“A fast start with responsive support”

Pros

Getting started with it is simple and the customer support team is quick to respond whenever needed. Most of the software we needed was already available and when new software is requested, the turnaround time to add it is fairly short.

Cons

I haven't run into any major issues really. That said, it would be better to have the latest software versions added in advance so users can access them right away.

“Fast scans with automatic package detection”

Pros

Right away, the app feels easy to use. It does a solid job identifying most open source packages automatically which saves a lot of time. Being able to track where a component is used across the organization is extremely helpful and I also appreciate the visibility into more than just license risk, including security and operational risk.

Cons

Pricing is the biggest downside because the billing model limits how much code can be scanned. That makes me hesitate to use it as often as I normally would even though it's simple enough that I'd prefer to scan as much code as possible. It also still has fewer capabilities than Protex although Black Duck does seem to be gradually closing that gap.

“provides useful reports”

Pros

The reporting is really useful especially things like operational risk and license reports. Those reports have been quite helpful overall. It would be even better if there were more details available for .Net applications.

Cons

Knowledge base is not very strong when it comes to third-party DLLs and other .Net application components. It would also help a lot if the JSON files we send to customer support could be automated through a Jenkins plugin instead of having to run them manually every time.

“issues get caught fairly early”

Pros

Compared with Protex and CodeCenter, BD Hub feels much more practical to use because everything is in one place instead of being split across two separate areas. The GUI has a few minor issues here and there but nothing serious enough to make it hard to manage. Setting up integrations with Jenkins, Coverity, Jira and other tools was smooth sailing and when BD Hub is properly connected with Jenkins, it helps catch operational, vulnerability and license issues much earlier in the process. The current Hub version also seems better from an installation standpoint since it comes as a single bundle rather than several separate add-ons like before. I did run into a small installation problem related to Linux lsb prerequisites because of multiple dependencies but aside from that, the setup went through without much trouble. Overall, the experience has been positive.

Cons

My exposure has only been to three BD products: Protex, CodeCenter and Hub. Out of those, Protex has been the one I liked the least because it did not feel very user friendly. That is just based on my own experience but it definitely seemed like something that could have been improved.

“easily integrated into workflow”

Pros

Getting this into our existing continuous integration setup was no hassle at all and using it day to day doesn't take much effort. They also keep rolling out new features regularly which shows they're actively working to make the product more usable.

Cons

Scan results still aren't as reliable as they should be. It needs to do a better job with the findings especially since there are quite a few false positives that should be fixed through database updates. Support for more programming languages would also be a valuable improvement going forward.

“Constant updates!”

Pros

New features keep getting added on a regular basis and the support team responds quickly whenever we have questions or run into issues.

Cons

The upgrade process is a big hassle. Every time we need to update the system, it feels like we're reinstalling the whole thing from scratch.

“Works so perfectly!”

Pros

The biggest plus with Hub is its integrations. Engineering teams are leaning more and more into automated build processes so having a tool that supports that direction is really valuable.

Cons

I don't have any complaints.

“packed with features”

Pros

It's packed with features, it also offers NuGet integration and solid post-sales support that covers development, security and DevOps, along with policy implementation.

Cons

It's hosted on Linux.

“Monitoring without false positives”

Pros

The biggest advantage from the start was how well it fit into our workflow and how quickly we could start using it. The feedback it provides is relevant and catching issues earlier in the SDLC has been really valuable. Real-time continuous monitoring, automated notifications and reports are easy to digest without being overloaded with false positives. Jenkins support and secure scanning are strong pluses too especially since the code never leaves the intranet. Another helpful feature is identifying open source licenses.

Cons

One area that could be better is the UI navigation which would benefit from a more sensible layout. Some of the report screens could also use contextual guidance to make the summary numbers clearer and easier to interpret.