<div class="embed-responsive embed-responsive-16by9">
<iframe src="https://player.vimeo.com/video/508907191" width="640" height="480" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe></div>

Join GitHub and panelists from Red Hat, Lightstep, and RedMonk as we explore the future of DevOps, from developer experience and automation to security and compliance.

We’ll answer questions like:

- What changes and trends have we seen in the way teams, customers, and the community collaborate to build faster, more stable software?
- How has “shifting security left” expanded beyond security, and what does it mean for teams, customers, and how we work?
- How is open source changing the way teams secure and deliver their software, and how should teams assess their approach to open source solutions?

Form_Ungated_Contact

Tell us more about your needs

Wondering how GitHub can help your business?

The goal of DevOps has stayed the same, but our tools, infrastructure, and operating models have changed. To support modern software delivery, it’s critical for organizations to know and prepare for what’s coming next.

Resource Page for /devops/fundamentals/whats-next-for-devops

CO-GHG-CONTACT-FY23-10Oct-01-WW-Resources-Contact-Request/406214

What's next for DevOps?

Este programa es una iniciativa especial de GitHub en colaboración con Microsoft AI for Good Lab, destinada a capacitar a la próxima generación de desarrolladores con herramientas esenciales y conocimientos de vanguardia. 💡

Durante dos sesiones interactivas, explorarás el mundo del control de versiones con Git y GitHub, además de descubrir las fascinantes posibilidades de la inteligencia artificial en la programación con GitHub Copilot. 🤖

Ya seas estudiante, desarrollador principiante o profesional buscando actualizar tus habilidades, estas sesiones te ofrecerán conocimientos valiosos y experiencias prácticas. 🚀

🌟 ¡Bienvenidos a Git Commit 101, una serie de eventos virtuales emocionantes diseñados para fortalecer tus habilidades en desarrollo de software! 🖥️



gitcommit

Resource Page for events/gitcommit

GitCommit 2024 

## Keynotes
Open to all registered attendees, our keynote addresses feature inspirational and visionary thought leaders from academia and industry. We are pleased to welcome Anne-Marie Imafidon (one of Forbes Magazine's top 50 women in tech globally), Muzlifah Haniffa (Interim Head of Cellular Genetics at the Wellcome Sanger Institute), and Martin Sharkey (founder and CEO of CloudKubed) to speak at RSECon24.

## Programme
RSECon aims to deliver a relevant, inclusive, and engaging conference experience for the RSE community, featuring a balanced and varied programme that caters to all roles and skill levels. We are committed to creating an environment where individuals from diverse backgrounds can fully participate and contribute.

## Networking
We’re hosting a series of enjoyable and relaxed social events and activities designed to help you mingle and network with friends and colleagues from the community.

## Community Awards
We’d like to recognise three amazing people for their outstanding contribution to the RSE Community in the past 12 months. The categories are : Impact, Rising Star, and Training & Education.

The international Research Software Engineering community convenes for an exciting week of sessions, speakers, and networking. I will bring together a mix of hundreds of engineers, developers, researchers, community managers, funders and educators on a shared journey of learning and growth.

RSEC Conf 2024 Hero

Resource Page for /events/rsec2024

Research Software Engineering Conference 2024

SOSS Community Days are held regionally, alongside the Open Source Summits and were formerly called OpenSSF Days. The change in name reflects the need to capture the broader interest in the security of open source software. What’s in the SOSS? Come to a Community Day to find out! Brought to you by OpenSSF.

Secure Open Source Software (SOSS) Community Days are an opportunity for Community Members from across the Security and Open Source ecosystem to get together and share ideas and progress on capabilities that make it easier to sustainably secure the development, maintenance, and consumption of the open source software (OSS) we all depend on.

Secure Open Source Software (SOSS) Community Days are an opportunity for Community Members from across the Security and Open Source ecosystem to get together and share ideas and progress on capabilities that make it easier to sustainably secure the development, maintenance, and consumption of the open source software (OSS) we all depend on. SOSS Community Days are held regionally, alongside the Open Source Summits and were formerly called OpenSSF Days. The change in name reflects the need to capture the broader interest in the security of open source software. What’s in the SOSS? Come to a Community Day to find out! Brought to you by OpenSSF.

SOSS Community Day Europe

Resource Page for /events/soss-community-day-eu-2024

/github-fund Hero

/github-fund Content blocks - value props

/github-fund Section Intro - Investment Themes

/github-fund Blocks - Investment Themes

/github-fund Section intro - portfolio

/github-fund Content Blocks - portfolio 1

/github-fund Content Blocks - portfolio 2

/github-fund Section intro - Updates

/github-fund Content Blocks - Updates

/github-fund Quote

/github-fund Section intro - Let's invest in open source together

/github-fund form

/github-fund FAQ

/github-fund

Research shows that enterprise software teams are twice as productive when they contribute to open source projects compared to teams who only consume open source code. Like every community, open source projects have unique ways of working—including a few important things to know before you start building.

## Getting to know the open source community

- Look through your software stack for open source code and identify the project it originated from.
- Find that project’s primary community (website, forum, or repository, for example) and try to get an understanding of their goals and future roadmap.
- Read the project’s README and CONTRIBUTING files for guidance on how to participate effectively.

## Supporting open source projects
- Explore open source projects in your preferred programming language; look for projects that both interest you and align with your organization’s strategy.
- Review your business’s open source investments and pick the most critical projects to support, which could include contributing time, effort, or
even financial assistance.

## Creating your own open source projects

- Identify non-proprietary, non-business-critical software your company has developed that could benefit the greater community as open source.
- Create and share your open source projects on GitHub.
- Announce your open source projects through your usual public-facing channels and in any open source communities that might find them interesting.

## Collaborating on GitHub

- Subscribe to repository notifications to stay up to date on changes.
- Read and comment on issues, or open a new one when you have something helpful to offer.
- If you have solutions to problems posed by the community, suggest them with pull requests.
- If you’ve made local improvements to open source code, contribute them back upstream to their source projects.
- Use the “-on-behalf-of” commit tag when contributing back to open source projects to indicate your organization’s support.
- Standardize your open source library usage as much as possible for easier maintenance and reduced exposure to vulnerable code.

When your team uses open source software (OSS), everyone benefits, but how much is up to you.

Resource Page for /open-source/enterprise-checklist-open-source-communities

The enterprise checklist for building with open source communities


For high-performing organizations, that means open source software is now a “when,” not an “if.”

In this IDC report, you’ll learn how open source code and communities drive digital transformation. You’ll also learn how GitHub can help your business use open source securely and adopt best practices like peer reviews, transparency, and collaboration that can move your software forward.


form-content-reg

Today, every company is a software company. Staying competitive depends on how fast your business can transform—and embrace new tools and technology.

Resource Page for /open-source/enterprise-innovation

CO-GHDO-CNTNT-FY20-10Oct-01-IDC-Report-Open-Source-Enterprise-Innovation/408033

IDC report: How open source is the key to innovation in the enterprise


Just as Microsoft Corp.’s acquisition of GitHub solidified the code-hosting service’s place in the software development world, GitHub’s recent announcement that its Enterprise Cloud has achieved FedRAMP authorization delivers, for the first time, a way for government agencies to securely participate in the entire open source development universe.

Traditionally, federal users have leveraged GitHub’s team plan or GitHub Enterprise Server platform by hosting it on-premises or in their own private cloud. GitHub Enterprise Cloud, which resides entirely in the cloud, has been available for the past year. It offers the ability to use single sign-on and a secondary identity provider (including government PIV and CAC cards) and includes expanded support and service level agreements.

“We have historically had [government] customers on GitHub.com, but they were either doing it as shadow IT under a team plan or non-mission critical systems. Because GitHub.com did not have an ATO [authority to operate] it was never deemed appropriate for most organizations’ day-to-day mission-critical applications,” said Jamie Jones, GitHub principal architect.

That changed in October, with GitHub achieving FedRAMP operating authority under a relatively new process called FedRAMP Tailored, which provides a more streamlined security approval process that is better suited for softwareas-a-service providers such as GitHub. “We’re now giving them a place where they can do this in the cloud on GitHub managed and hosted hardware,” said Jones.

The features on GitHub Enterprise Cloud are quickly gaining parity with, and in some cases exceeding, the features of GitHub’s Enterprise Server, its on-premises offering. But the big advantage of switching to GitHub Enterprise Cloud is it will give agencies of all sizes access to the entire GitHub universe of open source development and collaboration resources — and the vast community of developers contributing to those resources.

> We’re now giving them a place where they can do this in the cloud on GitHub managed and hosted hardware

<small>- Jamie Jones</small>

“In the average software product developed today, more than 57 percent of the code within it is actually open source or code that comes from other projects,” said Jones. “It’s become critical for modern software to be able to collaborate with the open source marketplace.”

And the size of that marketplace is mind-boggling. At its most recent annual user and developer conference, GitHub announced it has more than 31 million users currently on GitHub.com. Now, agencies that were once confined to operating within an enterprise GitHub community (anywhere from a handful to a few thousand developers) have access to a much larger code base and talent pool.

Governments all over the world are using GitHub. At last count, 143 U.S. federal civilian agencies, 14 Department of Defense agencies and 48 state agencies were leveraging GitHub to collaborate on code, data, policy and procurement, according to GitHub figures. In addition to the platform’s 31 million users, the number of organizations on it has jumped 40 percent to 2.1 million, as has the number of code repositories, which now stands at more than 100 million.

> At last count, 143 U.S. federal civilian agencies, 14 Department of Defense agencies and 48 state agencies were leveraging GitHub to collaborate on code, data, policy and procurement

<small>- Jamie Jones</small>

## FedRAMP Tailored

GitHub is among the first cloud service providers to take advantage of FedRAMP Tailored. FedRAMP was originally aimed at helping agencies certify that a cloud computing service met a long list of federally mandated security controls. The idea was that other agencies, once certified, could adopt that same service without repeating the same certification process. But the process was time-consuming, expensive and targeted initially toward infrastructure-asa-service (IaaS) and platform-as-a-service (PaaS) providers — in other words, the traditional large cloud providers like AWS, Google, IBM, Microsoft and others.

The FedRAMP Program Office within the General Service Administration, however, recognized an opportunity to finetune FedRAMP specifically for software-as-a-service (SaaS) providers that handle low-risk, low-impact data and aren’t responsible for a host of network security controls.

According to Ashley Mahan, acting director of the FedRAMP Program Office, the FedRAMP Tailored assessment process focuses only on a subset of the NIST 800-53 technical controls and places a greater focus on policies, procedures and training surrounding the management and use of public or non-sensitive data.

“What that does is it affords for a fast and efficient authorization process that lessens a vendor’s time to market and really speeds up the timelines on when an agency can make use of these innovative cloud technologies,” Mahan said.

That put the economics of FedRAMP operating authority within reach for GitHub for the first time, according to Jones. But it also opens the door for agencies to work with a wider range of software-as-a-service providers.

“FedRAMP Tailored was really developed as a way for SaaS solutions, such as GitHub, to get a FedRAMP authorization so that they could be easily consumed by the federal government while taking into account the appropriate security these systems require, as opposed to the traditional cloud providers,” said Jones.

Agencies can now simply go to the FedRAMP marketplace and pull down the authorization to begin using the platform with confidence that it meets the baseline security requirements established by the government for SaaS. “For some agencies it can reduce the time it takes to receive an ATO to mere minutes,” said Jones.

> One key benefit of using the FedRAMPauthorized Enterprise Cloud is we can now support your agency’s identification and authorization tools

<small>- Jamie Jones</small>

## The Business case

According to Jones, there is no reason for an agency that is currently using GitHub under a team or enterprise license not to move up to the FedRAMP-authorized Enterprise Cloud version — and in most circumstances, there are a number of advantages.

“One key benefit of using the FedRAMP-authorized Enterprise Cloud is we can now support your agency’s identification and authorization tools,” he said. “For the extra capabilities we are providing, including faster support requests or the ability to use SAML and your external identity providers, it’s far less of an administrative burden,” said Jones.

The FedRAMP-authorized GitHub Enterprise Cloud also offers enhanced security services and features that are not yet available for Enterprise customers.

For example, GitHub recently rolled out a vulnerability alert service. It began last year through a collaboration with the National Vulnerability Database to provide alerts directly through the FedRAMP-authorized GitHub Enterprise Cloud for vulnerabilities in Ruby, JavaScript, Python, Java and .Net. GitHub has identified more than 4 million vulnerable dependencies and has resolved more than 1 million of those during the past year.

If GitHub finds that you are using a library with a known vulnerability, the alert service will flag it for you and alert the repository administrators. GitHub will even alert the developers to potential upgrades that are known to fix the vulnerability, said Jones.

Offering increased security and vulnerability protections will translate into enhanced business speed for government agencies, according to Jones.

“We’ve all heard stories about how when government staff or contractors get hired and it’s days or weeks before they have access to the proper hardware and systems to even start working on their jobs. But by being able to access GitHub from the Internet, rather than behind an agency firewall, and still be able to use it in a secure and compliant way, this should allow agency users to get up to speed and working faster,” he said.

“Traditionally, we’ve seen great uptake in use of GitHub Enterprise Server, which is the on-premises version of GitHub,” Jones said. “But we’re hoping that the FedRAMP authorization for Enterprise Cloud will really allow our federal customers to take advantage of SaaS and GitHub running on the internet and in the cloud.”

> Making the move from GitHub Enterprise Server to the GitHub Enterprise Cloud happens seamlessly behind the scenes

<small>- Jamie Jones</small>

Making the move from GitHub Enterprise Server to the GitHub Enterprise Cloud “happens seamlessly behind the scenes,” said Jones. “As you move over to Enterprise Cloud, the key advantage is you’re able to move a lot of the infrastructure and workload into the cloud, which helps you meet the cloud-first mandate,” he said.



By achieving FedRAMP operating authority, GitHub’s Enterprise Cloud allows federal users to collaborate with millions of open source software developers.

Resource Page for /open-source/federal-access-open-source

Federal access to open source with GitHub


In this guide, you’ll learn what makes up an open source enterprise and the three key factors your team needs to build securely with OSS. Find out how you can use OSS to experience rapid innovation, outpace competitors, and cut down costs—all while minimizing risk.

## The new way to build software

Nearly every industry today uses technology to differentiate their products and services. Software has become the great equalizer—allowing small companies with big ideas to challenge the status quo and compete against major corporations.

Developers turn to the open source community for the resources they need to build better software, faster. However, enterprises have been more cautious, typically limiting open source adoption to proven areas like operating systems (Linux) or programming frameworks such as Ruby or JavaScript.

> 59 percent of IT leaders plan to increase their use of open source code in the next year.

<small>“The State of Enterprise Open Source” 2019 report</small>

## How organizations make the change

Maximum innovation, minimal risk: that’s the goal of adopting open source. By adding an open source software (OSS) component to your project, you benefit from the work of potentially thousands of developers—and also take on the risk of consuming code you didn’t create. As you bring in more code from outside your development team, your skills and approach to building software must also change.

Change is hard. Most enterprises aren’t used to working with external communities or even working across their own organizational silos. The ones who embrace change and build balanced, secure relationships with the OSS community become a new type of organization: open source enterprises.

## What is an open source enterprise?

Open source enterprises are organizations that recognize OSS as essential, not optional, for modern software development. They engage in open source communities and keep up with the best and latest technology. Open source enterprises transform their businesses by strategically investing in open source with the help of a secure platform. As a result, these organizations experience rapid innovation, outpace competitors, and cut down costs—all while minimizing risk.

## Three factors that make an open source enterprise

### 1. Open source engagement

OSS is the product of thousands of contributors. Getting the most out of open source requires commitment and action. According to a recent study by Harvard Business School, companies who contribute to open source receive up to twice the benefit of those who just use open source code. Open source enterprises consume and adopt open source, but also contribute to and mentor the communities they depend on.

### 2. Innersource culture

Open source communities are transparent and collaborative, which increases diversity of thought and promotes the best ideas. Open source enterprises use these same principles with their teams internally—an approach known as “innersource.” By implementing open source practices in your organization, you optimize your workforce and increase your output.

### 3. Secure and compliant platform

Open source usage comes with risks, and teams need to know how to work safely with OSS suppliers. Understanding open source dependencies and their vulnerabilities can be the difference between being patched or hacked. Open source enterprises invest in the right platform and tools to manage code vulnerabilities and use open source securely.


How large organizations use open source to build better software, faster.

Resource Page for /open-source/quick-guide-to-open-source-enterprises

The quick guide to open source enterprises

Open source software is the essential building block for any modern software project. Consuming open source securely and contributing back to the community have invaluable benefits at individual and organizational levels.<br><br>Join our fireside chat with IAG, Woolworths and GitHub experts as we discuss the pillars of a successful open source strategy including DevOps and security.

Resource Page for /open-source/secure-devops

Fireside Chat: Unleash the power of open source securely

/open-source/what-is-an-open-source-program-office Hero

/open-source/what-is-an-open-source-program-office River

/open-source/what-is-an-open-source-program-office Quote

/open-source/what-is-an-open-source-program-office Section Intro - Why are OSPOs beneficial?

/open-source/what-is-an-open-source-program-office - Content Blocks - Why are OSPOs beneficial?

/open-source/what-is-an-open-source-program-office - Section Intro - Top OSPOs

/open-source/what-is-an-open-source-program-office - Content Blocks - Top OSPOs

/open-source/what-is-an-open-source-program-office Section Intro - GitHub’s latest news on OSPOs

/open-source/what-is-an-open-source-program-office - Cards - GitHub’s latest news on OSPOs

/open-source/what-is-an-open-source-program-office Section Intro - Get involved

/open-source/what-is-an-open-source-program-office - Content Blocks - Get Involved

/open-source/what-is-an-open-source-program-office FAQ

/open-source/what-is-an-open-source-program-office CTA Banner

Landing Page for /open-source/what-is-an-open-source-program-office

/open-source/what-is-open-source-software Hero

/open-source/what-is-open-source-software Nav

/open-source/what-is-open-source-software Prose - overview

/open-source/what-is-open-source-software Prose - importance

/open-source/what-is-open-source-software Prose - how-does-it-work

SEO River - interrupt - GitHub’s DevOps Solution

/open-source/what-is-open-source-software Prose - popular-software

/open-source/what-is-open-source-software CTA Banner

/open-source/what-is-open-source-software FAQ

/open-source/what-is-open-source-software


Is your organization ready to use open source software securely? Here are seven questions to ask (and answer) to keep your team and your code safe.

## 1. Is there an approval process to help developers introduce new open source software (OSS) into our organization?

To keep up with the volume of OSS code, larger organizations often have <a href="https://resources.github.com/whitepapers/How-GitHub-secures-open-source-software/">open source</a> program offices to help them maintain company policies while using OSS. Work with your organization’s legal team to create an official approval process for contributing to OSS projects.

## 2. Does our organization have a list of pre-approved OSS licenses, so developers know which OSS they can use in proprietary software?

Open source licenses set the rules and guidelines for how OSS projects can be viewed, used, modified, and distributed—even in proprietary software. That doesn’t mean you can’t use any OSS in proprietary code; just confirm the OSS you use has the right license for your application’s goals and organization’s policies.

## 3. Can we easily audit dependencies, licenses, and other important information for the open source projects our organization will use?

Ignoring your organization’s compliance policies only creates future vulnerability or licensing problems. Automate compliance workflows now by building in process gates with required statuses and other code checks.

## 4. Does my team have a plan and tools for identifying and fixing vulnerable components?

Up to [70 percent](https://www.synopsys.com/content/dam/synopsys/sig-assets/reports/rep-ossra-19.pdf) of new software projects depend on open source code. Code reuse helps everyone build better software faster, but it also puts us all at risk of distributing security vulnerabilities. Make sure your developers have the tools they need to identify vulnerabilities and patch vulnerable code quickly.

## 5. Does my team use tools like token scanning to make sure highly sensitive credentials aren’t accidentally pushed to public repositories?

Even the most security-minded organizations eventually make a mistake. Protect your team from accidentally leaking secrets with tools that scan commits as they’re shared and proactively invalidate credentials before they can be compromised.

## 6. Do we have a private registry of software packages that are safe to use within our organization?

When you consume an open source package, it’s important to trust and understand the code. Use a package registry to quickly find what’s been approved for your organization’s repositories—and easily store packages in the same secure environment as your source code.

## 7. Do I have a way to validate users’ identities so that only my team is committing code to our projects, including signed commits?

Building with open source code means adding thousands of external developers to your team. Whether you’re collaborating on public or private projects, work with your identity provider to always verify certain commits and tags as coming from your organization.

### How did you do?

Did you answer “no” or “maybe” to any of the questions above? Your team may still have a few security changes to make before using open source software.


Open source helps enterprise teams build better software, faster—but also comes with unique risks and challenges.

Open Source

What's next for DevOps?

GitCommit 2024

Research Software Engineering Conference 2024

SOSS Community Day Europe

Funding the next generation of open source software

The enterprise checklist for building with open source communities

IDC report: How open source is the key to innovation in the enterprise

Federal access to open source with GitHub

The quick guide to open source enterprises

Fireside Chat: Unleash the power of open source securely

What is an Open Source Program Office (OSPO)?

What is Open Source Software (OSS)?

Seven questions to ask before using open source software at work