Securing Enterprise Open Source with Coalitions & Clearing Houses: Lightwell from IBM & Red Hat

<p>Most of an enterprise application stack is open source that nobody is paid to maintain. Gunnar Hellekson of Red Hat puts it at 60 to 70 percent, and that gap is what IBM's Lightwell is built for. He walks James Governor through the mechanics: members scan and triage their own dependencies, submit what they find with the source identity stripped out, and get fixes back after an embargo period before those fixes reach a wider network and, where a maintainer still exists, the upstream project. Financial services goes first. Hellekson is candid that plenty of customers cannot use the service yet, because joining would only lengthen a patch backlog already measured in months. Mythos, the two agree, mostly revealed how bad things already were. They also work through token economics, why nobody needs to scan OpenSSL separately, and why a fix should end up as deterministic code rather than something an AI keeps rediscovering.<br /><br />Red Hat is a RedMonk client, but this is free and independent content.<br /><br />Show notes: <a href="https://redmonk.com/videos/gunnar-hellekson/" rel="noopener noreferrer nofollow" target="_blank">https://redmonk.com/videos/gunnar-hellekson/</a><br /><br />Chapters<br />00:00 Introduction: IBM's big bet on open source security<br />03:18 A win-win for customers and the open source community<br />05:27 The problem: 60–70% of the stack is unsupported open source<br />07:15 Carry your own fork or hope upstream fixes it<br />09:17 Eat your vegetables first: hardened images and paid platforms<br />09:45 How Lightwell works<br />11:57 Scope: application dependencies<br />12:57 Network effects, industry clearinghouses, and identity washing<br />14:34 When to move off orphaned projects<br />16:04 Mythos showed how bad things already were<br />19:51 Delivery via Maven, PyPI, and npm<br />20:33 Attackers vs. defenders at machine speed<br />21:44 Why fixes should be deterministic code, not endless AI<br />23:06 Token economics and shared remediation<br />24:05 Nobody needs to scan OpenSSL separately<br />25:08 Will every enterprise build its own software?<br />27:38 Wrap-up</p>