How to Stop a Security Vulnerability From Happening Again

Remember: you can also always follow the show on Twitter @dotnetcoreshow, and the shows host on Twitter @podcasterJay or visit our Contact page.

Welcome to season 5 of the award-winning .NET Core Podcast! Check that link for proof.

Hello everyone and welcome to THE .NET Core Podcast. An award-winning podcast where we reach into the core of the .NET technology stack and, with the help of the .NET community, present you with the information that you need in order to grok the many moving parts of one of the biggest cross-platform, multi-application frameworks on the planet.

Software maintenance is an integral part of any software development project, but it can often be neglected, leading to a range of problems down the line. M. Scott Ford, the co-founder, chief code whisperer, and CTO of CorgyBytes, is passionate about helping teams make improvements to their existing software systems rather than throwing them away and starting from scratch. In this episode of The .NET Core Podcast, Ford and Jamie discussed the challenges of maintaining software and some of the tools they use to make it easier.

One of the tools they discussed was Freshli, a tool that visualizes tech debt and shows how difficult a codebase is to work with. It tracks the age of dependencies and can help identify potential risks before they become major problems. They also discussed the Equifax hack from 2017, which was caused by a single outdated dependency. This highlights the importance of keeping dependencies up to date and the potential risks of neglecting them.

The conversation also touched on the need for more spaces for developers to meet up and exchange ideas and feedback. Ford and Taylor believe that the real nuggets of information are shared in the conversations that happen between talks or at the pub afterwards, and that these sessions allow people to do that organically.

One key takeaway from the discussion was the idea of making small, incremental improvements to a project rather than trying to fix everything at once. This approach is similar to a sports team focusing on individual attributes to improve overall performance. It can be more manageable and less overwhelming for a team to make small changes rather than trying to tackle everything at once.

The podcast also highlighted the challenge of dependencies becoming out of date and the importance of tracking and updating them regularly to reduce risk. Ford and Taylor discussed the use of dependency freshness metrics, specifically the libyear metric, to track the age of dependencies and how it changes over time. This metric can be used to communicate the level of risk a development team is carrying to leadership.

Overall, the conversation in this episode sheds light on the importance of software maintenance and the tools available to make it easier. Outdated dependencies in software projects can have a significant impact on productivity and security, but it is often an invisible problem that goes unnoticed by leadership. By implementing tools like Freshli and tracking the age of dependencies, teams can reduce the potential risks and make software maintenance more manageable.

The full show notes, including links to some of the things we discussed and a full transcription of this episode, can be found at https://dotnetcore.show/episode-124-breaking-up-with-tech-debt-a-love-story-with-m-scott-ford/

Useful Links from the episode:

• The .NET Core Podcast Discord Server
• Part one of my discussion with M. Scott Ford
• CorgyBytes
• Legacy Code Rocks
  • Legacy Code Rocks on Mastadon
• MenderCon
• libyear
• Measuring Dependency Freshness in Software Systems
• FrequencyReducesDifficulty by Martin Fowler
• Freshli
  • https://freshli.app/
  • https://freshli.io/
  • https://github.com/corgibytes
• Software bill materials
• Ruby Gems
• PyPy
• https://owasp.org/www-project-cyclonedx/

Remember to rate and review the show on Apple Podcasts, Podchaser, or wherever you find your podcasts, this will help the show's audience grow. Or you can just share the show with a friend.

And don't forget to reach out via our Contact page. We're very interested in your opinion of the show, so please get in touch.

You can support the show by making a monthly donation on the show's Patreon page at: https://www.patreon.com/TheDotNetCorePodcast