So, I'm presenting today on behalf of US that's a community driven project that I'm
leading it's around for a year and I want to use the occasion here at first time to
a little bit summarize where we are, what it is about, and what are the next steps.
So, why are we doing US?
So last year was emotionally very difficult for some of us it was a year of demigration from
Windows 10 to Windows 11 for many of us.
I also was immigrated against my wish and there are other questions of course that are
relevant in this area.
Some hardware didn't allow for such windows migration because they were end of life, they were
not supported by Windows 11.
And then in my previous rule I was working for data protection authority that also had
a case with Microsoft and then using products for Microsoft at the same time feel a bit awkward.
So it's also a matter of having control of your working environment and there are some
areas that are more important than others.
I would say this is the case for competition authorities, for data protection authorities,
for courts.
But there are also the military, the embassies, the critical infrastructure at large, where
possibly with open source you would have more control and more resilience to carry out
your work.
And these are all the motives where I think there is a good case to use open source also
as a driver for our digital workplace.
Of course we see that there is rarely the case today and there are many reasons I suspect
why we do not all benefit from Linux on our corporate devices.
Immigration is, this can be some difficult to organize, you basically need for some time
two teams at the same time, a Windows team, for the ongoing operations and then a Linux
team to prepare the new set up.
Immigration can be very expensive because the cost saving benefits will only emerge later
and if many people are doing it at scale, then you may not have the know-how in-house
and the ecosystem and comparison to the Windows world is quite small, so there is also
shortage of expertise and in the absence of world models, but we all know where it worked
out perfectly, there are many unknowns yet and there is of course a risk to fail and we
have seen possibly in the Linux migration world more big cases that failed than that
where a success which also makes us not so attractive.
And of course there are the end users who are going to want to have any change at all
and please don't bother them and this is of course also something that a migration
would need to face and not all of these problems can be solved with something like
a US project or a risk-release or some are more inherent to an organization and how
human beings are in general, but I think some elements can be improved if we would collaborate
to explore some energies.
And I see that there are two areas for these energies, the first one is that if we have
a common approach on how to organize such a Linux migration, we would benefit from sharing
of knowledge, from sharing of the expertise that we have around and if we use the
same building blocks that we know already from the cloud technology, from servers where
we have been using Linux for years, we also explore these energies from these investments
in the cloud area and also from the cloud engineers that many public sector organizations
may already have in-house.
So what is the US?
It's not a project of the opinion, but it should be and some people are working active
on changing that, we will see how it goes, it is not a new Linux distribution because
indeed there are already many Linux distributions, but it is also not for private home users,
they can perfectly use whatever Linux distribution they are already around, they don't need
a managed system for themselves.
And it's not a project that is producing original code, of course we propose upstream
changes that would benefit our use case, but we reuse mostly existing codex explained
people how they can use it together.
So it's a proof of concept on the deployment of a fedora-based Linux OS with a KDE plus
my environment and bootable container technology that we know from the server world and
a typical public sector organization.
And it's not limited to the public sector on principle, many companies or NGOs have
merry-similar requirements and could also benefit from such a setup.
So US is a community of people who want to bring Linux to the desktop and the corporate
environment and it's another space with a website where we want to gather all the information
necessary to do that.
So how do we want to do this?
So I have done some research where Linux is used in the public sector on the desktop
and you see there are already quite some areas and it's a little bit growing.
So last week I added this one here in Prague, let's see archiving, the National Archiving
Center where they use fedora, bootable with bootable containers, very similar set up for
there for the rack stations and we see that in Spain especially in the education sector
there's quite some use of Linux but they're all work very isolated and all the setups
are different and therefore we have every struggle again from scratch and the idea is to say
yeah to make it at least easier for those that would like to get on the map that would
like to adopt Linux, let's do a similar fashion.
The proposition here and these are the only two technical slides I think I have is to start
with the container technology where we have a base layer that could be fedora and central
S because these luring mechanisms at the moment best supported by fedora possibly with
KDE then we have maybe a common U.S. layer with things that every organization certainly
needs but then of course every organization could add another Docker layer with their specifics
they are drivers for their printing system, their VPN whatsoever then we package this with
a tool that is core blue build it's open source we can do this in our existing get continuous
integration system and then with his bootable C technology we can transfer this on a desktop
without any hypervisor and with the form and server that is normally used to manage servers
we can actually also manage these desktop devices so that they will get provisioned fully
automatically and also keep up to date and then of course for the users we would have something
like free e-pa where users then can authenticate using the central directory of users to the
laptop and it also supports somewhat active directory to have intermediate hybrid setup and
this I think what we will need to to face we will have first organizations with only windows
that use X of directory then in the next step we want to add
some working groups that work then with a Linux desktop that is authenticated
and authenticated via free e-pa possibly still embedded and part of the X of directory and eventually we can take this array and
we end up with an organization fully on open source
so now let's boot up the system so where are we so far we have raised awareness on these matters
with users through our personal network through social media and we have reached out and had discussions
with the UPN data protection by the UPN Commission's digit department, connect department,
HRDS department with a joint research center that also this already using Linux,
e-rogers, duropole, the U-parlement courts, we have also spoken to international organizations such as the
International Committee of the Red Cross, the United Nations, the International Criminal Court and the International Court of Justice
and with a number of e-member states with denom, with senders, well-known and these four are here at Lissie Coldstein with the Ospo of the Netherlands
with the people from the Ospo of Luxembourg and we had a demo where we showed that during the talk
we can provision hands off a machine with the US and we will do again a demo most likely early in February in Madrid
so I hope that we will also have some discussions with the Spanish
and normally I would expect that this year we will also have a first feasibility study with the pilot and a public sector
organization with 150 seats possibly but we can only talk about it more after it happens
so what has been the feedback so far? What do people want? So when I talk to them they do not want to have anything innovative
they want to have something that is already around for 20-30 years at best that works really well with thousands of seats
and they don't want to be the first one to use it, they want to be the last one using it
they want to have enterprise support, they want to have enterprise tools for life cycle management of everything, monitoring and so on
and if we now consider that those that have an urgent need for digital sovereignty will be moved first
then this will be called, it will be the military, it will be secret services and they require of course a compliance with many different rules
so if you have the first one for a product to go through this this will be very hard
so ideally we rely on tools that have been already certified before in various contexts to make this process easier
then of course organizations often have already some sort of Linux use so they may have containers, they may have servers, VMs
or they may have open theirs that also has internal Linux distributions and then the question is do they want to have another one for the desktop or do they want to benefit
from doing the supply chain security under certification only once and use it for all of these use cases
so ideally there is this idea to have consolidation to one or very few Linux distributions in their organization
and then on the server side SAP is very important for many of these organizations and they don't want to change everything at once
so whatever it is would be nice if it has support for SAP and then some of the tools like MATLAB or SPSS or whatever this organization is doing in substance
then it should be of course supporting the sovereignty of the organization should be sustainable
and I talk about this in a moment a little bit more and many public sector organizations really like supporting their local economy
so if they can have a local champion that would be something that they would check out first this was my impression
but then again with the consistency it is difficult because your local economy might not provide everything
and then you will start importing other softwares from other governments and they have maybe the internal different dependencies
and this is why I think if as Europe or even large on a global scale we can agree on a set of digital public goods that we use again and again
we get closer to the goal of having consolidation with the tool and it will be much easier to support and maintain them in my view
so what is the commission saying on the topic of digital sovereignty much has been said in speeches which is a difficult to process
in this precise context part there is actually a project ongoing for cloud purchase system that allows institutions to get sovereignty in the cloud space
so that they have prepared an annex with the sovereignty objectives that gives a few details on how to measure specifically digital sovereignty in the context of cloud
so this framework does not apply for us because we are not doing cloud to redo the desktop operating system
but there are still some elements that I think can give an idea of how these organizations are thinking about sovereignty
highlight already two of the criteria there is this one of one strategic sovereignty it assesses ownership stability amongst many other things
and then there is another criterion number five which is about supply chain security will also point out that the graphical origin plays role
there is another talk about this specific document and what it means and how organizations can assess their own products
offered by Emil Brook tomorrow from open so I all invite you to check that out I try to be there as well
so what does it now mean for our question for the distribution that U.S. showed a build upon
I have written a blog post was a number of points, tables and numbers to also get some feedback from the community and the community then normally answers
but fedora is too much of the U.S. how come that we do not use outpind Linux and yeah I think if we do not do it was nix so as we are doing something one
so I this is like 80% of the feedback that I have and I want to remind everything also here through this talk again
it is very different if you want a corporate managed Linux fleet and an organization that is a court or if you are in your hacker space
and you have also your own Linux computer so you have much more freedom in the second case
so when we now look at those Linux distributions that I have been battle tested where there is a support network of at least one big player
they are not so many Linux distributions so there is Debian which is not profit in the U.S. but also in France managed by volunteers
but many organizations and companies work with stebian and can offer support there is Ubuntu which is a company in the UK
200 million dollars apparently revenue there is open user which is more revenue more staff with a headquarter in Germany and it is registered in Luxembourg there is redhead
which is again factor I don't know 10 more revenue more staff in the U.S. but also in the U. Interestingly there is the Armalinox Foundation which is a foundation in the U.S.
backed by some big players and then there is the rocky Linux Foundation that is something very similar
so what are the takeaways here? Fedora is factor 10 bigger and most of the developers in the U apparently work with this with Fedora
and that also mirrors here in the room when I asked who is using open user Fedora there were a lot of hands on Fedora
many people overestimate the market share that Ubuntu has on the Linux market
I think Ubuntu really made Linux more known but it is a lot of private users it is not so much the corporate users
and also the cloud business to drive the adoption of the Linux distributions and it seems that open user because it is certified for SAP products
is used a lot in the cloud area as well and Ubuntu may have less paying users even though it is very well known brand
so now the problem is that all these distributions are there good enough for us and this is why I think it was so nice that we had the previous two talks
where we heard first about the public product organizations so we could now ask is anyone of these distributions that we have seen
close to that or there was this idea of the digital public goods in the previous talk
and I can tell you that the user Linux enterprise has been certified as a digital public good
and also Fedora is a digital public good
but when we look at the criteria that the European Commission put out for the cloud where they look for long term ownership stability
I wonder how these mechanisms the digital public goods and the initiatives around it, the infrastructure around it are reflecting that well
so I think that could be a gap in the certification mechanism because if you want to have very good ownership stability
I think the first talk that we are the second talk in the track today on the digital public good
organizations is pointing to the right direction we want to have some sort of a nonprofit foundation that is financially stable
and when you would ask governments in the you they would prefer that they are of course based in the you
or alternatively for governments they would own the product that would of course also give them a lot of ownership stability
and when we now look through the distributions that I have had on the previous slide we see that red head as well as based
so not good Fedora has no separate legal entity not good
Suze enterprise is the u-base so that would tick the box but open Suze has no separate legal entity
there are some people from Suze that point to the geico foundation but I do not understand how sustainable the geico foundation
is at the moment and who is backing it apart of Suze itself
there is the al-malino foundation that seems to work very well but it is u-s based and who knows
loud red head how sustainable that can be there is Ubuntu in the UK so that is a company not a foundation
d-b-n has several legal entities a foundation also in France but it does not have the innovation
the technical features that we would need for our model of u-s that would help organizations
to do the customizations on their end and share most part of the of the base and build it in their
good art continuous integration service so this is why at the moment d-b-n is not ready to take the role of Fedora
so what we would actually need is a better governance for these Linux distributions something
that is really matching the requirements of the public sector something that is matching the public mandate
that the sector has so what we do not want is that a company can go on with
with institution rate until entire European public sector is using it and then try to
change their licensing, stop the development and we have seen some of these products going
that pass in the last year and of course it would be unclavered to now bet on the wrong underlying
distribution that would then be prone to go a similar pass so easily d-b-n would now come up
and also of a boot C support then it would be on the plan for u-s or almalinux could
also incorporate a foundation outside of the u-s could be in the European Union the
zoo foundation could also improve their at least their marketing and explain better what they
can do what they are about that would all help a lot and now I'm coming to my last slide
I was very much inspired by the Davos speech of the Prime Minister of Canada
that we heard some ten days ago Marcani who was addressing the situation of sovereignty
as well and he said risk management comes at a price but that coast of strategic autonomy
of sovereignty can also be shared and I think this is not only true for the economies
it's also true for the operating system on the in the public sector collective investments
in resilience are cheaper than everyone building their own fortresses shared standard
reduced recommendations complementaries are positive sum and the question for middle powers
like Canada is not whether to adapt to the new reality we must the question is whether
we adapt by simply building higher walls or whether we can do something more ambitious
something together and this is why also for us it is of course a goal to not bring
possibly only two three u countries behind the common goal but at best a much broader community
and therefore maybe the next u-s and inside was a little bit too narrow it could have been
something more ambitious because I would be happy when we can also share the goals that
you with u-s with other middle powers like Canada like Brazil like India like Mexico or
Australia and then I wonder if we want to reach out to these communities and say let's
share the the common investment and build the strategic autonomy together what would
be their take on the Linux distribution would there also be a fan of next OS would they
do they know already open to them can we can we forge an alliance on on one of these and this
is why I feel for the u-s project we will certainly try to aim for Linux distribution
that does not only help us with the consensus in a few member states possibly in the u but
at best also on a much more global scale and here by I want to close my talk I'm happy
to have any questions you may have I think we have five minutes left three okay
two and a half then it has to be very very good questions on the point please
so what would it say the question is now how can how much how closely are to mitigate the risks
so there is someone who is estimating creating a foundation and building the distribution
independently from a company would possibly take three for people you do it over three years
for the beginning it's five million euros so and more users you have the more clearer
is the use case I'm in talks with open user and with al Malinox to tell them about the difficulties
that I see and if they can improve their their stands we will see how it goes some have
already yeah shown some interest I would say and I'm quite quite optimistic that we can get a
step further this year one more question
so the question is if I had on my radar to just use the enterprise linux for us
I'm sorry I'm unable to answer that question any other question
okay that's one suggestion
the question is why not reach out to private companies and help build a building
of course totally true so my vision is that there's a foundation that has a lot of companies
big companies that are supporting it and it could be through the defense sector it could be the banking sector
it would be those private sectors that also work in critical infrastructure who have an interest to have an alternative
who would then also back such a foundation and yeah we're trying also to find context and this
cases but it is not very straightforward but yet on our radar so I think we at the end of the
talk thank you so much
and please set me an email for any follow-up