- opensource-wg - mailman.ripe.net

Fwd: Three Challenges to Contribute Back to Open Source
by Vesna Manojlovic 06 Jun '23

06 Jun '23

Let’s strengthen the Open Source ecosystem together! https://sovereigntechfund.de/en/challenges/ The Sovereign Tech Fund is looking for developers who use open source and want to contribute back. We need a sustainable ecosystem that enables new software development and ensures the ongoing security of existing dependencies. Many more people use open source software every day than contribute to it. It's time to give back and invest in this ecosystem, to increase its security and sustainability. In three challenges, participants can work on contributing back to open source for up to eight months with a budget of up to €300,000 for each of the four-month rounds. We’re accepting proposals starting today through July 6, 2023 (23:59 UTC+2). What are the Contribute Back Challenges about? The Sovereign Tech Fund is issuing three challenges to encourage active participation in open source infrastructure. With the call to “Contribute Back,” we are making it possible for developers, contributors, and maintainers to actively contribute to and work on the open source projects they depend on over a four to eight period. We want to identify critical issues in the open source ecosystem and empower people to work on them. To do this, the Sovereign Tech Fund is offering short-term challenge funding for participants to explore new solutions and focus on implementing them over a limited period of time. Our goal is to use these challenges is to discover the best ways to strengthen the ecosystem together. The Sovereign Tech Fund is providing up to €300,000 per application over a period of four months, with the possibility of a 4-month extension. We will support the creation and improvement of developer tooling, the production security of Free and Open Source Software (FOSS) components, and the documentation of critical open source infrastructure technologies. In the challenges, the STF hopes to answer important questions, for example: Can better developer tooling help FOSS maintainers manage growing technical debt and increase test coverage to provide greater reliability and maintainability in the long term? What software production security mechanisms enable FOSS projects to stay open to contributions while protecting against the increasing threat of supply chain attacks? As the demand on the FOSS infrastructure increases, what documentation is needed to allow new developers to participate and to reduce the load on maintainers? To learn more about the Contribute Back challenges, visit https://sovereigntechfund.de/en/challenges/ Thanks and let’s get to contributing back! The STF Team

1 0

Fwd: Announcement and CfP: OpenForum Academy Symposium 2023
by Vesna Manojlovic 17 May '23

17 May '23

FYI We are excited to invite you to the OpenForum Academy Symposium 2023 The CfP is now open until 29 May Hosted by TU Berlin, the OpenForum Academy Symposium will, on 28 November 2023, bring together researchers and practitioners from all walks of the Open Source research ecosystem at an interdisciplinary conference. Submit a proposal, register to attend and save the date Website and CfP https://symposium.openforumeurope.org As of today there is no academic conference covering questions relating to the social, political and economic impact of Open Source. This hampers the linking of research agendas, growth of the research area, and the societal understanding of the value of the Open Source ecosystem as a whole. The OpenForum Academy Symposium (OFA) fills this space. After a successful first, virtual edition in 2021, the OFA Symposium 2023 will bring together an interdisciplinary set of researchers, practitioners, and policymakers from around the world to Berlin, in order to explore the transformative power of Open Source Software and Hardware. At the OFA Symposium, we will examine the social, political, and economic implications of open source. We will explore how open source is changing the way we work, communicate, and interact with each other, and how it is shaping the future of technology and society. The Symposium will feature a diverse and group of speakers and participants, including researchers, policymakers, developers, and activists. We believe that the OFA Symposium will provide a unique and valuable opportunity for learning, collaboration, and networking. We hope you will join us for this exciting event, and look forward to exploring the social, political, and economic impact of Open Source together. First keynote speaker announnced Andres Guadamuz, Reader in Intellectual Property Law at University of Sussex and technology commentator @technollama

1 0

Agenda Open Source WG RIPE 86
by Martin Winter 09 May '23

09 May '23

Less than 2 weeks until RIPE. Below is the agenda for the Open Source WG Session. The session will be on Thursday afternoon, just after lunch. Hope to see you all in Rotterdam. Open Source WG Chairs A. Administrative Matters - finalize agenda - approval of minutes from previous WG meeting(s) - review of action list B. NGI-Zero: EU-funded framework for supporting FLOSS projects Niall O'Reilly, Tolerant Networks Ltd This presentation will alert participants to the EU Commission's New Generation Internet (NGI), to NGI funding opportunities, and to project support available from the NGI-Zero coalition led by the NLnet Foundation. Tolerant Networks Ltd is a partner in NGI-Zero. C. From Peering Manager features to standalone library Guillaume Mazoyer, Peering Manager Lead Developer During the process of writing the integration code for Peering Manager and IX-API, an opportunity arose to extract the relevant features from the main code base and create a separate library. As a result, pyixapi was born, providing a user-friendly and straightforward interface for interacting with IX-API endpoints. D. BIRD 2 - Overview and Future Outlook Ondřej Zajíček, CZ.NIC Five years ago, we released BIRD 2, the major overhaul of BIRD Internet Routing Daemon. I will recapitulate recent BIRD development, present new interesting features, and discuss the future outlook of BIRD development, including the upcoming multithreaded BIRD 3. E. Update from Route Server Support Foundation Niels Raijer, Chairman RSSF Why RSSF is there, the technological advances in OpenBGPD and rpki-client and a surprising way in which we received some funding. F. Lightning Talks These are short updates on different relevant OpenSource projects. They should be 5 mins (preferably) with a maximum of 10 mins(if space allows). No formal submission required ahead of RIPE, but please send a short message to opensource-wg-chairs(a)ripe.net by noon on Tuesday during the RIPE if you want to present an update. Selection of talks are done on Tuesday afternoon.

1 0

Agenda Open Source WG RIPE 86
by Martin Winter 09 May '23

09 May '23

Below is the Agenda for the Open Source WG Session during RIPE. One thing not mentioned in the agenda (but will be announced during the Admin section), is that Ondrej is stepping down as OS WG Chair. See you all in Rotterdam, Martin ----- A. Administrative Matters - finalize agenda - approval of minutes from previous WG meeting(s) - review of action list B. NGI-Zero: EU-funded framework for supporting FLOSS projects Niall O'Reilly, Tolerant Networks Ltd This presentation will alert participants to the EU Commission's New Generation Internet (NGI), to NGI funding opportunities, and to project support available from the NGI-Zero coalition led by the NLnet Foundation. Tolerant Networks Ltd is a partner in NGI-Zero. C. From Peering Manager features to standalone library Guillaume Mazoyer, Peering Manager Lead Developer During the process of writing the integration code for Peering Manager and IX-API, an opportunity arose to extract the relevant features from the main code base and create a separate library. As a result, pyixapi was born, providing a user-friendly and straightforward interface for interacting with IX-API endpoints. D. BIRD 2 - Overview and Future Outlook Ondřej Zajíček, CZ.NIC Five years ago, we released BIRD 2, the major overhaul of BIRD Internet Routing Daemon. I will recapitulate recent BIRD development, present new interesting features, and discuss the future outlook of BIRD development, including the upcoming multithreaded BIRD 3. E. Update from Route Server Support Foundation Niels Raijer, Chairman RSSF Why RSSF is there, the technological advances in OpenBGPD and rpki-client and a surprising way in which we received some funding. F. Lightning Talks These are short updates on different relevant OpenSource projects. They should be 5 mins (preferably) with a maximum of 10 mins(if space allows). No formal submission required ahead of RIPE, but please send a short message to opensource-wg-chairs(a)ripe.net by noon on Tuesday during the RIPE if you want to present an update. Selection of talks are done on Tuesday afternoon.

1 0

Fwd: Maintaining the Maintainers 🛠️ Open Collective is employing FLOSS developers
by Vesna Manojlovic 06 May '23

06 May '23

I hope you find this information relevant & informative. === Creating a Healthier Ecosystem Open Source Collective was created to help build a healthier and more sustainable ecosystem for open source creators. And a big part of that is personal health. Many open source projects that we love and rely on are maintained and updated by a small group of people, or sometimes just one. The tasks they need to do vary, but the demands on their time can build up fast. Some maintainers might want to devote more time to this kind of work, but fear losing the healthcare and benefits that come with their regular job. This is why OSC is now looking to employ maintainers on select sufficiently-funded projects, providing them with access to things like paid annual leave, healthcare, and sick leave. That way, they can spend more time maintaining their project, and supporting the wider community. Find out more: https://opencollective.com/opensource/updates/open-source-collective-is-hir… https://docs.oscollective.org/what-we-offer/employment-payroll-and-benefits

1 0

Fwd: Request for Implementation Partners for the Bug Resilience Project
by Vesna Manojlovic 02 May '23

02 May '23

I hope you find this information relevant & informative. === From: Sovereign Tech Fund <info(a)sovereigntechfund.de> Dear readers, The Sovereign Tech Fund is pleased to announce a request for partners to help implement a responsible bug bounty program, titled the Bug Resilience Project, to empower small and medium-sized open source projects to lower their risk of harboring bugs and improve their capacity to respond to bugs as they are discovered. The program will provide services to FOSS projects such as helping projects deal with technical debt, working on known security issues, implementing responsible vulnerability disclosure processes, as well as offering a bug bounty for researchers that discover bugs and report them responsibly. We are now accepting applications from interested organizations to partner with us in the implementation of the Bug Resilience Project. We are looking for partners who share our vision of strengthening the open source ecosystem and who are committed to promoting a balanced incentive structure for projects and researchers that fosters an equal and mutually beneficial working relationship. If your organization is interested in becoming a partner for the implementation of the Bug Resilience Project, you can apply to one or more of the following work packages. To find more information on our Bug Resilience Project concept or how to apply, please follow the links below: Work Package 1: Lowering Technical Debt in Participating FOSS Projects and fixing known issues https://www.dtvp.de/Satellite/public/company/project/CXP4YWL6ZF6/en/documen… Work Package 2: Implementing Responsible Bug Disclosure Processes https://www.dtvp.de/Satellite/public/company/project/CXP4YWL6ZFH/en/documen… Work Package 3: Manage a bug bounty program https://www.dtvp.de/Satellite/public/company/project/CXP4YWL6ZF5/en/documen… We look forward to hearing from you and working together to make the open source ecosystem more secure and resilient. Best, the STF team Sovereign Tech Fund Newsletter by Sovereign Tech Fund Lagerhofstr. 4 Leipzig, Sachsen 04103 Germany

1 0

RV: Webinars on software supply chain
by Marcos Sanz 21 Apr '23

21 Apr '23

All, attached some info on a series of webinars on the supply chain management organized by the NLnet colleagues, which I think could be of interest to the wg. Recordings of the two past webinars are available online (s. link further down). Also further down you'll details on the two upcoming ones. Enjoy and have a nice weekend! Marcos > NLnet and NGI Zero/NGI Assure are organising a series of webinars on > *Open Software Supply Chain management*. As the dependency of society > on technology continues to increase in every possible direction, it is of the > utmost importance to understand the dynamic life cycle of the free and open > source building blocks that form the basis of pretty much all technology we > use today - and how these can be kept safe and available. > > Not only do we need to improve our understanding of how and where > software is developed, maintained, built and deprecated at macro scale - but > we also need to create mechanisms to ensure that building blocks are kept > up to date, that different versions don't collide, FOSS packages from public > repositories have not "bit-rotted" or even worse: have been tampered with > by malicious actors as part of a "supply chain attack". There has been an > increasing attention to the fact that with software "eating the world", a > healthy and robust software ecosystem should be a key societal (and thus > political) priority. But at the same time, we should do so with full > understanding of the highly specific nature of "digital commons" - as the > controversy surrounding the upcoming Cyber Resilience Act clearly proves. > > In this series of webinars by leading experts such as Armijn Hemel (Tjaldur), > Shane Coughlan (OpenChain), Carlo Piana (OSI), Alberto Pianon (FSFE) and > Philippe Ombredanne (AboutCode) we look at software supply chains from > different angles. What do modern electronics supply chains look like, how is > provenance handled - and how *should* it be handled? What mechanisms > do we have to verify the integrity of deployed code packages and detect > abnormal code changes that may be signs of malicious modifications and > possible attacks? Where do "Software Bill of Materials" come into play? And > what is being done, and perhaps should be done from a legislative and > governance point of view? > > The entire webinar series is available free of charge, and will allow you a > deep dive into the hidden world behind the software and hardware we use - > and will help you get a clear understanding of how open source supply chains > work, and a grasp of what the policy challenges are. > > You can join the webinars via this BigBlueButton link: > > https://bbb.protagio.nl/b/ron-qed-tog-gey -- > The other episodes in the webinar series on Open Software Supply Chain > management are: > > * Thursday May 4th 2023 // 13.00 - 14.30 CEST (Amsterdam, Berlin, Rome) > > - Speakers: Carlo Piana & Alberto Pianon. > - Topic: The importance of a Software Bill of Materials in light of the > upcoming Cyber Resilience Act and product liability legislation in Europe. > - More info: > https://nlnet.nl/events/20230504/WebinarSoftwareSupplyChain-ep3 > > * Thursday May 11th 2023 // 13.00 - 14.30 CEST (Amsterdam, Berlin, Rome) > > - Speaker: Shane Martin Coughlan > - Topic: ISO standards and certification. (This talk was previously scheduled > for April 27). > - More info: > https://nlnet.nl/events/20230511/WebinarSoftwareSupplyChain- > ep4/index.html > > The first episode with Armijn Hemel already took place on April 6th, with the > topic of Open Source in (Consumer) Electronics Supply Chains. You can find > the link to the recording here: > > https://nlnet.nl/events/20230406/WebinarSoftwareSupplyChain/index.html > > Looking forward to see you there! > > the NLnet team

1 0

Opensource-WG: Call for Presentations (RIPE 86, 22-26 May)
by Martin Winter 13 Mar '23

13 Mar '23

The next RIPE Meeting is coming up - your chance to present about some interesting Open Source If you would like to give a presentation during the OpenSource WG session, then please contact us (the WG chairs). In general, each talk is 15-30 mins (depending on how much time is needed). If you have some idea and not sure how/if you should present something then feel free to contact us as well to discuss the idea. For small project updates, we are planning to reserve 30 mins again at the end of the WG session. These short 5..10(max) min updates/talks are decided on the day before the WG session on a time/space available base. No need to submit anything for these talks at this time. Thanks, Martin Winter, Marco Sanz & Ondrej Filip OpenSource WG Chairs

1 0

concern re: Cyber Resilience Act effects on open source?
by Maarten Aertsen 29 Nov '22

29 Nov '22

good afternoon list, I would like to understand the number of people/organisations on this list who are concerned about the European Commission's Cyber Resilience Act proposal effects on open source software development. This topic was presented at RIPE85 [1] and covered in a recent blog (see below, should have cross-posted), which was republished at RIPE Labs last week: https://labs.ripe.net/author/maarten-aertsen/open-source-software-vs-the-pr… You would help both me and RIPE NCC staff that are tracking the proposal by speaking up on list. Answers by both developers and users are valuable. A simple +1 is fine. Thanks. kind regards, Maarten -------- Forwarded Message -------- Subject: Re: [cooperation-wg] Cyber Resilience Act effects on OSS on agenda of open source-wg Date: Mon, 14 Nov 2022 09:38:00 +0100 From: Maarten Aertsen <maarten(a)nlnetlabs.nl> To: cooperation-wg(a)ripe.net Good morning, I just published an extended, written version of my RIPE talk in the open-source wg [1] with NLnet Labs' perspective on the European Commission's proposal for a Cyber Resilience Act vs. Open Source: https://blog.nlnetlabs.nl/open-source-software-vs-the-cyber-resilience-act/ We feel the current proposal misses a major opportunity. The CRA could bring support to open-source developers maintaining the critical foundations of our digital society. But instead of introducing incentives for integrators or financial support, the current proposal will overload small developers with compliance work. At the same time, this is only the Commission's proposal. I hope there is opportunity to raise awareness and influence the coming positions and negotations. I'm very grateful to the many people in the RIPE community that talked to me after my presentation. I feel my understanding of the issue is improving. Curious to hear what you think, how you feel this affects the projects you rely on and what we have yet to learn about the implications. kind regards, Maarten [1] https://ripe85.ripe.net/archives/video/911 -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/cooperation-wg

5 6

Minutes of RIPE85 opensource wg meeting
by Marcos Sanz 22 Nov '22

22 Nov '22

Dear all, the minutes of the session are online now: https://www.ripe.net/participate/ripe/wg/active-wg/os/minutes/open-source-wo rking-group-minutes-ripe-85 Have a great start in the day Marcos

1 0