279 lines
9.4 KiB
HTML
279 lines
9.4 KiB
HTML
<!doctype html>
|
||
<html lang="en">
|
||
<html lang="en">
|
||
<head>
|
||
<meta charset="utf-8">
|
||
<title></title>
|
||
|
||
<meta name="description" content="The Growing Body of Proprietary Infrastructure for FOSS Development: Repeating Bad History">
|
||
<meta name="author" content="Bradley M. Kuhn">
|
||
|
||
<meta name="apple-mobile-web-app-capable" content="no">
|
||
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
|
||
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no">
|
||
<link rel="stylesheet" href="css/reveal.css">
|
||
<link rel="stylesheet" href="css/theme/conservancy.css" id="theme">
|
||
|
||
<!-- Theme used for syntax highlighting of code -->
|
||
<link rel="stylesheet" href="lib/css/zenburn.css">
|
||
|
||
<!-- Printing and PDF exports -->
|
||
<script>
|
||
var link = document.createElement( 'link' );
|
||
link.rel = 'stylesheet';
|
||
link.type = 'text/css';
|
||
link.href = window.location.search.match( /print-pdf/gi ) ? 'css/print/pdf.css' : 'print/paper.css';
|
||
document.getElementsByTagName( 'head' )[0].appendChild( link );
|
||
</script>
|
||
</head>
|
||
|
||
<body>
|
||
<div id="hidden" style="display:none;">
|
||
<div id="header">
|
||
<div id="header-left"></div>
|
||
<div id="header-right"></div>
|
||
<div id="footer-left"></div>
|
||
</div>
|
||
</div>
|
||
<div class="reveal">
|
||
<div class="slides">
|
||
<section>
|
||
<h3><em>The Growing Body of Proprietary Infrastructure for FOSS Development: Repeating Bad History</em></h3>
|
||
|
||
<p>Karen M. Sandler, Executive Director, Software Freedom Conservancy (SFC)</p>
|
||
<p>Denver Gingerich, Director of Compliance, SFC</p>
|
||
<p class="copious"><s>Bradley M. Kuhn, Policy Fellow & Hacker-in-Residence, SFC</s></p>
|
||
<p class="copious">Bradley sends his regrets; he tested positive for
|
||
COVID-19 this morning and is quarantined.</p>
|
||
<p>FOSDEM 2025, Sunday 2 February 2025</p>
|
||
</section>
|
||
|
||
<section>
|
||
<h3>😷</h3>
|
||
<img align="right" width="30%" src="kant.jpg"/>
|
||
|
||
<blockquote cite="FIXME">
|
||
Act only according to that maxim whereby you can at the same time will
|
||
that it should become a universal law.<br/>
|
||
<p align="right"> — Immanuel Kant</p></blockquote>
|
||
|
||
<p class="copious" align="left">Bradley asked us to share the quote above and read this statement.</p>
|
||
|
||
|
||
</section>
|
||
<section>
|
||
<h3>FOSS Now Has a Long History</h3>
|
||
<img width="25%" align="left" src="samuel-clemens.jpg" />
|
||
<!-- FIXME: not thrilled with formatting here; I used to have a way to not
|
||
-- make the blog quote overlap picture, no time to research again.
|
||
-- Same is true on prior slide. -->
|
||
<blockquote cite="FIXME">
|
||
History doesn't repeat itself … but it often rhymes.
|
||
<p align="right"> — Samuel Clemens (nom de plume: Mark Twain)</p></blockquote>
|
||
</section>
|
||
|
||
|
||
|
||
<!-- Denver: you can edit above all you want -->
|
||
<!-- bkuhn promises to not work above here -->
|
||
<!-- bkuhn is still working on the below: -->
|
||
|
||
<!-- NO ONE BUT BKUHN EDIT BELOW YET: -->
|
||
|
||
|
||
|
||
<section>
|
||
<h3>Is There Really a Software Supply Chain?</h3>
|
||
</section>
|
||
|
||
<section>
|
||
<h3>Is There Really a Software Supply Chain?</h3>
|
||
|
||
<p>Not Really!</p>
|
||
</section>
|
||
|
||
<section>
|
||
<h3>Is There Really a Software Supply Chain?</h3>
|
||
|
||
<p>Not Really!</p>
|
||
|
||
<ul>
|
||
<li><s>Shipping containers</s></li>
|
||
<li><s>Giant cranes</s></li>
|
||
<li><s>Leakage (literal or figurative)</s></li>
|
||
<li><s>phone, lights, motor car</s></li>
|
||
<li><s>any single luxury</s></li>
|
||
</ul>
|
||
</section>
|
||
<section>
|
||
<h3>Is There Really a Software Supply Chain?</h3>
|
||
|
||
<p>The analogy does not fit <strong>for the same reasons that FOSS is a moral
|
||
imperative</strong>!</p>
|
||
|
||
<p>Physical objects are hard to store, move, copy, modify and reinstall.</p>
|
||
|
||
<p>FOSS is <em>trivially</em> stored, moved, copied, modified and
|
||
reinstalled.</p></section>
|
||
|
||
<section>
|
||
<h3>Who Cares about a Software Supply Chain, Then?</h3>
|
||
</section>
|
||
|
||
<section>
|
||
<h3>Who Cares about a Software Supply Chain, Then?</h3>
|
||
|
||
<p>Manufacturers and firms who <strong>want to make proprietary
|
||
software</strong> who seek to punish (for financial gain) any consumers who
|
||
share their software in the <strong>same way the laws of physics “punish” us
|
||
by making it hard to move physical items around the
|
||
world</strong>.</p></section>
|
||
|
||
</section>
|
||
|
||
<section>
|
||
<h3>The Bill of Materials Is About Physical Objects</h3>
|
||
|
||
<p>SBOM, like any cute marketing term, favors form over function.</p>
|
||
</section>
|
||
|
||
<section>
|
||
<h3>SBOM Has No Formal Definition</h3>
|
||
|
||
<p>As a marketing term, SBOM lacks specificity, which we should use to our
|
||
advantage as activists.</p>
|
||
</section>
|
||
|
||
<section>
|
||
<h3>CRA Does Not Mandate a Format</h3>
|
||
|
||
<p>There are competing SBOM format standards.</p>
|
||
<p>The CRA probably says the most about SBOMs of any regulation in the
|
||
world …</p>
|
||
<p>… but it mentions it only a few times and rather vaguely.</p>
|
||
<p>& CRA implementation regulations are still in flux.</p>
|
||
</section>
|
||
|
||
<section>
|
||
<p>
|
||
“Market surveillance authorities should be able to request manufacturers
|
||
… to submit the … SBOMs that they have generated pursuant to
|
||
this Regulation. In order to protect the confidentiality of SBOMs, market
|
||
surveillance authorities should submit relevant information about
|
||
dependencies to ADCO in an anonymised and aggregated manner. ”</p>
|
||
</section>
|
||
|
||
<section>
|
||
<p>
|
||
“[M]anufacturers should identify and document components contained in the
|
||
products with digital elements, including by drawing up an SBOM. …
|
||
Manufacturers should not be obliged to make the SBOM public.”</p></section>
|
||
|
||
|
||
<section>
|
||
<p>
|
||
“Implementing powers should be conferred on the Commission to
|
||
… specify the
|
||
format and elements of the SBOM … ”
|
||
</p></section>
|
||
|
||
|
||
<section>
|
||
<h3>The Biden EO is Moot</h3>
|
||
|
||
<p>You may have heard there has been a regime change in my homeland.</p>
|
||
<p>The Biden EOs are being rescinded and/or ignored.</p>
|
||
<p>There is <strong>no law in the USA that mandates SBOMs</strong>.</p>
|
||
<p>At least as long as we remain a Republic, <strong>executive orders
|
||
do not have the force of law</strong> by themselves.</p>
|
||
</section>
|
||
|
||
<section>
|
||
<h3>We Still Shouldn't Ignore SBOMs</h3>
|
||
|
||
<p>Despite there being no actual mandate, we shouldn't ignore SBOMs,
|
||
because …</p>
|
||
</section>
|
||
<section>
|
||
<h3>A Wise Lawyer Once Said</h3>
|
||
<p align="center">(heavily paraphrased)</p>
|
||
<p>Blessed are the list makers, for they shall inherit … <br/>the
|
||
… <br/>
|
||
bureaucracy … ?!?</p></section>
|
||
|
||
<section>
|
||
<h3>This Probably Will Happen To You</h3>
|
||
<p><img align="center" src="Bill_Lumbergh_Office_Space.jpeg"/></p>
|
||
</section>
|
||
|
||
<section>
|
||
<h3>Hopefully You Can Say</h3>
|
||
<p><img align="center" src="go-away-shell-script.jpg" height="200%"/></p>
|
||
</section>
|
||
|
||
<section>
|
||
<h3>The Only Truly Valuable SBOM is … </h3>
|
||
<p>The complete, corresponding source code including “scripts used to
|
||
control compilation and installation of the executable” … and a
|
||
verifiably reproducible build.</p>
|
||
<p>Everything after that is just making lists.</p>
|
||
</section>
|
||
|
||
<section>
|
||
<h3 >Follow-Up / Talk License</h3>
|
||
<p>I have a keynote about another interesting topic tomorrow:
|
||
<br/><a href="https://fosdem.org/2025/schedule/event/fosdem-2025-6153-the-growing-body-of-proprietary-infrastructure-for-foss-development-repeating-bad-history/">15:00
|
||
in Janson on SUN 2025-02-02</a>
|
||
<p>Please donate to become a Conservancy
|
||
Sustainer: <a href="https://sfconservancy.org/sustainer/">https://sfconservancy.org/sustainer/</a></p>
|
||
<img align="right" src="img/cc-by-sa-4-0_88x31.png" />
|
||
<p class="copious">Presentation and slides are: Copyright © 2024, 2025 Bradley M. Kuhn,
|
||
and are licensed under the <a rel="license"
|
||
href="https://creativecommons.org/licenses/by-sa/4.0/legalcode">Creative
|
||
Commons Attribution-Share Alike 4.0 International
|
||
License</a>.</p>
|
||
<p class="copious"> Some images included herein are ©’ed by others. I believe my use of
|
||
those images is fair use under USA © law (which I also believe is the
|
||
country of 1<sup>st</sup> publication under Berne). However, I suggest you
|
||
remove such images if you redistribute these slides.</p>
|
||
</section>
|
||
|
||
</div>
|
||
|
||
<script src="lib/js/head.js"></script>
|
||
<script src="js/reveal.js"></script>
|
||
|
||
<script>
|
||
Reveal.initialize({
|
||
controls: true,
|
||
progress: true,
|
||
history: true,
|
||
center: true,
|
||
transition: 'convex', // none/fade/slide/convex/concave/zoom
|
||
dependencies: [
|
||
{ src: 'lib/js/classList.js', condition: function() { return !document.body.classList; } },
|
||
{ src: 'plugin/markdown/marked.js', condition: function() { return !!document.querySelector( '[data-markdown]' ); } },
|
||
{ src: 'plugin/markdown/markdown.js', condition: function() { return !!document.querySelector( '[data-markdown]' ); } },
|
||
{ src: 'plugin/highlight/highlight.js', async: true, callback: function() { hljs.initHighlightingOnLoad(); } },
|
||
{ src: 'plugin/zoom-js/zoom.js', async: true },
|
||
{ src: 'plugin/notes/notes.js', async: true }
|
||
]
|
||
});
|
||
</script>
|
||
<script src="jquery/jquery-2.1.3.js"></script>
|
||
|
||
<script type="text/javascript">
|
||
// 3. On Reveal.js ready event, copy header/footer <div> into each `.slide-background` <div>
|
||
var header = $('#header').html();
|
||
if ( window.location.search.match( /print-pdf/gi ) ) {
|
||
Reveal.addEventListener( 'ready', function( event ) {
|
||
$('.slide-background').append(header);
|
||
});
|
||
}
|
||
else {
|
||
$('div.reveal').append(header);
|
||
}
|
||
</script>
|
||
</body>
|
||
</html>
|