AI-generated Code Copied From Open Source With Julian Coccia  ## Metadata - Author: [[The Business of Open Source]] - Full Title: AI-generated Code Copied From Open Source With Julian Coccia - Category: #podcasts - URL: https://share.snipd.com/episode/1fea7cd5-f9c7-488f-a82f-e758ef2ce5b9 ## Document Notes ## Highlights - **Open Source Dominates Software** - Open source software makes up about 90% of software today, yet most software companies don't adopt open source business models. - This is largely because people don't fully understand how to monetize open source and are used to traditional proprietary models. Transcript: Julian Coccia Well, because I think that people don't really understand the open source business model. I mean, there is, it's been many, many years of proprietary software models. And the switching to open source is not straightforward for everybody. And just to give you an example, what we do, which is this corner of the technology, is called software composition analysis. We are the first company now, after 20, I mean, this problem existed and this kind of companies existed for 25 years now. We're the first company that is entirely open source. So companies helping companies identify open source have done this through selling proprietary licenses to their proprietary software for 25 years. So it's crazy. But that's the way it is. And the shoemaker's son always goes barefoot. That's how we say in English. Something similar in Spanish. So yeah, and you know, open source to me is driving, is standardizing. I mean, if you do something as open source first, you're driving. And then if that offer becomes adopted, then you set up a de facto standard. And then you're ahead. And then everybody else has to follow. And that is very difficult for people to understand. ([Time 0:01:47](https://share.snipd.com/snip/d9a9f0c3-72cd-4dc2-a1a2-f2e062f1d3a8)) - **Challenges of Support-Based Models** - Selling premium support for open source software often leads to high churn and limits company valuation. - Support-based models typically don't generate recurring revenue or build lasting intellectual property. Transcript: Julian Coccia So, you know, open source-based business models are not easy. And, you know, in our case, we are a data company. So all the software we make and distribute is open source to facilitate subscriptions to our data. And we're also an open data company because we're also generating and providing open data sets. So how do you make money? How do you make money? Well, you know, back to open source business models. The most popular way of making money with open source is, I'll say, the less successful. I mean, people tend to say, okay, I make this offer and I sell it for free. And then I charge a premium support package to companies who need support. And, you know, usually large companies do need support. Large companies use open source, but usually they need someone to provide them with a hosted service. And, you know, they don't want to do this themselves. It's not their main business. And they want solutions problems and they want an SLA and they want you know a neck to choke if things go wrong that's basically the reason why companies will pay I mean this is again not Small and medium enterprises usually just go for the open source and they host it themselves sometimes you, you know, now it's like very popular. People just pay subscriptions. You pay subscriptions to everything. And that model of offering support, I say it is probably the weakest because, you know, yes, you will get customers. But then the problem is, how do you turn those customers into something recurrent? I mean, usually when you build a business you want a recurring revenue right and and if you're helping a company setting it up and then especially if they want to host it on premise you Know you will you will you will get your money for the first year but maybe they will not be very motivated to renew after they have already trained their people and everything is in-house. And then also the value of a company. You're a support organization, right? So you're just a consulting company. What is your IP? ([Time 0:03:38](https://share.snipd.com/snip/e4a71925-e348-49b5-936c-8b9c0d134829)) - **Monetizing Through Data Access** - Sell access to comprehensive, regularly updated open source data rather than proprietary software. - Deliver this data via SaaS or on-premise to meet compliance and security needs of large companies. Transcript: Julian Coccia Way we do it, I mean, we understood that this problem of identifying open source has to be solved. So we said, okay there's been many many companies selling proprietary software to identify open source and the main problem this causes to to large organizations is that when you sell Proprietary software you want to make it as difficult as possible for your customers to switch to the next tool when the contract expires and that how do you do that well by creating vendor Locking mechanisms. I'm sure you remember the issues with the Word and Excel formats in the old times, right? So that's the main problem and the main pain point for companies looking at switching to open source. So in our case large companies have already had for 20 25 years software internal software and tool chains that solve this problem to some extent so the last thing they need is yet another Company to tell them how to do things through a new ui right and i saw this myself at um at arizona at the time you know we needed to automate stuff there's a bunch of complex systems in large Organizations and and what you need is data I mean you needed an API to tap into to provide intelligence to your internal processes and systems so we understand this very well and and Although we've been doing this for a few years now, nobody else has taken that step because changing a business model is not easy, right, for companies. So we're solving this problem by providing a data subscription agreement to our customers. So we have this massive knowledge base of open source, basically every single piece of open source ever released, which is increasing at a rate of 10 15 component versions per second As we speak so it's a very very complex network and then we package all this together and we deliver to customers and we do this sas which is updated automatically daily or we do this also On-premise is usually the case because you know large companies you know when it comes to compliance is something very sensitive and usually their internal development systems don't Even have access to the internet you know they cannot query an api outside so most of our customers are um on-prem. So we deliver this database and then we deliver periodic updates to them. ([Time 0:06:40](https://share.snipd.com/snip/7710da3e-4032-4b35-a6c5-db6b53342fd7)) - **Deep Analysis of Open Source Components** - Open source identification requires granular components and snippet-level detection, revealing declared and undeclared use. - Additional data layers like license info, vulnerabilities, and code quality offer deep compliance and risk insights. Transcript: Julian Coccia Yes, yes, of course. You know, we have, I would say, our database, as I said, it has, it's huge. You have astronomic numbers, it's three trillion lines of code and 250 million component versions already mine and just clicking by the second the but then it's not that's what you Need to identify so basically what we do is you can run uh our client through your software and we tell you well here's this number of components you're using and then there is also these Files taken from github and here is a snippet in between lines 75 and 100 taken from this page in Stack Overflow, for example. So that's the level, the granularity or capillarity of the information we detect. But then once you know, that is actually to reveal your software composition. You know, it's just to find what is declared and what is not declared because everybody can say today, okay, I'm using a Python, I'm coding in Python, so I have my requirements, TXT, which Tells me what my external dependencies are, but that's only a partial view. That's only the things that are declared. And there is also a number of things that are not declared, like those files taken from Stack Overflow or code generated by AI that contains open source. And, you know, it's a big problem. So, but that's one part of the problem is to identify which open source you have. And then it's, what do you do with that? Then we have a number of data sets that provide your intelligence on those components that you have identified, like the licenses, the copyright statements, which you need for compliance, The known vulnerabilities, if there are already known vulnerabilities for those component versions, the geo provenance. Polarized world in which companies start to worry about who is behind this open source components that I'm using especially if they're you know working in defense projects you know It's a very sensitive problem and even for companies who are looking at you know the continuity of their of their If you are using, depending heavily on a component that is in a country, That maybe you're going to enter some sanctions or something that will prevent you from using that component, then you might want to know ahead of time. We have also data quality. We basically run static code analysis against every single open source component. We can tell you the basic rules. There are open source tools. And everything we do is we use open source tools. I mean, we don't reinvent the wheel. We understand how open source works, right? So there are tools like Semprep that has some 1,500 community rules, community-maintained rules on things that you are not supposed to do when coding from the security perspective. You know, validate your parameters before you send them to the SQL, you know, to prevent SQL injections, for example. Things like that. And so we can tell you exactly how many rules every component version breaks. And that talks about the quality of the software you're using and how likely would it be for that component version to expose vulnerabilities in the future based on how it's written. We're now releasing soon a sustainability layer. So we are giving an A to F, like the refrigerators or the television, on energy and consumption and sustainability based on what does the component do and how it does it. So is it a JSON parser or is it a Bitcoin miner? So then it's most likely an F, right? If it's a Bitcoin miner, no matter how optimized it is, it's a lot of computing power. So that's basically some of the data layers that we have. We have data layers to detect technical debt in code, all kinds of stuff. And that's how we make money. That's what we charge for, exactly. And even the free, I mean, SMEs, we encourage SMEs, we want SMEs to use the free version. ([Time 0:10:30](https://share.snipd.com/snip/f696aaa1-bd23-4b3e-abb6-2786518ef2a2)) - **AI Code Generators Copy Open Source** - AI code generators often produce code containing verbatim or heavily similar open source snippets. - This involuntary inclusion of open source creates a large compliance risk for companies using AI-generated code. Transcript: Emily O'Meara And I noticed that on your website, there's a lot of talk about AI. Could you tell me a little bit about this issue of being able to see how open source is used in AI-generated code? This is actually an issue that I find extremely interesting and also under-discussed. So tell me a little bit just about how is that a concern? What are people doing about it? And what's the role of ScanOS? Julian Coccia Okay, it's a big concern, especially for large corporations. Again, when it comes to compliance and risk, if it's a small company, nobody cares. If it's a big company, all the eyes are pointing at that big company, right? So the problem, as I said in the beginning, 90% of our call is open source. It's not me saying it, it's Gartner, Forrester, Wave, it's GitHub, it's 90% more or less roughly. And the problem is that the process, and actually the reason why this is at 90%, is that the development, the advances in software development technology, latest package managers And programming languages, and AI assistants, made the process of bringing open source into your code, integrating open source, an involuntary and invisible process. You do not know anymore, pretty much. You have to be very careful. You have to be very trained to say, I am bringing some open source. But if you're using AI for generating code, you don't know. I mean, that snippet, I mean, all LLMs are trained with open source. So it's possible and highly likely that the code that they generate contains open source, something that is either a verbatim copy or something that heavily resembles some open source. And we have done tests, and we found cases in which we asked ChatGPT to generate code that we do, like, for example, specifically the hashing algorithm we use for snippets. And it came up with our code from GitHub, including our developer comments. So, I mean, when you have a piece of code that is not only exactly the same but also contains text written by a human, I mean, there is no chance in a court that you will say, you know, I wrote This myself because the comments by a developer are like, you know, that's a footprint, right? Or a DNA sample, more like just a footprint. So it's a big problem. And actually, I read an article recently, a white paper from the University of Peking, and they say that up to 2% of the code generated by AI is either a verbatim copy or heavily resembles Open source. And 2% is a lot. I mean, think of how much code a large company produces. This is a lot. In fact, there is actually a follow-up paper that one of our engineers made and published that says that it could be up to 30%, depending on the case. So, it's a high chance. It's a pretty high chance that you will get open source in your code without you knowing. So, you know, and then everything, when it comes to the risk of using open source, I'm always careful of saying risk of using open source doesn't mean that open source is a bad thing. I mean, it's just that just like any external source that you bring in, you're assuming a risk and a liability. It's not just license compliance. You could be bringing vulnerable code. You could be bringing code that uses encryption algorithms that affect your export control classification number. This is trade compliance. It could be quality issues. It could be countries with sanctions. I mean, it could be anything, right? And it all starts by knowing and having a visibility on your software composition. ([Time 0:15:40](https://share.snipd.com/snip/9942dc3c-dc0b-4549-abcc-317389c934b7)) - **Embrace AI with Compliance Tools** - Companies cannot afford to ignore AI tools despite compliance risks, as it accelerates development. - Use open source tooling to detect AI-generated open source code snippets and mitigate risks proactively. Transcript: Julian Coccia Yeah. You know, recently, you know, GitHub has this tool called Copilot. And just to, of course, you need to use AI. You cannot say you're not going to use AI. It's banned. That was the first reaction in the beginning, right? I mean, that was the first reaction with open source 25 years ago. You cannot bring any open source to this company. Same happened with AI in the beginning. But you quickly realize that you have a big disadvantage if you don't use it, if you don't embrace it, because everybody else is moving much faster. Everybody else was using open source and you know using these building blocks that would allow them to to build applications much faster same goes with ai you have like a like a co-processor Like a you know an implant and you code faster but you know you need to have the tools in place to to mitigate this this kind of risks it's very easy and it's open source, so you can do this. There's plenty of tools that do this. And we are the only tool that allows you to see snippet level comparison and seeing if you're copying, pasting or bringing modified codes or things like that. And you can use ScanOS absolutely free. ([Time 0:20:10](https://share.snipd.com/snip/82f777f0-a461-4654-aa28-3537dd52801a)) - **Open Software, Paid Data Model** - Provide your software as fully open source but monetize a high-value, comprehensive dataset. - Separate free data access via a foundation to foster ecosystem adoption without endangering company revenue. Transcript: Julian Coccia I saw this because I come from this world and I saw that need many, many years ago. And I'm not the only one in the company with long years of experience in the SEA market. Our head of sales and our CEO come from the biggest company doing this in the U.S. Called Black Duck. And, you know, I remember when I tried to, during my Ericsson years, who's now our head of sales, was the head of sales for Scandinavia for BlackDak, and I was her customer. So I used to be her pain at Ericsson. Now I'm her co-worker, right? And at the time, I remember I told her, we cannot get this thing to work. We cannot get this software to do what we want. Why can't you just give me access to the database? We pay you for access to the database. And, you know, we figure out because we already have all the software in-house. So, I mean, for me, it was a no-brainer. I always saw it like that. And everybody else agreed. So, we said this has to be done based on selling data, not software. And then besides, you know, the managing compliance and checking has, in the beginning, it was something that you will do before an M&A or at the end of the development process. People will just audit the code to find open source. And that was 25 years ago. And that's how this company started from a legal perspective for compliance. But the problem is that you will find issues that were introduced two years ago by some developer who's no longer in the company. So then software development managers started to worry about this and started to think about this as one of the many things that you have to do earlier in a development process and that Goes to this shift left in this devops automation of many checks i mean that checking compliance is i mean you're you're sending your pull request does it build to start with? Does it pass the test? Does it contain any open source that is not supposed to be there? So this is how this need went from an end of the development process or preacquisition to CI, CD, pipeline integration. Emily O'Meara But was there a particular process at ScanOS where you weren't sure what or how to monetize? Or from the very beginning, was it clear? Julian Coccia From the very beginning, yes. I mean, we knew that we needed to do something open source because this DevOps and CI, CD, pipeline they are using all open source tools. You don't want to bring a proprietary tool there. And then we knew that it was going to be 100% open source from the beginning. And no questions about that. We knew that we needed to sell data but you know in our case it's like that was a that was a process in the beginning it was scan oss providing free access to the knowledge base and you know Quickly you realize that customers say okay this is very nice but how long will it take you to shut down that api or start charging a ridiculous price for it, right? So that actually matured the idea of needing a separate entity hosting the free service. And, you know, that was such a painful process because setting up a foundation in Spain is an incredible painful process. Mean it's like you know government entities assume that you are going to be washing money or I mean you have to prove the you know you start by by being a suspect basically before you want To do anything so it's very very lengthy and costly process to actually get that done but we managed to do it. So we first matured the idea of having to have an external entity. Of course, we could have gone to some other foundation, right, with ideas saying, hey, can you host this for us? But then that's also, it was not the main business of any foundation. So we thought something like this doesn't exist. So we need to make it from scratch. So it was first a thinking process that led to the conclusion, and then we need to actually put it in practice. ([Time 0:21:57](https://share.snipd.com/snip/f1c37e6c-a3fc-4735-92cf-0f087da6312a)) - **Visibility Challenges in Open Source Sales** - The biggest challenge for open source companies is lack of visibility into their sales funnel. - Transparent funnels are rare; companies may use free offerings for months before engaging commercially. Transcript: Julian Coccia Well, that's actually the main thing is the lack of visibility on your funnel. That is the main challenge. Most open source companies will tell you my challenge is to monetize. It's not a problem at all. It's not a problem at all. We don't have any issues monetizing because, you know, companies knock on the door and say, I need this. It's no problem. We don't have also another problem that open source companies have is churn. As I said, if your business model is based on selling support, you're going to have something close to 100% churn, right? We have zero churn so far, knock on wood. It's been many years and companies are very happy. But the problem, and I guess we resolve a number of things. I mean, we have a number of achievements there, which is, you know, things that usually open source companies face. But our problem is more trying to anticipate who, you know, the visibility, the full visibility on the funnel. We know that it's never going to be possible. But, you know, that's where we have our efforts also. The effort is also on communication. It's very difficult to explain what do you do for free, what do you do, what is the pain, what is the difference between one thing and the other, what's the foundation, what's you. ([Time 0:29:58](https://share.snipd.com/snip/c42d8e0c-5670-414c-ab85-d0adbadc5272)) - **Hire Open Source Experts** - Build your team with experienced people who understand open source business models. - Surround yourself with knowledgeable experts to increase chances of business model success. Transcript: Julian Coccia Get the right people in your team. Bring the right people in your team. Bring people who brings knowledge and who spin through this. And, you know, that's a pretty general advice, I would say, to any sort of business. Bring the right people, not the wrong people. But when it comes to open source, you have to be surrounded by people who understands this, who has done this, who has done run or either work in some open source company or run some sort Of open source business model before. That's the key. That's the number one. There could be many others, but that would be the, you know, I'll wrap it up with that. ([Time 0:33:47](https://share.snipd.com/snip/9f97d059-4c25-4849-92f0-86ed64219709))