Bad open source packages can slow down your team and create risks for your organization's revenue, data, and customers. Tidelift helps reduce reliance on such packages by partnering with maintainers of thousands of open source projects, ensuring they are healthier and more secure. With the Tidelift Subscription, organizations can evaluate and monitor packages, eliminate bad ones, and improve overall security, productivity, and application quality.
Learn more at: tidelift.com/
Transcription:
Using bad open source packages is slowing your team down and creating risk to your organization's revenue, data, and customers. When you don't know where end-of-life, abandoned, or insecure packages exist in your applications, your only defense is to scan for existing vulnerabilities and fix what you find. Bad packages lead to more vulnerabilities, many of which are difficult to fix. This is making your application development team less productive and creating more risk for your security team to manage. Tidelift helps you proactively reduce your organization's reliance on bad open source packages. We are the only company that partners with the maintainers of 1000s of the most relied upon open source packages and pays them to make their projects healthier and more secure. Our maintainer partners implement enterprise-grade secure software development practices and document the practices they follow.
By using Tidelift recommendations to identify and eliminate bad packages in their applications, organizations can reduce security risk by eliminating attack entry points, improve productivity by reducing vulnerability fire drills, improve application quality by building with healthy and resilient open source packages, and improve operational efficiency by saving costly manual package evaluation time.
In fact, one large organization saved over $1.6 million in manual package evaluation time and eliminated over 3000 points of risk in applications running in production.
With the Tidelift Subscription, organizations are able to evaluate packages before pulling them in for application development to monitor the open source packages they already have in use, to identify and eliminate potentially bad packages they've already adopted, and to reinforce at-risk packages to keep them from becoming bad. Tidelift's package intelligence can easily be integrated into your preferred workflows by using our web UI seen here, through our command line interface, or by using our flexible APIs.
The most unique aspect about the Tidelift Subscription is that it reinforces at risk packages to keep them from becoming bad in the first place. Tidelift customers play a direct role in ensuring the packages they rely on keep getting better, because package maintainers are paid in part based on customer usage. Maintainers use this income to improve the secure development practices they have in place to document these practices and to commit to maintaining them over time. This means that customers can use open source with confidence, knowing that experienced maintainers have made the commitment to ensure their project follows enterprise grade secure software development practices and that they have the income they need to ensure it stays resilient and healthy into the future.
Please contact us to learn more about how your organization can reduce security risk from bad open source packages, while also ensuring the open source you rely on keeps getting better.