Take your seats and we are moving to the next speaker.
He goes for another stress.
He's going to talk about Alan OTP's journey towards CRE compliance.
Take your voice, sir.
So let me tell you the story about the airline
ought to be your need towards CRE compliance.
Chapter 1, the Kingdom of Code.
In the Kingdom of Code, there is to the micitaward of airline.
The tower of airline, informally known as the airline program
in language, has been open sourced for more than 30 years.
And as such, it has received thousands and thousands of contributions.
The tower of airline was forged in the workshops of erection
and has a reputation for never falling, not even in the hardest storms.
But in the shadows, dark forces are gathering.
And it's really unknown if this new beast can create vulnerabilities for the tower.
Across the run, hundreds of fervent towers were built.
And in the recent years, New Architects came.
With these architects, you modified a bit of the island tower
and created new towers, such as the Elixir Tower and the Gling Tower.
And those are now informally known as the Elixir Premier Language
and the Gling Program Language.
The best thing about this tower's airline, Elixir and Gling,
is that they enable really complex communication patterns,
which ones use thousands of pigeons from towers to tower.
The pigeons carry scrolls, which are messages,
and based on that, new businesses can be built.
Which ones? Well, we have some known companies.
WhatsApp uses the pigeons to send messages.
Clarna uses the pigeons to send money.
Quivera uses to send important letters,
an erection and Cisco uses it for more of our global communication.
But outside the run, there were other towers.
And these towers were facing new challenges.
New beasts came to those towers and started to attack them.
And these are known if these new beasts
can attack our towers.
Such, they can slow towards, informally known,
as the Elixir Co-System Foundation met
in the great holes of the Elixir Tower.
In there, they had also scouts that have spotted red dragons
and worms, spotted losing gates outside the run.
And then they was, again, and known,
is that something that can happen in our towers?
It remains to be seen.
There was one thing that was 100% sure known.
Instead of relying on whatever so-one says,
is a vulnerability, we need to be a united front.
How do you do that?
You created the best tree book.
The best tree book basically is the one
that is going to tell to the run, we're going to identify the dragons
and we're going to save something in some vulnerability.
We're going to name those dragons.
Because, again, we know about our run.
So this is going to apply to the whole all of the towers.
And that's all we're going to publish and update the best tree book.
So that everyone that is in the run can follow up with,
whether you have a vulnerability or not.
Informally, this is one, we say that the Elixir Foundation,
Erlangico-System Foundation, became a CNA.
Now, not long after that, came a royal decree by the king.
And it was mandating the following items.
It was saying, for now on, you need to keep a legion of materials.
For every wall.
This is really tricky.
Because the walls have thousands of stones.
And it was said that if you take an Apache stone,
and you put on top a GPL stone, the Apache stone is going to melt
and slightly contribute to the GPL.
Is that something that you want?
I don't know, you need to know, right?
So you need to do your legion material sense.
Understand, what is it that you can combine?
You need to post the scouts to watch for the relance.
Sure, you need to know if you're going to be attacked.
You need to declare your threats and pass it out immediately,
which also makes sense.
And finally, you need to prove the defenses you seem regular audits.
Fail to comply with this royal decree,
informally known as the CRA, and your tower
may be closed for business.
So it has a huge impact.
To fortify fences, they cancel off towards maps.
And the other feedback through its working security groups.
And there was one thing that was clear.
Given that all the other towers and the whole realm
is built on top of the other tower,
because the other thing is a modification of it.
It makes sense that the maintenance of the towers
are going to implement the following protocols that I'm going to discuss.
So that we can comply with the royal decree.
The maintenance of the tower are going to post gatekeepers.
The gatekeepers are the ones that are going to check
with key practices and are going to check if you're doing that patch
on the other tower.
You need to have maybe a reviewer that is checking that as well.
That's all.
What are we going to create, of course, a legion of materials?
We're going to post scouts, so that we can watch for dragons.
And publish official notices together with the cancel off
towards the airline ecosystem function.
Let's see how we do this, because we cannot just
with all ourselves the maintenance of the other tower.
We need reliefs that are not helpful.
For the gatekeepers, the gatekeepers are the ones that are going
to check risky practices.
As I said before, if you are patching a wall, you need to know
whether you are doing it correctly.
And so one is reviewing it.
You need to have maybe a test, so that you know that if there is a
crack, don't just leave it, go and fix it, so far.
How do you get to a good baseline?
I would say it's pretty tricky to know if you're doing things correctly or not.
So what can we do then?
Well, the cancel of towards together with the maintenance of the tower,
when I'm fixing the open SSF kingdom.
And they try to understand what is this new technology called scorecard.
Scorecard is a technology that is going to find risky practices.
And now we have quite a few risky practices that we didn't know about.
And now we have a baseline.
Based on that, the maintenance of the tower
fixed the mocks or high priority issues, and they continue to work on it.
But now at least the most risky issues have been fixed.
Now there's also one thing.
There were some practices that were good in the Erland tower,
but it was not recognized by the scorecard technology.
So we did, well, anyone, I guess, could do.
We contributed back.
We have that those practices, so that now everyone that is using
the Erland, Elixir, or Blint towers,
those practices are going to be recognized by scorecard.
Given this, we can close off the regular audits,
because this is the technology that's going to do those regular audits.
Ledger of materials, this is really tricky.
You need to list every stone that is part of the tower.
We have thousands of stones, and even more, you cannot stack
sometimes one stone on top of the other one,
because one is Apache, maybe the other one is a GPL,
sometimes that doesn't go together.
So it's not stable.
What do we do in this case?
We decided to go on this set, the OF review toolkit,
Kingdom and Re use.
These are two different kingdoms,
but they have somewhat similar technology that overlap.
For the Re use, it's really interesting,
because they are able to give them a stone,
if it has rooms, which are,
informally known as pdx license identifier,
they know what it is, and they're going to tell you, yeah,
we know what this one is, that's perfectly.
For the stones, where those rooms are a bit more tricky to spot,
or actually toolkit, implicitly throughs can code,
is able to tell you what is the category in which these stones go think.
Based on that, we combine both technologies using custom machinery,
so the now for the things that have rooms,
we know what they are, and the ones that are not,
because again, we have thousands of stones,
not all of them follow the room principle,
then those will follow with the OF review toolkit.
Even more, OF toolkit was really good at categorizing,
but there was one thing missing, the printing in a scroll of this,
was not really working, so we contributed back to that project,
so now that is printed, and this is what now,
the island tower and the electricity tower are used in.
How does it look like now? Well, I think you can more or less with it.
We have what is informally known as a SPDX package.
A package can be thought as a bunch of stones put together
so that it serves a purpose, that's all.
There's someone that built the wall,
we have some references with the commenter, say, well,
this is about this case, this is the OTP SSH package or part of the wall,
which version, where you send, and if there's any kind of known vulnerability into it,
so we have this as well. All the stones have been analyzed,
and then we have the names of all the stones that they are categorized.
But this is not enough, right? We need to know as well if there were some tests,
so we have that as well in our SPDX. You take it and you see it quite clearly.
In this case, we say that the SSH test package is the one that contains the test for the OTP SSH
part of the wall. But it's also important to the documentation.
We have that as well categorized, because it's not the same the wall that is on the outer side
of the tower, which maybe needs to be robust and start the, that part of the inner wall,
which is maybe more for the key to go and type. All of it is part of the package
around the tower, project OTP, and also important if there are dependencies,
and you cannot build the package OTP SSH because you need a solid base first,
that is also explicitly stated in this stroke.
A bit more. What happens when you need to take prefabricated walls? What are prefabricated walls?
The vendor packages. You need to deal with those as well. Those are the ones that
the maintainers cannot build themselves, so they take the sanctions somewhere else and they put it
into the project integrated now. As such, you need to identify the version that is associated or
designed that you took with it, so that you know what kind of tower you're building, so to speak.
By some of this, the work we also got the stamp of open chain license compliance.
Given this, we have the ledger of materials. Now we're going to talk about the scouts.
The scouts are the ones that are going to monitor dragons. The part of money to
the dragons, in this case, especially refers to the prefabricated walls, because those
are the ones that we don't know if we could be affected. Whether they know initially exactly
how to do it, but then we figure out that we can talk to the people from the OTP kingdom.
They have some really nice, bestiary books, and now we just created custom machinery because
the prefabricated solutions from OSB was not integrating well enough. The Mingi is in that case,
is that the OSB kingdom at the time that we did the integration to monitor dragons was not able
to recognize something called open vets, so they'd use the move false positives. So we handle that ourselves.
And then this couch, what they're supposed to do is, if they find a dragon exploding
our vulnerability in some of the prefabricated walls from some other project, then they're supposed
to send a message immediately to their own tower. Finally, a publishing of the official notices.
Any kind of vulnerability that is reported in the run, that is going to be published by the
cancel of stores, C.I. Of course, there's need to be an immediate patching of walls by the
maintainers, and the maintainers will tell where I'm also going to print something called open vets.
What is it that they're going to do? Well, they're going to replicate the vulnerabilities in the
open vets format, and they're also going to say, if there's a pre-package wall that is
vulnerable, is it really applying into the Atlanta where you're not? That is going to be also
contained in there. The attack. One misty morning, a couch on sheltered the car.
The dependency dragon sheltered this car. This was a dragon that was known to exploit
subtly pre-package and a walls. We know from our legend of materials that kind of prefabricated
wall has been integrated into the tower. As such, this couch follows protocol and informs tower.
How? Well, something a message, but that's what you do. The message arrives to the tower.
This is what it looks like. It has been spelted by the scout Erlan's counterbot,
really important scout. It affects the version 28, and there's possibly a vulnerability
unit to check it out into your open vets statement. It identifies the prefabricated wall
and the dragon that is causing that. So, cb-226, 22184. Given that we have the
ledger from materials, now it's really easy to check if this is something that could be affecting us.
We will also check the OSB, a bestiary book, to see what they said that it is about.
In this case, during the integration process of that prefabricated wall into the Erlan tower,
we were not affected. Beakers, the stones that were vulnerable were not part of where we moved
to during the integration. Now, this is not open vets. This is our own format that we created
because the Erlan tower has many different parts of the wall, like the runtime system and many
different applications. And as such, what we do in this case is identify the prefabricated wall,
we put the dragon that is assigned and the applications that have been affected.
Based on this, we can generate open vets statements. The open vets statements goes to the
print machine and now we have the name of the dragon. We have the packages affected. In
this case, if you are based on the OTP tower version 26, you are not going to be affected.
If you are using yes, part of the wall version 14, you are not affected.
If you decide to go to the next iteration of the design, which is cooler, then you are not going to be
affected. But let's say that you wear on the version 26 and you get updated,
a minor part of the wall, in this case, ERTS 1401, then you are not affected either.
And as such, this is like 20 statements because it gets complex. But then you know for sure you are
not affected. It will be good if the open vets for my have ranges, nice things easier,
but I couldn't find it, so this is what we do. Not affected, at least home was not present.
Even more, we have the legend of materials, right? But in the legend of materials, maybe you don't
want to see the ERTS and what not. We are going to put as well this prefabricated wall that we took
from this version is not affected. Then now you can have a margin between the yes form
and the open vets and you can remove the false positives.
Pre-solution, the attack passed, the defenses hold, and the tower fireman is to compliant with
a sealant against the danger. Now, call two arms. This is what we have done for the basic
building block. If you are building on top of it, you still need to do your work. And the same
thing goes for any kind of technology that you have. You need to keep your ledge honest,
your scout sharp, and your notice is swift. If you haven't done so yet, join the watch.
This is kind of work if you are going to join, because there are way too many towers,
and the council of towards or your foundation is not big enough to be able to deal with all the
issues. So you need to join the watch. If you join, all the towers can stand for generations.
And please, remember, the racons never sleep.
Thank you.
Well, I was fantastic. Thanks to a question for the long half time for questions.