Thank you.
Sorry for the delay.
There's always technical issues.
My name is Salvin Wilson.
I'm involved in a group called the CPAN Security Group.
I'm a new person, a new member of the ESPOM community.
And I'm going to talk to share some interesting stuff with you.
I was hoping the technical stuff here would become a little bit easy to handle,
but everything is going wrong today.
So we'll see how we manage.
A little bit about myself.
Let's see if we can get connection to the screen here.
The real topic should really be,
whether it's in all of the supply chain should make the data come from.
But attributes and make the data,
then it's like key in value pair.
So it's just assumed I mean both.
So why should we even ask about where our metadata comes from?
There's one major reason for us in Europe,
and that comes from the European Union and the cyber-sinsactive,
which says supplying incorrect and complete or misleading information,
may be find up to 5 million euros or 1% of global turnover.
So somebody is threatening us.
And the references are in the slides.
I'll make them available through the organizers later on on the foster website.
So this is awesome.
But now that I've showed you some texts from the cyber-sinsactive,
I have to point out I'm not a lawyer.
I'm actually not even an authority of any kind. I'm just a volunteer.
So I'm at the lowest rank in the open source community,
and anything you should take everything with a pinch of salt,
but I hope it's still useful though.
And what I'm showing you is my own studies over the last year or so.
It's a working progress. If you find something wrong,
it's okay, because tell me about this.
I can improve it, so this can be a useful resource for everybody.
And yes, contributions are appreciated.
This is based on basically open sources,
attribution share light published on the CPAN security group website,
and I would love to hear some feedback.
So I'm bringing an ecosystem perspective.
What you see on the left here is an open source ecosystem
and an idealized way with the different roles
that do something hidden behind the bunch of names here.
Maintainer, Colabi persistent would be the GitHub.
Language ecosystem would be PIPA, CPAN,
that on package ecosystem would be the debions
and the container registry is out there.
There's a new thing called the Stuart.
There are contributors in here, of course,
and the manufacturer would be an integrator,
somebody who writes applications and makes something
valuable, that's somebody's willing to pay for.
At the bottom, you have a customer who cares,
or a market authority who wants to check if the metadata is correct.
I won't try to quickly go through all these.
I think that we have a short time, so I'll have to rush a bit
that I hope this doesn't make this horrible talk,
but we'll see what we're going to do.
Might also cover a few more points.
So just for the colors here,
these are things we do with metadata.
We create them, we contribute to the metadata,
we distribute them, we verify them, and we censor the metadata.
And each of these different roles throughout the ecosystem
will be doing something with the metadata.
Here are a few of the actors you can find throughout the ecosystem.
These are not all of them.
I've found in my research.
I've tried to figure out, and naming some of them
as they will be in a struggle.
A custodian, for example, is an actual role.
You can find that work on the half an open-source project
to take care of it if the original author or maintainer
is not available anymore.
He left or she was driven over by a time
or it could be anything.
Somebody takes care of it because the code needs to exist
and if there's a security issue, somebody has to take care of it,
but they don't own it or they cannot take full responsibility.
These are a lot of them that's simplified a bit.
Here are the ones that are significant when it comes to metadata
and it's ordered them a little bit.
This is the order that are from the top of the two of the bottom.
The author and the maintainers are the top.
You have a custodian, so all the contributors.
Somebody builds the packages.
Somebody's a curator, decides where it's published.
There's a student there coming soon.
Somebody patches the packages.
Somebody packages the packages.
Some of the symbols the containers.
We do all the packages in it.
Some want to integrate something.
Something is being deployed.
And each of those steps will influence the response
that the metadata that are being produced.
And all of these are sources potential or actual sources
of the required metadata that we have threatened with the final.
So that's already one of the questions that I asked in the talk description.
There you have it.
These are some of the people.
We should know about them.
And while they have to probably also talk with them.
Because they have information we need.
So those are the actors.
We have a bunch of attributes.
We want to care about them.
We have some metadata about the metadata.
Of course, you guys probably know this by heart.
Some of those who are on the other side of the camera might not be.
I'll be sharing some of these.
These are the basic ones from S-bombs.
The antenna and the IA's.
The minimum elements should be known.
A few more here in bold from them.
Caesar added a few more metadata with a framing document.
Sarah adding more data.
Because they want to make things work in their regime.
The German design.
The information technology regulators.
They added a few more hidden in there.
They are in bold.
Please trust me.
There's a reference there if you want in blue.
And the security change bureau in India wants also a bunch of stuff.
And I'm trying to give you here a point here.
There's a trend going on here of more and more attributes being added.
And the ecosystem.
Some people who need to write the tooling and who are writing the services.
And have to update specifications to handle all these new metadata.
We are throwing our hands in the air and say, you know, this kind of going.
If every country is going to add their own metadata, this is going to explode.
And it will be horrible.
Because these open source ecosystems, all of them.
They have a lot of constraints to work under.
The ecosystem cannot break.
They have to keep on being compatible.
So people cannot upgrade tooling and make sure that it continues to work.
We have to think about forwards and backwards compatibility.
We have to make sure that any upgrades that happen.
Among the users and the businesses out there that have used this tooling.
That upgrades happen without any problems.
And there's a lot of work around information and outreach to teach people at this time to upgrade.
These are the new features.
And all this happens with volunteer work.
This is maybe not for you guys.
You are at first them.
You know this stuff on the other side of the camera.
Maybe there are some regulators who are maybe not completely aware of this.
So the reassure of ecosystem responses when somebody comes and asks at least in my community.
If someone asks for a feature, they say, well, volunteer.
Thank you for your thoughtful input and your contributions.
So who's going to volunteer to make all of this?
Maybe it's a little bit unfair to ask the regulators to do this.
We do have a bunch of people who are involved already.
So the ecosystem people we are all in there.
And we have stuff to do.
Standards people, yes, we know how this works.
They are of the social way awesome stuff that's happening there.
And we have now a new part of the new member and the regulators.
The common fold we need features.
Of course, they are not in the business of writing bug reports.
They need to work on a different level.
But in a sense, they are still part of the open source community could say.
So here's the second question.
Where do the aspects of attributes come from?
Both are the three.
ecosystem people about the technical fields.
Standards people about the metadata, metadata and the other fields.
And they're going to just about things that they feel is necessary.
So we have no one who we can point at now.
Awesome.
This is cool.
Now, I would like to do a little bit of a quick poll with you guys here.
Can everybody see this?
So this is a sign.
I'm going to race.
And when I race it, I want everybody to clap.
Awesome.
One more time.
Brilliant.
Okay.
For those on the other side of the camera, this is what it sounds when everybody claps.
Now, if you only the first door claps, now when I race it.
And just you clap.
Okay.
So if everybody agrees me, you know, now know how this sounds.
And if only one person agrees me with me, you know how that sounds on the other side of the camera.
You can't make it on this is me.
Can you see me?
I know it's your mic.
Yeah.
Well, we'll hope.
Let's see how this goes.
So component attributes.
Let's make a clap for each one of these is this useful.
And I want to show the sign you make a clap.
Prime me, component them.
Version.
Purpose.
Supply a name.
Security contact.
Corporate notice.
Licenses.
Unique product idea.
Cryptographic hash.
Prime me, component file name.
Not that much.
Depends this.
Everybody knows that.
Depends the relationship.
Yes.
S bomb author.
Fuel like that.
Creation type sign.
The format of the S bomb sign.
Generation tool.
Only a few.
The location where you find it.
Three people.
Prime me, component.
Wow.
This is actually important because you refer to what.
The component is referring to.
Like this is we need that one.
So if you didn't clap now, you need to read up.
Sorry.
S bomb release.
Nobody knows what it means.
serial number.
Okay.
Sure.
We can want to detect changes between S bombs.
Some of us are this type.
S bomb types.
There's a ecosystem.
And then we have different S bombs at different places in the ecosystem.
How about the stuff that opens or steward requires.
And intended for commercial use.
Three people.
Who is the open source steward?
Three.
Security attestations.
Five.
Maybe six.
Awesome.
How about the manufacturing attributes from the cyber scene.
In fact, they need to know what the confirmed assessment bodies.
One person.
They need a lead to the declaration of conformity.
Five.
Yeah.
How about the support end date?
Is that useful?
How about the technical documentation?
Yeah.
Some of them like that.
Authorised to pass sensitive.
Not very attractive metadata fields here.
It's too bad.
How about special attributes for integrators in Germany?
Like.
The executable property.
One person.
The archive property.
Nobody.
Structured property.
This is required by the BSI.
To be included in S bombs that are delivered in German legislation.
And it's published in September.
Version 2.0.
But still.
Even if it's specific use cases.
The tooling needs to support it.
Because it comes from where firmware.
The information needs to be stored.
The metadata needs to be shown in the websites.
It needs to be found.
It needs to be indexed.
All that stuff.
This implies work.
How about in India?
The special attributes for the integrators in the international sector?
They want to have known and known dependencies.
Could be useful.
What encryption is used?
How about the frequency of updates?
Access control information in the S bomb.
One person likes that.
Methods for accommodating errors.
This is required from the Indian financial sector.
Yeah.
So that's.
Yeah.
No claps for that.
So there's a point for me.
In addition to giving your chance to move on a little bit at the end of a long day.
So I'm not getting going to sleep.
After the two days of intense fasting.
There are also things there that are important.
And here are some optional attributes.
Nobody's asking for them.
Who thinks a download location for where you got your architect is useful?
Quite a lot.
Who would think code combination would help you find security issues?
Almost everybody.
Who thinks that having a link to the code repository would be useful?
Yes.
Nobody asked for this.
No more of the regulations to say this is important.
This is not just a mismatch here.
Which is super important that we are well.
So I'm going to break a big rule here.
I'm not going to ignore you.
The audience and instead go to the camera and say, dear regulators, dear regulators.
Welcome to the open source community.
We are many, we're much more, many than you are.
We are everywhere because open source is not a country phenomenon.
It's a universal phenomenon.
You can find open source people on all continents in Antarctica.
You can find open source people in space everywhere.
So of course, we'd like to support everyone.
And when you as a regulator say, I want this and another regulator says, I want this other thing.
And the third one, we have 200 and what's 30 countries on this country and each one of them would like their own special little thing.
Because if it's special or they have a special need for their specificity.
The ecosystems have to support all of it if it's going to be useful in your legislation, in your regulatory era.
And that is not tenable.
That's not useful because we are volunteers.
We don't work for free.
This is not the same thing.
Volunteering is not the same thing as working for free.
You share out of your own free will because you want to help somebody or you want to do something which you can be proud of or things like that.
The set of motivations are outside of money usually and it has worked.
We have 20 or 30 years of open source now and free software that has proven this model works.
So you can play along with the model or think you can do better.
I can hint to you now, it's better if you just become a part of the open source community.
And do it all the way with it has worked.
It's really good actually.
So your contributions are welcome, well volunteered, but not all of them.
So do like an ST and see their focus on the minimum of stuff.
When an ST published their minimum elements, that was the right thing to do.
They just found out well is the absolutely most necessary of metadata that is can be required.
And we need for everything to be useful in function.
And the CSR recently updated that list.
Still good stuff, but please don't be creative.
Because somebody else has to do the work unless you make pull requests and of course that would be awesome.
But nobody expects that from you guys.
So well volunteered.
There is time for some questions and comments.
There's all right.
And before we stop completely, there are references.
And thank you.