So don't go anyway. So this is the boundary between the panel and the fishbowl. So the
fishbowl session is like a panel, but it's a panel that you can be on. So if you would
like to join the conversation, if you would like to come down and stand outside this
box, and somebody who is inside this box will then leave it and let you into the box
so that you can participate in the conversation. We're not, we're doing this in, because
none of you know how to ask a question for goodness sake. This is instead of questions.
So you get the opportunity to come down here and give your short talk and possibly to ask
you a question. So no need to put it in the form of a question. So what I'm going to do now
is I'm going to carry on the conversation, and then if you do want to participate, you don't
have to raise a hand, you just have to politely form a line to come into the box down in this
area by the door. Okay, and we'll do that until either it gets out of control or we run out of time.
There we go. So, so there's something I want to say which is that
Yeah, so, so I am, as through my consulting work, I am the technical lead of the opening
regulatory compliance working group at Eclipse, and we have all the ways on a direct liaison
with sense and I like, and I think what I want to say which I think is, you know, good news
is that everyone in the different organizations, whether it's the commission or a sense of
like or a self, are really well aware of the friction and how unpleasant it is, right? And
our own trying to find wiggle room to make this work, right? So, you know, there's real positive
and good intention to make this happen, and I think that's really important to take in mind.
And there's a structure and a legal process that we have to work with. So, you know, I think
that's a really positive note. And then the second completely unrelated thing and I want to
quickly say, which, you know, I think one of the comments that, you know, all of you made about
like meetings and all of that is, one of the things that open source, I believe, can bring to
those organizations in the future is versioning and like building standards, the way we build
open source software. This is something I pushed a long time ago at W3C, and it's like
incredible moving from like sharing docs through like actually having poor requests on on
on GitHub, whatever your flavor of versioning system is. And it makes, it accelerates things
very much and it makes it really easier to have a broader set of stakeholders. It's like there
are only benefits to this, right? And the tooling now that we have makes it actually quite accessible
even to non-technical people. So, I think like having some, you know, pushing for something like
that would be really, really great. And I'm done with my soapbox. And now I'll leave the
audience about how we do it. Just so you know what it looks like now, we have these documents.
Everyone knows this. We have these documents, standard version 1, final 2, comments SRPDF,
version 2x.xml kind of things with comments highlighted in five different colors or in this
is how we work. So I would very much appreciate like a model model like that, but yeah, this is one of
the technical issues we have and then also the people in there and they are probably all very
nice. I've met most of them, but you can see that most of them are used to an older way of
working like they don't like sharing things often. Like we don't want input from the outside
and that's I think needs to change. I'm not sure I do not have a lot to say anymore.
Maybe only like, so the, for me it's really a mind-boggling process. Because it is still
not assured that it is something that you can actually use practically. And I'm like very
much focused on stuff that is like guidance, perspectives and so on that people can actually do.
And what kind of process me with monetization stuff is that it has that the applicability
is something that is like, that's very high level. So people are there and say, okay,
now I know that you know, but, but how do I actually do that? Yes, that is a thing where open like
this is where open source actually shines much more than actually in the process to describe that
high level. Also because it is very annoying that it's like in terms of there is something that
developed over a long time, you know, in, like also in the software space, but due to that
disconnection between how you think about safety standardization and how you think about security
standardization. I believe this is where the friction actually is. It has nothing so much to do with
the other things. It's really like also why you actually standardize that. Yeah, so.
Yeah, actually, I think that's a super interesting topic in itself. I'll take one more minute to
to comment on this. On the document sharing, I believe that now in Senna Lake, they were already
experimenting with this open document system. Okay, it's starting, guys. I mean, we have to give it
also a bit of time to evolve and it's evolving. And then on this really interesting point of,
first, on the point of having practical frameworks, I mean, that's practical frameworks are great.
But the scope of the cyber resilience act is so broad. It covers everything from micro-electronics
to industrial machinery to stuff that is pure and simply just software. And so, because of this,
we really need to find also an abstract language that we can refer to so that there can be ways of
communicating again across the supply chain. This is going to be thinking innovation and something
that is still needed and something that will take some time to figure out what's the right level
of abstraction which to talk. And that's going to be important to find also for regulatory
purposes because precisely also to address the point initially raised, that these standards need
to be product agnostic. So again, we need to be able to talk about things in a slightly abstract way
to avoid falling into the trap of standard essential patterns, things like that. So it is also
kind of an intellectual exercise of just sort of how can we talk about this in a way that we can all
agree. And that's very hard at the very horizontal level and that's why the current work has been
so much a talk shop, but slowly we're going to get into very product specific standards and I think
that those problems are going to sort of disappear because they're going to be about most specific
use cases and the actual risks that we find and how to mitigate them. So and that's where I think
that the legislation helps is to be able to also give an incentive to just discuss what are the
common requirements that everybody needs to implement and then having a much specific discussion
of how the implementation should actually look in context. And again, this is where the standard
would help and this is where it gets closer, I hope, to a framework. I guess I'll give it a mic
to someone else. Thank you very much. Thank you. Thank you. Thank you.
Thank you. Thank you. So it would be good if anyone's to respond to Filipe, rather than start
new topic, that would be good. And if there's no new topic, then it is no response and we'll start
new topic. All right. Okay. Hi. I'm Svanteshu Wood. I'm working on ODIF. I'm one of the chairs
on ODIF. I'm but also an editor of the sense standard. You're sent norm for European
electronic invoices since 2019. And if you pay more for Dean, then you can share internally as
well. Yes. So and there's a eurigulation that from 2012, 2025, that ever European standard
have to be, I didn't see other slides, but have to be in European norm. So they have some kind of
monopoly or cartel because they're different sectors. And I find it, okay. I mean, yeah,
any, but the drafts as well, I can share the drafts, but I don't go there's, yeah, I'll show you
this page later. But what I mean is, it's a fine business model that you have a monopoly
by law, and you can do the price tech on it. And all the others, and I pay for them, Dean,
to work with them, and they sell it. And I had to be an editor because there were
former pages of PDF and I wanted to extract it by automation this table. And so I wanted
to get my hands on this ODIT. It was a dark ex, but then I transformed the ODIT and transformed
it there, but it's directed the data. And now come to the second thing, I think software,
and they are still the waterfall model from the 18th years. So it's software is very fast now,
like two weeks, there's a release. And the blueprint, the standard, is like five years and
send. So we have to be more generalable. So we have to be more structured data. And instead
extract and data, we generate the machine-readable form and the human-readable form as well
from that. And I'm, I put this saying goodbye on Git, sorry, not GitLab, I've made a mistake.
But so there was a spreadsheet of 50 tasks, and I generated by 250 GitHubs by this.
You don't have this weekly meeting or every meeting has a PDF. It's horrible. This process
is horrible. You have five clicks to get it. But then we have everything in issue with everything.
I just suggest to do it the same way. Maybe GitLab, not GitHub, sorry. Yes. But okay. So
I wish that is a different business model. I need their experts. I think open source need money,
repeated of money. So somebody can take off. I buy my bread for not for free. So I need money
as an open source or open standard developer. And even I love to have expert. They're very
good experts who moderate it, at least the Dean group meeting, C.S. So I think and for like a
working invoices, when I met there in Iceland, there were 25 consultant. There was not a single
who like working invoices. But so I think if you use it, not to start with a participating,
that you should pay for it. So maybe the test should be at the standard as well.
But I think it's talked too much. Thank you.
I would be interested in any response to that.
I would remain careful. I already don't have to be here for the paper.
There's a lot of points. I'm sorry. I'm trying to...
Sorry. Do you keep in? If any one wants to respond to the question,
I'd rather have come to say can be read amongst the papers.
Okay. So what I understood is that the temptations of creating market entry barriers and
forming a cartel and having this business model is very tempting. What I would say on the
end of the inwards because the Dean sends you even if you want to go there that everything you
sent there is now their property. So that's in there so they steal all your ideas,
which is very bad even if you adjust the guest. And that's that's crazy. I managed to get around it.
But on the other side, the problem is it slows down everything. And I'm a product manager
and for for for Susan, right? And we have interest in being fast. Being fast on the market.
And I have some hope that this speed argument might outrule these other kinds of tendency to have
market entry barriers because these market entry barriers will not so the the period where there
are worth something is going down. And this might be a very good argument that this investments there
might be blinded or going in the wrong direction. And so open stunners are much faster. You can
make much faster money with it. And so this could be an argument to say well step out of this cartel
thinking step in through their own regulation. Just quick quick answer and then step out.
So there's a regulation, the usual antipathy solution pattern against it like I'm a oasis.
We make in freestand it oasis and then we go by fast path to each isol. So you still and there's
no difference. So we've got the isol sign but still you can have open access it. That's the same thing.
Whenever I want to do something I first release it openly. And then I throw the sense and
see us the link and we can put it in the standard. So that's the way you have to circumvent it.
Just to just and the other thing is I have to validate invoices just another thing. It's just to
see the relation. And to be compliant I have to check every 27 VAT member states in German VAT laws
a hundred of page of PDF. And it have to be structured as well. So structure structure structure
please yes. So I'll leave the bubble. I think the most important thing is please argue with
speech because open source is speed and speed is money. So hello before everybody leaves I want to
basically raise a call to action. We've heard a lot today about we have like 12 meetings a week
and hundreds pages of PDF documents and that's ridiculously old system. There was recently a
consultation should this system be changed. Should the European standardization organization be
revisited? Naturally we have submitted that we think it is out of shape and needs to be fixed.
Other organizations especially those deeply entrenched in the current system have submitted
opinions that they said this system is perfectly fit for purpose. So what I'm saying is we should
not take for granted that this will automatically improve. We should keep the pressure up and say
better collaboration methods exist today. They need to be deployed also in the European
Sennetization organization. Sennetization organization is actually regulation for that.
1025. The currently the commission is about to decide whether or not this will be reopened
and then we written. And of course we're pushing for it should be reopened and we written.
And you should all participate in that pressure to make sure that this system actually changes for
the better. Thank you. Thank you.
Thank you for talking about this back in the box. There's no one's put you out yet.
Okay. As a participant in several standardization groups but not on CRI. I know the
feeling of being pressured in the waiting time. I'm just calling your attention that the ICT
Observatory for standardization. The standard ICT.eu has open calls for grants for people that are
for European nationals that are participating in standard bodies. And so they should use
you should apply and use it. I also would like that anyone that's involved in a standard
participant just makes a call to add to bring in more volunteers into helping them. And at the same
time I would ask for people that on the open source worlds that are participating in these standards
efforts to join in a forum or something so that we can have a common strategies to cope with all of
this in more or less common way even if you are subjects of standardizations are different.
So this might help us in increasing the pool of open source activists participating in open
source but also in having common ways to address the different standard bodies.
It's a quick audience poll because you're all sleeping I can see you. How many people here
participate in activities of the standards body? Either OACS, W3C, Sen, and more than a third of the
audience. How many people here would do so if only they could work at how they held to do it?
Okay so I would love you all as you could easily find my contact details because I'm on the
devrim. I would love you all to contact me so that I know who you are and can talk to you and if you
need to get access I can help you because really all we are lacking here is enough person power.
And maybe to say that the European Commission is trying to give funds to people who want to
step up as individual experts to participate in these kinds of standardization work and the
standardization bodies. So the first two links up there on the board, cyberstand.du and the standi
city.du thanks for mentioning it. Those are such projects that basically allow people to submit
the project for participation in standardization work and get individual grants.
Now I am a I was a reviewer on standi city.du and it is not the easiest process to submit an
application for a grant. So if you're doing it for the first time and you would like some help
then ask and I will be very pleased to help review your application so that it's more likely to succeed.
I am going to start. So I'm on the other end of the spectrum so I'm part of an open source
project that's international. It's not just you, it's the United States, it's in East Asia,
all over the world. I have some concern when I hear standards and regulation together because
that's just going to make our life much, much more difficult. So I just wanted to open that up as
a question really. How would you address that? Yeah. How back in the book? Thanks. I mean the reason
I like standards is because they represent a kind of bottom-up organic form of self-regulation
where the expertise of people on the ground is codified and can be dynamically adapted to the
needs of an ecosystem and so therefore I think it's kind of true by definition that when regulation
gets involved it's a little bit harder, everything becomes a little bit heavier. I think that's
just true but I also think that regulation generally can play a positive role in sort of the
organization of our modern societies that are super complex. So I think it has to be a kind of
given take and I think certainly for the cyber resilience act I don't know if you're familiar with
that part of the work but I think it was overdue that products need to be secure and so this fast
tracking of a discussion on we suddenly we need harmonized standards for this that's only possible
because there were so many existing frameworks before on the market. In fact the market had
the fragmentation of security frameworks where basically each sector had its own approach to security
and this is also inefficient and not necessarily reasonable and also a bit kind of security
by obscurity or even insecurity by obscurity and so it's a different form of of obscurity and
and prevent and certainly preventing of security as a as a name that people should be entitled to
is not really met by a fragmented landscape of frameworks that are not mutually compatible.
So I think that the CRA can as a form of regulation can actually come and give a sort of incentive
to have a more a broader discussion, a coherent discussion of what does really security mean
at different security levels. Otherwise we kind of end going only for the worst case scenarios
that need to be treated because otherwise it would be a fiasco but we don't really cover
sort of medium and low risk consumer risks for instance in a very systematic way.
So it's basically I see it as the need for a dialogue and that legislation should certainly
learn from standardization but at the same time legislation can kind of insert more high-level objectives
that may be standardization was not addressing and therefore kind of give a stimulus for those
high-level objectives to also be met. Yeah, I wrote it. Yeah, so thank you for this question.
I think this is a very important question. I think one of the undersung value of open source
is the fact that open source has standardized licenses that every lawyer in the world kind of
know what it means, right? I mean, it's a big overstatement but like there's that they yeah yeah yeah
and that's incredibly valuable because it means that you know this whole trove of a software
that is part of the common goods is really easy for anyone in the world to just include and
have a good sense of how they're going to be able to use it not only in their own country but
as they export their products elsewhere, right? Of course, if we now have compliance rules and
different countries that are entirely don't match, right? And if you build something in the U.S.
leveraging a piece of open source that is compliant to U.S. legislation but then when you want
to move it to Europe no longer compliant, that's going to be an awful nightmare and we're going to
completely lose the value of this whole open source all of the of all open source really.
And so I think this is why we really need to start talking about a harmonized compliance
and essentially leverage standardization as a way to get compliance across the different jurisdictions.
I think this is really, really critical and as we you know as as we address the CRA we have to
think about upcoming legislation elsewhere, right? And this by the way is why our interest group at
ORC is not called the CRA interest group but the cyber resilience interest group because we
acknowledge there's going to be more legislation of the same nature and the artifacts that we produce
we want it to help all of those different, all of those different compliance requirements and
all of those different jurisdictions. So comment, just rain 10 minutes and I'd like one more topic
of those standards. Yeah, so I do not agree with what you said. There is all about that we have to
have like all like you know that it is too fragmented and so on. So I'm a software person so that
means like my understanding of what the reality of software is is that you have to have different standards
because you have different industries you have different in all like especially when safety
something else than a pure security standard. So that means like there is a need for a variety
of things that work that's a one part. The other part is every like you know of course like
if you believe in democracy then you need to make a sure that you know like that other countries
can also actually choose whatever they choose as their main objective for security and safety. So
but what's what's the power of open source is to be able and anticipated and also like what
we do a lot of like mapping like the hell out of like legislation and how what tools can
head to supply you know like with what head. So there will not be the ultimate you know like
horizontal standard that is there and you know like if you follow with you like you know you
like this is not going to work. So I believe there needs to be also that realism that you know
like the acceptance that in that sector it is like this and then you know like so and this is like
you know like more the framing and more in my point of view but also the strength of open sources.
It's just one hand side like to you've to be exactly what you said as a product manager I'd like
to advocate a little bit for the end user and customer and one of that is if you regulate him
you need a definition of done. So you need something that tells when he did his job
especially if he's liable and this can only be done in a fair way it be a standards.
Thanks very much sorry just sorry a quick idea that I also wanted to share so first of all
I made before this this pyramid on the screen I don't know if people in the video if it's
still visible but for the cyber resilient act we certainly it's not enough to have horizontal
standards things need to get specific and that's where you can have the dynamic of understanding
the context and understanding sort of what are the risks and what are the appropriate mitigations
so I certainly agree that the horizontal discussion is just the beginning of this conversation
and is just to try and give a kind of coherent umbrella framework for it it's not meant to be a
single standard for all so definitely importance of context is key and also the difference to
safety I think is really interesting and this is where I wanted to plug in because maybe people
here in the room can actually participate in in this broader discussion so I've understood that
some concepts that we're trying to use from a legal point of view were developed to deal with problems
of safety and I realized that safety even though it's very complex and you have to be very careful
about safety you know safety is about something that affects human bodies and human bodies have been
roughly the same for the last three million years since the sort of homo erectus came about but
computers have evolved a lot in the last three million years especially in the last 50 years right
so so it's very difficult it's it's a more dynamic domain and so what that means is that we need
new social structures new social frameworks for how to think about the dynamic landscape how to
think about evolving machines and how to think about different use cases when you have an industrial
machine it's usually one big machine for one big purpose and it's always in a factory so one
machine is one use case but when you have a computer one computer can be put anywhere and can be used
for anything so you have infinite context infinite use cases it's a completely different approach
so what this means is we need to start thinking how can this be proportionate how can we think about
a computer but not have a single statement on that computer we need to have different statements
for the computer depending on where that computer is what the computer is doing and that again comes
down to this idea not horizontal standard no we need product specific standards we need standards
for specific use cases so that it can take context into account and this is where everybody comes in
what are the contexts what are the use cases what is the correct expectations for security
for a given use case for a given set of users this is a key societal discussion that needs to
happen and we'll start to happen now that the CRA is a low so it's not going to be right from the
beginning it's not going to be closed from the beginning either it needs to start happening and
everybody can be a part of that discussion when they make explicit what are our security expectations
thanks no stopping go for it well this is something I've been thinking about for quite some time
and I remember when when a patent was issued for I believe it was Amazon and it patented the idea
that a user of a computer could click a button they didn't define button by the way buttons are
all over the button you could click a button and buy a product and they patented this idea now that
was to my mind one of the stupidest patents ever issued and it brought to mind the fact that
patents are good for lawyers they're bad for everybody else except people who want to make money on
some stupid idea I would just have one request if software developers and open source in particular
software developers are going to be relieved of the burden of proving that they are in compliance
simply by following a standard I would beg you to disallow any patenting of any standard
that we are supposed to adhere to and standard should be developed in the open any idea that they
should be patented is I'll use the word again stupid that's it yeah just say thank you for saying this
and I the reason why I'm here is to make sure that as many people as possible can go and
analyze the standards to make sure that that happens okay we need people who know what's happening
inside those documents to identify if there is a hidden patent inside so that we can meet it out
no that's why we're here is not patentable not patent yeah I don't have the power to do that but I can
there be a good law that would be a good law but that's a different conversation it's not the
CRA standards but I agree with you it's a good law I got some hope for you sorry the original idea
behind a patent was that the secrecy which was before was put to an end so that people could
open the way or their technology to the public so that others could learn in exchange so
it was a trade in exchange for a monopoly for a couple of times right but the problem is 25 years
is a lot and currently 25 years is too much to monetize on a product or if standard in IT so
if we just keep a look on connectors and how fast they are evolving so it is not the guarantee
for development and for money on for anything else but open source is because you're faster
and you're setting sort of standards and compatibility while you're openly producing your
products while others could adapt to it and I think that has the potential and shows already the
potential to overrule this closeness of patents and borders in favor of a faster moving and more
prosper economy thank you my hope is just that we can use the excuse of European legislation
to make that world come about thanks thank you thank you okay so the time has come