improvements.open-source, product updatesRead Article
  28. Apr 25, 20255 minAnnotate Dependencies with Context: Introducing Package Labels in FOSSAIntroducing FOSSA Package Labels - a powerful way to annotate packages with contextual metadata, enabling more efficient and insightful reporting and filtering.dependency management, package labels, open-sourceRe
  29. Apr 21, 20258 minSlopsquatting: AI Hallucinations and the New Software Supply Chain RiskLearn about slopsquatting, an emerging category of software supply chain risk that can stem from AI coding tools.Software Supply Chain Security, Slopsquatting, AI CodingRead Article
  30. Apr 10, 20257 minIntroducing FOSSA Binary Composition Analysis (BCA)FOSSA's new Binary Composition Analysis (BCA) product enables organizations to mange security, license compliance, and SBOMs for binary files.Binaries, BCARead Article
  31. Feb 25, 20258 minSBOMs in India: Analyzing CERT-In GuidelinesAn analysis of the CERT-In guidelines for building and managing an SBOM program, recommended data fields, automation support, and best practices.SBOM, India, GuidelinesRead Article
  32. Jan 23, 20257 minThe Role of SBOMs in Managing DORA ComplianceAn exploration of the importance of SBOMs in complying with the EU's Digital Operational Resilience Act (DORA), focusing on software tracking and monitoring requirements for financial entities.DORA, SBOMRead Article

2024 33

  1. Dec 19, 20244 minWinter 2025 FOSSA Product UpdatesExplore the new functionalities of FOSSA for managing SBOMs, vulnerabilities, and open source license compliance, including automated NOTICE file recreation and FDA compliance support.FOSSA, SBOM, License ComplianceRead Article
  2. Dec 5, 20244 minLicense Compliance, SBOM, and Vulnerability Management for Smaller Teams: FOSSA Business TierFOSSA introduces a new business tier tailored for smaller teams, offering flexible pricing and comprehensive features for SBOM, vulnerability management, and license compliance.SBOM, open-sou
  3. Dec 2, 20244 minNew Relic and FOSSA Upgrade Supply Chain Security with Connected Build-Time and Run-Time Vulnerability ManagementNew integration between FOSSA and New Relic provides end-to-end visibility and actionable insights for developers to manage software supply chain security efficiently.Secu
  4. Nov 21, 20245 minIntroducing SBOM Policies in FOSSALearn about FOSSA's new SBOM policy feature that helps enforce SBOM standards for compliance and security.SBOM, FOSSA, ComplianceRead Article
  5. Nov 8, 20249 minUnderstanding CVSS: The Common Vulnerability Scoring SystemAn in-depth look at the Common Vulnerability Scoring System (CVSS), its evolution, scoring methods, and its importance in prioritizing vulnerabilities.CVSS, vulnerabilityRead Article
  6. Oct 23, 20248 minFall 2024 Software Licensing RoundupExplore the significant licensing stories of fall 2024, including Elastics return to open source, the new fair source licensing model, and the PearAI controversy.elastic, licensing, open-sourceRead Article
  7. Oct 17, 202411 minA Proposal for the Future of SBOM Minimum ElementsExploring the next steps for improving SBOM usability across the ecosystem with new data requirements and considerations for vulnerability management.SBOM, CybersecurityRead Article
  8. Sep 30, 20247 minSnippet Scanning, ExplainedAn in-depth look at snippet scanning tools, their methodologies, and their impact on open source license compliance.open-source, snippet scanningRead Article
  9. Sep 27, 20247 minCUPS Vulnerabilities: Impact and FixesExplore the newly discovered vulnerabilities in OpenPrinting's CUPS and their potential impact on UNIX-like operating systems, with guidance on remediation.CUPS, VulnerabilitiesRead Article
  10. Sep 13, 20245 minU.S. Army Announces New SBOM RequirementsThe U.S. Army has announced new SBOM requirements for contractors and subcontractors to improve software supply chain security. Learn about the implementation timeline, scope, and how to prepare.SBOM, U.S. ArmyRead Article
  11. Sep 10, 20247 minSBOM Requirements in the EU’s CRA (Cyber Resilience Act)An overview of the Cyber Resilience Act (CRA) and its implications for SBOM requirements, diving into its standards and comparisons to global initiatives.SBOM, Cyber Resilience Act, EU RegulationsRead Article
  12. Sep 4, 20246 min4 Considerations for Effective SBOM SharingOrganizations are successfully generating SBOMs for security, regulatory compliance, and business reasons, but struggle with their distribution.SBOM, SecurityRead Article
  13. Aug 14, 202423 minActioning the Stakeholder-Specific Vulnerability Categorization (SSVC) ModelAn overview of the CISA Stakeholder-Specific Vulnerability Categorization (SSVC) model, focusing on its decision-making framework to categorize and prioritize vulnerabilities based on unique organizational
  14. Aug 8, 202414 minAutomate Regulatory Compliance With FOSSA's New SBOM Management Add-OnIntroducing FOSSAs new SBOM Management add-on to simplify software inventory and compliance processes.compliance, SBOMRead Article
  15. Aug 1, 20244 minFOSSA Acquires StackShare to Enhance Developer Tools Management and SecurityFOSSA has acquired StackShare to improve developer tools management and enhance security visibility for enterprises.Company News, technology, acquisitionRead Article
  16. Jul 24, 202411 minUnderstanding SBOM Requirements in PCI DSSThis blog post explores the introduction of SBOM requirements in PCI DSS 4.0, detailing the specific requirements and timelines, and suggesting steps for organizations to prepare for the March 2025 enforcement date.SBOM, PCI DSS, SecurityRe
  17. Jul 14, 20247 minSecure Open Source for All: FOSSA's Free Plan Just Got BetterFOSSA's free plan now includes security, license compliance, and SBOM management for up to 25 developers and 5 projects.open-source, securityRead Article
  18. Jul 10, 20246 minPolyfill Supply Chain Attack: Details and FixesAn overview of a significant supply chain attack on the Polyfill CDN service, including its background, impact, and mitigation strategies.supply chain attack, securityRead Article
  19. Jul 2, 20249 minUsing the CISA Kev CatalogExplore how the CISA KEV Catalog aids organizations in vulnerability prioritization and learn about its evaluation process.vulnerability, securityRead Article
  20. Jun 11, 202411 minDefining SBOM Requirements for Software SuppliersExplore how to effectively define SBOM requirements for software suppliers to ensure transparency and compliance in procurement processes.SBOM, Software SuppliersRead Article
  21. May 7, 20243 minFOSSA Joins Forces with New Relic in the Secure Developer AllianceFOSSA partners with New Relic in the Secure Developer Alliance to enhance vulnerability management with cutting-edge resources and collaborations.vulnerability management, secure developer allianceRead Article
  22. May 2, 20245 minHow Sentry Manages Software License ComplianceDiscover how Sentry manages software license compliance through policies, processes, and automation using FOSSA's open source management platform.software licensing, complianceRead Article
  23. Apr 17, 20248 minSPDX 3.0 Is ReleasedSPDX 3.0 introduces new profiles for better use case targeting and flexibility. Major upgrades include changes in document structure, profiles, relationships, and creator information.SPDX, SBOMRead Article
  24. Apr 12, 20245 minWhat’s New in CycloneDX 1.6?Learn about the new features and improvements in CycloneDX 1.6, including Cryptographic BOM, Attestation support, and Machine Learning BOM enhancements.CycloneDX, SBOM, Software SecurityRead Article
  25. Apr 3, 20246 minCVE-2024-3094: New Vulnerability Impacts XZ UtilsA new vulnerability, impacting XZ Utils with CVSS severity score of 10, brings potential remote code execution risks.security, linux, vulnerabilityRead Article
  26. Mar 29, 20244 minFOSSA Product Updates: Spring 2024Explore new features from FOSSA designed to enhance software transparency and mitigate open source risks across your organization.FOSSA, Product UpdatesRead Article
  27. Mar 26, 202415 minSBOM Formats Explained and ComparedExplore different SBOM formats like SPDX and CycloneDX, their specifications, and their implications for software transparency and cybersecurity.SBOM, Software TransparencyRead Article
  28. Mar 21, 20244 minEnhancing Risk Observability with FOSSA's Issue Overview DashboardExplore FOSSA's Issue Overview Dashboard to enhance your software's risk observability with insights into security, licensing, and quality issues.risk management, FOSSARead Article
  29. Mar 12, 20244 minBeyond Vulnerabilities: Understanding Package Health with FOSSA QualityExplore FOSSA Quality's tools for assessing and improving the health of your software's open source components.FOSSA, Open SourceRead Article
  30. Mar 8, 202411 minComplying with the FDA’s SBOM RequirementsExplore the FDA's new SBOM requirements for medical devices, detailing the scope, structure, and support information needed for compliance.FDA, SBOM, CybersecurityRead Article
  31. Feb 2, 20244 minEnable Global Visibility and Swift Remediation with Package IndexExplore how FOSSA’s Package Index enhances software supply chain visibility, enabling swift vulnerability detection and remediation.Package Index, Security, SoftwareRead Article
  32. Jan 26, 20247 min4 Takeaways from the ESF's OSS and SBOM Management RecommendationsA summary of the key insights from the ESF's latest recommendations on OSS and SBOM management.ESF, SBOM, Open Source SoftwareRead Article
  33. Jan 9, 20244 minReduce Alert Fatigue with FOSSA’s Auto-Ignore RulesLearn how FOSSA’s auto-ignore rules streamline license compliance and vulnerability remediation by minimizing redundant alerts.FOSSA, Auto-Ignore, Open SourceRead Article

2023 31

  1. Dec 22, 20234 minTerrapin (CVE-2023-48795): New Attack Impacts the SSH ProtocolResearchers from Ruhr University Bochum have uncovered Terrapin, a new SSH vulnerability (CVE-2023-48795) allowing man-in-the-middle attacks, affecting widely used SSH applications.Cybersecurity, SSHRead Article
  2. Dec 20, 202311 minSCA vs. SAST: Comparing Security ToolsA detailed comparison of SCA and SAST security tools, highlighting their differences and combined use for enhanced security.security, SCARead Article
  3. Dec 13, 20236 minDual-Licensing Models Explained, Featuring Heather MeekerUnderstanding dual licensing with insights from Heather Meeker, covering scenarios for choice-of-license and multi-license models, and managing associated risks.licensing, open-sourceRead Article
  4. Dec 5, 202312 minA Comprehensive Guide to Source-Available Software Licenses, Featuring Heather MeekerExplore the intricacies of source-available software licenses, contrasting them with open-source and proprietary licenses.software licenses, open-source, source-availableRead Article
  5. Nov 17, 20237 minUnderstanding and Using the EPSS Scoring SystemExplore the EPSS scoring system and how it helps prioritize vulnerability exploitability.EPSS, Scoring SystemRead Article
  6. Oct 26, 202310 minBest Practices for Generating High-Quality SBOMsExplore crucial elements for creating high-quality SBOMs including tooling, integration strategies, configuration, and data fields in compliance with licensing and security requirements.software, SBOMRead Article
  7. Oct 13, 20234 minCurl Vulnerabilities: Impact and Fixes (Curl 8.4.0)Curl 8.4.0 addresses two critical vulnerabilities; learn the impacts and recommended fixes.curl, vulnerabilitiesRead Article
  8. Oct 6, 20238 min5 Ways to Reduce GitHub Copilot Security and Legal RisksExplore strategies to mitigate security and legal risks associated with GitHub Copilot and similar AI tools.AI, GitHub CopilotRead Article
  9. Sep 26, 202310 minSBOM Examples, ExplainedExplore the world of Software Bill of Materials (SBOMs) with examples and explanations of popular formats like SPDX and CycloneDX.SBOM, SPDX, CycloneDXRead Article
  10. Sep 11, 20237 minUnderstanding and Using SPDX License Identifiers and License ExpressionsAn overview of SPDX License Identifiers and Expressions and how they streamline open source licensing communication.SPDX, LicensingRead Article
  11. Aug 23, 202311 minBusiness Source License (BSL 1.1): Requirements, Provisions, and HistoryThe Business Source License (BSL) is a hybrid between open source and end-user licenses, providing a unique balance of access and restrictions. Learn about its requirements, provisions, and history in this comp
  12. Aug 18, 20236 min5 Ways an SBOM Can Strengthen SecurityExplore how a software bill of materials (SBOM) can enhance your organization's security by providing visibility into open source vulnerabilities, improving software supply chain transparency, enabling VEX, supporting vulnerability remediation,
  13. Aug 10, 20234 minFOSSA Product Updates: August 2023Discover the latest enhancements and features introduced by FOSSA, designed to improve your experience with our platform.FOSSA, Product UpdatesRead Article
  14. Aug 3, 20233 minDirect Dependencies vs. Transitive DependenciesExplore the differences between direct and transitive dependencies, and how they impact your project's development and maintenance.dependencies, programmingRead Article
  15. Jul 12, 202311 minVulnerability Remediation TacticsExplore strategies for addressing vulnerabilities in third-party components, including patching and upgrading methods.security, dependenciesRead Article
  16. Jun 29, 20239 minWhat’s New in CycloneDX 1.5?The CycloneDX team released version 1.5, building on existing capabilities and introducing enhancements such as the Authoritative Guide to SBOM.CycloneDX, SBOM, softwareRead Article
  17. Jun 8, 202314 minVEX (Vulnerability Exploitability eXchange): Purpose and Use CasesExplore the purpose and significance of VEX (Vulnerability Exploitability eXchange) in managing software vulnerabilities, detailing its necessity, applications, and future implications for suppliers and users.cybersec
  18. May 24, 202312 minThe FOSSA Podcast: Product Management from Startup to EnterpriseIn this episode of The FOSSA Podcast, our senior product manager and a longtime engineer discuss product development's evolution as companies grow, including collaboration, management tools, and growth vs. retention st
  19. May 16, 20238 minGenerative AI and Software Development: Copyright Law and License ComplianceExplores the impact of recent U.S. Copyright Office decisions on generative AI, potential risks from open source licensing, and strategies to mitigate IP risk in software development.AI, software development
  20. Apr 28, 20237 minThe FOSSA Podcast: Managing Engineering ProjectsThe fifth episode of The FOSSA Podcast discusses managing engineering projects with insights from FOSSA’s VP of Engineering and a senior developer.engineering, project managementRead Article
  21. Apr 26, 202311 minHeather Meeker on Open Source License Compliance PoliciesDiscussion on tailoring open source license compliance policies for different deployment models, including strategies for SaaS, mobile apps, and embedded systems.Open Source, License ComplianceRead Article
  22. Apr 24, 20235 minPicking the Right FOSSA Deployment ModelExplore the differences between FOSSA's deployment models and find the best option for your organization.deployment, FOSSARead Article
  23. Apr 4, 20234 minThe FOSSA Podcast: SCA Purchasing and Implementation TrendsA discussion on open source usage and software composition analysis tools to manage OSS license compliance and security risks.open-source, securityRead Article
  24. Mar 9, 20238 minThe FOSSA Podcast: Structuring and Growing a Customer Success TeamThe third episode of The FOSSA Podcast discusses managing strategic customer relationships, offering guidance on structuring customer success teams and building a company-wide customer-success mindset.customer success,
  25. Mar 2, 202312 minContainers and Open Source License ComplianceAn exploration of open source license compliance in the container ecosystem, discussing key components and compliance strategies.open-source, license complianceRead Article
  26. Feb 21, 202310 minThe FOSSA Podcast: Early-Stage Technology Decisions and RegretsIn the second episode of the FOSSA Engineering Podcast, engineers reflect on early-stage technology choices and offer guidance for developers facing similar decisions.technology decisions, podcastRead Article
  27. Feb 16, 20237 min2023 Open Source Management Trends, Predictions, and ObservationsExplore trends, predictions, and observations on mission-critical open source management, including SBOM data usage, license compliance automation, and more.open-source, software managementRead Article
  28. Feb 3, 202312 minThe FOSSA Podcast: Adopting Haskell into an Existing CodebaseFOSSA's podcast explores the adoption of Haskell into its codebase, discussing the reasons and benefits of the functional programming language.Haskell, Programming, PodcastRead Article
  29. Jan 26, 20236 minHow to Operationalize SBOMs Throughout the SDLCDiscover how businesses can leverage software bill of materials (SBOMs) throughout the software development lifecycle (SDLC) to manage risks including software supply chain security and open-source license compliance.SBOM, SDLCRead Arti
  30. Jan 11, 20233 minAnnouncing Support for CycloneDX and SBOM ImportDiscover FOSSA's latest updates enhancing SBOM management and new support for the CycloneDX SBOM standard.SBOM, CycloneDXRead Article
  31. Jan 4, 20234 minHow to Use 1Password to Authenticate the FOSSA CLILearn how to authenticate the FOSSA CLI using 1Password's shell plugin for secure and easy integration.FOSSA, 1PasswordRead Article

2022 41

  1. Dec 13, 20228 minHow Applause Makes Open Source Management Work for DevelopersDiscover how Applause, led by CTO Rob Mason, leverages FOSSA to optimize open source management, reducing burdens on developers.open-source, software managementRead Article
  2. Nov 30, 20228 minComplying with GPL v3’s User Product ClauseExplore the GPL v3's 'User Product' clause and strategies for compliance, addressing challenges faced by manufacturers while protecting user freedom.GPL v3, open-source, User ProductRead Article
  3. Nov 17, 20229 minManaging OSS License Compliance Risks in Commercial Software Licensing Agreements, Featuring Jim MarkwithExplore the evolution of open source software license compliance risks and best practices in commercial software agreements.OSS, License ComplianceRead Article
  4. Nov 1, 20223 minAnnouncing the GA of C and C++ Security and License ScanningFOSSA announces the general availability of its security and license scanning for C and C++ projects, offering tailored solutions for dependency identification.C++, SecurityRead Article
  5. Nov 1, 20223 minNovember 2022 FOSSA Product UpdatesEnhancements to FOSSA's platform with new C/C++ support, issue resolution updates, container scanning improvements, and Azure integration.software updates, C/C++, AzureRead Article
  6. Oct 31, 20224 minOpenSSL Vulnerability 2022: Details and FixesThis post discusses two high-severity vulnerabilities impacting OpenSSL versions 3.0 and later, including details on how to find and fix them.OpenSSL, SecurityRead Article
  7. Oct 26, 20224 minCVE-2022-42889 Text4Shell Vulnerability: Impact and FixesA critical remote code execution vulnerability called Text4Shell impacting the Apache Commons Text library.vulnerability, securityRead Article
  8. Oct 22, 20225 minOpen Source Licenses 101: Microsoft Public License (Ms-PL)Explore the Microsoft Public License (Ms-PL), often used in .NET projects, known for its unique place in the open source licensing landscape.open-source, licensesRead Article
  9. Sep 29, 20226 minAnalyzing the Securing Open Source Software ActAn overview of the Securing Open Source Software Act, its implications for federal agencies, and potential effects on the private sector.open-source, securityRead Article
  10. Sep 21, 20227 minU.S. Government Memo Requires Self-Attestation to Secure Development PracticesThe U.S. federal government’s Office of Management and Budget published a memo requiring software suppliers to self-attest to secure development practices, impacting government and private sector software
  11. Sep 16, 202212 minHeather Meeker on Open Source License Compliance ToolsA detailed exploration into the evolution and current trends of compliance tools for open source software licenses, with insights from Heather Meeker.open-source, license complianceRead Article
  12. Aug 30, 202213 minQ and A: Heather Meeker on Hot Topics in OSS License ComplianceA discussion with Heather Meeker on pressing issues related to open source software license compliance, featuring key Q and A highlights from a recent webinar.OSS, license complianceRead Article
  13. Aug 22, 20223 minFOSSA Earns Great Place To Work CertificationFOSSA has achieved the Great Place to Work Certification™, showcasing its commitment to a supportive and inclusive work environment.Workplace Culture, CertificationRead Article
  14. Aug 17, 20228 minCustomer Q&A: Collibra's Journey to Scaling OSS License ComplianceAn insightful interview with Amanda Weare, Collibra's VP and Deputy General Counsel, discussing their approach to open source license compliance.license compliance, open source, CollibraRead Article
  15. Aug 12, 20229 minA Practical Guide to the SLSA FrameworkA guide to understanding and implementing the SLSA framework for improving software supply chain security across organizations.SLSA, Software Supply ChainRead Article
  16. Jul 27, 202210 minHow to Implement the CSRB’s Log4j Security RecommendationsRecommendations from the CSRB to improve software security concerning the Log4j vulnerability, with a focus on private enterprises.security, log4j, csrbRead Article
  17. Jul 21, 20225 minRust: How to Transform a Byte Stream for Fun and ProfitA guide on transforming byte streams in Rust by using iterators to create powerful modifications.Rust, ProgrammingRead Article
  18. Jul 13, 20226 minWhy Open Source is ESGExploring how open source software can align with ESG principles, serving both as a risk and an investment opportunity.ESG, investingRead Article
  19. Jul 6, 20223 minAnnouncing the Private Beta of FOSSA Risk IntelligenceIntroducing FOSSA Risk Intelligence, a private beta add-on to enhance software supply chain security by addressing risks like stale packages, abandonware, and more.open-source, security, risk managementRead Article
  20. Jun 24, 20226 minOpen Source Licenses 101: SIL Open Font License (OFL)An overview of the SIL Open Font License (OFL), its versions, and provisions for font software use, modification, and redistribution.Open Source, Licenses, FontsRead Article
  21. Jun 7, 20227 minHow to Build an Open Source License Compliance Program, Featuring Jim MarkwithExplore the importance and elements of building a successful open source license compliance program, as discussed by Jim Markwith, a technology and transactions attorney.open-source, license complianceRead
  22. Jun 2, 20225 minUnderstanding and Preventing Dependency Confusion AttacksExplore the concept of dependency confusion attacks, how they work, and strategies to prevent them from affecting software supply chains.cybersecurity, supply chain attacksRead Article
  23. May 19, 20229 minHighlights from NIST SP 800-161r1: Cybersecurity Supply Chain Risk ManagementAn overview of NIST's updated recommendations for managing cybersecurity risks across supply chains, featuring frameworks and templates for organizations.cybersecurity, risk managementRead Article
  24. May 13, 20229 minThe Massive Implications of Software Freedom Conservancy vs. VizioExploration of Software Freedom Conservancy's lawsuit against Vizio and its potential impact on open source license enforcement.open-source, softwareRead Article
  25. May 10, 20227 minOpen Source Licenses 101: Boost Software LicenseA thorough examination of the Boost Software License, showcasing its similarities to and differences from other permissive licenses.open-source, software licenseRead Article
  26. Apr 26, 20227 minOpen Source Licenses 101: The CDDL (Common Development and Distribution License)The CDDL — short for Common Development and Distribution License — is a weak copyleft open source software license initially published by Sun Microsystems.open-source, licensesRead Article
  27. Apr 13, 20227 minBest Practices for Implementing Software Composition Analysis, Featuring Rancher LabsExplore the successful implementation of Software Composition Analysis (SCA) at Rancher Labs, focusing on simplicity, CI/CD integration, barrier removal, and addressing tech debt.software, SCARead A
  28. Apr 7, 20227 min4 Reasons Rancher Labs Chose FOSSAExplore why Rancher Labs selected FOSSA for open source management, enhancing their development efficiency and security posture.Rancher, FOSSA, Open Source ManagementRead Article
  29. Apr 2, 20224 minAn Overview of Spring RCE VulnerabilitiesA review of critical remote code execution vulnerabilities in Spring, highlighting CVE-2022-22965 and CVE-2022-22963, their impact, and mitigation strategies.Spring, RCE, SecurityRead Article
  30. Mar 30, 20229 minBuilding a Sustainable Software Supply ChainExploring strategies to enhance software supply chain security through sustainability practices.software, securityRead Article
  31. Mar 22, 20223 minAnnouncing New Support for C/C++ Scanning, SBOMsFOSSA introduces support for C/C++ scanning and SBOM generation, enhancing software supply chain security.FOSSA, C/C++, SBOMRead Article
  32. Mar 18, 20227 minHow FOSSA Addresses Challenges Scanning C/C++ CodeExploring the challenges of scanning C and C++ code and how FOSSA addresses these challenges with their code scanning technology.C/C++, Code ScanningRead Article
  33. Mar 8, 20229 minThe Three Pillars of Reproducible BuildsExploring the guiding principles of reproducible builds to strengthen software supply chain security.software, security, buildsRead Article
  34. Feb 25, 20222 minOverriding Dependency Versions and Using Version Ranges in MavenExplore how Maven handles dependency versions, including declaring dependencies, overriding them, and utilizing version ranges.Java, MavenRead Article
  35. Feb 15, 20229 min5 Highlights from the U.S. Senate’s Log4J Vulnerability HearingAn overview of the U.S. Senate's hearing on the Log4J vulnerability, highlighting key discussions on software security.software security, cybersecurityRead Article
  36. Feb 7, 20226 min6 Takeaways from the Linux Foundation's SBOM ReportA detailed analysis of the Linux Foundation's SBOM report, outlining key insights into software supply chain security.SBOM, CybersecurityRead Article
  37. Feb 4, 20226 minReact Security: How to Fix Common VulnerabilitiesLearn about the common security vulnerabilities in React and best practices to prevent them.React, Security, VulnerabilitiesRead Article
  38. Jan 25, 20228 minOSS License Compliance Expert Heather Meeker on the AGPLAn exploration of the AGPL's implications, how it compares to the GPL family, and its inception.Open Source, AGPLRead Article
  39. Jan 18, 20226 min5 Must-Have DevSecOps ToolsA discussion on essential DevSecOps tools that help automate software testing and management, enhancing security throughout the software development lifecycle.DevSecOps, toolsRead Article
  40. Jan 11, 20224 minOpen Source Developer Sabotages npm Libraries 'Colors,' 'Faker'The developer behind 'colors.js' and 'faker.js' sabotages his own npm libraries, causing widespread disruption.npm, open source, sabotageRead Article
  41. Jan 6, 202215 minDependency Management in Visual Studio: NuGet and BeyondA comprehensive guide to managing dependencies in Visual Studio using NuGet, exploring .NET projects, project dependencies, and alternative tools for effective dependency management.Visual Studio, NuGetRead Article

2021 8

  1. Dec 22, 20215 minDoes TikTok Live Studio Violate GPL v2?Exploring the license compliance concerns surrounding TikTok Live Studio's use of GPL v2-licensed OBS Studio.GPL, license complianceRead Article
  2. Dec 22, 20216 minQ and A: Heather Meeker on AGPL, Truth Social, OSS License ComplianceHighlights from a webinar with open source licensing expert Heather Meeker discussing AGPL, Truth Social's compliance issues, and Google's AGPL policy.AGPL, Open Source, License ComplianceRead Article
  3. Dec 21, 20213 minHow to Quickly Find and Remediate Log4J Vulnerabilities (Log4Shell)Explore detection and remediation strategies for Log4J vulnerabilities, including Log4Shell, using FOSSA's CLI.Log4J, security, vulnerabilityRead Article
  4. Dec 19, 20213 minHow to Fix the New Log4J DoS Vulnerability: CVE-2021-45105A guide on addressing the newly discovered Log4J DoS vulnerability CVE-2021-45105 and recommended updates.Log4J, VulnerabilityRead Article
  5. Dec 15, 20213 minFOSSA Partners with OpenChain to Promote Open Source ManagementFOSSA has partnered with OpenChain to support organizations in achieving OpenChain Conformance, promoting compliance with OSS licensing requirements.Open Source, ComplianceRead Article
  6. Dec 10, 20214 minLog4J "Log4Shell" Zero-Day Vulnerability: Impact and FixesDiscover the critical CVE-2021-44228 vulnerability in Apache Log4J affecting many applications and how to mitigate it.vulnerability, securityRead Article
  7. Nov 30, 20215 minIntroducing FOSSA's New License ScannerExplore FOSSA's upgraded license scanner, featuring improved speed and accuracy, and learn how it benefits users with enhanced capabilities.license scanning, software updatesRead Article
  8. Nov 24, 20213 minManaging Dependencies in .NET: .csproj, .packages.config, project.json, and MoreAn overview of dependency management in .NET including .csproj, .packages.config, project.json, and other related artifacts..NET, dependency managementRead Article

Undated 116

  1. Nov 15, 20213 minFOSSA Product Updates: Announcing Our New and Improved CLIAnnouncing FOSSA's revamped CLI that simplifies integrations with reduced configuration. Discover the new features and improvements.CLI, FOSSARead Article
  2. Nov 12, 20217 minDevSecOps 101: Understanding and Implementing DevSecOps PrinciplesExplore the principles of DevSecOps, a natural extension of DevOps, focusing on integrating security testing throughout the software development lifecycle.DevSecOps, Security, DevelopmentRead Article
  3. Nov 8, 20215 minEmbedded Malware in NPM: Coa, Rc, Ua-parserA significant rise in NPM packages with embedded malware has been reported, affecting popular packages like coa, rc, and ua-parser. This raises serious concerns over the ecosystem's security.NPM, Security, MalwareRead Article
  4. Nov 2, 20218 minOpen Source Software Licenses 101: The Eclipse Public LicenseAn overview of the Eclipse Public License, its key provisions, and its compatibility with other licenses.eclipse, open-source, licensesRead Article
  5. Oct 25, 202112 minBest Practices for Testing in GoAn exploration of effective testing practices in Go, including strategies for choosing what to test and examples of making it work in applications.Go, TestingRead Article
  6. Oct 14, 20217 min4 Key Elements of Technical Due DiligenceExplore the essential aspects of technical due diligence, from third-party software usage to intellectual property protections.technical due diligence, M&ARead Article
  7. Oct 7, 20218 minQ and A: Software Bill of Materials and FOSSAExplore common questions related to FOSSA’s SBOM solution including its features, export formats, and security aspects.Software, SBOMRead Article
  8. Sep 30, 20218 minAnatomy of a Software Supply Chain AttackUnderstanding software supply chain attacks and strategies to defend against them.cybersecurity, software securityRead Article
  9. Sep 22, 20216 minHow to Generate an SBOM with FOSSALearn how to use FOSSA's SBOM tool to generate a software bill of materials easily and effectively.SBOM, FOSSARead Article
  10. Sep 15, 20216 minbouk/monkey and the Importance of Knowing Your DependenciesExploring the significance of understanding software dependencies, licenses, and the unusual case of bouk/monkey's license.open-source, license complianceRead Article
  11. Sep 9, 20214 minRole-Based Access Control (RBAC), Zero Trust, and FOSSAExploring the implementation of Zero Trust through Role-Based Access Control (RBAC) with FOSSA.cybersecurity, zero trust, access controlRead Article
  12. Aug 30, 20217 min3 Best Practices for OSS Management in the Automotive IndustryExplore best practices for OSS management in the automotive industry to reduce license compliance, security, and quality risks.open-source, automotiveRead Article
  13. Aug 27, 20213 minFOSSA Product Updates: August 2021Overview of several new features in FOSSA, including analysis target configuration, announcements banner for on-prem users, new language support, container scanning, audit logging, and the ability to manually add dependencies.FOSSA, Product UpdatesR
  14. Aug 23, 20213 minFOSSA Receives Highest Scores Possible in License Risk Management, SBOM Criteria in Forrester WaveFOSSA is recognized as a significant SCA solution in The Forrester Wave™ report, achieving highest scores in license risk management and SBOM criteria.SCA, FOSSARead Article
  15. Aug 20, 20217 minOpen Source Software Licenses 101: The LGPL LicenseAn overview of the GNU Lesser General Public License (LGPL), its requirements, permissions, and its current usage in the open source software development community.open source licenses, LGPLRead Article
  16. Aug 13, 202112 minOpen Source Software Licenses 101: The AGPL LicenseExplore the intricacies of the GNU Affero General Public License (AGPL), its history, requirements, and its impact on the open-source software community.open-source, AGPL, licensesRead Article
  17. Aug 3, 20212 minAnnouncing FOSSA Container ScanningAnnouncing the availability of FOSSA Container Scanning, a tool that helps identify vulnerabilities and license risks in container images.container scanning, securityRead Article
  18. Jul 28, 20216 minStockfish vs. ChessBase and What it Means for GPL v3An exploration of the Stockfish lawsuit against ChessBase, testing the GPL v3 license regarding derivative works and license termination.GPL, chess, open-sourceRead Article
  19. Jul 23, 20217 minThe Minimum Required Elements of an SBOMAn overview of the minimum required elements for a Software Bill of Materials (SBOM) as outlined by the U.S. Federal Government's NTIA.SBOM, software, complianceRead Article
  20. Jul 14, 20217 minAnalyzing the Legal Implications of GitHub CopilotExplore the potential legal challenges GitHub Copilot faces regarding copyright infringement and license compliance of its code suggestions.GitHub, Legal, CopilotRead Article
  21. Jun 25, 20219 minContainer Image Security and Vulnerability ScanningExplore today’s container image security landscape and learn strategies to fend off cyber threats like vulnerability scanning and digital signatures.Container Security, Vulnerability ScanningRead Article
  22. Jun 22, 20218 minAll About CWE-79: Cross-Site ScriptingAn overview of CWE-79: Cross-Site Scripting, a common web vulnerability that allows attackers to inject malicious code into web applications.XSS, security, web vulnerabilitiesRead Article
  23. Jun 8, 20218 minCopyleft Licenses and the Venture Capital ConnectionExplore the impact of copyleft licenses on venture capital investments, including insights from IP lawyer Kate Downing and the NVCA Stock Purchase Agreement Model Form.open-source, venture capitalRead Article
  24. Jun 3, 202114 minAll About Permissive LicensesAn exploration of permissive open source licenses, their history, and their role in the software community.open-source, licensesRead Article
  25. May 26, 20218 minCybersecurity Executive Order and Software Supply Chain SecurityAn overview of the Biden Administration's executive order on cybersecurity and its impact on software supply chain security.cybersecurity, software supply chain, security, executive orderRead Article
  26. May 20, 20214 minIT Central Station: What Makes for an Effective SCA SolutionExploring the essential features of an effective Software Composition Analysis (SCA) solution through insights from IT Central Station members.SCA, Software, SecurityRead Article
  27. May 10, 202112 minAll About Copyleft LicensesAn exploration of copyleft licenses, their history, differences from permissive licenses, and their role in the open source community.open-source, licensesRead Article
  28. Apr 29, 20219 minApplication Security for Developers: SCA, DAST, and GitHub ActionsExplore application security testing with SCA and DAST, and learn how to implement these tools using GitHub Actions for early bug detection and cost reduction.application security, GitHub ActionsRead Article
  29. Apr 22, 202110 minSoftware Bill Of Materials (SBOM) Formats, Use Cases, and SpecificationsExplore the significance of Software Bill of Materials (SBOM), its formats, use cases, and essential elements crucial for compliance and security in the software supply chain.SBOM, softwareRead Article
  30. Apr 16, 20215 minHow SCA Helps Manage OSS VulnerabilitiesExplore how Software Composition Analysis (SCA) helps teams manage open source software vulnerabilities.OSS, SCA, softwareRead Article
  31. Apr 12, 202110 minOpen Source Software Licenses 101: The ISC LicenseExplore the history, requirements, and key differences of the ISC License in open source software.open-source, licensesRead Article
  32. Apr 6, 202112 minOpen Source Software Licenses 101: Mozilla Public License 2.0An in-depth look at the Mozilla Public License 2.0, its requirements, comparisons with other licenses, and its use cases.Open Source, Software LicensingRead Article
  33. Mar 30, 20217 minTop Build Systems for MonoreposExplore various build systems suited for monorepos, detailing the difference between imperative and declarative systems, and providing insights into top choices such as Bazel, Buck, and Pants.build systems, monoreposRead Article
  34. Mar 25, 202113 minOpen Source Software Licenses 101: The BSD 3-Clause LicenseAn overview of the BSD 3-Clause License, its history, requirements, and how it compares to other permissive licenses.open-source, software licensesRead Article
  35. Mar 20, 20217 minSoftware Supply Chain Security for Automotive OrganizationsExploring supply chain security risks in automotive industry and how software composition analysis can mitigate these threats.software security, automotive industryRead Article
  36. Mar 12, 20213 minHow OSS Conquered the World: Insight from Veteran DevelopersFOSSA staff engineer Konstantin Gredeskoul and Oxide Computer Company's co-founder Bryan Cantrill discuss the development and impact of open source software in an informative and entertaining podcast.open-source, OSSRead Ar
  37. Mar 9, 20216 minBuilding an Open Source Program Office (OSPO)Explore the components and staffing necessary for establishing a successful Open Source Program Office to manage and strategize open source software use.OSPO, open-sourceRead Article
  38. Mar 3, 202113 minOpen Source Software Licenses 101: GPL v3Explore the differences between GPL v2 and GPL v3, understand the key features of GPL v3, and discover why it's a popular choice among developers and companies. Learn about its use cases, compatibility with Apache 2.0, and the future of GPL v
  39. Feb 24, 202111 minOpen Source Software Licenses 101: GPL v2An informative guide on the GNU General Public License Version 2.0, highlighting its terms, conditions, and how it contrasts with other open source licenses.open-source, GPL, licenseRead Article
  40. Feb 19, 20215 minHow to Choose an Open Source Software License Compliance ToolGuidance on choosing the right open source software license compliance tool, covering aspects such as scanning, automation, integration, issue management, and reporting.open-source, complianceRead Article
  41. Feb 10, 20213 min4 Takeaways from the 2021 State of Open Source Vulnerabilities ReportAn analysis of the 2021 State of Open Source Vulnerabilities report, highlighting frequent targets like Java and JavaScript, common issues such as poor input validation, and vulnerable libraries.vulnerabilities, op
  42. Feb 6, 202110 minOpen Source Licenses 101: Apache License 2.0An exploration of the Apache License 2.0, outlining its terms, use cases, and how it compares to other permissive licenses.open-source, apache license, software licensesRead Article
  43. Feb 1, 202116 minHow to Apply a License to Your Open Source Software ProjectExplore how to effectively apply a license to your open source software project, addressing common challenges and scenarios.open-source, licenseRead Article
  44. Jan 28, 20219 minOpen Source Software Licenses 101: The MIT LicenseExploring the MIT License, a popular open source software license, its permissions, restrictions, and comparisons to other licenses.open-source, licensesRead Article
  45. Jan 26, 20215 minTakeaways from OpenChain ISO/IEC 5230:2020Key insights from the OpenChain ISO/IEC 5230:2020 standard, focusing on requirements for license compliance programs and how to achieve OpenChain Conformance.open-source, complianceRead Article
  46. Jan 19, 20217 minTop Security Takeaways from the 2020 FOSS Contributor SurveyDiscover key security insights from the 2020 FOSS Contributor Survey and explore actionable recommendations for open source project owners.Open Source, SecurityRead Article
  47. Jan 13, 20215 minThe Future of Software Composition Analysis, Featuring ForresterExploring the future of Software Composition Analysis (SCA) with key insights into automation, governance, and developer integration.software, open-sourceRead Article
  48. Jan 8, 20217 minImproving Page Speed Using Google PageSpeed Insights in Rails AppsIntegrate Google’s PageSpeed Insights API into Rails apps to improve site performance, accessibility, and SEO.Rails, Google PageSpeedRead Article
  49. Dec 29, 20209 min5 Ways Companies Can Get More Value From Open Source SoftwareExplore strategies for maximizing open source software benefits while ensuring compliance and security.open-source, software developmentRead Article
  50. Dec 23, 20209 minSolarWinds, Supply Chain Attacks, and Software Composition AnalysisExploring the implications of the SolarWinds hack and methods to prevent similar software supply chain attacks, with a focus on software composition analysis.supply chain attacks, cybersecurityRead Article
  51. Dec 22, 20207 minHow UiPath Reduced Open Source Risk Through Team CollaborationExplore how UiPath reduces open source risk through collaboration between engineering, compliance, and security teams.open-source, risk managementRead Article
  52. Dec 17, 20205 minWhat is Software Composition Analysis?Discover how Software Composition Analysis (SCA) helps you manage and reduce risks associated with open source components in your software.software, analysisRead Article
  53. Dec 12, 20206 minPros and Cons of Using MonoreposMonorepos, used by companies like Google and Facebook, offer benefits like simplified dependency management and large-scale code refactoring, but also present challenges in build pipelines and VCS tooling.monorepos, software developmentRead Article
  54. Dec 9, 20205 minHow Zendesk’s Legal Team Scored an Open Source Compliance VictoryDiscover how Zendesk's legal team improved open source compliance with the help of FOSSA, optimizing workflows and reducing time spent on compliance processes.open-source, complianceRead Article
  55. Dec 4, 20203 minFOSSA Announces SOC 2 ComplianceFOSSA has achieved SOC 2 Type 2 compliance, reaffirming its commitment to the highest standards of security and data protection.SOC 2, complianceRead Article
  56. Nov 25, 20206 minHow to Choose the Right Open Source LicenseThis post guides you on how to choose the right open source license for your project, ensuring your software is protected and shared as you wish.open-source, licensingRead Article
  57. Nov 21, 20204 minA Look Inside FOSSA’s New Product DesignExplore FOSSA’s recent design refresh, focusing on brand consistency and user experience improvements.design, product updateRead Article
  58. Nov 18, 20209 minQ&A: Heather Meeker on Open Source License NoticesHeather Meeker shares insights on open source software licensing and the role of automation in managing license notices.Open Source, License ComplianceRead Article
  59. Nov 13, 202010 minHeather Meeker on Open Source License Notices and AutomationDiscussing the importance of open source license notices and how automation can help address compliance challenges.open-source, license complianceRead Article
  60. Oct 27, 202012 minA Journey Through Our New Brand and WebsiteExplore how we redesigned FOSSA's brand and website, focusing on new design principles and a modernized aesthetic that enhances user experience and brand identity.branding, website redesignRead Article
  61. Oct 20, 20205 minA Framework for Evaluating Software Composition Analysis ToolsUnderstand the importance of Software Composition Analysis (SCA) tools for mitigating risks associated with open source components in modern software development.Software Composition Analysis, Risk MitigationRead Article
  62. Oct 15, 20203 minFOSSA Raises a $23.2M Series BFOSSA announces a new funding round of $23.2M to accelerate the development of open source inventory solutions.funding, open-sourceRead Article
  63. Oct 15, 20204 minPress Release: FOSSA Accelerates Growth, Hits Significant MilestonesFOSSA announces $23.2 million in Series B funding and launches new security management capabilities, affirming its leadership in the software composition analysis market.open-source, security managementRead Article
  64. Oct 14, 20205 minIntroducing Open Source Security Management at Enterprise ScaleAnnouncing the launch of FOSSA Security Management, empowering enterprises to prevent vulnerabilities proactively and continuously.security, open-sourceRead Article
  65. Sep 17, 20204 minHow Open Source License Audits Became a Strategic Key to M&A SuccessOpen source non-compliance can impact company transactions like mergers and acquisitions by slowing, devaluing, or breaking deals.open-source, M&ARead Article
  66. Sep 15, 20208 minThe Huge Risk that Most IPOs MissExplore the often-overlooked risks in IPO preparations, focusing on open source license management and compliance.IPOs, Risk ManagementRead Article
  67. Aug 27, 20204 minNow's the Perfect Time to Evolve Legal and Engineering CollaborationIn remote work, businesses' confidence in their software supply chain is crucial, highlighting risk mitigation's importance.open-source, complianceRead Article
  68. Aug 26, 20209 minTikTok, Trump, and the Future of Open Source SurveillanceExploring the intersection of TikTok, national security, and the future of open source software surveillance.surveillance, open-sourceRead Article
  69. Jun 3, 20204 minFOSSA and Container ScanningExplore how FOSSA aids in scanning different components of a container to ensure compliance and security.container, dockerRead Article
  70. Apr 10, 202015 minOpen Source Management: FundamentalsExplore the role of open source in the enterprise market and learn the essentials of managing open source software including strategies, policies, and tools for effective oversight.Enterprise, SoftwareRead Article
  71. Apr 8, 20205 minWhy Source Code Scanning Tools Are Essential for Open Source ComplianceExplore the risks and necessity of source code scanning tools in open source compliance to prevent licensing issues and ensure smooth project management.open-source, complianceRead Article
  72. Feb 14, 20202 minFOSSA January 2020 Product Release NotesExplore the January 2020 FOSSA product release, featuring Release Groups for better project management and new dependency editing workflows, alongside various CLI improvements.FOSSA, Product UpdatesRead Article
  73. Jan 6, 20202 minFOSSA December 2019 Product Release NotesDecember 2019 product release notes, highlighting user management enhancements and updates to attribution reports.FOSSA, release notesRead Article
  74. Dec 18, 20195 minSnippet Scanning: Is it Right for Your Team?Explore the nuances of snippet scanning and its relevance to software development today, while considering risk profiles and modern development practices.open-source, software composition analysisRead Article
  75. Dec 5, 20192 minFOSSA November 2019 Product Release NotesLearn about FOSSA's November 2019 product updates including user management enhancements, UI improvements, and new reporting features.Read Article
  76. Nov 12, 20192 minFOSSA Named to CNBC's Upstart 100FOSSA has been named to CNBC's Upstart 100 List following the closing of $8.5 Million in Series A Funding.startups, open-source, recognitionRead Article
  77. Oct 3, 20192 minFOSSA Acquires Dawn LabsFOSSA announces the acquisition of Dawn Labs to enhance its focus on developer-focused products and expand its team with experienced developers known for creating Carbon and working with ZEIT.Acquisition, Developer ToolsRead Article
  78. Oct 2, 20192 minFOSSA September 2019 Product Release NotesHighlights from FOSSA's September 2019 release, including updates to JIRA integration, project addition enhancements, new reporting formats, and FOSSA-CLI improvements.FOSSA, Product Release, IntegrationsRead Article
  79. Sep 16, 20194 minFOSSA Raises $8.5M for Enterprise Open Source ManagementFOSSA announces an $8.5M Series A funding to enhance open source management for enterprises, and shares success stories with notable clients.Enterprise, Open SourceRead Article
  80. Sep 11, 20192 minDevOps and Open Source + CI/CD = Mitigating Risk Without Sacrificing SpeedExplore how DevOps and open source tools can be leveraged with CI/CD to mitigate risk without compromising on speed.DevOps, CI/CDRead Article
  81. Sep 2, 20193 minFOSSA August 2019 Product Release NotesHighlighting FOSSA's August 2019 product updates, including streamlined issue management, new language support, and enhanced reporting features.FOSSA, release notesRead Article
  82. Aug 14, 20191 minWe’re excited to partner with CircleCI to release our CircleCI orb!Learn about FOSSA's new CircleCI orb for easier OSS license compliance and CI/CD integration.CircleCI, Open SourceRead Article
  83. Aug 1, 20191 minFOSSA July 2019 Product Release NotesEnhancements to the FOSSA CLI, Rust support, and improvements to on-prem deployment are highlighted in the FOSSA July 2019 product release notes.Product Release, FOSSA, CLIRead Article
  84. Jul 22, 20191 minA Partnership Between Legal Teams and Software Engineers is More Important Than EverExplore why collaboration between legal and engineering teams is critical in the era of privacy legislation and open source licensing.legal, engineeringRead Article
  85. Jul 19, 20193 minFOSSA Marketing Intern ReflectionMahak Bandi shares her experiences and growth as a Marketing Intern at FOSSA.Marketing, InternshipRead Article
  86. Jul 9, 20193 minWTFPL to Beerware: Top 6 Out-There Open Source LicensesExplore some of the most unconventional open source licenses, from Beerware to WTFPL.open-source, licensesRead Article
  87. Jul 2, 20192 minFOSSA June 2019 Product Release NotesKick off the summer with new Haskell language support, plain text reporting, and major enhancements to FOSSA's project page.FOSSA, release notesRead Article
  88. Jun 26, 20196 minAll About Open Source LicensesA comprehensive guide to understanding open source licenses, including permissive and copyleft licenses, and how to apply them.open-source, licensesRead Article
  89. Jun 24, 20193 minWhat is a Private Artifact Repository?Exploration of the benefits and limitations of private artifact repositories, highlighting three common issues developers face along with solutions offered by FOSSA.open-source, artifact repositoryRead Article
  90. Jun 10, 20197 minStill Asking Engineers to Fill Out Open Source Request Forms?Exploring the impact of manual open source request processes on engineering culture and innovation speed.open-source, software developmentRead Article
  91. Jun 7, 20191 minWe’re Excited to Announce Our CNCF MembershipFOSSA is excited to announce its CNCF membership, highlighting the importance of open source in software development and our commitment to the community.open-source, CNCFRead Article
  92. Jun 4, 20193 minFOSSA May 2019 Product Release NotesExplore the latest updates from FOSSA, including simplified reporting, enhanced CLI, and better support for NuGet and Gradle.product, release notesRead Article
  93. May 16, 20195 minA Case For Continuous ComplianceExploring the importance and benefits of continuous compliance in the use of open source software.open-source, complianceRead Article
  94. May 14, 20199 minCreating a Comprehensive 3rd-Party Package License Policy for OSSLearn how to create a comprehensive third-party package license policy, a vital element for companies engaging with open source software and ensuring compliance across various licenses.OSS, Open Source ComplianceRead A
  95. Mar 15, 20195 minWhy Open Source License Compliance Needs to Be CI-AgnosticExploring the importance of adopting platform-agnostic tools for open source license compliance and the benefits of avoiding vendor lock-in.open-source, license complianceRead Article
  96. Feb 19, 20193 minAutomating Open Source Reports with FOSSA at ApplauseDiscover how Applause leveraged FOSSA to automate their OSS licensing and compliance process, saving time and improving accuracy.open-source, FOSSARead Article
  97. Nov 29, 20185 minCost/Benefit Analysis: Manual Audits vs Automated License ComplianceExploring the costs and benefits of manual versus automated license compliance in software companies.compliance, auditsRead Article
  98. Nov 29, 20185 minFast Integration Tests for 3rd Party Services - The Easy WayLearn how to efficiently use integration tests for third-party services with mocha-tape-deck, optimizing speed and reliability.integration tests, third-party servicesRead Article
  99. Nov 15, 20183 minReflecting on 1 year of early-stage engineeringReflections on an engineer's journey in a small company, highlighting the diverse roles and skills acquired.software engineering, startupsRead Article
  100. Nov 15, 20184 minWhich Open Source License Is Best for Commercialization?Exploring the best open source licenses for commercialization, including the balance between permissive and restrictive licenses.open-source, licensesRead Article
  101. Nov 5, 20182 minDiscussing Commons Clause on Software Engineering DailyExploration of open source software, business models, and the impact of the Commons Clause, with insights from Kevin Wang.open-source, business modelsRead Article
  102. Oct 24, 201810 minPathologies of Go Package ManagementAn exploration of the challenges and strategies in managing Go package dependencies, including issues with reproducible builds and dependency analysis.Go, package managementRead Article
  103. Oct 17, 20184 minFOSSA 0.8.0: Overhauling our onboarding system + other usability improvementsFOSSA introduces version 0.8.0, featuring an overhauled onboarding system and a series of usability improvements.FOSSA, software updatesRead Article
  104. May 30, 20183 min300+ New Licenses Supported in FOSSAAnnouncing new license data quality updates with over 300 new licenses in FOSSA.FOSSA, licensesRead Article
  105. May 1, 20185 minJS Foundation chooses FOSSA as the Open Source License Cert. ProviderThe JS Foundation, supporting critical JavaScript infrastructure, chooses FOSSA for automated open-source license compliance.JavaScript, Open SourceRead Article
  106. Apr 16, 20185 minCombating Alert Fatigue with a Global Issue DashboardThis post discusses how FOSSA's new dashboard tools address alert fatigue by improving issue management and triage for modern enterprises.alert fatigue, dashboardRead Article
  107. Mar 15, 20183 minOpen sourcing FOSSA’s build analysis in fossa-cliFOSSA is open sourcing its dependency analysis infrastructure, allowing everyone access to the tools necessary to get comprehensive dependency data from any codebase.open-source, dependency-analysisRead Article
  108. Feb 5, 20184 minDelivering a better on-premises experienceExplore the unique challenges of on-premises deployments and discover how FOSSA improves onboarding, support, and integrations to enhance user experience.on-premises, deployment, FOSSARead Article
  109. Nov 30, 20175 minLegal Concerns for SaaS Companies Going On-PremExplore the legal and compliance challenges SaaS companies face when transitioning to on-prem solutions for high profile clients, such as Fortune 500 companies.SaaS, Legal, On-PremRead Article
  110. Nov 1, 20175 minOrganization-wide issues & conditional policiesDiscover how FOSSA improves organization-level issue management and introduces conditional policy rules to streamline compliance.compliance, policiesRead Article
  111. Aug 24, 20177 minDon’t Over-REACT to the Facebook Patents LicenseThe controversy surrounding Facebook's 'BSD+ Patents' license is more partisan than practical, and the Apache Foundation's decision to reclassify it is unlikely to impact the use of ReactJS.open-source, Facebook, patentsRead Article
  112. Jul 7, 20176 minThe Ultimate GPL Survival GuideA comprehensive guide on GPL compliance for professionals in consumer electronics, IoT, and automotive industries, featuring useful flowcharts and checklists.GPL, open-source, complianceRead Article
  113. Feb 23, 20177 minAnnouncing FOSSA Public Beta & FundingAnnounce the public beta release of FOSSA and a $2.2MM seed round led by Bain Capital Ventures.FOSSA, Open SourceRead Article
  114. Feb 21, 20176 minYou can’t get around code scanning if you care about open source licensesExploring the necessity of code scanning tools for tracking and complying with open source licenses in modern software development.open-source, code scanningRead Article
  115. Jan 1, 20175 minHow SmartThings runs IoT open source compliance across dozens of releases per dayAn exploration of how SmartThings automates their code release process for IoT platforms with the help of FOSSA compliance tools.IoT, SmartThingsRead Article
  116. Jul 5, 20164 minFOSSA partners with npm to deliver open source license complianceFOSSA introduces a new add-on for npm Enterprise to enhance open source license compliance.open-source, complianceRead Article