May 2024 - Foundation-board - lists.openinfra.dev

Informal Security Working Group - Next Meeting - May 23rd, 2024
by Julia Kreger 15 May '24

15 May '24

Greetings everyone, I have scheduled our next meeting of the informal security working group on Thursday May 23rd, 2024 at 8 AM US Pacific / 1500 UTC. If you're interested, please feel free to join us. Details can be found on the etherpad. Thanks, -Julia [0]: https://etherpad.opendev.org/p/board-informal-security

1 0

Following up from informal security working group - A security principal?
by Julia Kreger 10 May '24

10 May '24

Greetings, Yesterday during the informal security working group meeting, we had a lighter and somewhat of a different attendance due to just the nature of schedules. We didn't end up diving into the high level requirement extraction which is where our first meeting started approaching, and in this meeting we started heading into the question of the principals and high level requirements as a starting point to building consensus. While we have some core themes we collected in the etherpad[0], what is likely needed is a stated principal or set of principles, much like the four opens. Something to set a tone is what is needed. It was noted in discussion that a principal could be as simple as an item in the project confirmation guidelines, but that might not set the overall tone required. I'm sure future discussion amongst the board will help bring consensus as time moves forward. One interesting aspect we need to keep in mind as we move forward, we're not just talking about aspects which relate to the foundation, but the expectations to have of our communities as well as expectations as it relates to how packagers/distributors engage. To cover some of the core themes, it was noted: - Open Infrastructure means a long-term investment in both trust and security. - No new release of software from a project should ever take place with a known vulnerability. This means guidelines and project level processes would be necessary as well, and highlights a need for an upper level principal statement to drive consensus. - Users should have a forward path they can take, i.e. to upgrade. One challenge I've encountered writing this email is we can be vague with a principal to set a tone, except any attempt to be specific begins to take us down the path of expectation setting. Setting a requirement is also easy, but expectation setting requires specific dialog in that specific context. As a result, I think the best path to a principal statement is reaching consensus along the lines of "Security is a primary concern for all OpenInfra projects, second only to the project's specific problem it seeks to solve." With an established principle, we can then begin to set requirements at the foundation level, and then engage projects to ensure requirements are clear, communicated, and are appropriately documented. Documentation is also critical as packagers/distributors and regulatory/market surveillance authorities will need a clear understanding of relationships and how to engage specific projects should issues arise. Thoughts? -Julia [0]: https://etherpad.opendev.org/p/board-informal-security#L107

1 0

OpenInfra Foundation Staff Update - May 2024
by Allison Price 06 May '24

06 May '24

Hi OpenInfra Board Members, I hope you’re all having a great start to May. Several of us are about to head to different OpenInfra Days in Europe and are excited to meet with the local communities! I wanted to share an OpenInfra Foundation staff update via email with some of the latest momentum and progress we are making since we are not having a board meeting this month where we would have normally presented this staff update. To best represent the recent activities, I wanted to organize them around the 2024 OpenInfra Foundation goals. Strengthening OpenInfra projects For the OpenStack project, several initiatives are in motion to improve the software through new releases delivering impactful features as well as improving project brand awareness. As we discussed at a board meeting earlier this year, Broadcom’s acquisition of VMware has provided a massive opportunity to the OpenStack and StarlingX ecosystem. Forrester reached out to us and asked for a briefing in which a group of several analysts said they were getting “truckloads of inquiries” about OpenStack being an alternative for VMware. We distributed a VMware strategy survey to OpenInfra Platinum, Gold and Silver members. With the information gathered, we learned that 82% of polled OpenInfra members have already received interest from organizations seeking a VMware alternative and 61% of respondents have already successfully migrated a VMware customer to an OpenStack-based product. 100% of members were interested in an OpenInfra Foundation ecosystem collaboration to make the most of this opportunity, which we will be kicking off in the next few weeks. We are also commissioning a third party report from an industry reporter who has covered the space for 15+ years. This will provide external validation with market statistics that we can all leverage. We are making progress on a whitepaper that shows the value of integrating OpenStack, Kubernetes and Linux. Kendall Nelson is leading the development and hosted a kickoff meeting last week with several volunteers from the OpenStack and StarlingX community. I am also working with OpenInfra Platinum and Gold members to create reference architectures and customer case studies. We are aiming to publish this at the OpenInfra Summit Asia in September. The OpenStack community delivered its 29th release, Caracal <http://openstack.org/caracal>, last month and the StarlingX community delivered its 9.0 release <https://www.starlingx.io/blog/starlingx-release-9/> as well. Here is just some of the coverage from these two releases. Please share with your networks and congratulate the community members on these important milestones! OpenStack Improves Support for AI Workloads <https://techcrunch.com/2024/04/04/openstack-improves-support-for-ai-workloa…> OpenStack Caracal improves agility & delivers bite as VMware alternative <https://www.computerweekly.com/blog/Open-Source-Insider/OpenStack-Caracal-i…> StarlingX 9.0 open source cloud platform boosts performance for telco and edge <https://www.sdxcentral.com/articles/analysis/starlingx-9-0-open-source-clou…> StarlingX is an O-RAN darling, version 9.0 toughened & hardened <https://www.computerweekly.com/blog/Open-Source-Insider/StarlingX-is-an-O-R…> Zvonko Kaiser, a newly elected member of the Kata Containers AC, presented NVIDIA’s use of Kata Containers <https://katacontainers.io/use-cases/#NVIDIA> at KubeCon EU Defending the OpenInfra Vision of Open Source Thierry Carrez was re-elected as vice chair to the OSI Board as it tackles important challenges, like defining open source AI or momentum around new restrictive licenses. At the end of April, Llama 3 was released as the newest AI model claiming to be open source (it is not). Mark Collier took a stance in this New Stack article <https://thenewstack.io/open-source-has-a-definition-lets-get-serious-about-…> explaining why using “open source” incorrectly needs to be something we all band together to defend. The OpenInfra Foundation staff continues to engage with the relevant stakeholders to follow progress and engage as necessary around the EU’s Cyber-Resilience Act. Thierry shared an update <https://lists.openinfra.dev/archives/list/foundation-board@lists.openinfra.…> to the board mailing list last week on the latest developments. Upon hearing about a “Post-Open Zero Cost License,” Mark talked to a reporter and was quoted in the Register <https://www.theregister.com/2024/04/30/bruce_perens_post_open_license/> defending open source licensing. Increasing OpenInfra Impact OpenInfra Days Europe is kicking off tomorrow with OpenInfra Day Sweden! Across the five OpenInfra Days events, over 700 community members are registered and several organizations are sponsoring the events. We will have several Foundation staff traveling to the events over the next few weeks and are excited to connect with our local communities! We would like to thank all of the community organizers who have made these events possible! If you are attending any of these events, please let us know. The OpenInfra Summit Asia is being held in Suwon, South Korea September 3-4. Registration <https://2024.openinfraasia.org/>, sponsorship <https://openinfra.dev/events/sponsorship> and the CFP <https://openinfrafoundation.formstack.com/forms/openinfra_asia_summit_2024> are open for the OpenInfra Summit Asia! The CFP closes May 29, so please encourage your teams to submit presentations <https://openinfrafoundation.formstack.com/forms/openinfra_asia_summit_2024> to be included in the event! Last month, we had another virtual PTG where we had over 30 teams hold over 60 hours of discussions with over 600 attendees. The project teams published summaries <https://superuser.openinfra.dev/articles/ptg-april-2024-summary/> from the discussions held that week. The OpenInfra Asia Advisory Board met for the 2nd time in 2024, ramping up for the OpenInfra Summit Asia and the OpenInfra Europe Advisory Board will meet in June to reflect back on OIDs Europe. We have a lot of exciting momentum across the various OpenInfra project communities as well as with the events being hosted around the world. Thank you to everyone for your contribution and collaboration! Cheers, Allison

1 0

Update on EU Cyber Resilience Act (CRA)
by Thierry Carrez 03 May '24

03 May '24

Hi everyone, As promised we keep you updated on new developments on the Cyber-Resilience Act in the EU, a legislation that will affect everyone providing products based on digital elements on the European market in the coming years (not just open source). The text that was adopted at first reading by the European Parliament on March 12 has been published, you can find it here: https://www.europarl.europa.eu/doceo/document/TA-9-2024-0130_EN.html#title2 It is based on the same text that the Trilogue negotiations agreed to in November 2023, which we previously communicated to you when it was published in December, but is not exactly the same. You will find that the recitals and articles have been renumbered, but overall the text did not change much. One addition that is significant from the perspective of open source appears in article 2(48) when they define what they mean by open source: “Free and open-source software is understood as software the source code of which is openly shared and the license of which provides for all rights to make it freely accessible, usable, modifiable and redistributable.” You can see that in addition to requiring a license that respects base open source freedoms, they added the requirement that the source code be "openly shared", a requirement that is not encoded in open source licenses (only recipients of binary form must be able to request the corresponding source code). We have evidence that this was carefully considered and added on purpose, in one step that reinforces the permissionless innovation nature of open source. The process is now moving to defining the "harmonized standards", which translate the requirements detailed in the regulation into detailed technical specifications. Those are a critical element, as products which are in conformity with those harmonized standards will be presumed in conformity with the CRA. The Commission published a few days ago the draft of the upcoming call for European Standards Organization (ESOs) to produce such standards: https://ec.europa.eu/docsroom/documents/58974 Given that those standards organizations do not have a stellar record for transparency and engaging with the open source community, it was a relief to see that in this draft the Commission requires that "particular account should be given to the needs of the free and open source software community" (recital 10), that the inclusion of the open source community is documented in the ESOs work programmes (article 2), and that the reporting on the work includes a clear description of how they facilitated representation and participation of the relevant stakeholders (specifically including the open source community, article 3). The first standards are expected for August, 2026. The OpenInfra Foundation staff continues to engage with the relevant stakeholders to follow progress and engage as necessary. We'll continue to keep you updated on new developments. Regards, -- Thierry Carrez General Manager, OpenInfra Foundation

1 0