So the other teams in further detail were
to be able to participate in the
world discussions and
immediate improvements in through
theαν but
East drift
later on when outwakes
in.
All we have to do is
to get touted on the
I mean, the first time I see it's actually from last year.
I was both yours.
So how do you deal with it?
Yeah.
Okay, take your seats, guys.
Yes.
We are starting.
Please, please, take your seats.
Is it everybody?
Okay.
No worries.
All right.
The next one is going to be something very special.
This is the panel, which is called from minimum compliance to
the minimum stewardship.
Take it away, Marlene.
Can you hear me now?
Yeah.
So, thank you.
Hello.
Thank you very much for staying with us.
As Roma said, we have some kind of different panel today.
Talking about new stewards and more specifically from minimum compliance
to minimum stewardship.
I'll start with a briefing trial about what is an open source steward
and how that's defined by CRA.
Nothing that I want to use my wonderful panelists.
We'll continue from there.
By the way, my name is Marlene.
I'm your policy advisor at OpenSF.
And I think that's enough.
I don't want to bore you with useless things about me.
So, open source software steward means a legal person,
other than a manufacturer that has the purpose or objective of systematically providing
support and sustained basis for the development of specific products,
with digital elements.
Qualifying as free and open source software,
and intended for commercial activities,
and that ensures the viability of those products.
It was okay.
I'm not the CRA opens source software stewards
or given a light touch regime.
But it's not an empty one.
Article 24 sets out concrete obligations.
What CRA doesn't define is what good looks beyond satisfying
those requirements.
It doesn't tell us when a policy meaning fully improves security
or when it simply exists to be shown to an authority.
That gap between meeting Article 24 obligations on paper
and actually threatening open source ecosystems
is what we are here to explore.
And I have wonderful people here joining me in this panel.
Could you please briefly introduce yourself
and explain how your organization fits or doesn't fit
the series definition of open source software steward.
Pavel can you start?
Hello everyone.
My name is Pavel Hruza and I represent the redhead.
So my company in this fits to both roles as a manufacturer
and also as a steward.
So we'll leave kind of as a dual citizen in this.
And as I'm responsible for the CRA program,
and I'm in charge because we have to run it as a program.
It's a big company.
So I have kind of a little bit different inside
than probably my colleagues who are way more technical.
So maybe I will bring also some,
let's say business inside today.
Kate?
Sure.
I'm Kate Stewart.
For this panel, purposes of this panel,
I'm here with my Zefer role,
where we have open source art tasks.
Zefer actually has a security team, a piece of team,
and so we've been doing a lot of work.
Make sure that the project is ready for CRA
and compliance to the CRA.
And with that then, I will hand it over.
Salve?
Thank you.
My name is Salve Nissen.
I'm part of something called the CPAN security group.
We tried to improve the security posture
and the oldest open source ecosystem
as the comprehensive pearl arcade network.
We've been around for just a little bit more than 30 years now.
And we're still around.
And we're still operating on a volunteer basis.
Nobody's going to pay it literally.
And we still have to pay along.
And we're part of this new regime.
The EU Commission has envisioned for us.
And I want to know the people in the CPAN security group
who has been looking at policy,
at the Stewart organizational,
how the metadata fits in all of this
and a bunch of other issues.
Thank you.
So we have already heard three different interpretations
of what the Stewart means.
Let's go a little bit deeper into details.
From your perspective, let's start with Kate, maybe.
Now, what is the real difference between
minimum compliance and meaningful stewardship?
This is the title of this panel.
And where do you see most organizations
currently lending today?
Minimum compliance is putting out exactly what
the act is calling for and no more.
meaningful compliance is making it easy for
manufacturers to use your open source project
as part of their products.
I think that and so basically making sure that we can make
the transition when they bring in your open source project.
They actually have an easy way of getting the artifacts
that they need to build upon for their compliance as well.
That's wonderful.
Solidar.
Yeah.
So, but the minimum is what it says in a state.
But I'm also thinking of this from a practical minimum.
Because after all, the whole of the REST starts with
a recital 1 and 2 about the whole point with this exercise.
And that is to think increase the security
of products in the whole of the European Union.
And that means we actually have to play along.
And while the manufacturers are there with the library
and have the work to do to make sure their products are secure,
they cannot do it alone.
They have to get their suppliers so to speak in on the game.
And for anybody who have a complex product like a service using
a programming language which might be open source and have a ecosystem
like CPAN backing up that might involve hundreds of projects.
Or thousands or even tens of thousands depending on the complexity
of what's going on behind the curtain.
And all of these have to, we have to figure out how they play along.
And so a meaningful minimum is something that takes into account
the limitations also of the ecosystem that everybody depend on.
And all the projects and communities and volunteers that are actually doing
an unpaid work taking care of this, this digital infrastructure.
And if we don't do that, we risk having this whole project for the part.
That means we kind of have to think about this from a cultural standpoint
of making an attitude change in how we, as a society and businesses
and communities and stewards interact in this.
And for me, a student rolling there is a facilitator to make all this happen.
Thank you.
Turning to your power.
And maybe from my side, we've heard what's the minimum and I fully agree
but what does meaningful mean for us because you all know how red it is built.
We built on communities, we built on the upstream,
which means that it has to be natural support of what we do
and how we build our software, our products.
Because without being good stewards, helping our upstream projects,
most of our upstream projects, we won't be able to deliver to our customers
and be the good downstream.
So that's a critical role and that's what meaningful means for me.
Thank you very much, very insightful.
The mic is at you.
You mentioned that red had operates both as manufacturer
and in few cases also steward.
This is also your, you are here on in this panel.
Think about the future when both obligations will be necessary
to be fulfilled.
What tensions do you think that will arise when compliance obligations in communities
to what should goals collide and how to decide which responsibility takes.
Yeah, getting back to the meaningful.
Because if I say it from the business perspective,
there are no penalties for stewards not doing their duties,
but there are huge penalties for manufacturer,
not fulfilling the requirements.
Meaning the business decision would be clear.
Big no.
Because that comes back to the meaningful and meaningful for us means
that we need to work with our communities with the upstream
and I'm glad that ladies just in a previous lighting talk
where community managers and brought out that topic.
Because if we have a good community managers,
we have an asphalt and working with our communities,
this is something how we can get back to our manufacturers role
and build on that.
So when it collides, legal versus,
I don't want to call it common sense,
but let's call it common sense for this purpose.
Yes, we have to fulfill our legal obligations, no discussion,
but also if there is some big pork needed,
which has to be done on our side as a manufacturer,
we will do so even though upstream will not accept that change
or that fix at the moment.
We will have to do that on our own expense,
because that's our problem, we serve our customers.
And then we continue working with the community.
That's what I care the most,
because this is the business model we built on.
So for me, the meaningful is the work of the day,
how to do that,
to provide something back to the communities
because then we get from this community,
especially right ahead.
Thank you.
Moving to Kate, now, I have the pleasure to read.
On your website,
your way of documenting the CRE related compliance work.
You have them in tremendous job already there,
and I think you're one of the most advanced projects
from the Linux Foundation for Zefe.
In this way, or in this path,
to document the CRE related compliance work,
what has surprised you most so far,
particularly when regulatory expectations
don't align neatly with hope and source projects,
actually work.
I think the biggest thing that was,
this can be a challenge,
is the aspects of notification for open source projects.
We're going to have to figure out which C-Certs
we're going to work with here in the EU.
Now, some open source projects are already CNAs,
and have been used to working with the CVD numbering authority people,
and working on working in the relationships and adjusting,
and so forth, but a lot of open source projects
don't have a dedicated vulnerability channels.
In Zefe, we do, and we also have ways
that people who are shipping products
can register to be notified by us.
Okay.
Now, you have to prove that you actually have a product,
you're not a bad actor.
Okay, but if you do have that,
then you can just basically sign up for free,
and we will push you notification
when we have a vulnerability fix ready.
Getting these fixes out and then through the downstream,
so we actually have products,
I think it's going to be a challenge for a lot of open source projects.
And we've got a partial, we've got our solution right now,
but I think other open source projects
are going to just tackle this part of that notification aspect,
I think that's a big gap right now.
Okay.
Moving to Sullivan.
Yeah, many open source ecosystems
like yours, don't have a single vendor foundation
or huge legal department that handles the legal aspects.
In a theory world, what does stewardship
realistically look like for communities like yours
that are decentralized very much volunteer driven
and also resource constraint?
Yeah.
I've been struggling a lot with that question.
The percol communities, in a sense,
an example of the classic open source community
where everybody is working just on the things that
gives them something that is found
or interesting as they come learned from it.
And that basis of motivation is throughout everything.
All the systems and service and projects and components
and the relationships are tooling is based
on the foundation of volunteerism.
And finding people who want to care about policy
and compliance and stuff is like
who is how long on a software developer
gets care of and strange people like me.
There are a handful of us.
But we still can't have to do something.
So we have a percol nation,
which has a few things.
But it doesn't have the capacity
or competence or speaking the willingness
to approach this problem.
So we have a luxury in the sense
that we can look at this whole new thing
with the cybersecurity sector from our first principles perspective.
Like what does a student look like for us
like this ecosystem with its shape
and requirements?
And look at what we need to make it work.
And that's a fantastic journey to figure out.
And I think I don't know how much I would love to go
into that of course.
But the core of it is protecting the culture we have
and the volunteerism is actually number one.
It's the maintainers and their projects.
And secondly,
it has to also be the communities that support them
and not rather.
And in third comes the downstream usage
because in the manufacturers that are required
the cooperation of these communities and these maintainers.
And it has to be like that
given the fact that we are operating without any resources.
If we have more resources,
something we hope to look at as a consequence of the introducing
the CRA, then things like change.
We can do the extra work like organizing
the things that make a community proper community.
Like for example, we have something called the Permongers
a meetup community or global,
where we are organized a lot for beer
and talk about the interesting things.
And it's been around since 2000, I think,
or 2001.
And it's a fantastic set of communities
that this is also beginning of the conferences that are
in this where people can share their projects
and create the open source community that we have are.
And so in a sense,
if we're going to help secure the maintainers
software,
we have to also keep making sure that the foundations
that are necessary to make this actually work
are protected and supported.
And so it's not only about the maintainers,
they are the core,
but it also needs to be the rest.
And most manufacturers and businesses out there
it's too much for them.
So in a sense,
supporting organization,
if it's a separate steward or a foundation,
the things about these things and make that happen,
I think is key for making this work.
Thank you very much.
Would you like to add something?
Okay.
I would have like to keep the mic at a selfie
because I introduced or started to talk about manufacturers
and this kind of collaboration between manufacturers,
communities,
ecosystems in the end.
From your perspective,
from your huge experience,
where does that collaboration work well
and where does it break,
especially from cybersecurity perspective?
It's always been an opt-in thing.
People who wish to do something,
they do so.
It's like,
I think it's called actocracy,
or democracy or something like that.
Those who step up and do the work they get to decide.
And that goes both from the businesses that
decide to hire people that can know this technology,
to use those technologies
and whether or not they support it by sponsoring events,
for example, or allowing their engineers
to spend time on open-source things.
And on the community side,
it's always been about what is done,
strictly speaking,
and interesting.
And one core insight,
I've learned,
after being like,
one of the community guys
in the Perlain Sea,
by community in Europe,
helping do this stuff is that
having open-source projects
that multiple people care about the same thing,
and do that over time,
that's fertile ground for creating friendships.
And most people who come into the Perlain community,
they stay there because it's awesome people.
And they go to places like foster them,
because we get to meet those awesome people again,
and again, they go what would be there.
That's part of the culture that we want to protect.
And it's also basis for making things work,
and figuring out how to help each other,
and well where the problems are,
and we would love to have more of our structures in on this game,
but they have to kind of decide for themselves.
They have to opt into the open-source community
that they depend on.
We can't force them as the same way,
strictly speaking, they can't force the maintainers
to play along in the needs they have.
So this is a choice of goodwill.
And if everybody has goodwill,
I think we can make this work.
I think this can be awesome, actually.
Okay.
You mentioned that you were multiple hats.
Here are your representatives of here,
but you're involved also in SPDX,
you're involved in open SSF,
and in many other communities.
And from your perspective,
where does this collaboration work very well
and where does this breakdown?
And how do you see that the improvements are needed?
Okay, so the one area I'm worrying about personally
is the communities may have volunteers.
Some of those volunteers work for manufacturers,
and there's various penalties on manufacturers
for notification.
And so what I don't want to see
is manufacturers pulling their staff off of the security teams
because of this penalty.
So I really want to make sure that it gets clarified
that if you've got working with an open source project
to volunteer hat on,
that doesn't count against your company.
Okay.
Who's paying your salary to some extent,
from some cases.
So this is the area I'm worried about
personally between on the implementation side.
But I think we've got a lot of,
a lot of tooling.
There's a lot of things that have been emerging
over the last five years,
and how they're playing into this like the SBOM world.
You know, we're being asked for SBOMs if you generated
the projects we're starting to generate them now automatically.
And so some of these pieces of metadata
that's going to be necessary, that's all emerging.
So I think we're seeing maturity emerge
that we can actually take in leverage.
However, I do worry about the interactions
between manufacturers of manufacturer obligations
and how that's going to work with the projects.
Which probably leads me right to you.
Exactly.
Or I think at you, why would you like to add
to this question?
Because sometimes you're a manufacturer,
you're still at it.
But I imagine that you are still
contributing directly to the code upstream.
Well, for the support,
and so I've already mentioned that the critical thing I see
is some organizational background,
meaning, you know,
voluntary groups, foundations,
working groups.
We are all members of many of them,
and that's something what I see as one
of the key success factors,
because we then know each other
we meet on many occasions,
and eventually when we are part of,
let's say, standardization committees,
we can influence it, which is a critical part for us.
Where does it fall apart?
If there is no clear ownership,
and that's my problem, it's closer to my heart,
as you know, managing programs,
that you need to have a clean ownership of everything,
otherwise you won't get results.
It doesn't touch just open source,
it's everything.
So, I would say that the critical part is that
collaboration,
I especially, I would like to appreciate,
you know, the volunteers,
and these organizations,
foundations or working groups,
which are organized by bigger entities,
which invest to this,
with currently,
if I take it to the business,
we have no idea what will be ROI,
but we still do this today, and that's the key.
That's great.
Yeah, time flies when we are having fun,
and such and such as some amazing guys,
we still have only two or three minutes,
if I'm not mistaken.
Let's move viewers,
and we first forward few years, as I said,
and the theory has generally improved
upon subsequent, let's imagine that.
Let's do this kind of exercise.
What criteria would you say that an ideal
steward must meet,
especially in a decentralized market-driven
voluntary ecosystem,
and what is the greatest challenge
on the path towards this future?
Pavel, if that's done?
So, I would say,
I see the CRA as a great opportunity,
especially for the big companies,
to stick more to the upstream and clear.
And with that,
if I imagine CRA or
the industry in 2030,
I would say,
I'd like to see steward as a invisible middleman.
Just something, what's there,
what naturally helps
to community with everything,
all these hidden investments,
like a tooling,
and I don't know compliance support,
let's call it compliance as a service,
if you will.
And with that,
I believe that if steward's won't be mentioned,
that much in 2030 or in five years,
that will be the success.
And then you challenge on this path?
Legal,
I would say,
pardon my French,
but this is something,
what we face day to day with the CRA,
and we need to get,
we need to get unified,
because I know that in all these working groups,
we all have our say,
and the standardization committees,
resolving all the comments is a long-term run.
And of course,
nations,
push their interests,
companies,
push their interests.
So this is just something where we need to,
we need to grab it,
and as I said,
as I see the CRA,
the opportunity for the big companies,
especially now representing the big company,
this is the way to go,
and the big companies would see that opportunity as well.
I believe this is the challenge we could,
overpass.
Thank you.
Kate,
from your perspective,
how an ideal storage for the new client?
In an ideal situation,
we've increased the quality of the code,
the open source code.
We've got more resources coming in from the manufacturers
to get things right upstream,
and we improve our technologies for getting things right.
If we do this,
you know,
we have projects out there that everyone's using,
where the back ports are one per hour.
Okay.
Getting the quality up in these open source projects,
so that the security improves.
If we've done this right,
there's motivations to make this happen.
As far as I'm concerned.
And the challenge is,
is actually making it happen.
Yeah.
Southern, from your perspective.
Okay.
Ideal.
How does it look like?
I'm a little bit agreeing that it's true,
or in session,
if it's invisible,
that would be fine.
But I think that's not possible.
I think it has a role to play.
It is a facilitator in solving real problems.
And in identifying them,
the needs of the manufacturers,
and connecting those to the relevant projects.
And making that a smooth experience,
and making sure that it is funded.
Because the work we're talking about here,
is mind-numbering the boring.
It's really, really not fun at all.
And asking a volunteer to do that,
is actually not a friendly thing at all.
And we should try to make sure that they get the resources
that they need to be able to take part,
because we have to include the maintainers in one way.
The alternatives, almost all of them, are much more expensive.
In solving the open source projects, as they are now,
that is the cheap option.
It will not be as free as it used to be,
but it's definitely not as expensive as trying to go
in a proprietary direction,
or in housing, or the other options.
Thank you very much.
Yeah, I have to bad guys here,
thank you so much for everything that you have said here.
That was an amazing part.
Thank you so much.
Okay, thank you very much.