FinJS London 2016 brings together thought leaders in the fintech, financial services and development spaces. The Foundation's presentation, titled "Leveraging open source in the development process to maximize security, compliance and quality," can be found here for your reference.

1. Leveraging open source in the dev
process to maximize security, compliance
& quality
December 7th, FinJS London
Maurizio Pillitu
Devops Director, Symphony Software Foundation
@maoo maoo@symphony.foundation

2. What is Symphony

3. • Stewardship of Symphony open core
• Hosts Symphony community projects
• Fosters an open ecosystem
• Delivers Symphony as commercial
SaaS
• Supports Symphony open core
• Main contributor to the Symphony
Software Foundation (for now!)
Foundation & Corporation

4. https://www.blackducksoftware.com/2016-future-of-open-source
65%
Consumption
+5% from 2015
65%
Contribution
+2% from 2015
33%
Commitment
50%
Compliance
2016 - Future of is Open Source
Download, run, test, deploy
code publicly available (to
production?)
Open issues, send patches,
join mailing-list discussions
Commit dedicated
resources to Open
Source development
Define formal policies for
selecting and approving
Open Source code

5. Consumption Contribution
Your journey to Open Source
“Deliver enterprise-ready
software that adheres to
quality, security and legal
standards imposed by
highly-regulated industry”
“Navigate through the
OSS software offerings;
assess, test, run, then
choose”

6. Decomposing Compliance
Metrics and
KPIs
Metrics are defined across
3 macro areas; KPIs define
the way metrics are
measured
Measurement
and automation
Measurements are
(preferably automated)
processes that return KPI
values for each metric

7. Legal
IP cleanliness,
outbound license
consistency, ...
Security
CVE free, OWASP guidelines, ...
Quality
Project liveliness,
documentation, test
coverage, ...
Metrics examples
https://symphonyoss.atlassian.net/wiki

8. Metric trends for the past
and roadmap for the
future
Stats Docs
Which metrics are
checked and what’s the
current score
Badges
Project green lights
Publish clear instructions
to simplify consumption
Incubating Active Archived
Project Lifecycle

9. runtime
platform-specific
License compatibility
production
Measurements...
run

10. myget
Travis CI
Atlassian Cloud
Nodesecurity
… and automation

11. Advanced challenges
• Limits on hosted projects and/or collaborators
• API rate limits
• Custom metrics and measurements
• Hosted and SaaS hybrid build systems
• Secrets management
• Multi-platform and multi-ecosystem

12. Filling the gap
between
Compliance and
Consumption
Consumers
● Badges, stats and docs
● High quality, secure, compliant software
● Access to the community
Contributors
● Best of breed Infrastructure
● Metrics, KPIs and automation
● Exposure through the community

13. Questions?
Maurizio Pillitu
Devops Director, Symphony Software Foundation
@maoo maoo@symphony.foundation
● https://blog.symphony.foundation
● https://symphonyoss.atlassian.net/wiki
symphonyoss on