Loading…
September 19-21, 2023
Bilbao, Spain
View More Details & Registration
Note: The schedule is subject to change.

The Sched app allows you to build your schedule but is not a substitute for your event registration. You must be registered for Open Source Summit Europe 2023 to participate in the sessions. If you have not registered but would like to join us, please go to the event registration page to purchase a registration.

This schedule is automatically displayed in Central European Summer Time (UTC/GMT +2). To see the schedule in your preferred timezone, please select from the drop-down menu to the right, above "Filter by Date."

IMPORTANT NOTE: Timing of sessions and room locations are subject to change.

Back To Schedule
Thursday, September 21 • 12:50 - 13:30
Dependency Management: The Cause of—and Solution to—All Supply Chain Problems - Eve Martin-Jones & Josie Anugerah, Google

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Tweet Share
Feedback form is now closed.


How many dependencies does your software project have? How much confidence do you have in them? We say in open source there is safety in ‘eyes on the code’, but with supply chain attacks on the rise - who is really watching? Most software is built with hundreds if not thousands of direct and transitive dependencies, and those dependencies change every day. Our analysis shows that up to 20% of PyPI packages change their dependency graphs multiple times per week. Ensuring that each one of these dependencies is trustworthy is a daunting task. In this talk, Eve and Josie will share some stats and stories from their experiences building deps.dev. They'll look at what it means for a project to be healthy, dig into the complexities of dependency resolution algorithms, and recommend tools that can make practical dependency management possible if not easy.
Speakers
avatar for Eve Martin-Jones

Eve Martin-Jones

Software Engineer, Google
Eve is an engineer working on open source software security at Google. She lives in Australia, with her cat Mochi, who is surprisingly proficient at JavaScript. Between D&D campaigns, she can be found deciphering the Cargo dependency-resolution algorithm bug-for-bug, advocating for... Read More →
avatar for Josie Anugerah

Josie Anugerah

Software Engineer, Google
Josie is an engineer at Google, working on Open Source Supply Chain Security. She lives in Sydney, Australia, with her cat Polly, who remains sadly ambivalent about software security. Between badminton games, she can be found wrangling advisory data for vulnerability databases, finding... Read More →

Dependency management the cause of and solution to all supply chain problems pdf
Thursday September 21, 2023 12:50 - 13:30 CEST
Room 0C (Floor 0)
  SupplyChainSecurityCon
  • Presentation Slides Attached Yes