Securing Enterprise Open Source w Coalitions & Clearing Houses: Project Lightwell from IBM & Red Hat
Most of an enterprise application stack is open source that nobody is paid to maintain. Gunnar Hellekson of Red Hat puts it at 60 to 70 percent, and that gap is what IBM's Lightwell is built for. He walks James Governor through the mechanics: members scan and triage their own dependencies, submit what they find with the source identity stripped out, and get fixes back after an embargo period before those fixes reach a wider network and, where a maintainer still exists, the upstream project. Financial services goes first. Hellekson is candid that plenty of customers cannot use the service yet, because joining would only lengthen a patch backlog already measured in months. Mythos, the two agree, mostly revealed how bad things already were. They also work through token economics, why nobody needs to scan OpenSSL separately, and why a fix should end up as deterministic code rather than something an AI keeps rediscovering.Red Hat is a RedMonk client, but this is free and independent content.Show notes: https://redmonk.com/videos/gunnar-hellekson/Chapters00:00 Introduction: IBM's big bet on open source security03:18 A win-win for customers and the open source community05:27 The problem: 60–70% of the stack is unsupported open source07:15 Carry your own fork or hope upstream fixes it09:17 Eat your vegetables first: hardened images and paid platforms09:45 How Lightwell works11:57 Scope: application dependencies12:57 Network effects, industry clearinghouses, and identity washing14:34 When to move off orphaned projects16:04 Mythos showed how bad things already were19:51 Delivery via Maven, PyPI, and npm20:33 Attackers vs. defenders at machine speed21:44 Why fixes should be deterministic code, not endless AI23:06 Token economics and shared remediation24:05 Nobody needs to scan OpenSSL separately25:08 Will every enterprise build its own software?27:38 Wrap-up
