IT Central Station is now PeerSpot: Here's why

Black Duck OverviewUNIXBusinessApplication

Black Duck is #7 ranked solution in top Software Composition Analysis (SCA) tools. PeerSpot users give Black Duck an average rating of 8 out of 10. Black Duck is most commonly compared to Mend: Black Duck vs Mend. Black Duck is popular among the large enterprise segment, accounting for 72% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a computer software company, accounting for 33% of all views.
Buyer's Guide

Download the Software Composition Analysis (SCA) Buyer's Guide including reviews and more. Updated: June 2022

What is Black Duck?

Black Duck is a comprehensive solution for managing security, license compliance, and code quality risks that come from the use of open source in applications and containers. Named a leader in software composition analysis (SCA) by Forrester, Black Duck gives you unmatched visibility into third-party code, enabling you to control it across your software supply chain and throughout the application life cycle.

Black Duck was previously known as Blackduck Hub, Black Duck Protex, Black Duck Security Checker.

Black Duck Customers

Samsung, Siemens, ScienceLogic, Noser Engineering AG, ClickFox, Dynatrace, CopperLeaf

Black Duck Video

Archived Black Duck Reviews (more than two years old)

Filter by:
Filter Reviews
Industry
Loading...
Filter Unavailable
Company Size
Loading...
Filter Unavailable
Job Level
Loading...
Filter Unavailable
Rating
Loading...
Filter Unavailable
Considered
Loading...
Filter Unavailable
Order by:
Loading...
  • Date
  • Highest Rating
  • Lowest Rating
  • Review Length
Search:
Showingreviews based on the current filters. Reset all filters
Project Lead at ABB Group
Real User
Stable, but the process is very manual and the price should be reduced
Pros and Cons
  • "The stability is okay."
  • "It needs to be more user-friendly for developers and in general, to ensure compliance."

What is our primary use case?

We use Black Duck to examine our source code for compliance issues.

What needs improvement?

The older version that we are using is very primitive. You have to do every step, right from setting up an application to the user. The code has to sit in a particular folder and all of the open-source dependencies have to be there. With everything in one folder, it starts to scan. As we are using Code Center, we need to ensure that all of the components are there. However, there are thousands of components and for each submission, the components have to be there. There are no bulk submissions or bulk transfers. Essentially, you need to write your own scripts with the APIs to do it more efficiently. It needs to be more user-friendly for developers and in general, to ensure compliance. The scanning should be quick and easy to use, rather than complex. The pricing for this solution should definitely be lower.

For how long have I used the solution?

We have been using Black Duck for between five and six years.

What do I think about the stability of the solution?

The stability is okay. We need to keep cleaning up and archiving, which is the standard care by an administrator.
Buyer's Guide
Software Composition Analysis (SCA)
June 2022
Find out what your peers are saying about Synopsys, Mend , Snyk and others in Software Composition Analysis (SCA). Updated: June 2022.
609,272 professionals have used our research since 2012.

What do I think about the scalability of the solution?

The number of people we have using Black Duck at any time is on a project-by-project basis. We probably have around 500 users, although they do not use it on a continuous basis. The usage is based on the number of requests. For some projects, it will be used just one time, and that's it. 

How are customer service and support?

We have just started to contact technical support, so it is too early to evaluate them.

Which solution did I use previously and why did I switch?

We did not use another similar solution prior to Black Duck.

How was the initial setup?

The initial setup is complex. It is installed and configured on a Linux-based system, and the on-premises database needs to be updated. Upgrading our version of Black Duck to the most recent is a tedious process. It is very step-by-step and very manual.

What's my experience with pricing, setup cost, and licensing?

The price is quite high because the behavior of the software during the scan is similar to competing products. 

Which other solutions did I evaluate?

We are currently evaluating whether we should continue to work with Black Duck, upgrading to the most recent version, or change to another solution. We are looking at several tools that also include WhiteSource and Checkmarx Composition Software Analysis. Ideally, we want to find a solution that suits our everyday needs. One thing that we have found is that the price of Black Duck is quite high, compared to other products.

What other advice do I have?

As we are using an older version, and have not yet completed a PoC with the most recent one, I am not sure whether there are newer features that we need or will use. Things that we would like to see may have already been implemented. I would rate this solution a six out of ten.

Which deployment model are you using for this solution?

On-premises
Disclosure: I am a real user, and this review is based on my own experience and opinions.
Zvika-Ronen - PeerSpot reviewer
Chief Technology Officer (CTO) at FOSSAWARE
Real User
Auto analyzes components and supports a range of scales
Pros and Cons
  • "I like the fact that the product auto analyzes components."
  • "The scanner client is limited by the size of software it can handle."

What is our primary use case?

I'm a technology leader and an open source compliant and risk expert. I lead two domains, both are open source compliant. We use Black Duck in order to make internal audits on software during development, for license compliance, open source compliance, and open source vulnerability. We have an open source audit team, which has some administration rights on the tool and can make changes to the reports based on feedback from business units. Remaining users have permission via tokens to view reports. We would have around 300 users. Up to 20 users can access the system at any one time. The product is used on a daily basis. 

What is most valuable?

I like the fact that the product auto analyzes components. In comparison to Protecode where you're given a suggestion and you have to manually choose the correct one, Black Duck analyzes automatically. However, there is a degree of error, possibly around 5%. 

What needs improvement?

In terms of improvement, there are several areas. The scanner client is limited by the size of software it can handle. If you're scanning software larger than five gigs, it needs to be split and is separated into sub-scans. If you want the status on a certain scan, you can't get it automatically and it can sometimes take a couple of hours. If you want to attach the scan into a CI process and then get an actual result it cannot provide an accurate status.

We are running a Proscan developed in-house and this manipulates the result. It doesn't change the result but it adds some attributes to it. For instance, it gets an alter source and it gives you a link for the domain where you can read more about it. Or if the GUI suggests the conversion, and provides an excel report, you do not really need to go to the GUI, it can be accessed by email after the scan. These attributes and manipulations are done by the API developed in-house for the GUI.

For additional features, I'd like to be able to see SQL on demand, side by side. I'd like to be able to change a room with managed components inside the project, and still have it affect other projects. There is currently no internal database for manual changes which would be a good addition. Also, it would be helpful to include isolation of parts from the doctor image, for instance.

For how long have I used the solution?

We've been using Black Duck for three years.

What do I think about the stability of the solution?

Stability is quite good. 

What do I think about the scalability of the solution?

Scalability is quite good, because they manage to support a range of scales, but it's not unlimited. We can scan six in a row with no problem, but there might be some delay. This is the threshold that we set, we don't scan more than six at once. It's a good product for enterprise companies and smaller ones too, although it is quite expensive for a small company. 

How are customer service and technical support?

There are some very professional support people. No one tool is perfect, but if you're comparing to the rest of the tools on the market, Black Duck comes out on top. They have some really unique features, especially from the perspective of seeing a wide range of open source versions. It's something that is not available in other tools.

I am happy with the support, although I work in Israel and the work week is from Sunday to Thursday - they work Monday to Friday. It means there are only four days in the week when we overlap. If I need something on a Sunday I have to wait. It's challenging. They do have some good training videos.

How was the initial setup?

The complexity of setup depends on the scale. If it's an out-of-the-box scan, it's basically scaled for the port, but once we started to utilize it, we wanted a system that automatically scaled up, so we moved to Upper Shift. It was challenging and required some support from their R&D. Then we applied integration, which required consulting with experts. You can use their documentation and set up your own software, it works smoothly. but depends on the size of the setup.

The product requires someone familiar with the tool. It's not that complicated, but it's not intuitive to find your way through the tool easily. There are two kinds of setup that I am aware of in Black Duck. One is a complete SAS solution where you upload your software to the cloud. Alternatively, you have your on-premise hub, which is attached to the knowledge base. This is a secure solution and can be compared with the knowledge base. The way this hub communicates outside is very important because it needs a stable and wide metro connection.

What about the implementation team?

Deployment was with external support but the integration had some challenges and took some extra days. We had a very professional expert on site, we pay for premium support.

What's my experience with pricing, setup cost, and licensing?

There are some features that cost extra but we don't use them because I'm not sure there's added value. The product is not cheap. There are several methods of payment - by product, by scale, or by code-based size. I suggest those buying Black Duck know their code size in relation to the code size that the system registers. This gives a good estimation of how to negotiate the pricing model. If you're buying extremely high capacity, it costs a lot.

What other advice do I have?

The set up is on-premises but the knowledge base is through the cloud. As mentioned, it's a hybrid solution.

The main difference between Black Duck and other solutions is the way the software identifies the open source. If it's being used out of the box and there's no need for any changes or modification or integration, probably a software based on SHA-1 would be good enough. If the company's customizing its software based on a customer requirements, changes will be needed. Software that works on a single match point probably will miss that. And that's the advantage of Black Duck.

I would rate this product an eight out of 10.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
Buyer's Guide
Software Composition Analysis (SCA)
June 2022
Find out what your peers are saying about Synopsys, Mend , Snyk and others in Software Composition Analysis (SCA). Updated: June 2022.
609,272 professionals have used our research since 2012.
TundeOgunkoya - PeerSpot reviewer
Consulting Partner, Cyber Security Delivery - Africa at DeltaGRiC Consulting
Reseller
Useful for determining the health of applications that contain open source components
Pros and Cons
  • "It highlights what the developers have done, and it shows the impact from an intellectual property point of view."
  • "I would like to see more integration with other solutions, such as IntelliJ IDEA."

What is our primary use case?

We have been using this solution for between two and three years.

We frequently use this solution for software composition analysis. We also use it for vulnerability assessment and operational risk assessment. This is usually for customers who want to do one-off assessments, trying to check open source components they are using in their build. 

How has it helped my organization?

This solution helps our customers to understand what really lies in their application. In terms of the open source components, it can show the dependencies that other components are relying on, which you don't see. For example, if your application is packaged with other stuff, it would help to pull up all of the dependencies. It will list all of the open source dependencies in the entire library and show details about what they are using. It highlights what the developers have done, and it shows the impact from an intellectual property point of view.

This can also impact them from a security perspective. For example, it can tell you about the health of an application. What we often see is that developers are using an older version of an open source component, and they don't change it because it works. In cases where a newer version is available, we are able to show them what old components they are using, and the age of those components. This gives them a measure of health for their application in terms of operational risk. If an application were to break tomorrow, the chances that it can be quickly fixed may be dependent on the age of the component.

Largely, this is the kind of value we use Black Duck to provide to customers in this part of the world.

What needs improvement?

I would like to see more integration with other solutions, such as IntelliJ IDEA.

What do I think about the stability of the solution?

This solution is stable. Maybe, depending on the browser that you use, you might have delays in response. If you are using Chrome, for example, and you click refresh on the web GUI, you get delays sometimes. I think that this is normal with most applications. 

What do I think about the scalability of the solution?

In terms of scalability, we are a small team so we have never tried with too many users. We only have one user and have used this for two or three customers in South Africa. I think that it is pretty scalable, but the limitation comes from the pricing and licensing agreement.

Beyond the licensing, you might be limited by your hardware capacity. I think that it starts off with 16GB RAM and four cores minimum, but if there are more people on it then you might need to expand the resources. 

How are customer service and technical support?

Like with any product, the technical support can be better. They have a feedback system where you raise a ticket, and it usually takes twenty-four hours before they respond. If there is something very urgent then you can escalate it, and I think that the delay is reduced to six hours.

How was the initial setup?

The initial setup for this solution is straightforward. It is Dockerized, and very easy if you use Linux. If you have a server on Azure then you can just go to the Azure marketplace and spin it up straight from there.

If you are using an instance on Google Cloud, for example, we've done deployments where you simply spin up the application and it deploys by itself in about four minutes. If you have to deploy by yourself, you have to wait for Linux to completely finish, etc. But if you're using a cloud service provider then it is automatic. You put in your license and you integrate it with whatever you want to do.

Once it is deployed, it is again straightforward. You can easily take your build, use the Hub Detect to scan it and get a JSON file, then upload it to the server. It will do the analysis and it is usually fast, except sometimes when you want to check code snippets. 

It does not require more than one person for deployment and maintenance.

What about the implementation team?

We handle the deployment ourselves.

What was our ROI?

It is difficult to determine ROI when it comes to security because it depends on many things.  For example, it may tell you how much knowledge your developers have about licensing, or security, which may ultimately reduce the cost of training.

On the other hand, it may increase the rate at which you find bugs or problems with specific components. This, again, may contribute to the ROI. However, it is difficult to say without a set of predefined metrics.

What's my experience with pricing, setup cost, and licensing?

The pricing works either by the number of users or by code size. In the case of code size, they give you unlimited users. For example, if you have two thousand developers but you want a code size of 20GB, then that is what you get. If, however, you have forty developers and a lot of projects then you can say "We'll use forty developers and then we can scan unlimited applications, even if our applications are going to be 3,000GB."

Depending on the use case, the cost could range from $10,000 USD to $70,000 USD. It depends on what you are doing. There are no costs in addition to the standard licensing fees, including the academy. If you buy the license then they give you access to their academy, where you can get trained. The integrations are free, and the plug-ins are free.

What other advice do I have?

This is a good solution. My advice to anybody interesting in implementing it is to be clear in their mind whether they want to go on a user-based model, or they want to do a code-based model. It can get tricky if your development team is growing rapidly.

Maybe you started off with five developers and then the next year you are growing to ten. Then, in another year, there are fourteen or twenty. As you grow, a user-based model may not work for you so you might consider going with the code-based model.

However, if you are working on multiple projects then you may consider the user-based model, as long as your headcount is relatively stable.

Overall, the deployment is straightforward, uploading code is straightforward, analysis is straightforward, but with integration then it may be slightly lacking.

I would rate this solution a nine out of ten.

Disclosure: My company has a business relationship with this vendor other than being a customer: Reseller.
Buyer's Guide
Download our free Software Composition Analysis (SCA) Report and find out what your peers are saying about Synopsys, Mend , Snyk, and more!
Updated: June 2022
Buyer's Guide
Download our free Software Composition Analysis (SCA) Report and find out what your peers are saying about Synopsys, Mend , Snyk, and more!