Black Duck Software Composition Analysis (SCA) vs. NGINX

If you are using a lot of open-source libraries, which is most likely, this is a must-have to ensure no known vulnerabilities slip into production

Incentivized

[NGINX] is very well suited for high performance. I have seen it used on servers with 1k current connections with no issues. Despite seeing it used in many environments I've never seen software developers use it over apache, express, IIS in local dev environments so it may be more difficult to setup. I've also seen it used to load balance again without issues.

Incentivized

• Vulnerability scans
• Tracking of the problem
• Alerting

Incentivized

• Straight-forward configuration format that users of all skill levels can learn, and yet is powerful enough for the huge breadth of features that Nginx provides.
• Massive scale right out the box. We've never had a Nginx instance overwhelmed by requests, and if we did it would be trivial to spin up more Nginx instances to handle the load.
• SSL termination means that we can deliver content over HTTPS without needing our individual services to require TLS support. This saves us a lot of time and headache while keeping us secure.
• Nginx is open-source and free, meaning that anyone can use it to power their services, from individual projects to billion-dollar websites.

Incentivized

• Very slow.
• Bad UX.
• Outdated design.
• Too expensive.

Incentivized

• Customer support can be strangely condescending, perhaps it's a language issue?
• I find it a little weird how the release versions used for Nginx+ aren't the same as for open source version. It can be very confusing to determine the cross-compatibility of modules, etc., because of this.
• It seems like some (most?) modules on their own site are ancient and no longer supported, so their documentation in this area needs work.
• It's difficult to navigate between nginx.com commercial site and customer support. They need to be integrated together.
• I'd love to see more work done on nginx+ monitoring without requiring logging every request. I understand that many statistics can only be derived from logs, but plenty should work without that. Logging is not an option in many environments.

Great value for the product

Incentivized

If you don’t know how to scan for the language, it isn’t entirely user friendly

Incentivized

This tool is really easy to use and configure. Consumes very less system resources. It is highly modular and configurable. You can easily use it with other tools like certbot for SSLs. You can configure basic security with configuration and headers

Incentivized

I have a very strong reason for the very best rating. Usually, Black Duck support is quick enough and they continuously keep me updated about the status if some issue is taking time for them to resolve. Overall, I am happy with the response I get from t customer care. I was planning an upgrade and I ran into an issue as the migrated Postgres database does not get identified by the new version of the hub. And all the projects, scans and the huge amount of work we put in comments under version are all lost. I immediately opened a case in the Black Duck customer portal. And in no time, I get a message back from the support for a quick WebEx session. And support was able to help me and my weekend was saved. Thank you for the quick support Black Duck. Appreciate it. I also have some questions on using Black Duck in an optimal way. I get helpful replies quick enough.

Incentivized

Community support is great, and they've also had a presence at conferences. Overall, there is no shortage of documentation and community support. We're currently using it to serve up some WordPress sites, and configuring NGINX for this purpose is well documented.

Incentivized

Black Duck is an obvious choice, with its versatility, integration, best enterprise support and on top of the list the knowledge base Black Duck has. Vega or Grabber also scans the application and tells about vulnerabilities. But it can never be compared with the feature set of Black Duck. Black Duck can also generate reports.

Incentivized

All of those are paid solutions with very good features, but they also offer dedicated scenarios for web application hosting. If you run applications on on-premises web servers and don't have a Microsoft licence agreement, Nginx is a very good and reliable option, based on Linux distributions and available as freeware.

Incentivized

• It is hard to measure ROI since Black Duck Hub saves us from costly legal battles that have thankfully never had to happen.

Incentivized

• Our websites are noticeably faster, causing an increase in customer satisfaction.
• Nginx has such a low memory/resource footprint that we save money from not needing multiple large, expensive servers.
• Ability to load balance traffic, have server-redundancy, and have high-availability allows for 100% uptime and provides cost-effective solutions to alternatives that can cost a lot.

Incentivized