A Year of Open Source (2016)
Known for his open source and JavaScript security initiatives, Liran Tal is an award-winning software developer, security researcher, and open source champion in the JavaScript community. He's an internationally recognized GitHub Star, acknowledged for his open source advocacy, and has received the OpenJS Foundation's Pathfinder for Security for his work on Node.js security. His contributions to developer security education include leading OWASP projects, building supply chain security tools, participation in CNCF and OpenSSF initiatives, and authoring books such as O'Reilly's Serverless Security. He leads the developer advocacy team at Snyk.io and is on a mission to empower developers with better application security skills.
Nov 1, 2016 ~ 4 min read
A Year of Open Source (2016)
share this story on
We recently celebrated Rosh Hashana, which is the Jewish New Year, so obviously a lot of self examination which translate to us engineers as a Retrospective.
This year has been yet another wonderful engagement with open source communities for me. So many new technologies, and many more repositories that I contributed to and new projects I started.
Here are some highlights of this year for me:
Speaking
Public speaking isn’t natural to me since I’m a classic introvert, but lucky for me we have Morad Stern in HPE, who manages the developer communities, and supported me to take this step.
The previous year I did local meetups but this year was exceptional in order of magnitude:
- The amazing Paul Brie and Amalia Pomian invited me to speak about Open Source and the JavaScript MEAN Stack in hello.js conference that turned out to host an overwhelming 300 participants. I made a lot of great friends and was immediately hooked to the vibe and attitude of the Cluj people in Romania.
- Morad landed GitHub own heroes David Newman and Aziz Shamim for a hosted public GitHub Day event where I was speaking on similar topics.
- With a lot of respect to the security community in Israel, I was also invited to speak at OWASP AppSec about Node.js Security with a great crowed and much interest in the hands-on session.
I can’t stress enough how important it is to take part in speaking at meetups and conferences. It’s an amazing experience to spread the knowledge and connect about many ideas with other speakers.
As Nike say, Just do it!
Open Source Fun
I’ve been in love with open source since my early youth. The community, the people, the openness and collaboration is magical.
Stressing another important topic — the value of side projects and contribution to open source.
MEAN.JS
Those whom are following me know that I’m passionately maintaining the wonderful and lean MEAN.JS framework. This year we’ve done so much, such as:
- The release of MEAN.JS 0.5.0
- Closing hundreds of PRs and Issues (some were much outdated)
- All dependencies are up to date and secure with Snyk.io reporting zero vulnerabilities and Bithound scores 91 for dependency analysis.
Security
In this yearly OWASP AppSec IL 2016 I spoke about Node.js Security with live demo and many accompanying source code and documentation on how to get it right for Node.js web developers.
I also created gulp-mraudit which is a small gulp plugin to scan your project for insecure source code and alert when best practices aren’t taken into account. It mainly conveys the importance of security as part of your CI process.
ES5, Babel, Webpack
Today’s JavaScript ecosystem heavily relies on many frameworks and tools to package web, mobile and desktop applications.
I took the plunge to keep up just like everyone else. It’s much more fun when you practically use them in real world projects so:
- I joined up Deepak to update and migrate to ES5 his PDF-To-Text Node.js library.
- Writing a few articles (stay tuned!)
Angular2
Angular2 was officially released (finally! phew).
If you plan on also keeping up with that I recommend going for the angular-cli generator project as it is kept up to date with Angular2 best practices, project structure, and general updates.
My recent fun Angular2 projects:
- CRON Quartz Web — it’s a web based conversion utility that is based on my cron-to-quartz Node.js package.
- AtomBundles — Not yet live, but it’s my next upcoming web project for easily picking up a collection of Atom packages for your favorite programming platorm. How cool is that? So help me out with PRs: https://github.com/lirantal/atombundles
daloRADIUS
You would think that a project I built a decade ago for managing WiFi Hotspots, and FreeRADIUS would be obsolete by now but this is hardly the case.
The daloRADIUS community is still kicking with over a weekly 1300 downloads and a total of ~350,000 downloads of this niche piece of web software I wrote when I just started out taking the web seriously.
I now manage the project source code in GitHub and there has been some reviving recent activity there:
- PHP 7 support for daloRADIUS.
- Docker-based image for quickly getting up and running.
- Security, and bug fixes contributed by other community members.
In Summary
The list is too long to list everything but this year has been nothing short of pure open source and technology awesomeness for me.
I am planning on closing 2016 with some great upcoming projects so stay tuned!
