Presented at Embedded Systems Conference (ESC) Minneapolis 2018, this session discusses the most effective uses of open source software; how to maintain MISRA, CWE, OWASP, and other standards compliance across all code sources; how to avoid license risk; and reduce critical safety and security issues.

1. 1© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Are open source and
embedded software
development on a
collision course?
Rod Cope, CTO
RogueWave Software

2. 2© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Presenter
Rod Cope
CTO
Rogue Wave Software
rod.cope@roguewave.com
Twitter: @rodcope

3. 3© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Agenda
1. Introduction
2. Using OSS
3. License risk
4. MISRA, OWASP
5. Safety & security
6. Q & A

4. 4© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Introduction

5. 5© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Open source is everywhere
GitHub
5 million+
OSS projects
80+
Licenses approved
by OSI
98%
of organizations
use OSS
https://guides.github.com/activities/contributing-to-open-source/
https://opensource.org/licenses/alphabetical
http://www.roguewave.com/programs/open-source-support-report

6. 7© 2017 Rogue Wave Software, Inc. All Rights Reserved.
67% of developers are not sure
if there’s a policy for source
code, or don’t know what it is.
http://www.roguewave.com/resources/white-papers/software-security-begins-with-flaw-free,-standards

7. 8© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Using OSS

8. 9© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Support the implementation
Self-support
Committer
support
Community
support
Commercial
support

9. 10© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Why use commercial support
Missing skillset
Time constraints
People change jobs

10. 11© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Commercial support example
The original implementation was not
built for scale. We’ll help you build a
workaround.
We’re experiencing heavy latency and heavy
resource utilization with ActiveMQ. The person
who built this left.

11. 12© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Support the selected software
80% of support issues
are either a lack of
product knowledge,
or something in the
environment outside
of the package.
http://www.roguewave.com/programs/open-source-support-report

12. 13© 2017 Rogue Wave Software, Inc. All Rights Reserved.
What can organizations do?
Detect critical areas
Investigate knowledge gaps
Implement a plan

13. 14© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Legal risk

14. 15© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Free comes with restrictions
Organizations may be at risk of
violating legal obligations.

15. 16© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Open source related legal action
• Versata v. Ameriprise
• XimpleWare v. Versata and Ameriprise
• Oracle v. Google
• Jacobsen v. Katzer
• Welte v. Fantec

16. 17© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Audit code
Identify packages
Bill of materials (BOM)
Obligations

17. 18© 2017 Rogue Wave Software, Inc. All Rights Reserved.
MISRA, OWASP, etc.

18. 19© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Maintain compliance

19. 20© 2017 Rogue Wave Software, Inc. All Rights Reserved.
MISRA recommends SCA
“In order to ensure that the source code written does conform to the
[MISRA] subset it is necessary to have measures in place which
check that none of the rules have been broken.
The most effective means of achieving this is to use one or more
of the static checking tools that are available commercially.”
- Section 4.3.1

20. 21© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Analysis tools
Identify bugs
and
vulnerabilities
Compliance
checkers

21. 22© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Safety & security

22. 23© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Vulnerabilities

23. 24© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Remediation
Establish processes
Research issues
Scan all code

24. 25© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Community updates
Monitor and implement
community updates.

25. 26© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Critical security announcements
OPENUPDATE SIGN UP: roguewave.com/openupdate

26. 27© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Monitor and test implementation

27. 28© 2017 Rogue Wave Software, Inc. All Rights Reserved.
Q & A

28. 29© 2017 Rogue Wave Software, Inc. All Rights Reserved.