July 2023 - Foundation-board - lists.openinfra.dev

News on the Cyber-Resiliency Act
by Thierry Carrez 01 Aug '23

01 Aug '23

Greetings Directors, At our in-person board meeting in Vancouver last month, our lawyers at DLA Piper presented a landscape of regulatory threats and challenges that could affect open source in the near future. One of those challenges was the Cyber-Resiliency Act, a proposed legislation in the EU that aims at introducing safety best practices in digital products. Unfortunately, the initial text proposed by the EU Commission was drafted without much input from the open source community, and failed to take into account the specificity of our development model, potentially resulting in a chilling effect for developers and organizations involved, or the fragmentation of our global communities. We participated in the community response by posting our position[1], aligned with our partner organizations in the open source world. The next steps were to wait for the new versions of the proposed legislation as the EU Parliament committees worked on their own version, to see if they included any further provisions to protect open source or not. [1] https://openinfra.dev/blog/openinfra-foundation-cyber-resilience-act The Parliament version of the text was recently presented, ahead of the ITRE (Industry, Research and Energy) committee vote on the draft. I personally reached out to ITRE committee members asking to delay the vote, but the committee nevertheless approved it on a vote[2] *yesterday morning*. [2] https://www.europarl.europa.eu/news/en/press-room/20230717IPR03029/cyber-re… The new version of the text now contains further precision to exclude from its scope open source software developed using a “fully decentralised development model”, which matches the principles under which OpenInfra software is being developed (the Four Opens). However, this provision is superseded by other provisions squarely placing any project with developers employed by commercial entities within the scope of the act, which basically covers nearly all of open source software produced today. The text also contains no improvement on the process itself, for example still requiring that vulnerabilities be disclosed to ENISA within hours of discovery, even if no patch has been developed to fix them. This is orthogonal to vulnerability management best practices (like limiting access to unpatched vulnerabilities to the key people able to fix them, or responsible disclosure), while making the ENISA database a single high-value target for hackers in search of unpatched vulnerabilities. Adoption by the ITRE committee does not mean the fight is over, or the text final and approved. Now that it’s gone through the three committees involved (LIBE, IMCO, and ITRE), the text becomes a proposal to be voted on by the full Parliament. It is unclear at this stage if there will be a specific discussion and a free vote on it, it will depend how consensual or controversial it appears to be. In parallel, the EU Council (representing national governments) will prepare its own version of the text, and in the end all proposed acts will be reconciled into a single version that will become law. At the OpenInfra Foundation level we will follow next steps with attention, and participate in any industry initiative to improve this text to take into account the specificities of our global, collaborative value creation model. More specifically, we collaborate with the Open Source Initiative, Open Forum Europe, Linux Foundation and others to coordinate and support industry response. We will keep you updated on future developments. Regards, -- Thierry Carrez General Manager, OpenInfra Foundation Director, OpenInfra Europe

3 3

OpenInfra Foundation Board of Directors Meeting, August 1st, 2023 at 2100-2300 UTC
by Julia Kreger 28 Jul '23

28 Jul '23

Greetings, The next meeting of the OpenInfra Foundation Board of Directors will occur on Tuesday August 1st, 2023, between 2100 and 2300 UTC. During this meeting we expect to receive an update from the Foundation Staff during which they will provide an update on event plans for 2024. Meeting Date: August 1st, 2023 Meeting Time: 2100-2300 UTC / 2:00 PM - 4:00 PM US Pacific Video conference: https://zoom.us/j/96201224963 International dial-in (audio only): https://zoom.us/zoomconference (conference ID #962 0122 4963) To join the session by phone only: +1 669 900 6833 US (San Jose) OR +1 646 876 9923 US (New York) Meeting ID: 962 0122 4963 Agenda: https://board.openinfra.dev/meetings/2023-08-01 Please feel free to reach out if you have any questions. Thanks, -Julia

1 0

Call for Agenda Items for August 1st 2023 OpenInfra Board Meeting
by Julia Kreger 25 Jul '23

25 Jul '23

Greetings Directors, Our next meeting of the Board is rapidly approaching on August 1st, 2023 at 2100 UTC. I have posted a draft agenda to the board Wiki[0]. If you have specific items we need to cover during the meeting, please let me know as soon as possible. Thanks! -Julia [0]: https://board.openinfra.dev/meetings/2023-08-01

1 0