OSPOlogyLive Amsterdam 2025 Presentations & Roundtable notes

[anajsana]

Creating a thread for the OSPOlogyLive Amsterdam presentations. Please add your presentations and roundtable notes as new comments to this thread

[bvhme]

20250327 OSPOlogy live.pdf

Here is the presentation of Koos Steenbergen and me. Thanks.

[anajsana]

OSPOlogy_OSSRiskManagement_2025.pdf

Here is the presentetion from Miguel Angel and me 🙂

[anajsana]

OpenSSF presentation and CHAOSS were added to the OSPOlogyLive AMS repo directly. I'm referencing here too:

• OpenSSF Security Baseline - Daniel, OpenSSF
• Government OSS Work of Remy DeCausemaker - Sean Goggins, CHAOSS

[GeekoOnTour]

IT Security & IT Regulations - Day 1 (Room C)

Getting ready for the Round Table on IT Security & IT Regulations

To prep you can think of:

• What goes well?
• What needs improvement?
• Where do need help?

[sgoggins]

Things we do well

• Clear view
• OpenSSF Scorecard and other metrics.
• OWASP
• OpenCAT
• National Cybersecurity Center: National Dutch institution that provides advisories and other security information.
• SBOM is registerred for formal standardiation
• EU Standards
• STIG/CIS - Provide pre-hardened images of your platform, like LINUX for example
• Reporoducable builds.
• A number of Dutch companies, such as Radically Open Security and CISOFY (security hardening tools for open source )

[sgoggins]

Things to work on Improving:

• "This is Fine" mindset ought to be improved. Greater urgency and resource commitment is necessary.
• Funding
• Awareness
• Cyberresiliance act (Could also be considered as going well).
• CRA Should know more
• GDPR
• Different persons for the same thing with regards to regulation
• Standards are outdated
• Critical digital infrastructure is not fine
• The level of detail of the SBOM needs to be greater
• SBOM requires continuous updating/maintenanc

[sgoggins]

Where we need help:

• Best practices and reference architecture
• The government could make certain that the best practices and reference architectures happen
• Compliance statements for open source packages/software
• Regulations to make it more clear when it is "compliant enough"

[sgoggins]

• List of common criteria that we should check against
• Help with coordinated vulnerability disclosures
• How to do security by design

[anajsana]

Build Better Together Roundtable Notes - Day 1 (Room B)

Academia - Industry - Government Collaboration and Partnerships in Europe

Cross-collaboration between academia, industry and governments

What are the scenarios where these connections happen?

Some topics raised by attendees:

• Bring together industry, academia and government
• How does industry-academic collaboration happen
• How does funding -academic funding happen
• What tooling can help to better collaborate and not reinvent the wheel across industry-academia-governments?
• How can we better implement InnerSource patterns to build an open source culture that prepares organizations to open source their projects, contribute to existing ones, and ensure long-term success and maintainability — while staying compliant and fostering excitement?

[anajsana]

Perceived Challenges

• Cost-benefit of open source is not clear : E.g why my company should be investing in UN's SGD?
• Open is by mutalizing the cost of compliance
• Value related to the USE of open source has bigger audience than the one CREATING. However, sometimes we only focus on convincing leadership about cration

Potential pushback from decision-makers / executives

Unless we automate the whole security / compliance risk issue, decision makers or policy makers are not going do nothing, event though they know is critical (because they don't have the means, not the tooling to make this happen)

[anajsana]

Example: What made Kubernetes so powerful?

• Technology need from the bottom up
• Maintenance and security were big blockers
• Strategic support from major industry players (e.g Google, CNCF)
• Modular and extensible architecture that invited innovation

[anajsana]

Where we Need Help

• Automating Security and Compliance Risk Management: Maintain and improve existing tooling (e.g., ORT, GrimoireLab, Augur) to streamline how organizations assess and manage open source risk, reducing the manual overhead and making it easier to adopt at scale.
• Identifying Critical Needs in Open Source Projects: Develop better mechanisms to pinpoint where projects need support—especially in areas like security, compliance, and long-term maintenance — and connect these needs with effective funding strategies from organizations.
• Elevating Cross-Organizational Collaboration: Move beyond isolated contributions toward structured, high-level collaboration models that foster shared ownership, co-investment, and coordinated roadmaps across companies and communities.

[cornovromans]

Here's my presentation.
ospology-20250326-SURF.pdf

[jklardie]

Thanks for having me! Here are my slides on The Challenges and Successes of open source at the City of Amsterdam.

opensource-city-of-amsterdam.pdf

We have an enablement team in place that focuses on creating standards, best practices and discover, build and maintain reusable components. Currently we're focussing on implementing an internal developer portal to get a better overview of our technical ecosystem, address ownership and improve on our overall quality of code, documentation, etc.

[jklardie]

Also very much related to what we have been discussing today: https://www.amsterdam.nl/nieuws/nieuwsoverzicht/digitale-onafhankelijkheid/

[anajsana]

Security & Regulations Workshop - Day 2 (Room C)

Workshop open-sourcing a project

📝👉 Full notes Avaliable 🦊 here

[anajsana]

📝👉 Full notes Avaliable 🦊 here

Overview of the Previous Work Done

• OSPO Scode Scanner: A GitHub Actions workflow and related configuration files to check if code repositories follow typical open source practices.
• OpenSSF Scorecard: Automated tool that assesses a number of important heuristics ("checks") associated with software security and assigns each check a score of 0-10.
• OpenSSF Baseline: A minimum definition of requirements for a project relative to its maturity level.
• RepoLiner: Lint open source repositories for common issues
• OpenRailAssociation - Compliance Assistant: toolset designed to assist with creating and managing Software Bill of Materials (SBOMs). It helps in enriching SBOMs with licensing and copyright information and checks for Open Source license compliance using data from ClearlyDefined.

Useful Guides to Project Launch

• NL - Project Launch Checklist
• EN - Starting an Open Source Project

[anajsana]

Overview of OSS License Best Practices by SPDX Guide

Read the Guide

Guide on publishing code that is not transparent-by-design

[anajsana]

Notes

Leadup to the workshop

• KNMI weather app published without open source license https://gitlab.com/KNMI-OSS/KNMI-App/knmi-app-api/-/issues/1 Public domain or with a license?
• Also other aspects could have been improved.
• Mitch did research in this area for the goverment.
• Mitch, Thomas and Nico have expertise in how to open to open source codebases.

Introduction

• Under the WOO legislation source code can be requested. So need to publish. Organizations looking for guidance.
• Review of tooling according to OSPO Code Scaner workflow that combines multiple tools.
• Repolinter, how to run it on multiple repositories? TODO
• Open Rail Association Compliance assistant, more focussed on SBOMs.
• Mismatch between OSPOs need and what companies provide. For example dual-use tools that can check both internal and outside projects.
• Discussion: different levels of maturity in organization open source expertise. Let's not make perfect the enemy of good.
• Difference whether an organization needs to publish code on request or can decide for itself.
• Review of WOO requests, organizatios handled it differently. For some it was it was too sensitive to publish immediately and more delibaration was needed. The publication of BGP 2.0 became political and got discussed in parliament and it was a difficult to make it readable.
  • Intellectual property rights: the organization did not fully own the components and intellectual property was not correctly handled so it had to be handled the moment of the request.
  • So: how to think beforehand about intellectual property and other aspects to avoid hassle.
• Idea to get to certain default standards for publication. Also to distinguish 'code dumps' from collaborative projects. To make it instanatly clear. Public.yml file.
  • Idea of 3 ambition levels: For the aspect of collaboration this can be 1) not seeking input 2) seeking input 3) community driven development. Can also be part of the project launch checklist. Other aspects could be part of this too, like having multiple businesses involved.
  • Other aspects: README quality, presence of CICD pipeline.
• When to open source? You don't want to be ambarassed.
• Apache project badge to say that project is experimental. Then go to incubation. To explicitly label the maturity levels.
• About starting private first. If you start private and have to publish later, the lawyers want to review at the moment. It is easier to start in public and be explicit that is just starting.
• A strict review process for publication can be sidestepped by open sourcing the initial code and contributing the substance afterwards.
• Regarding business case, some organizations would like to hand off their open source projects to some other organization to continue maintance.
• Review of Abacus project.
• Open source policy as code was inspiration for ORT, to be able to change and improvement it where necessary by developers.
  • Match on proprietary software file in a dependency. But that was flagged and fixed already. But do you go to this level?
  • Distinction of development packages and runtime packages. In ORT the developer can indicate if a library is used just for development or not. Important to make it clear to legal.
  • Distinction between declared licenses and detected licenses

[anajsana]

Wrap Up Screenshots