Remembering How We Should Manage Open Source

This post discusses the Equifax attack as a case study for open source vulnerabilities, highlighting the use of Apache Struts CVE-2017-5638. It presents data on the growth of vulnerabilities and the prevalence of known fixes. The post advocates for shifting security left and continuously scanning for vulnerabilities, specifically recommending WhiteSource Bolt, a VSTS extension, for scanning builds in release pipelines to identify open source vulnerabilities and notify users of new discoveries.