Okay, next up, our gig and storm us, we'll be talking about creepy data, we need better open source data for CRA compliance.
Yes, we do. Take it away, guys.
All right, welcome all. I know it's already getting late. It's dark outside, but we're happy to see you here.
My name is Thomas Timbergren. I work, I mostly help organizations by using open source should you be safely and effectively.
And with me.
I'm Gail Blink. I'm an open source strategist. My focus on helping organizations become more professional in their use of data and metrics.
We are here because we have the Cyber Resilience Act.
It's coming. The dates are approaching when we need to start to do our reporting and comply with all the obligations there is.
And we want to talk about the data aspect.
For those who are new to the conversation, a little background on why we need Cyber Resilience Cyber Security.
There have been many more attacks over the last years. The trend is increasing and it is on the EU to say, okay, enough is enough.
We need to regulate this. So the software industry is becoming regulated.
And with AI, this is only compounding and we need to have not just new tools to manage the situation.
We also need to make better decisions for which we need data.
When we look at the solutions that are emerging, there are a couple things we want to say to this.
And we need real solutions, not just work around. We cannot rely on doing things by hand.
We need to automate things. We need the reliability of the data and the tools that we are using.
And there are a lot of things already in the works.
And we will need to, of course, support open source with whatever companies and organizations that have the obligations.
They will need to work in the upstream ideally that is my hope as an open source, strategist and advocate.
So one of the things that I believe in, the re-believing, is that we have the digital commons for the software supply chains and there are shared solutions.
And if you picture what the world could look like in the ideal scenario, we have best practices that are shared and easily available.
We have practical standards that are adopted for consistency across the ecosystem.
And in this ideal world, we also have interoperable tools where the data is a standard across and usable anywhere.
And we can plug and play and choose the tools that we want to use.
And then, of course, we need that reliable data, which is in an ideal world available to everyone.
And if you look at this ideal world, there's already a lot being done on creating those shared tools, shared standards, the collaboration is there.
And there's a lot of logos with a lot of initiatives, but really behind the scenes, all of these people working on this, no each other, they're working together, collaborating.
And there are emerging, de facto standards.
Some of them have even gone this step of becoming the Azure standards, like ESO standards in this process.
So there is a lot already happening in this space.
And it really comes to show that when we have good community consensus, we create practical standards.
And that is what we are seeing here some examples, again, of these standards developed by the community, where these are already available today.
It's a mix and match, and I'll pass this to Thomas to talk about this more.
Yeah, so one of the things that I commonly see, I work as a to do ospms with a lot of different organizations, is they come from a world where they have a single vendor, they bought a vendor.
And like, oh, we have to use this vendor for this poem.
In the world where I live in where most of the time I would say, like, look, no, there is not one magical, physical tool that fixes everything.
You have to use and mix a match of tool to basically use a base of what you need.
I know most vendors will promise you everything, and nothing about more should our great commercial benefits as well.
But in reality, most software companies, unless you're very small startup, you don't have and one is just like where everything is the same.
You have multiple different problems, and you just like just simply said, don't think everything, because you have everything is a nail.
Sometimes these players, unions on this soul, it's exactly the same, you need to have a tool set.
And so that's really where you see the difference happening, and you see actually the leading edge when you look at the CRA, it's all open source tools.
Because people are like, oh, hang on, we need to do things, we can't do this, we need to do this differently.
And that's where you're basically like, yes, oh, I need to mix match of tools that this interval, I need to be taking from one thing, I need to connect to the other thing and be able to do my CRA patient.
Oh, ideally, I wanted to be community driven, because guess what, the CRA is still developing, we don't know, like everybody in the community's old trying to figure out the CRA, how it works, how it can connect things together.
So you really want to have a community driven tool where really input is done.
You also want to have a decentralized and fertilized, because guess what, there are slightly different differences between each country.
We're in jurisdiction, the law is not the same. So you want to have tools that, hey, one tool might be perfectly working in France, because that's the particular way how they operate in this particular organization.
But in other side, they're like, oh, hang on, we're not, but still, that's why the benefit on the opposite side is to code this open.
I take things that are happening in France, that as well, so I was in Germany, that completely don't apply in my legal session, but still, I said, hey, that's a clever idea to do package detection.
I will take this little snippet they're doing, they are writing it in goal, I were writing it in Python, but I just take that bit that is useful.
Of course, give them credit, don't don't, don't, don't things that, and also what I look, what we do as well as the proposal of the program office, we work together.
So don't, what I see in specialists here, they say, oh, it's a security topic.
No, it yes, it's a security topic, but it's also a legal topic, it's also a topic for your developers.
You really need to start learning to work together. And this is where having basically open, so software is usually easier, because the people on those teams,
means, they can play with a tool already beforehand, and they can discuss, within their group,
within their peers, like, hey, I have this new open source tools, but do you think about
it?
And you see basically a more diverse of the opinions.
So this picture, I would just put the futures, in reality, I tried to put more than 180
different tools related to the CRA, because I often get asked about it.
We try to put some of the major ones.
So again, it is a little complex, yes, I would love, we were working on, we had a workshop yesterday
in the last interview to workshop where we actually discussed, like, hey, we would be ideal
if we started making a landscape picture out of it, so it's made for it easier.
And there, open chain project, there is actually a tooling mapping already being worked
on, so to make it the user, but it said, just keep mind that there's not a single tool that
is perfect.
And I'm saying this is my tool, I'm a tool creator myself, I, on a regular basis, advise
people not to use even my own tool, people like I, but you are an org maintainer, why are
you not the vice versa, but in the context of that organization, my tool, it might not be
the best solution, a tool from somebody else, maybe a better solution.
So I'll talk about tools, one of the projects that we are working on, which we got some
subsidy from your permission, it's a project called Octat U, if you have any questions,
well, Martin is also in the room as well, we're basically trying to work for small media
and businesses, oh yeah, at there, in the back, threats like this is your DEL, to basically
make it easier for small media enterprises that might not have to know how to basically
say, like, hey, fill in the survey things, we're trying to help them out with this, again,
I know a lot of faces in the room, I don't know if some of them work for large companies,
you have the benefit of big corporate backing you, small media enterprises might not have
that support, so luckily the EU commission said, like, hey, we're working on a solution
for that, but set, yeah, we have a saying in my little net of the help of social
community, a full with a tool, a still a full, in this case, there's all things saying,
like, tools only good as this input data, so I was not saying garbage in garbage out,
what I see with a lot of tools when I compare them and I do this in a regular basis is like,
oh yeah, why is there such a difference between these tools and then you start looking
at, like, yeah, it's data, all the tools operate on different data, luckily there are
more projects coming and if I like, why is it not one project? Do you know how big
the Opusus ecosystem is? You know how many millions of Opusus packages in there, with
all their various specific things, so there's, yes, there's different people working on different
parts of the corners from a different angle, which is good, because then you have different
opinions and you can say, basically, how, um, ecosystem as such, as this, oh, as this says
that, I know, we're working this in, I know because I work with sometimes, in some ecosystems
I trust this provider better than the other provider and then I just make some match, but it's
very good to see the differences. We do not want to have one provider that is dominant and
at least every, I like diverse opinions. I think in Europe, we kind of prefer this as well,
otherwise we would have thought that being the United Nations of Europe, um, so what do we
still need? If we have all this projects and all of this stuff, we have already so many things
around. And, um, well, data, data, data, we, we only start scratching the, the initiatives that
we have now, they look, they're great, but we don't have deep data. Like, we now have, like,
oh, we have all the package metadata, that, that is great, but we don't always have good data,
for instance, on what yours, like, on project health, is, can I type in a random thing and so
like, is, how is this project doing? Um, how, like, yes, do you have most of them,
oh, the amount of containers for this project? I myself work with no container, um, Josh
Brescher, I, I'm one of the security guys I follow, she showed me like in the MPM, the top 10,000
MPM packages, I think, have like 40% has a single maintainer. So if you write the policy in your
series policy, oh, our risk profile says like, we do not like furnishes with a single maintainer,
well, then you don't use note anymore. You can exclude all of that from your stack,
because the majority of note packages are maintained by a single container, and other ecosystem
type of similar picture. But you need to know that. So what do we need? We actually need open,
trusted, actionable, and curing data that you can rely on. And this is still in there.
We run it at that time. Ooh, then I'll go quick. Um, three,
bit of the data that we need. Your clock was telling me something different. Um, we need data
about packages. We need data better data about vulnerabilities. As I said, our project is working
this, and we need community data. Uh, I said, there's a lot of screen-to-projects already working
in. We ourselves are fortunate enough that we are working on a new project in this space. Uh,
again, funded by the European Commission. So he posted will post on Zoom. Um, let's all collaborate
on data. That's it.