Randy Kilmon, VP of Engineering at Black Duck, chats about open-source security, container auditing, and empirical vs. formal methods for static code analysis.