A Lawyer and an Engineer Walk Into a Bar and Talk Open Source

### Overview In this talk presented at a Linux Foundation conference, Ravi Devineni, Senior Director of Engineering for Cloud and DevOps at Northwestern Mutual, and Shantanu Singh, Assistant Legal Counsel at Northwestern Mutual, examine how large financial technology (fintech) organizations can capture the advantages of open source software while actively mitigating legal, security, and operational pitfalls. By pairing an engineering perspective with a legal perspective, the speakers present strategies for navigating open source consumption safely through clear policy, automated governance, and technical controls.

### Key Topics - **Legal Redefinition of Property Rights**: Framing open source through the legal concept of a "bundle of sticks," where individual permissions and restrictions (such as in permissive licenses versus strongly protective licenses like AGPL) are granted or withheld based on community collaboration rather than traditional, exclusive monetary ownership. - **Engineering Benefits**: Accelerating time to market by leveraging established open source solutions for commodity functions (operating systems, content management, authentication, database connectors, and HTTP handling), eliminating license fees to lower total cost of ownership, ensuring transparency, and aiding talent recruiting. - **Security and Supply Chain Threats**: Publicly known vulnerabilities, transitive dependency risks, lack of active support, and next-gen software supply chain attacks where malicious actors push malicious code into public registries like Docker Hub, Maven Central, and PyPI. Notable real-world cases mentioned include the Equifax Apache Struts breach and SolarWinds. - **Intellectual Property and Compliance Risks**: The dangers of unintentional disclosure of proprietary code through mixing, copyright infringement from unauthorized modifications or forking, compliance surprises from non-compliant contributions, and how dual licensing bridges community traction with commercial monetization.

### Technical Details To protect the software supply chain and ensure license compliance, the speakers highlight several engineering and governance mechanisms: - **Comprehensive Inventory vs. Software Bill of Materials (SBOM)**: Maintaining a macro-level inventory of all open source components and versions across the enterprise by scanning SCM repositories, coupled with micro-level, application-specific SBOMs (using standards like SPDX or nested JSON, and tools such as Syft or Tern). - **CI/CD Security Scanning**: Integrating automated security scanning into delivery pipelines to detect and block releases when high vulnerabilities appear, noting that thousands of new vulnerabilities emerge annually (averaging approximately 68 per day). - **Dependency Health Scoring**: Leveraging automated evaluation frameworks like OpenSSF Scorecard to assess dependency viability based on metrics including CI best practices, branch protection, active maintenance, vulnerability track record, and pinned dependencies. - **Centralized Ingress and Dependency Proxies**: Eliminating direct downloads to developer machines or disparate build systems by channeling all open source components through a single gated entry point or dependency proxy (such as GitLab or Artifactory) that enforces an organization-wide block list.

### Takeaways - **Formal Enterprise Policy**: Fintech companies must establish a documented open source stance defining risk tolerance, acceptable usage, and accountable decision-makers. - **Automated Governance**: Given the vast scale of direct and transitive dependencies, human change committees cannot keep pace; governance, vetting, and enforcement must be automated in pipelines. - **Legal and DevOps Collaboration**: Legal counsel must work directly with DevOps teams to translate legal obligations, cybersecurity risk tolerances, and licensing restrictions into enforceable production rules.