Check our datasheets, events and webinars to get new ideas

Once again, we’ve compiled aggregate Revenera Compliance Intelligence data to produce our annual list of the Top 20 Software License Misuse and Piracy Hotspots around the globe. If you’re not familiar, Compliance Intelligence enables software suppliers to detect, identify and report on the unlicensed use of their applications…

Blog

What’s Trending with SBOMs, Developers, and Code Scanning

Those involved in the world of software development are used to continuous change, high expectations, and industry interruptions that require constant pivoting, but the last couple of years have challenged the most stalwart of professionals. There was the pandemic beginning in 2020 that may have long-lasting impact. In 2021, we…

Blog

Pursuing Software Piracy Claims in China

There are many misconceptions about intellectual property protections in China, the processes for seeking redress, and the likelihood of success. My colleague Vic DeMarines, VP, Product Management for Software Monetization, and I recently welcomed Chris Bailey, a Principal at Rouse, and Landy Jiang, a Partner at Lusheng, (Rouse’s network law…

Blog

The CFO’s Role in Growing Company Revenue and Overall Valuation

The way a company monetizes its software has a huge impact on business success, growth and profitability. CFOs and financial leaders strive to make their software companies even more successful and set them up for growth. Moving away from one-time perpetual license sales to recurring revenue models, as well as…

Blog

Spring4Shell: Deep breath. Don’t panic. Mitigate.

Development and security teams, software creators, and companies alike were hit once again with another vulnerability when news made its way online of a disclosure of a PoC for an unauthenticated zero-day vulnerability in Spring Core. The disclosure of CVE-2022-22965—nicknamed Spring4Shell—is an RCE vulnerability in one of the most popular…

Blog

Log4j: Come out, come out wherever you are!

On December 10th, 2021, a critical vulnerability was found in Log4j. It impacts almost every organization which develops applications in Java, or that uses third-party software. Vulnerabilities get discovered every day. However, due to the impact and widespread use of log4j, this vulnerability is driving a serious discussion on the…

Blog

Open Source: Trouble because of sudden license changes

Open Source does not mean that the use of the code is allowed without any restriction: The use is subject to conditions which are formulated by the author (copyright holder) in the form of a license. Recently, Bitsea observed some Open Source projects maintained by commercial companies have changed their…

Blog

The story behind colors.js and faker.js

The bizarre case of the author who corrupted his own npm packages – colors.js and faker.js. Originally reported by Bleeping Computer on Jan 9th the author of npm packages colors.js and faker.js, Marak Squires, has intentionally committed corrupt versions of each to his public GitHub repositories that trigger infinite loops…

Blog

The FTC’s warning to companies about the failure to protect against open source vulnerabilities

In direct response to the Log4j vulnerability, the United States Federal Trade Commission published an alert. Net? If your company does not take proactive steps to prepare for future vulnerabilities like Log4Shell, not only do you risk legal and financial damage to your business because of hacks and data breaches,…

Blog

Software Entitlement Management – A key component in Enterprise IT Applications Ecosystem

Software producers often wonder whether they need a dedicated back-office application to facilitate software licensing and software entitlement management for the applications they sell in the marketplace. This blog explains where software entitlement management fits within an application producer’s IT portfolio. Implementing an entitlement management system There is no denying…

Blog

Software supply-chain vulnerabilities: A close look on code

Vulnerabilities that affect the supply chain of software and its distribution are easily among the most terrifying experiences any company involved must endure. Such vulnerabilities typically affect a wide range of different parties who use the affected software or parts thereof and who may distribute them further down the road.…

Blog

What you need to know about the Log4j security vulnerability

If you’re not scrambling to contain and fix this vulnerability, do so now. It’s a doozy folks! Every organization using third-party software or developing custom applications with the Java programming language is potentially impacted. All current versions of log4j2 up to 2.14.1 are vulnerable. Log4j is a very popular logging…

Blog

When is the right time to conduct an open source audit?

No matter what industry you are in, your company’s code most definitely contains code from someone else. Today’s software is not written from scratch, but rather assembled from parts. These parts mostly originate from open source software that’s freely available from the internet. However, your awareness should not be limited…

Blog

Field Notes: Understanding GPL Linking Exceptions

Notes from the Field: SCA Analysts and Code Insight Product Trainers talk Observations, Trends and Findings. I find the subject of GPL Linking Exceptions resurfacing often, whether I’m on a SBOM review call with an audit client, advising on Remediation Practices and open source license policy creation, or simply refreshing…

Blog

Build Your Next Software Installation in the Cloud

The global pandemic’s impact on business continues to surface in both small and big ways, including security issues, work-from-home challenges, reopening approaches, and profit losses. Because of this new normal many organizations are engaging in strategies to migrate to the cloud and more seriously consider paths to digital transformation. For…

Blog

How developers can drive open source compliance

Perhaps you’ve seen the delightfully clever new ad for the iPhone and Apple Watch integration, in which a farmer taps a button on his watch that then signals his phone, lost in a huge haystack, to beep. He reaches in and finds it in seconds. Pre-Apple Watch, we might characterize…

Blog

Automation is King. Good News for Today’s Software Development Teams.

When most of us want to leave 2020 behind as a year of unquestionable struggle, we can’t ignore the impact it’s had, specifically on the need for organizations to step up their efforts to meet changing digital transformation requirements. We’ve been talking about it for a while. You may think…

Blog

Will your customers want proof of a secure software supply chain?

A little more than a week before the Colonial Pipeline attack, two government agencies issued an overview and guidance on how software buyers and vendors could identify, assess and mitigate software supply chain risks. In that 16-page document, “Defending Against Software Supply Chain Attacks” the National Institute of Standards and…