- Foundation-board - lists.openinfra.dev

Informal Security Working Group - Next Meeting - May 23rd, 2024
by Julia Kreger 15 May '24

15 May '24

Greetings everyone, I have scheduled our next meeting of the informal security working group on Thursday May 23rd, 2024 at 8 AM US Pacific / 1500 UTC. If you're interested, please feel free to join us. Details can be found on the etherpad. Thanks, -Julia [0]: https://etherpad.opendev.org/p/board-informal-security

1 0

Following up from informal security working group - A security principal?
by Julia Kreger 10 May '24

10 May '24

Greetings, Yesterday during the informal security working group meeting, we had a lighter and somewhat of a different attendance due to just the nature of schedules. We didn't end up diving into the high level requirement extraction which is where our first meeting started approaching, and in this meeting we started heading into the question of the principals and high level requirements as a starting point to building consensus. While we have some core themes we collected in the etherpad[0], what is likely needed is a stated principal or set of principles, much like the four opens. Something to set a tone is what is needed. It was noted in discussion that a principal could be as simple as an item in the project confirmation guidelines, but that might not set the overall tone required. I'm sure future discussion amongst the board will help bring consensus as time moves forward. One interesting aspect we need to keep in mind as we move forward, we're not just talking about aspects which relate to the foundation, but the expectations to have of our communities as well as expectations as it relates to how packagers/distributors engage. To cover some of the core themes, it was noted: - Open Infrastructure means a long-term investment in both trust and security. - No new release of software from a project should ever take place with a known vulnerability. This means guidelines and project level processes would be necessary as well, and highlights a need for an upper level principal statement to drive consensus. - Users should have a forward path they can take, i.e. to upgrade. One challenge I've encountered writing this email is we can be vague with a principal to set a tone, except any attempt to be specific begins to take us down the path of expectation setting. Setting a requirement is also easy, but expectation setting requires specific dialog in that specific context. As a result, I think the best path to a principal statement is reaching consensus along the lines of "Security is a primary concern for all OpenInfra projects, second only to the project's specific problem it seeks to solve." With an established principle, we can then begin to set requirements at the foundation level, and then engage projects to ensure requirements are clear, communicated, and are appropriately documented. Documentation is also critical as packagers/distributors and regulatory/market surveillance authorities will need a clear understanding of relationships and how to engage specific projects should issues arise. Thoughts? -Julia [0]: https://etherpad.opendev.org/p/board-informal-security#L107

1 0

OpenInfra Foundation Staff Update - May 2024
by Allison Price 06 May '24

06 May '24

Hi OpenInfra Board Members, I hope you’re all having a great start to May. Several of us are about to head to different OpenInfra Days in Europe and are excited to meet with the local communities! I wanted to share an OpenInfra Foundation staff update via email with some of the latest momentum and progress we are making since we are not having a board meeting this month where we would have normally presented this staff update. To best represent the recent activities, I wanted to organize them around the 2024 OpenInfra Foundation goals. Strengthening OpenInfra projects For the OpenStack project, several initiatives are in motion to improve the software through new releases delivering impactful features as well as improving project brand awareness. As we discussed at a board meeting earlier this year, Broadcom’s acquisition of VMware has provided a massive opportunity to the OpenStack and StarlingX ecosystem. Forrester reached out to us and asked for a briefing in which a group of several analysts said they were getting “truckloads of inquiries” about OpenStack being an alternative for VMware. We distributed a VMware strategy survey to OpenInfra Platinum, Gold and Silver members. With the information gathered, we learned that 82% of polled OpenInfra members have already received interest from organizations seeking a VMware alternative and 61% of respondents have already successfully migrated a VMware customer to an OpenStack-based product. 100% of members were interested in an OpenInfra Foundation ecosystem collaboration to make the most of this opportunity, which we will be kicking off in the next few weeks. We are also commissioning a third party report from an industry reporter who has covered the space for 15+ years. This will provide external validation with market statistics that we can all leverage. We are making progress on a whitepaper that shows the value of integrating OpenStack, Kubernetes and Linux. Kendall Nelson is leading the development and hosted a kickoff meeting last week with several volunteers from the OpenStack and StarlingX community. I am also working with OpenInfra Platinum and Gold members to create reference architectures and customer case studies. We are aiming to publish this at the OpenInfra Summit Asia in September. The OpenStack community delivered its 29th release, Caracal <http://openstack.org/caracal>, last month and the StarlingX community delivered its 9.0 release <https://www.starlingx.io/blog/starlingx-release-9/> as well. Here is just some of the coverage from these two releases. Please share with your networks and congratulate the community members on these important milestones! OpenStack Improves Support for AI Workloads <https://techcrunch.com/2024/04/04/openstack-improves-support-for-ai-workloa…> OpenStack Caracal improves agility & delivers bite as VMware alternative <https://www.computerweekly.com/blog/Open-Source-Insider/OpenStack-Caracal-i…> StarlingX 9.0 open source cloud platform boosts performance for telco and edge <https://www.sdxcentral.com/articles/analysis/starlingx-9-0-open-source-clou…> StarlingX is an O-RAN darling, version 9.0 toughened & hardened <https://www.computerweekly.com/blog/Open-Source-Insider/StarlingX-is-an-O-R…> Zvonko Kaiser, a newly elected member of the Kata Containers AC, presented NVIDIA’s use of Kata Containers <https://katacontainers.io/use-cases/#NVIDIA> at KubeCon EU Defending the OpenInfra Vision of Open Source Thierry Carrez was re-elected as vice chair to the OSI Board as it tackles important challenges, like defining open source AI or momentum around new restrictive licenses. At the end of April, Llama 3 was released as the newest AI model claiming to be open source (it is not). Mark Collier took a stance in this New Stack article <https://thenewstack.io/open-source-has-a-definition-lets-get-serious-about-…> explaining why using “open source” incorrectly needs to be something we all band together to defend. The OpenInfra Foundation staff continues to engage with the relevant stakeholders to follow progress and engage as necessary around the EU’s Cyber-Resilience Act. Thierry shared an update <https://lists.openinfra.dev/archives/list/foundation-board@lists.openinfra.…> to the board mailing list last week on the latest developments. Upon hearing about a “Post-Open Zero Cost License,” Mark talked to a reporter and was quoted in the Register <https://www.theregister.com/2024/04/30/bruce_perens_post_open_license/> defending open source licensing. Increasing OpenInfra Impact OpenInfra Days Europe is kicking off tomorrow with OpenInfra Day Sweden! Across the five OpenInfra Days events, over 700 community members are registered and several organizations are sponsoring the events. We will have several Foundation staff traveling to the events over the next few weeks and are excited to connect with our local communities! We would like to thank all of the community organizers who have made these events possible! If you are attending any of these events, please let us know. The OpenInfra Summit Asia is being held in Suwon, South Korea September 3-4. Registration <https://2024.openinfraasia.org/>, sponsorship <https://openinfra.dev/events/sponsorship> and the CFP <https://openinfrafoundation.formstack.com/forms/openinfra_asia_summit_2024> are open for the OpenInfra Summit Asia! The CFP closes May 29, so please encourage your teams to submit presentations <https://openinfrafoundation.formstack.com/forms/openinfra_asia_summit_2024> to be included in the event! Last month, we had another virtual PTG where we had over 30 teams hold over 60 hours of discussions with over 600 attendees. The project teams published summaries <https://superuser.openinfra.dev/articles/ptg-april-2024-summary/> from the discussions held that week. The OpenInfra Asia Advisory Board met for the 2nd time in 2024, ramping up for the OpenInfra Summit Asia and the OpenInfra Europe Advisory Board will meet in June to reflect back on OIDs Europe. We have a lot of exciting momentum across the various OpenInfra project communities as well as with the events being hosted around the world. Thank you to everyone for your contribution and collaboration! Cheers, Allison

1 0

Update on EU Cyber Resilience Act (CRA)
by Thierry Carrez 03 May '24

03 May '24

Hi everyone, As promised we keep you updated on new developments on the Cyber-Resilience Act in the EU, a legislation that will affect everyone providing products based on digital elements on the European market in the coming years (not just open source). The text that was adopted at first reading by the European Parliament on March 12 has been published, you can find it here: https://www.europarl.europa.eu/doceo/document/TA-9-2024-0130_EN.html#title2 It is based on the same text that the Trilogue negotiations agreed to in November 2023, which we previously communicated to you when it was published in December, but is not exactly the same. You will find that the recitals and articles have been renumbered, but overall the text did not change much. One addition that is significant from the perspective of open source appears in article 2(48) when they define what they mean by open source: “Free and open-source software is understood as software the source code of which is openly shared and the license of which provides for all rights to make it freely accessible, usable, modifiable and redistributable.” You can see that in addition to requiring a license that respects base open source freedoms, they added the requirement that the source code be "openly shared", a requirement that is not encoded in open source licenses (only recipients of binary form must be able to request the corresponding source code). We have evidence that this was carefully considered and added on purpose, in one step that reinforces the permissionless innovation nature of open source. The process is now moving to defining the "harmonized standards", which translate the requirements detailed in the regulation into detailed technical specifications. Those are a critical element, as products which are in conformity with those harmonized standards will be presumed in conformity with the CRA. The Commission published a few days ago the draft of the upcoming call for European Standards Organization (ESOs) to produce such standards: https://ec.europa.eu/docsroom/documents/58974 Given that those standards organizations do not have a stellar record for transparency and engaging with the open source community, it was a relief to see that in this draft the Commission requires that "particular account should be given to the needs of the free and open source software community" (recital 10), that the inclusion of the open source community is documented in the ESOs work programmes (article 2), and that the reporting on the work includes a clear description of how they facilitated representation and participation of the relevant stakeholders (specifically including the open source community, article 3). The first standards are expected for August, 2026. The OpenInfra Foundation staff continues to engage with the relevant stakeholders to follow progress and engage as necessary. We'll continue to keep you updated on new developments. Regards, -- Thierry Carrez General Manager, OpenInfra Foundation

1 0

Informal Security Working Group
by Julia Kreger 26 Apr '24

26 Apr '24

Greetings Directors, As I mentioned during our last meeting, I've built some initial consensus on holding an informal working group session in relation to security to serve as input into updating our project confirmation guidelines. We will be having our first meeting this coming Thursday at 8 AM US Pacific / 1500 UTC. If you're interested, I've started an initial etherpad with a link to the meeting[0]. -Julia [0]: https://etherpad.opendev.org/p/board-informal-security

1 1

Cancelling May 2024 Meeting of the Board
by Julia Kreger 23 Apr '24

23 Apr '24

Greetings everyone, This morning the Foundation leadership staff, myself, and our vice-chairs met to discuss topics for our May meeting of the board. We quickly determined the staff has been very busy with press interactions and supporting the local organizers for OpenInfra days events. As such the staff had no pressing topics from their side. From the board side, we have one policy which we have been working on, but that is also not pressing. Combined with the schedule overlap with OpenInfra Days Sweden, we reached consensus we would cancel the May meeting. Anticipate the staff to share an email in the next couple of weeks to cover the press and marketing updates If anyone has pressing topics, please feel free to reach out to me directly. Otherwise, have a great month of May and I look forward to seeing you all during the June meeting of the Board. Thanks! -Julia

1 0

OpenInfra Summit Asia Update
by Allison Price 17 Apr '24

17 Apr '24

Hi everyone, I wanted to provide an update on the OpenInfra Summit Asia that Helena Spease shared to the mailing list yesterday. Registration, CFP and sponsorship are now available for the OpenInfra Summit Asia, happening in Korea September 3-4. We encourage you to share this information with your teams! OpenInfra Summit Asia Date: 3&4 September 2024 Register: https://2024.openinfraasia.org <https://2024.openinfraasia.org/> Submit a talk: https://openinfrafoundation.formstack.com/forms/openinfra_asia_summit_2024 Sponsor: https://openinfra.dev/events/sponsorship/#OpenInfraSummit-OCPRegionalSummit This event is being co-located with the OCP Regional Summit APAC. Registering via the provided link gets you access to all sessions whether they are hosted by the OCP community or OpenInfra community. If you have any questions, please let me know. Cheers, Allison > Begin forwarded message: > > From: Helena Spease <helena(a)openinfra.dev> > Subject: [OpenInfra Foundation] [OpenInfra Event Update] Registration for OpenInfra Summit Asia is now open and OpenInfra Day Hungary date change > Date: April 16, 2024 at 7:50:32 PM CDT > To: foundation(a)lists.openinfra.dev > > Hi everyone! > We are very excited to let you know that registration, CFP, and sponsorships for the OpenInfra Summit Asia are now open! > > ——— NEW EVENT UPDATES——— > OpenInfra Summit Asia > Date: 3&4 September 2024 > Register: https://2024.openinfraasia.org > Submit a talk: https://openinfrafoundation.formstack.com/forms/openinfra_asia_summit_2024 > Sponsor: https://openinfra.dev/events/sponsorship/#OpenInfraSummit-OCPRegionalSummit > This event is being co-located with the OCP Regional Summit APAC. Registering via the provided link gets you access to all sessions whether they are hosted by the OCP community or OpenInfra community. > ________ > OpenInfra Day Hungary > OpenInfra Day Hungary has been moved one day. The event will now take place on 3 June 2024 > ________ > OpenInfra Day Germany > Sponsorship for this event is almost sold out! The Platinum Sponsorship level is still available. https://openinfra.dev/events/sponsorship/#Germany > > ————— EVENT STATUS————— > Want to sponsor a 2024 OpenInfra event? Take a look at your options! https://openinfra.dev/events/sponsorship > > Submit your talks! > - OpenInfra Day Hungary: The deadline to submit your talk is 23 April https://docs.google.com/forms/d/e/1FAIpQLSe0JihvR_CQSB_r8G9bqZdtC8RIIZkxygy… > - OpenInfra Day Turkiye: The deadline to submit your talk is 30 April https://openinfraturkiye.org.tr/call-for-presentations/ > - OpenInfra Summit Asia: The Deadline to submit your talk is 29 May https://openinfrafoundation.formstack.com/forms/openinfra_asia_summit_2024 > _____ > OpenInfra Days Europe > See the latest info on OpenInfra Days Europe here: https://openinfra.dev/days > If you have any questions, email us at events(a)openinfra.dev! > _____ > Regional OpenInfra Summit Asia > See the latest info on the Regional OpenInfra Summit Asia here: https://openinfra.dev/summit > If you have any questions, email us at summit(a)openinfra.dev! > > Cheers, > Helena > > helena(a)openinfra.dev > Community Programs Coordinator > The OpenInfra Foundation > _______________________________________________ > Foundation mailing list -- foundation(a)lists.openinfra.dev > To unsubscribe send an email to foundation-leave(a)lists.openinfra.dev

1 0

OpenInfra staff at Open Source Summit NA
by Ildiko Vancsa 12 Apr '24

12 Apr '24

Greetings Directors, I’m reaching out to you about Open Source Summit NA (https://events.linuxfoundation.org/open-source-summit-north-america/), to let you know that Kendall Nelson and myself will attend the event this year. We will be available at the conference from Monday (April 15) morning till Thursday (April 18) afternoon. We are setting up meetings and will be exploring the event for news and updates that are relevant for the OpenInfra communities and ecosystem. Please let us know if you will be in Seattle, WA, USA for the conference and would be available to catch up with us in person. Thanks and Best Regards, Ildikó ——— Ildikó Váncsa Director of Community Open Infrastructure Foundation

1 0

StarlingX 9.0 is now available!
by Ildiko Vancsa 12 Apr '24

12 Apr '24

Greetings Directors, I’m reaching out to you with some exciting news. The StarlingX community reached another milestone by releasing the latest, 9.0 version of the platform! The new release of the project is strengthening the platform in several areas that are crucial for modern software infrastructure platforms, which include security, robustness, sustainability, and more! You can find further information in the press release: https://www.prweb.com/releases/starlingx-9-0-delivers-o-ran-enhancements-em… For more details about the new features and enhancements, please check out the release notes and project documentation: https://docs.starlingx.io/releasenotes/index.html#release-notes Please let me know if you have any questions. Best Regards, Ildikó ——— Ildikó Váncsa Director of Community Open Infrastructure Foundation

1 0

Follow-up on Board Topic - Revisiting security/vulnerability guidelines for projects
by Julia Kreger 05 Apr '24

05 Apr '24

Greetings Directors, During our last meeting we ended up touching upon a topic of revisiting our project confirmation guidelines with an eye towards both improving overall security while also seeking to ensure projects have appropriate base coverage as the regulatory environment evolves. I would like to set up a call where directors, and any interested community members could join in, with the idea of overall revisiting the pieces of known regulation which may or will apply, and determining if there are any requirements we can identify or expectations we can set for projects moving forward. That being said, I also realize this next week is the Project Teams Gathering. Would any board members be interested in participating in the PTG on Friday. This seems ideal in terms of community overlap. Let me know your thoughts as soon as possible, and if we have a few folks interested I'll schedule a session for us as well. Thanks, and have a great weekend! -Julia

2 1