Transforming Software Development

Transcription

1

2

3

4 Who Did We Talk To? Role Within the Organization 52% Software Developer/Engineer 22% Architect 13% Team Lead/Project Manager 5% Build Manager 6% Manager, Director, or Executive 3% IT Operations

5 A variety of organizations were represented Organizations Surveyed 17% Financial Services 33% Tech & ISV 12% Consulting 6% Telecommunications 2% Manufactoring 5% Media & Entertainment 7% Goverment & Military 18% Other

6 Organizations large and small participated Number of Developers in the Organization 24% 19% % 34%

7 OS development infrastructure is quickly becoming the standard Does your organization use open source development infrastructure? We re standardizing on an open source development infrastructure stack 49% % 2012 We only use open source infrastructure if it s commercially supported 7% 10% It s not our corporate standard, but tons of people use it 27% 27% A few of our developers use it, but it s not widely adopted 11% 17%

8 Most of you use a repository manager, here s why Why do you use a repository manager? 35% To enforce standards for component usage 64% Improve build time 67% To manage component usage 32% Better visibility into component usage

9 Visibility and control is even more important for large organizations Why do you use a repository manager? Organizations with over 500 developers 75% To manage component usage 41% To enforce standards for component usage 34% Better visibility into component usage 64% Improve build time

10 2/3 of organization contribute to open source projects Open Source in Organizations 9% 34% We strictly consume open source 12% 45% 34% We use open source and contribute 45% directly back to projects We use open source and contribute 12% back via a third party 9% We contribute to open source projects even though our company s policies prohibit it

11

12 You told us that Java OS components are the most important to you How important are the following types of open source components to your organization? Percentage reporting critical, pretty important, or medium, but getting more important 15% 14% 86% 2..NET 3. C / C++ 4% 4% 1. Java 4. Python 5. Perl

13 Web searches are the most common way of finding components How do you find artifacts for your projects? Search the web for artifacts that meet our needs 70% Rely on the advice of my colleagues Use master repository search tools (eg. Central Repository Search) 35% Must adhere to corporate standards 35% 42%

14 The Central Repository is the most popular source of components What sources of open source components are most important to your development efforts? Percentage reporting critical or important 51% 2.44 of 5 43% 2.22 of 5 78% 3.17 of 5 2. Project Sites 3. JBoss 39% 2.13 of 5 27% 1.87 of 5 1. Central Repository 4. Atlassian 5. GitHub

15 Here s what you said matters about the component you use For the components you use in your applications, how important are these attributes? 22% 32% 25% 19% 18% 28% 25% 27% 39% 51% 51% 34% Security Code Quality Project Maturity Licensing Mission critical Extremely important Somewhat important Minor concern Not a concern at all

16

17 Only half of you have an open source policy Does your organization have an open source policy? 51% No 49% Yes

18 You told us, most of your organizations lack control over OS usage Control of artifacts in development We re completely locked down. We can 20% only use approved components. We have some corporate standards, but 43% they aren t enforced. 37% There are no standards. Each developer team choose the components that are best for their project.

19 Interestingly, enforcement seems to be on the rise Control of Artifacts in Development 37% 45% in 2011 There are no standards, each development team chooses their own components. 43% 42% in 2011 We have some corporate standards, but they aren t enforced. 20% 13% in 2011 We re completely locked down. We can only use approved components. 2011/2012 Sonatype surveys of developers, architects, and managers (2011 n=1,600; 2012 n=2,550)

20 Regulated industries are more likely to be locked down Control of Artifacts by Sector We are completely locked down. We can only use approved components. 31% 18% 25% 21% 19% 19% 13% 12% Financial Services Tech/ISV Consulting Manufacturing Govt & Military Telecommunications Media & Entertainment Other

21 Only 23% of you need approval before using OS components Does your organization have an open source policy? 51% Do not have a policy 26% Have a policy 23% Must have approval before using any open source components

22 For those of you with policies...more than half of you hate them

23 Lots of groups are responsible for open source policy Who is responsible for Open Source Governance? Development Teams Legal OSS/FOSS Committee/ Department 12% 18% 16% 6% 7% Security Risk and Compliance IT Operations 15% 28% Application Development Management

24 Does your open source policy restrict component usage based on specific licenses? Over 3/4 of organizations restrict component usage based on specific licenses Yes and we examine every component and *all* of its dependencies Yes and we examine every component but *not* its dependencies 51% 25% No, our policy does not restrict component usage based on licensing 24%

25 Policy restricting component usage based on specific licenses Policy restricting component usage based on specific licenses: Yes and we examine every component and *all* of its dependencies have no effective 49% licensing policy 51% 25% 24% Yes and we examine every component but *not* its dependencies No, our policy does not restrict component usage based on licensing

26

27 Does your organization maintain an inventory of open source components used in production applications? 48% No 32% Yes, for all components including dependencies 20% Yes, for all components but NOT their dependencies

28 It s difficult to know when components & dependencies are updated When a component is updated, how do you know? 74% 66% By searching the web Keeping up with project sites 40% 30% 20% From colleagues Word of mouth No good way to find out

29 Thank you!