- opensource-wg - mailman.ripe.net

Fwd: Request for Implementation Partners for the Bug Resilience Project
by Vesna Manojlovic 02 May '23

02 May '23

I hope you find this information relevant & informative. === From: Sovereign Tech Fund <info(a)sovereigntechfund.de> Dear readers, The Sovereign Tech Fund is pleased to announce a request for partners to help implement a responsible bug bounty program, titled the Bug Resilience Project, to empower small and medium-sized open source projects to lower their risk of harboring bugs and improve their capacity to respond to bugs as they are discovered. The program will provide services to FOSS projects such as helping projects deal with technical debt, working on known security issues, implementing responsible vulnerability disclosure processes, as well as offering a bug bounty for researchers that discover bugs and report them responsibly. We are now accepting applications from interested organizations to partner with us in the implementation of the Bug Resilience Project. We are looking for partners who share our vision of strengthening the open source ecosystem and who are committed to promoting a balanced incentive structure for projects and researchers that fosters an equal and mutually beneficial working relationship. If your organization is interested in becoming a partner for the implementation of the Bug Resilience Project, you can apply to one or more of the following work packages. To find more information on our Bug Resilience Project concept or how to apply, please follow the links below: Work Package 1: Lowering Technical Debt in Participating FOSS Projects and fixing known issues https://www.dtvp.de/Satellite/public/company/project/CXP4YWL6ZF6/en/documen… Work Package 2: Implementing Responsible Bug Disclosure Processes https://www.dtvp.de/Satellite/public/company/project/CXP4YWL6ZFH/en/documen… Work Package 3: Manage a bug bounty program https://www.dtvp.de/Satellite/public/company/project/CXP4YWL6ZF5/en/documen… We look forward to hearing from you and working together to make the open source ecosystem more secure and resilient. Best, the STF team Sovereign Tech Fund Newsletter by Sovereign Tech Fund Lagerhofstr. 4 Leipzig, Sachsen 04103 Germany

1 0

RV: Webinars on software supply chain
by Marcos Sanz 21 Apr '23

21 Apr '23

All, attached some info on a series of webinars on the supply chain management organized by the NLnet colleagues, which I think could be of interest to the wg. Recordings of the two past webinars are available online (s. link further down). Also further down you'll details on the two upcoming ones. Enjoy and have a nice weekend! Marcos > NLnet and NGI Zero/NGI Assure are organising a series of webinars on > *Open Software Supply Chain management*. As the dependency of society > on technology continues to increase in every possible direction, it is of the > utmost importance to understand the dynamic life cycle of the free and open > source building blocks that form the basis of pretty much all technology we > use today - and how these can be kept safe and available. > > Not only do we need to improve our understanding of how and where > software is developed, maintained, built and deprecated at macro scale - but > we also need to create mechanisms to ensure that building blocks are kept > up to date, that different versions don't collide, FOSS packages from public > repositories have not "bit-rotted" or even worse: have been tampered with > by malicious actors as part of a "supply chain attack". There has been an > increasing attention to the fact that with software "eating the world", a > healthy and robust software ecosystem should be a key societal (and thus > political) priority. But at the same time, we should do so with full > understanding of the highly specific nature of "digital commons" - as the > controversy surrounding the upcoming Cyber Resilience Act clearly proves. > > In this series of webinars by leading experts such as Armijn Hemel (Tjaldur), > Shane Coughlan (OpenChain), Carlo Piana (OSI), Alberto Pianon (FSFE) and > Philippe Ombredanne (AboutCode) we look at software supply chains from > different angles. What do modern electronics supply chains look like, how is > provenance handled - and how *should* it be handled? What mechanisms > do we have to verify the integrity of deployed code packages and detect > abnormal code changes that may be signs of malicious modifications and > possible attacks? Where do "Software Bill of Materials" come into play? And > what is being done, and perhaps should be done from a legislative and > governance point of view? > > The entire webinar series is available free of charge, and will allow you a > deep dive into the hidden world behind the software and hardware we use - > and will help you get a clear understanding of how open source supply chains > work, and a grasp of what the policy challenges are. > > You can join the webinars via this BigBlueButton link: > > https://bbb.protagio.nl/b/ron-qed-tog-gey -- > The other episodes in the webinar series on Open Software Supply Chain > management are: > > * Thursday May 4th 2023 // 13.00 - 14.30 CEST (Amsterdam, Berlin, Rome) > > - Speakers: Carlo Piana & Alberto Pianon. > - Topic: The importance of a Software Bill of Materials in light of the > upcoming Cyber Resilience Act and product liability legislation in Europe. > - More info: > https://nlnet.nl/events/20230504/WebinarSoftwareSupplyChain-ep3 > > * Thursday May 11th 2023 // 13.00 - 14.30 CEST (Amsterdam, Berlin, Rome) > > - Speaker: Shane Martin Coughlan > - Topic: ISO standards and certification. (This talk was previously scheduled > for April 27). > - More info: > https://nlnet.nl/events/20230511/WebinarSoftwareSupplyChain- > ep4/index.html > > The first episode with Armijn Hemel already took place on April 6th, with the > topic of Open Source in (Consumer) Electronics Supply Chains. You can find > the link to the recording here: > > https://nlnet.nl/events/20230406/WebinarSoftwareSupplyChain/index.html > > Looking forward to see you there! > > the NLnet team

1 0

Opensource-WG: Call for Presentations (RIPE 86, 22-26 May)
by Martin Winter 13 Mar '23

13 Mar '23

The next RIPE Meeting is coming up - your chance to present about some interesting Open Source If you would like to give a presentation during the OpenSource WG session, then please contact us (the WG chairs). In general, each talk is 15-30 mins (depending on how much time is needed). If you have some idea and not sure how/if you should present something then feel free to contact us as well to discuss the idea. For small project updates, we are planning to reserve 30 mins again at the end of the WG session. These short 5..10(max) min updates/talks are decided on the day before the WG session on a time/space available base. No need to submit anything for these talks at this time. Thanks, Martin Winter, Marco Sanz & Ondrej Filip OpenSource WG Chairs

1 0

concern re: Cyber Resilience Act effects on open source?
by Maarten Aertsen 29 Nov '22

29 Nov '22

good afternoon list, I would like to understand the number of people/organisations on this list who are concerned about the European Commission's Cyber Resilience Act proposal effects on open source software development. This topic was presented at RIPE85 [1] and covered in a recent blog (see below, should have cross-posted), which was republished at RIPE Labs last week: https://labs.ripe.net/author/maarten-aertsen/open-source-software-vs-the-pr… You would help both me and RIPE NCC staff that are tracking the proposal by speaking up on list. Answers by both developers and users are valuable. A simple +1 is fine. Thanks. kind regards, Maarten -------- Forwarded Message -------- Subject: Re: [cooperation-wg] Cyber Resilience Act effects on OSS on agenda of open source-wg Date: Mon, 14 Nov 2022 09:38:00 +0100 From: Maarten Aertsen <maarten(a)nlnetlabs.nl> To: cooperation-wg(a)ripe.net Good morning, I just published an extended, written version of my RIPE talk in the open-source wg [1] with NLnet Labs' perspective on the European Commission's proposal for a Cyber Resilience Act vs. Open Source: https://blog.nlnetlabs.nl/open-source-software-vs-the-cyber-resilience-act/ We feel the current proposal misses a major opportunity. The CRA could bring support to open-source developers maintaining the critical foundations of our digital society. But instead of introducing incentives for integrators or financial support, the current proposal will overload small developers with compliance work. At the same time, this is only the Commission's proposal. I hope there is opportunity to raise awareness and influence the coming positions and negotations. I'm very grateful to the many people in the RIPE community that talked to me after my presentation. I feel my understanding of the issue is improving. Curious to hear what you think, how you feel this affects the projects you rely on and what we have yet to learn about the implications. kind regards, Maarten [1] https://ripe85.ripe.net/archives/video/911 -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/cooperation-wg

5 6

Minutes of RIPE85 opensource wg meeting
by Marcos Sanz 22 Nov '22

22 Nov '22

Dear all, the minutes of the session are online now: https://www.ripe.net/participate/ripe/wg/active-wg/os/minutes/open-source-wo rking-group-minutes-ripe-85 Have a great start in the day Marcos

1 0

Draft Agenda Open Source WG RIPE 85
by Marcos Sanz 10 Oct '22

10 Oct '22

Dear all, please find attached the draft agenda for our upcoming working group meeting during RIPE 85. Looking forward to meeting you all there, Martin Winter & Ondrej Filip & Marcos Sanz Open Source WG Chairs ---- Agenda RIPE 85 Open Source WG Session Wednesday, October 26, 10:30 - 11:30 (CEST) A. Administrative Matters * finalize agenda * approval of minutes from previous WG meeting(s) * review of action list B. "Cyber Resilience Act effects on OSS", Maarten Aertsen, NLnet Labs NLnet Labs is closely following a legislative proposal by the European Commission affecting almost all hardware and software on the European market. The Cyber Resilience Act intends to ensure cybersecurity of products with digital elements by laying down requirements and obligation for economic operators. In this short talk you'll learn what to expect in the Cyber Resilience Act and why this proposal may matter to you as a developer or user of open source software. If so, let's make sure that policy makers take into account its effects on open source development by professional organisations and volunteers alike. Do get in touch with Maarten when you have similar concerns, want to team up or can help us to provide technical expertise in the right places. C. "Infrastructure as code: Managing IXP services using terraform and the IX-API", Annika Hannig The fabric of the internet in recent years has become more and more flexible. Software defined networking enabled us to provision network services in the blink of an eye. Providing services on the internet nowadays involves, rather sooner than later, dealing with things like virtual circuits, peering and route servers. All this is now part of your infrastructure - just like the cloud compute instances where you are running your applications. In this talk I will cover what is what is infrastructure as code and what is terraform. How can you benefit from this, and how this tool can be used to provision services on an IXP using the IX-API. D. "ARTEMIS: An Open-Source Tool for Detecting BGP Prefix Hijacking", Lefteris Manassakis, Code BGP ARTEMIS (Automatic and Real-Time dEtection and MItigation System) is an open-source tool to monitor, detect, and mitigate BGP hijacks. In this talk, after a short introduction to the project, we will demonstrate ARTEMIS, how it works, and how network operators can use it for real-time BGP hijacking detection. E. Lightning Talks These are short updates on different relevant open source projects. They should be 5 mins (preferably) with a maximum of 10 mins (if space allows). No formal submission required ahead of RIPE, but please send a short message to opensource-wg-chairs(a)ripe.net by noon on Monday during the RIPE if you want to present an update. Selection of talks are done on Monday afternoon.

1 0

Call for Opensource-WG Presentations (RIPE85, 24-28 Okt 2022)
by Martin Winter 14 Sep '22

14 Sep '22

The next RIPE Meeting is coming up again - your chance to present about some interesting Open Source Are you using some cool Open Source project at your LIR which we haven't talked about? Let us know! Are you working on a project and want to present about it? Let us know! If you would like to give a presentation during the OpenSource WG session, then please contact us (the WG chairs). In general, each talk is 15-30 mins (depending on how much time is needed). If you have some idea and not sure how/if you should present something then feel free to contact us as well to discuss the idea. For small project updates, we are planning to reserve some time at the end of the WG session. These short 5..10(max) min updates/talks are decided on the day before the WG session on a time/space available base. No need to submit anything for these talks at this time. Thanks, Martin Winter & Ondrej Filip & Marcos Sanz OpenSource WG Chairs

1 0

Re: [opensource-wg] Call for OpenSource WG Chair Nominations (due by Oct 9, 23:59 GMT)
by Martin Winter 14 Sep '22

14 Sep '22

Everyone, The fall RIPE is coming up and this is the time for Open Source WG chair elections. Nomination period is from NOW until Oct 9, 23:59 GMT Chair selection is as follows: - If there are no nominations, then it will continue as is without any vote (all three of us are willing to continue) - If there is a nomination, then we will try to decide in a consensus (between existing chairs and nominees) on how to proceed - If the consensus fails (i.e. if one of the nominations wants to force a vote to replace an existing maintainer and there is any other disagreement), then we’ll have a public vote during the Open Source WG (Consensus between existing chairs and all the nominees) See https://www.ripe.net/participate/ripe/wg/open-source-working-group/open-sou… for details. So if you want to become a OS WG chair, then this is the time to do so and speak up. Please send your nomination to opensource-wg-chairs(a)ripe.net (mailto:opensource-wg-chairs@ripe.net) If you miss this chance, then the next nomination period is in one year (each Fall RIPE meeting) The new WG chair starts after the Fall RIPE meeting. Regards, Your current Opensource WG Chairs Martin Winter, Ondrej Filip, Marcos Sanz

1 0

New on RIPE Labs: Competition - Environmental Impact of Open-source - 23 September 2022
by Antony Gollan 18 Aug '22

18 Aug '22

Dear colleagues, "The Sustainable Digital Infrastructure Alliance (SDIA) and the German Environmental Protection Agency (UBA) invite the open-source community to spend an afternoon measuring and reducing the environmental impact of popular open-source libraries and tools. Together, we hope to make a positive contribution to the ongoing climate crisis." https://labs.ripe.net/author/max-schulze/competition-environmental-impact-o… Kind regards Antony Gollan Communications Team Manager RIPE NCC

1 0

Test, please ignore
by Marcos Sanz 07 Apr '22

07 Apr '22

1 0