In the Java world Maven Central is the most important single service. You can get Java SDKs and even container images from various vendors but Java code comes from only one place: Maven central. Serving overt 10 billion requests a week, Maven Central is sooo boring, sooo reliable that it’s understandable that it’s mostly invisible. It’s just there. Times are changing and so is Maven Central. As cyberattacks grow the defences at Maven Central have grown too and now we're on the offence. Learn how Maven Central is working with the Linux Foundation and others to add features and services that will keep the Java community safer, more informed and better prepared.

1. Maven Central ++

3. @spoole167

5. Whatever your preferred language or build system

8. 8

14. Why?

16. 496BILLION

17. 79k
27TB
8.8m

19. But it’s
what we do

22. Prove you own the domain!

24. @spoole167

26. zip
jar

27. zip
jar pack
age
class method

28. zip
jar pack
age
class method
zip
zip
zip

31. https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-
threats/exploiting-ai-how-cybercriminals-misuse-abuse-ai-and-ml
https://techmonitor.ai/cybercrime-future/ai-cybercrime

32. @spoole167
where do you get your
open source java
components?

34. https://pixabay.com/users/creozavr-2567670/
How do we navigate
open-source software
and avoid the bad
actors?

36. Best Worst

37. Best Worst

38. Popularity: “It’s got the most downloads / stars on GitHub …”
Compatibility: “It can read xml and json files too!” , “it connects with the software
from the same vendor”
Reputation: “It’s from IBM, Apple, …”. , “It’s written by the people who did
xyz”
Documentation: “It’s got some, and it’s not translated from Klingon”
Peer recommendation: “It’s what stack overflow says is the
best”
Release frequency: “This project has actually released a
1.0”
License: “Ok, not GPL so we’re good to go. What is the Happy Bunny Licence
anyway?”
https://github.com/ErikMcClure/bad-licenses/blob/master/happy-bunny-license

39. Popularity: “It’s got the most downloads / stars on GitHub …”
Compatibility: “It can read xml and json files too!” , “it connects with the software
from the same vendor”
Reputation: “It’s from IBM, Apple, …”. , “It’s written by the people who did
xyz”
Documentation: “It’s got some, and it’s not translated from Klingon”
Peer recommendation: “It’s what stack overflow says is the
best”
Release frequency: “This project has actually released a
1.0”
License: “Ok, not GPL so we’re good to go. What is the Happy Bunny Licence
anyway?”
https://github.com/ErikMcClure/bad-licenses/blob/master/happy-bunny-license
Security: “… um. , Nexus says it’s OK?”

47. For 96% of
vulnerable
downloads, there
was a non-
vulnerable version
available

49. https://ossindex.sonatype.org/

50. https://ossindex.sonatype.org/

51. https://ossindex.sonatype.org/

53. https://bomdoctor.sonatype.com

54. https://bomdoctor.sonatype.com

58. •
•
•
•
•
•
Not just is it free,
does it do what I
want?

61. •
•
•
•