Right, so we have around 20 minutes to fill, so we can have an opposition as they want
that it's planned on the end, or we can have people ask questions, or we can have, I don't
know, we can get it, we can get it.
So does anyone have questions on anything regarding as bombs that there is a room full of experts
people here that they can answer, I'll make sure that, yeah, we'll have, let's start
from there, right, right, so the question is, what's the best tool to do everything, or what
was it, yeah, to do everything with that's bomb, and yes, I'm pretty sure we will have an
answer here, a single answer for everyone, right, another question, is there any update on
the season tests on the S bomb, until he has his own up, there was a briefing for the participants
who had submitted S bombs, they've only looked at the Cyclone DX S bombs to date, which
was the were more S Cyclone DX than SPDX tools or S bomb submitted, they were identifying
some common themes, some languages were better than others, some of the tools were better
than others, I think worst was quite good, there were some challenges, no surprise you
that things like C is a real challenge, there was clearly very few fully met the minimum
requirements, which I think with everybody would recognise that, that's been a challenge
for everybody, there was quite a variety of the level of information that was included
in the S bomb in terms of the richness, some were very minimum, some had a lot of data,
I think it was quite useful exercise, but I think determining what's the source S bomb
and what's the build S bomb, people have different interpretations, the data sets available
there are nine data sets, if people look for S bomb harmonization, then there's a link
to the nine repos, I think the final report will come out at this month or early March,
I think it's how much of it will be redacted, I don't think it's going to identify the
particular tools, but I think it's going to give general themes, but I think each tool vendor
has an opportunity to talk to SAA directly to understand what they, what was found.
So, repeating the question would be, the pretty much question will be like, the outcome
of the result will benefit us to improve what we are doing, or actually if it shows something
that we will screwed up because it will be saw by management first and they'll try to
impose us to change in things that is basically decided by SAA not us, but, yeah, valid, yeah, yeah,
yeah, yes, we know, yeah, you know, somebody else, yeah, please, you should die
there come here, because yeah, you should come here to the mic,
check one, two, okay, I know that some industries, at last the medical device industry,
which I don't work for, has been organizing some plug-fest since five years now, between
producers and consumers of SBAM under NDA, of course, close door, etc, but five years
is quite long, obviously they use different tools to produce and consume SBAM, so that's
interesting, and they published a report, not too long ago, maybe one, two months ago,
if meter, it's public, it's available, it's about 20 pages long, really, it's quite interesting,
but all the pesky details that you can have when actually trying to use or exchange SBAM's
across organization, thank you for that, yes, there have been many efforts of running
intercompatibility tests between the different tools based on the specs of like that,
yeah, we've been running them for a few years or more than a few years, okay, on that one,
anybody else, a question or something, yes, please,
but it's very fun to call it the issue that was mentioned and the database, okay, Augustine,
the question was about the software transparency foundation that was mentioned in the previous
slide, and Augustine is the right person to answer, it's a Spanish foundation, it's
a small one, it has basically one core service at the moment, although this year we will
start hosting the open data sets, the services basically, well, probably you know clearly
the fine, okay, so instead it's something like that, so we are taking advantage of the
a subset of the scan OSS knowledge base and we are providing the service for free to open
source organizations, upstream developers, obviously it's a very expensive service,
so we have some limitations on the amount of scans that you can do as scale, actually
there are several software composition analysis, open source tools that use data as a
backend, I'm going to name three, phosology or T, first slide for instance, and the idea
basically of this service is provide something to upstream developers to be able to create
complete response, so they can detect what is the clear, but also they can detect what is
the open source that is not the clear, the tool is extremely good at that, and then obviously
you have to do your manual creation to decide what you do with that information and then
use whatever tool, you can also use the open source scan OSS tools, and what we are hoping
and aiming is that more tools use as a backend for doing that, and hopefully we will
also get some members to put some money so we can scale up the service because it's the
operational part and the cost system, the main bottleneck at the moment, it's a Spanish foundation
if I didn't say, thank you, it was thin, others, questions, announcements, Thomas,
yeah, I don't, I'm full no, I'm full touch guy, I don't know me, everybody knows, almost
almost everywhere, there are new people in the room, so my name is Thomas Timergan, I am the
do Ospo Ambassador for Europe, so basically we are talking about a lot of the S-bombs I am
involved in this for many years, but I do mostly open source management, so I just had a
question about what S-bombs tool should you use, before you look at an S-bombs tool, we
as open source, Ospo professional say, first right your policy, because all the service
queue, all the laws is all about risk management, so first right your risk management
policy, then you know what your risks are and then start looking at tools, and of course
it doesn't pick it up on the right for some reason, we are working from the open chain
community, we're actually trying to help a lot of people know here, know already how
S-bombs are about our tons of people that don't know, so from the open chain community
we're organizing an event in Stuttgart in a beginning of April, and it's basically meant
to help the people in the sudden half of Germany love S-bombs getting into open source management,
so these are people that probably have never heard about S-bombs, they might have heard
of open source, but they did hear it about S-bombs, it's a really, we're trying to basically
bring various parts, so I actually organize a lot of events, there's also going to be an event
in Amsterdam, as well as people are more reading to Ospos, but this is really meant for open source
management.
Oh yeah, I need to stay out of the, I don't know, you have to smack me.
My, my, my, my, my nice little camera, and the nice thing out is, so we're going to have a
three-day event, we're doing this together with Bonne Lutibuck, and the nice thing is for the
small S-bombs, Bonne Lutibuck will make grants available to help small S-bombs get started
with open source management, so all the questions about S-bombs tools and all the other stuff,
they don't know anything, bottom of everything we like a lot, that's, so that's also the
nice thing, it's actually a collaboration of many different parts of the open source community
basically coming together in a very nice location, Institute Guards, to really try to help
basically the smaller companies that are, and I'm organizing similar events, I can also
let it all over Europe, so we're doing one in March, in Amsterdam, which is basically
most of government focus, and I'm probably going to do one in Paris and in Sofia,
it's pretty good for somebody who's doing an employee and just gets money from open source
friends to do things, so if you have any questions or want to participate, speak a lot, let us know
and we're happy to have the two core organizations, Marseilles here as well, so I'll send
thing, if you have any questions about journal open source management, so I'm not just
you can ask me anything, take your lectures,
other questions or announcements or whatever, or we just relax for the next 10 minutes and
yeah, fuck that, it's an open mic and that's always
Kate, although she's on this poll, she was
grateful enough to bring us lots of nutritious and I also brought around 60 different chocolates
and yeah, so we can survive the day, whoops, considering a get together after this death room
that's the thing, people trying to get together after a while from the vacation, yeah,
okay the question was, is there interesting get together after this, so if you're not bored
or looking at the same phase is for nine hours, if you want to continue that after all,
I think it's free for all, I don't know, I mean, yeah,
yes, Anthony has a question, I will repeat it so yeah, go with it, also there's also
a lot of issues about AI and actually Bill and Monsieur for AI, as part of the transparency
and the ELA AI app, what comes first, and in the goodness of standards we have SPDX and
cycle of the X, both having different viewpoints about the data to be captured in the AI,
what are people thinking about how they're going to address in the funds that the AI
act in terms of providing the transparency, are people already developing tools, are people thinking
well, yeah, is an answer, but what are people starting to be, is that on people's horizons,
really, because when we when I was in SPDX, SPDX was starting to think about the AI fund,
so summarizing this because we were, so yeah, the question is about AI,
modern software, very software that is pertaining to AI, right, and there are regulations that
we have about AI, they have also a regulation about their bombs, there are ways to express
information in different standards, what do people do about it, do they produce new tools,
do they use what these there, that was Anthony questions, anybody wants to offer it inside?
Yeah, yeah, yeah, Helio will provide their insights.
So basically is inevitable, yeah, okay, you are ready seeing the people trying to use,
yep, don't, so you're ready seeing people trying to use an AI and an event in
it, well, we are being seeing that, but we are changing exactly the focus, because people don't
realize that what really happening there is that after-driven results is done, who evaluates
these results? So basically we have two options, are you starting to teach in lawyers,
are you making lawyers become AI, they've evaluated results, so you make it as a completely
full circle, but it's not in another way, we need people that understand what results is done by
AI, so yep, it will happen, we can, we see tools doing that, we see people selling
proper tools with that, but the question now is that how we find people to evaluate these results,
because no one understands anymore, how is this done or the origin of the things, yeah?
Thank you, Helio, just second, yeah, you want to answer, yeah, thank you,
yeah, but yeah, very short times whereby Marcel and would be, not an answer, but an addition to that,
so some of you might know that since last year we're trying to do also some
dummy repositories that we use on the tooling side, right, to also have some reference inputs
to test our tooling to have this central reference, and they are on my wish list that would have
been a dummy for such an AI, so if someone has an idea, it does not need to be a big one, but just
that we, because I'm a hands-on guy, those who know me, I need something to play around, so if someone
has something, you're welcome to contribute with that, and then we can also have a look at it
in practice, thank you, that's a great result, yes, one minute maybe two. Hi, I'm Hank, I have never seen
of any of you I think any day like before, but sometimes you see me in Zoom calls, so I'm coming
from the world of trustworthyness and FPGA's run models, and some people want to understand which model
was activated and take relief stuff and something went wrong, that's for our
continuity, we were talking about lawyers, yes, they are interested in which model made the mistake,
and that's a continuity problem, so what we're doing is we are creating remote attestation
evidence proofs about which model ran on which hardware, which was typically FPGA's arrays,
and then we create evidence about that, in order to make that evidence actually actionable in a
legal sense, we are using e-notaries, which is transparency service, and then we just create a
want to say, a receipt that this has happened, and this receipt will survive the existence of any
other certificate that it lives, that all these have live spends, and they're basically enshrined
and append only ledgers, I'm not allowed to say a mercury, so it's an append only ledger of a certain
constraint, and so what we actually have to put in there is an interesting thing, that is
the association of model to hardware, and if this is a bomb that would be great, if this is a
standardized bomb that would be even greater, but at the moment we are just going with the evidence
that is hardware environment has some software running on it, and that's all, it could be better.
Thank you Hank, so we managed to fill up this empty space,
if we'd like to be able to create a found description of the sequence,
we'd like to open them.