HTML Injection Attacks: Impact and Mitigation Strategies
Involvement of software companies in oss - serli-jerome petit - f os-sa2011
1. Involvement of Software Engineering companies
in OSS contributions : a virtuous circle
27/10/2011 Jérôme PETIT
2. A few words about SERLI
● Software engineering company based in France
● 65 people
● 80% of the business is Java-related
● Small company working for big ones
● OSS contribution : 10% of workforce
● www.serli.com @SerliFr
27/10/2011 Jérôme PETIT
3. Fewer words about me
● Lead New Information Systems activities at
SERLI
● Injected massive Open Source contribution in
the business model of the company in 2005
● Poitou-Charentes JUG leader
● jerome.petit@serli.com @jeromepetit
27/10/2011 Jérôme PETIT
4. Involvement in OSS contribution
● We offer engineering time to OSS projects
● From a few days to tens of man-monthes
27/10/2011 Jérôme PETIT
5. Targeted projects
● Editors projects
e.g. GlassFish, JBoss, Sonar
● Community projects
e.g. JOnAS, Selenium
● Home-made projects
e.g. JaasLounge
27/10/2011 Jérôme PETIT
6. Nature of contributions
● Bug fixes
● Satellite features
● Core features
From day-to-day production needs...
...to cutting-edge innovation
27/10/2011 Jérôme PETIT
7. What to contribute & When
● Community-driven
● Editor-driven
→ features are choosen with community
managers & project leaders
→ contribution planning matches project
roadmap & release plan
27/10/2011 Jérôme PETIT
8. Examples of contributions
● GlassFish : versionning, vmware support
● Ceylon : Eclipse IDE support
● Sonar : i18n support
● Infinispan : CDI support
● Weld : Weld-OSGi
● JOnAS : JASPIC implementation
● Selenium : Webdriver integration
● Hibernate Validator : message interpolator
●
27/10/2011 Jérôme PETIT
9. How it actually does change things
● Impact on organization
● Impact on business
● Impact on human beings
27/10/2011 Jérôme PETIT
10. Impact on organization
● Visibility, credibility, attractivity
→ We work on world-class projects
→ Editors & communities share the credit : blog
articles, citations in conferences, twitter...
→ Our engineers talk at JavaOne, Devoxx...
27/10/2011 Jérôme PETIT
12. Impact on business
● It is easier to convince new customers to come
● We also gain new spontaneous customers
27/10/2011 Jérôme PETIT
13. Impact on business
● Cutting-edge visible contribution allows to gain
new business cases & higher-end missions
● New business cases : implementing features
editor's customers are asking for
→ Sonar i18n is sponsorized by customers,
managed by SonarSource, developed by SERLI
27/10/2011 Jérôme PETIT
14. Impact on business
● People involved once in a visible OSS
contribution have a quite full agenda
27/10/2011 Jérôme PETIT
15. Impact on business
SERLI evolution, from 2005 to 2010 :
● Total revenue : 1850 K€ → 4150 K€
● Java revenue : 10% → 80%
● New deals : classical solicitation → spontaneaous
demand
27/10/2011 Jérôme PETIT
23. Impact on humans
● OSS development is a school of quality &
transparency
● People learn different engineering cultures
● Developers can realize their potential
● Shy people can become brillant orators
→ OSS contributors become better professionals
27/10/2011 Jérôme PETIT
25. Virtuous circle(s)
Contribution
Credit
Visibility High-end recruitment
Revenue++
Skills++
High-end missions
New customers
27/10/2011 Jérôme PETIT
26. Virtuous circle(s)
Contribution
Business ++ Quality ++
Credit
Visibility High-end recruitment
Revenue++
Skills++
High-end missions
New customers
27/10/2011 Jérôme PETIT
27. Sustainability of the model
● Keep good balance between business &
contribution
● Avoid developer overload (super-heroe myth)
● Deliver the right software at the right time :
contribution has to be well-managed
27/10/2011 Jérôme PETIT
28. A few things I would like to share
● Challenging core features are the best choice :
they give adrenaline & credibility... if you are
good :)
● Manage contribution as any other project in the
company... or the inverse
● Check that developers do not forget to sleep
27/10/2011 Jérôme PETIT
29. A few things I would like to share
● Community managers & project leaders are
COOL
● Give all that you can : 100x returns guaranteed
27/10/2011 Jérôme PETIT
30. Acknowledgements
● JOnAS team, Benoît Pelletier, Florent Benoît, Jacques
Cayuela, Guillaume Sauthier & all the Grenoble gang
● GlassFish team : Alexis Moussine-Pouchkine, Hong Zhang,
Jérôme Dochez, Tim Quinn & so many others
● Anil Gaur, VP Java Platform @Oracle
● JBoss guys : Emmanuel Bernard, Pete Muir, Ales Justin,
Gavin King
● Selenium folks from Google & Saucelabs
● Olivier Gaudin from SonarSource
● The whole SERLI team
27/10/2011 Jérôme PETIT