1
00:00:00,510 --> 00:00:02,730
- Thanks for joining Return
Oriented Policymaking

2
00:00:02,730 --> 00:00:04,380
here at the policy village of DEF CON.

3
00:00:04,380 --> 00:00:05,580
We're gonna talk about open source

4
00:00:05,580 --> 00:00:06,720
and supply chain security.

5
00:00:06,720 --> 00:00:07,812
And I say, we,

6
00:00:07,812 --> 00:00:09,720
really, it's gonna be
this illustrious panel

7
00:00:09,720 --> 00:00:12,270
you see sitting on either side of me.

8
00:00:12,270 --> 00:00:13,980
I'm gonna quickly introduce them.

9
00:00:13,980 --> 00:00:14,820
We're gonna go down the line,

10
00:00:14,820 --> 00:00:17,670
let everybody offer some
thoughts on this issue.

11
00:00:17,670 --> 00:00:18,855
The framing for the discussion...

12
00:00:18,855 --> 00:00:21,150
(indistinct)

13
00:00:21,150 --> 00:00:21,983
Oh, okay, got it.

14
00:00:21,983 --> 00:00:23,855
Is there a way we can tamp down the,

15
00:00:23,855 --> 00:00:25,003
I just don't wanna kill people.

16
00:00:25,003 --> 00:00:26,880
(indistinct)

17
00:00:26,880 --> 00:00:27,714
Got it.

18
00:00:27,714 --> 00:00:30,780
The framing for this discussion is,

19
00:00:30,780 --> 00:00:32,970
we've got some really
interesting pressing challenges

20
00:00:32,970 --> 00:00:37,020
in the supply chain security
challenge of open source.

21
00:00:37,020 --> 00:00:39,360
How do we make choices about dependencies,

22
00:00:39,360 --> 00:00:40,890
pass those dependencies upstream,

23
00:00:40,890 --> 00:00:42,750
make choices about products
we're building for users,

24
00:00:42,750 --> 00:00:45,390
how the users manage
risk for those products,

25
00:00:45,390 --> 00:00:47,010
looking at open source code.

26
00:00:47,010 --> 00:00:49,530
The return oriented policymaking
framing for this is,

27
00:00:49,530 --> 00:00:53,310
what can we do with policy
that's already on the books.

28
00:00:53,310 --> 00:00:54,750
So rather than write a new law,

29
00:00:54,750 --> 00:00:56,160
come up with a brand new construct,

30
00:00:56,160 --> 00:00:58,680
how do we use existing
organizations, existing budgets,

31
00:00:58,680 --> 00:01:01,200
existing authorities more creatively

32
00:01:01,200 --> 00:01:03,300
to try and address some
of these challenges.

33
00:01:03,300 --> 00:01:05,220
So I would encourage
folks to come to the table

34
00:01:05,220 --> 00:01:06,900
with challenges they see,

35
00:01:06,900 --> 00:01:09,990
as well as interesting
applications of law,

36
00:01:09,990 --> 00:01:12,750
of policy that we have
kind of already in play.

37
00:01:12,750 --> 00:01:14,610
Try to make this as close
to a problem solving session

38
00:01:14,610 --> 00:01:15,922
as we can.

39
00:01:15,922 --> 00:01:17,880
This is gonna be Chatham House.

40
00:01:17,880 --> 00:01:19,890
So you are free to take notes,

41
00:01:19,890 --> 00:01:22,658
just please do not attribute
anything that you hear here.

42
00:01:22,658 --> 00:01:23,880
We're gonna have some notes,

43
00:01:23,880 --> 00:01:25,800
and hopefully write those notes up

44
00:01:25,800 --> 00:01:27,210
in some kind of fun graphical form

45
00:01:27,210 --> 00:01:28,770
once we're all done,

46
00:01:28,770 --> 00:01:29,610
And tweet at DEF CON,

47
00:01:29,610 --> 00:01:31,387
as "Everyone leaves the CON is very sad,

48
00:01:31,387 --> 00:01:33,810
"and that we're reminders
of what we did here."

49
00:01:33,810 --> 00:01:34,643
Before we get into this

50
00:01:34,643 --> 00:01:36,270
let me introduce our panelists.

51
00:01:36,270 --> 00:01:39,791
First, almost everybody's
from the government

52
00:01:39,791 --> 00:01:41,160
and here to help.

53
00:01:41,160 --> 00:01:41,993
Harry Mourtos,

54
00:01:41,993 --> 00:01:43,920
here from the Office of The
National Cyber Director.

55
00:01:43,920 --> 00:01:46,020
Eric Mill, with the Office
of Management And Budget,

56
00:01:46,020 --> 00:01:47,340
I take it with the CIO office, correct?

57
00:01:47,340 --> 00:01:49,087
- Mhm.
- Excellent.

58
00:01:49,087 --> 00:01:51,000
Aeva Black who wears many hats.

59
00:01:51,000 --> 00:01:53,550
They are here in their
personal capacity, however,

60
00:01:53,550 --> 00:01:55,500
and although all the hats are exciting,

61
00:01:55,500 --> 00:01:56,693
none of 'em will be
represented directly here,

62
00:01:56,693 --> 00:01:57,870
which I think is accurate.

63
00:01:57,870 --> 00:01:59,430
All right, Brian Behlendorf

64
00:01:59,430 --> 00:02:01,590
who is executive director
with the Open SSF,

65
00:02:01,590 --> 00:02:03,570
Open Source Software Security Foundation.

66
00:02:03,570 --> 00:02:06,183
And then Mr. Jack Habel,
the man from Congress.

67
00:02:07,140 --> 00:02:08,970
With that, let's go back down the line,

68
00:02:08,970 --> 00:02:10,950
get a couple of thoughts
quickly from folks,

69
00:02:10,950 --> 00:02:13,073
and then we'll open it up
from our general discussion.

70
00:02:18,210 --> 00:02:19,043
- All right.

71
00:02:19,043 --> 00:02:20,340
Hey, good afternoon, everyone.

72
00:02:20,340 --> 00:02:21,300
I'm Harry Mourtos

73
00:02:21,300 --> 00:02:22,650
with the Office of The
National Cyber Director.

74
00:02:22,650 --> 00:02:24,240
Thank you for coming to listen

75
00:02:24,240 --> 00:02:27,120
to our round table discussion.

76
00:02:27,120 --> 00:02:28,890
Just to open it up, I
do wanna take a moment

77
00:02:28,890 --> 00:02:30,690
and just take a step
back from the open source

78
00:02:30,690 --> 00:02:33,330
and talk more, just for a
moment, if you'll indulge me

79
00:02:33,330 --> 00:02:35,550
about policy and cybersecurity,

80
00:02:35,550 --> 00:02:36,572
and how thrilled I am

81
00:02:36,572 --> 00:02:39,303
that DEF CON has a policy trend this year.

82
00:02:40,153 --> 00:02:44,010
It's a very good development for my view.

83
00:02:44,010 --> 00:02:45,382
I think that oftentimes

84
00:02:45,382 --> 00:02:47,790
we view sort of the
cybersecurity community

85
00:02:47,790 --> 00:02:52,080
with this barrier between
the technical and the policy,

86
00:02:52,080 --> 00:02:54,030
and it's in all of our best interests

87
00:02:54,030 --> 00:02:56,190
to sort of break down that
barrier wherever we see it.

88
00:02:56,190 --> 00:02:57,750
In order to one,

89
00:02:57,750 --> 00:02:59,940
encourage those with technical expertise

90
00:02:59,940 --> 00:03:02,013
to engage in good policymaking,

91
00:03:02,013 --> 00:03:04,500
that expertise is extremely valuable

92
00:03:04,500 --> 00:03:06,095
to help influence decisions

93
00:03:06,095 --> 00:03:08,383
and how we think about these problems.

94
00:03:08,383 --> 00:03:11,820
And two, as ambassadors of the community,

95
00:03:11,820 --> 00:03:14,130
we are all, whether we're
conscious of it or not,

96
00:03:14,130 --> 00:03:18,330
ambassadors of cyber security
as a whole, when we interact

97
00:03:18,330 --> 00:03:20,430
with those who are not
members of our community.

98
00:03:20,430 --> 00:03:23,370
So allowing on ramps for our policy makers

99
00:03:23,370 --> 00:03:26,850
to be able to engage and
make the technical aspects

100
00:03:26,850 --> 00:03:28,290
of what we do a little
bit more accessible,

101
00:03:28,290 --> 00:03:31,680
wherever we can is in all
of our best interests.

102
00:03:31,680 --> 00:03:33,570
So I just wanted to take
a moment and thank DEF CON

103
00:03:33,570 --> 00:03:34,962
for creating this track.

104
00:03:34,962 --> 00:03:38,790
I'm really excited to see
what's going to come of this.

105
00:03:38,790 --> 00:03:39,623
Thanks.

106
00:03:39,623 --> 00:03:42,126
(panel clapping)

107
00:03:43,230 --> 00:03:44,063
- Hi, yeah.

108
00:03:44,063 --> 00:03:47,191
So Eric Mill with OMB with
the Federal CIO Office.

109
00:03:47,191 --> 00:03:51,930
So I think it is important to zoom out

110
00:03:51,930 --> 00:03:54,600
like Harry talked about,
and at the top here,

111
00:03:54,600 --> 00:03:55,433
is one of the things

112
00:03:55,433 --> 00:03:56,880
that I think rides through
a whole lot of the,

113
00:03:56,880 --> 00:03:59,100
certainly the policy
track here at DEF CON.

114
00:03:59,100 --> 00:04:02,010
Are some of the consequences
of how we sort of,

115
00:04:02,010 --> 00:04:04,440
other technology and cybersecurity

116
00:04:04,440 --> 00:04:07,255
in American society and global society,

117
00:04:07,255 --> 00:04:09,916
where it is just something
that is happening over there

118
00:04:09,916 --> 00:04:12,600
that we don't need to understand
until there's a crisis.

119
00:04:12,600 --> 00:04:14,568
At which point we want
to understand everything.

120
00:04:14,568 --> 00:04:16,606
And I think open source security
is a really good example

121
00:04:16,606 --> 00:04:21,060
of something that is
accessible and understandable

122
00:04:21,060 --> 00:04:23,331
to just a very small,

123
00:04:23,331 --> 00:04:26,517
almost like a little priesthood in society

124
00:04:26,517 --> 00:04:29,730
that all of a sudden,
when something bad happens

125
00:04:29,730 --> 00:04:32,458
that involves open source security people

126
00:04:32,458 --> 00:04:34,538
kind of come out of the woodwork.

127
00:04:34,538 --> 00:04:36,780
All of a sudden paying
attention like a laser

128
00:04:36,780 --> 00:04:39,570
focused to this thing, and they
hear about it, how it works.

129
00:04:39,570 --> 00:04:40,473
And they're like, "Well,
that can't be right."

130
00:04:40,473 --> 00:04:45,187
"And that can't possibly be the foundation

131
00:04:45,187 --> 00:04:47,100
"on which all society
is built these days."

132
00:04:47,100 --> 00:04:50,559
But it is, since it is that way,

133
00:04:50,559 --> 00:04:52,500
this is one of those issues

134
00:04:52,500 --> 00:04:54,450
where it's really important for us all to,

135
00:04:54,450 --> 00:04:59,095
I think be bridging the
gap between sort of,

136
00:04:59,095 --> 00:05:02,250
what large risk averse organizations

137
00:05:02,250 --> 00:05:04,860
and institutions that are
really important need.

138
00:05:04,860 --> 00:05:06,900
And then just the reality on the ground

139
00:05:06,900 --> 00:05:10,980
of how software moves around
and is built in the modern day.

140
00:05:10,980 --> 00:05:14,220
That's certainly our goal
to try to be smart about it

141
00:05:14,220 --> 00:05:17,910
and to represent those
issues and bridge them,

142
00:05:17,910 --> 00:05:18,743
and really looking forward

143
00:05:18,743 --> 00:05:20,590
to what folks bring to the discussion.

144
00:05:24,988 --> 00:05:26,790
- So as Trey said, I'm Aeva.

145
00:05:26,790 --> 00:05:29,700
And I do wear a lot of hats
on, I work at Microsoft.

146
00:05:29,700 --> 00:05:32,760
I'm on the technical advisory
committee for the Open SSF,

147
00:05:32,760 --> 00:05:33,690
and on the board of directors

148
00:05:33,690 --> 00:05:34,860
for the open source initiative.

149
00:05:34,860 --> 00:05:37,355
That's the neutral body
that sort of defines

150
00:05:37,355 --> 00:05:38,341
what is open source,

151
00:05:38,341 --> 00:05:40,623
what is an open source software license,

152
00:05:42,314 --> 00:05:46,140
but yeah, I'm here talking more
as an independent right now.

153
00:05:46,140 --> 00:05:47,625
I would like to suggest to everyone,

154
00:05:47,625 --> 00:05:50,730
especially policy makers
and folks in the room,

155
00:05:50,730 --> 00:05:52,080
that any solution that we come up with

156
00:05:52,080 --> 00:05:54,690
has to balance an individual's
right to free expression

157
00:05:54,690 --> 00:05:56,370
through publishing the source code.

158
00:05:56,370 --> 00:05:59,760
And that's grounded in the
Bernstein case from the '90s.

159
00:05:59,760 --> 00:06:02,126
Has to balance that
against the responsibility

160
00:06:02,126 --> 00:06:05,070
of corporate consumers of open source

161
00:06:05,070 --> 00:06:08,040
or anybody who's integrating
open source into a product.

162
00:06:08,040 --> 00:06:10,740
That that is where the
responsibility should lie

163
00:06:10,740 --> 00:06:12,900
to ensure the safety of the product,

164
00:06:12,900 --> 00:06:17,523
not upstream on someone who's
expressing their free speech.

165
00:06:19,724 --> 00:06:21,150
To that,

166
00:06:21,150 --> 00:06:23,880
I would suggest we think
about trusting the process,

167
00:06:23,880 --> 00:06:25,500
not the person.

168
00:06:25,500 --> 00:06:26,340
Not the individual,

169
00:06:26,340 --> 00:06:28,830
but how that open source
project is being built,

170
00:06:28,830 --> 00:06:31,890
managed, audited, secured, looked at.

171
00:06:31,890 --> 00:06:33,240
There are some examples out there

172
00:06:33,240 --> 00:06:35,190
and there's two paradigms here.

173
00:06:35,190 --> 00:06:36,540
The four freedoms.

174
00:06:36,540 --> 00:06:38,250
Folks may have heard about in open source,

175
00:06:38,250 --> 00:06:42,720
the freedom to share, to
use, to inspect, to modify.

176
00:06:42,720 --> 00:06:45,300
And the four opens, which is
a much more recent innovation

177
00:06:45,300 --> 00:06:46,200
in open source community,

178
00:06:46,200 --> 00:06:48,630
as it describes how to
build open source software

179
00:06:48,630 --> 00:06:51,183
collaboratively,
transparently, and accountably.

180
00:06:52,800 --> 00:06:55,087
The challenges really that we're
facing here are inseparable

181
00:06:55,087 --> 00:06:57,417
from the challenges also
facing privacy rights,

182
00:06:57,417 --> 00:06:58,500
free expression,

183
00:06:58,500 --> 00:07:00,810
and queer and trans people in society

184
00:07:00,810 --> 00:07:02,520
in reproductive justice.

185
00:07:02,520 --> 00:07:04,260
So I'd like ask everyone to think about

186
00:07:04,260 --> 00:07:06,758
any second order effects of any policy

187
00:07:06,758 --> 00:07:09,630
that we might be creating,
not just the return,

188
00:07:09,630 --> 00:07:12,000
but what are the second order
effects on civil society

189
00:07:12,000 --> 00:07:14,190
and free expression in civil rights

190
00:07:14,190 --> 00:07:15,253
from anything we're doing?

191
00:07:15,253 --> 00:07:18,690
And so that everyone
can participate equally

192
00:07:18,690 --> 00:07:21,960
in this incredible
acceleration to society,

193
00:07:21,960 --> 00:07:23,070
to science and technology

194
00:07:23,070 --> 00:07:26,100
that's happened through open
source in the past 25 years.

195
00:07:26,100 --> 00:07:26,933
Thank you.

196
00:07:30,150 --> 00:07:31,860
- Hey everyone, I'm Brian Behlendorf,

197
00:07:31,860 --> 00:07:32,880
as Trey mentioned,

198
00:07:32,880 --> 00:07:34,920
I lead the Open Source Security Foundation

199
00:07:34,920 --> 00:07:36,030
at The Linux Foundation.

200
00:07:36,030 --> 00:07:37,770
I think if you're in this building,

201
00:07:37,770 --> 00:07:39,318
you have to wear lots of hats. (chuckling)

202
00:07:39,318 --> 00:07:40,487
So I'm also on the board

203
00:07:40,487 --> 00:07:42,600
of The Electronic Frontier Foundation,

204
00:07:42,600 --> 00:07:44,730
and The Mozilla Foundation,
and a few other things.

205
00:07:44,730 --> 00:07:48,450
So I think Trey framing
is an interesting one

206
00:07:48,450 --> 00:07:51,840
because so much of the work
in open source has proceeded

207
00:07:51,840 --> 00:07:55,863
without the direct explicit
engagement of government.

208
00:07:57,990 --> 00:08:00,330
If we like to cite the
history of the internet

209
00:08:00,330 --> 00:08:03,240
and the like, as plausibly
coming from research

210
00:08:03,240 --> 00:08:04,650
that was funded by the government.

211
00:08:04,650 --> 00:08:05,483
And certainly

212
00:08:05,483 --> 00:08:06,990
it's been supported from
a policy point of view,

213
00:08:06,990 --> 00:08:10,230
but open source software has
largely been a phenomenon

214
00:08:10,230 --> 00:08:12,270
of the private sector.

215
00:08:12,270 --> 00:08:14,100
It's had lots of volunteerism,

216
00:08:14,100 --> 00:08:16,590
lots of input from
universities, of course,

217
00:08:16,590 --> 00:08:20,040
but it's also been
somewhat of a short path

218
00:08:20,040 --> 00:08:21,570
to solving problems,

219
00:08:21,570 --> 00:08:24,347
rather than necessarily
thinking long term.

220
00:08:24,347 --> 00:08:27,270
The folks involved in it,
in open source software

221
00:08:27,270 --> 00:08:28,993
have tended to be about solving
and to scratching your own,

222
00:08:28,993 --> 00:08:31,320
and try it solving your immediate problem.

223
00:08:31,320 --> 00:08:33,450
We have foundations in this domain

224
00:08:33,450 --> 00:08:35,250
that are chartered with thinking long term

225
00:08:35,250 --> 00:08:38,130
and chartered with trying to
set up just enough processes

226
00:08:38,130 --> 00:08:40,650
and the like, to allow these projects

227
00:08:40,650 --> 00:08:42,600
to live beyond their original creators,

228
00:08:44,070 --> 00:08:46,020
to solve this, so-called
hit by a bus problem,

229
00:08:46,020 --> 00:08:48,810
or as we like to call
it now going to Fiji.

230
00:08:48,810 --> 00:08:52,650
But security has only
recently been a priority

231
00:08:52,650 --> 00:08:54,087
for most of those.

232
00:08:54,087 --> 00:08:56,190
And so at the Open Source
Security Foundation,

233
00:08:56,190 --> 00:08:58,827
what we're seeing is a mix of companies

234
00:08:58,827 --> 00:09:02,100
and individual open source developers,

235
00:09:02,100 --> 00:09:04,680
and now foundations coming
together and saying,

236
00:09:04,680 --> 00:09:06,930
are there ways in which we've...

237
00:09:06,930 --> 00:09:08,550
The way that we do the supply chain,

238
00:09:08,550 --> 00:09:11,347
the way that developers choose
what dependencies to include

239
00:09:11,347 --> 00:09:13,920
and the build processes that they adopt.

240
00:09:13,920 --> 00:09:15,750
Are there systemic weaknesses in this,

241
00:09:15,750 --> 00:09:18,960
that outside of solving,
scratching our own itch

242
00:09:18,960 --> 00:09:20,280
or solving an individual problem,

243
00:09:20,280 --> 00:09:22,140
we can work together to address.

244
00:09:22,140 --> 00:09:23,550
What's the role for government in that?

245
00:09:23,550 --> 00:09:26,301
Well, government is a
major consumer of software.

246
00:09:26,301 --> 00:09:30,240
Just like if you were to
count them as an organization,

247
00:09:30,240 --> 00:09:33,300
they'd be larger than
perhaps the top three, four,

248
00:09:33,300 --> 00:09:34,266
10 companies combined.

249
00:09:34,266 --> 00:09:36,243
Somebody should do the math.

250
00:09:37,950 --> 00:09:40,530
And they're also now a
producer of open source code.

251
00:09:40,530 --> 00:09:44,358
So they have a role
commensurate to that size.

252
00:09:44,358 --> 00:09:47,040
But secondly, they do
have this kind of role

253
00:09:47,040 --> 00:09:50,400
as the guarantor of last
resort in so many industries,

254
00:09:50,400 --> 00:09:54,390
from the banking sector, to
transportation, to insurance,

255
00:09:54,390 --> 00:09:56,280
it's like we kind of depend upon them

256
00:09:56,280 --> 00:09:59,670
to help keep the foundations
of society running.

257
00:09:59,670 --> 00:10:01,920
And I think the log4shell debacle,

258
00:10:01,920 --> 00:10:03,810
by the way, I wanna declare moratorium

259
00:10:03,810 --> 00:10:05,087
on using the word log4j,

260
00:10:05,087 --> 00:10:07,710
'cause that's a project
with real developers

261
00:10:07,710 --> 00:10:08,543
and people behind it.

262
00:10:08,543 --> 00:10:11,793
It was the log4shell.
(indistinct)

263
00:10:11,793 --> 00:10:13,053
All right, all right.

264
00:10:14,220 --> 00:10:16,590
So I think the log4shell thing

265
00:10:16,590 --> 00:10:19,230
kind of demonstrated to us
how systematic this code,

266
00:10:19,230 --> 00:10:20,580
and pervasive this code is,

267
00:10:20,580 --> 00:10:24,226
affecting everything from banking
websites to security doors

268
00:10:24,226 --> 00:10:27,330
that were compromisable with an RFID tag,

269
00:10:27,330 --> 00:10:31,140
with just the right kind of bad content.

270
00:10:31,140 --> 00:10:34,140
So this requires an all
of society response,

271
00:10:34,140 --> 00:10:35,160
and I think government can play a role

272
00:10:35,160 --> 00:10:36,840
as a convener in that,

273
00:10:36,840 --> 00:10:41,190
but I think doing it in a way
that is a peer-to-industry,

274
00:10:41,190 --> 00:10:44,103
and is also inherently
global is important as well.

275
00:10:46,440 --> 00:10:47,273
- Great.

276
00:10:47,273 --> 00:10:50,460
And really just to build off
of what everyone's been saying.

277
00:10:50,460 --> 00:10:54,480
I think we do have to think
of the government's role

278
00:10:54,480 --> 00:10:56,280
in helping secure open source software

279
00:10:56,280 --> 00:10:59,040
from as many different lenses as possible.

280
00:10:59,040 --> 00:11:00,180
There's the consumer end,

281
00:11:00,180 --> 00:11:03,030
where US government is
probably one of the largest,

282
00:11:03,030 --> 00:11:05,370
if not the largest consumers
of open source software

283
00:11:05,370 --> 00:11:06,420
in the world.

284
00:11:06,420 --> 00:11:08,700
And if we look at how much it uses

285
00:11:08,700 --> 00:11:10,080
versus how much it puts out

286
00:11:10,080 --> 00:11:11,580
or how much it contributes back,

287
00:11:11,580 --> 00:11:14,430
I think we'd find that we've probably been

288
00:11:14,430 --> 00:11:17,520
under contributing to this community.

289
00:11:17,520 --> 00:11:19,560
So needing to step up both there,

290
00:11:19,560 --> 00:11:22,110
either through kind of
natively used software,

291
00:11:22,110 --> 00:11:23,280
natively developed software,

292
00:11:23,280 --> 00:11:25,050
or software used through contracts,

293
00:11:25,050 --> 00:11:27,013
and thinking through how
we can make sure that...

294
00:11:27,013 --> 00:11:30,690
And this is feeding back into
the open source ecosystem

295
00:11:30,690 --> 00:11:35,250
and allowing the contributions
that happen in government,

296
00:11:35,250 --> 00:11:36,780
not just to stay in government,

297
00:11:36,780 --> 00:11:40,144
but benefit everyone using
open source software.

298
00:11:40,144 --> 00:11:43,350
And then I think there's
the perspective of say,

299
00:11:43,350 --> 00:11:44,580
critical infrastructure

300
00:11:44,580 --> 00:11:48,453
where open source really
does underpin pretty much

301
00:11:48,453 --> 00:11:53,250
every critical infrastructure
sector there is today.

302
00:11:53,250 --> 00:11:57,690
So it's just a fact that open
source, if it underpins this,

303
00:11:57,690 --> 00:12:00,120
it is an essential layer
of that the US government

304
00:12:00,120 --> 00:12:01,470
has its responsibility

305
00:12:01,470 --> 00:12:03,353
in helping protect critical infrastructure

306
00:12:03,353 --> 00:12:05,910
should view open source software

307
00:12:05,910 --> 00:12:07,893
as a fundamental component of that.

308
00:12:08,760 --> 00:12:11,820
So being able to help ensure

309
00:12:11,820 --> 00:12:14,400
that we have this long term security,

310
00:12:14,400 --> 00:12:16,440
not just kind of thinking
in the short term,

311
00:12:16,440 --> 00:12:18,330
but what can we do to make sure

312
00:12:18,330 --> 00:12:21,450
that throughout the long
term open source ecosystem

313
00:12:21,450 --> 00:12:23,580
is as secure as it can be.

314
00:12:23,580 --> 00:12:25,781
And looking forward to getting
into some of those areas

315
00:12:25,781 --> 00:12:30,510
where we can help ensure
security down the road.

316
00:12:30,510 --> 00:12:31,343
- That's awesome.

317
00:12:31,343 --> 00:12:32,176
Appreciate that from all.

318
00:12:32,176 --> 00:12:34,140
So I'm gonna take moderators
prerogative for a minute

319
00:12:34,140 --> 00:12:35,160
and ask one question,

320
00:12:35,160 --> 00:12:36,960
but then we'll welcome folks in the group.

321
00:12:36,960 --> 00:12:37,887
And if can, as we go around,

322
00:12:37,887 --> 00:12:40,140
just be friendly to pass the mics down,

323
00:12:40,140 --> 00:12:41,440
so everybody can be heard.

324
00:12:42,870 --> 00:12:45,450
As I listen to everyone, what I heard,

325
00:12:45,450 --> 00:12:47,040
where at least three kind of common themes

326
00:12:47,040 --> 00:12:49,350
of where government can play a role,

327
00:12:49,350 --> 00:12:50,610
what it does already well.

328
00:12:50,610 --> 00:12:53,340
It is able to convene.

329
00:12:53,340 --> 00:12:54,390
It brings folks together,

330
00:12:54,390 --> 00:12:56,340
creates some kind of trusted
ground for negotiation

331
00:12:56,340 --> 00:12:58,170
where it's potentially
not an interested party.

332
00:12:58,170 --> 00:13:00,780
Although I think as the point
was made by several of you,

333
00:13:00,780 --> 00:13:01,920
it is an interested party.

334
00:13:01,920 --> 00:13:03,810
It is a consumer in this case,

335
00:13:03,810 --> 00:13:05,970
as much as it is a regulator.

336
00:13:05,970 --> 00:13:08,130
The second is to fund things,

337
00:13:08,130 --> 00:13:09,661
and consider the power of the public purse

338
00:13:09,661 --> 00:13:12,480
to support this sort of infrastructure.

339
00:13:12,480 --> 00:13:14,280
Which to me is a really
interesting framing,

340
00:13:14,280 --> 00:13:16,410
'cause I think to the
point that Brian makes

341
00:13:16,410 --> 00:13:17,970
about log4shell.

342
00:13:17,970 --> 00:13:20,700
So often the policy
framing for open sources,

343
00:13:20,700 --> 00:13:22,770
something's on fire, "Put it out."

344
00:13:22,770 --> 00:13:24,810
As opposed to, how do
we make this healthier?

345
00:13:24,810 --> 00:13:26,280
How do we grow these communities?

346
00:13:26,280 --> 00:13:28,178
How do we make this a stronger ecosystem?

347
00:13:28,178 --> 00:13:31,620
How do we think about protections
beyond just the security

348
00:13:31,620 --> 00:13:33,900
of an actual product or a piece of code?

349
00:13:33,900 --> 00:13:35,880
So these are absolutely
core government functions.

350
00:13:35,880 --> 00:13:38,940
So thinking about that
allocation of resources.

351
00:13:38,940 --> 00:13:40,897
The last though, and
I'm curious for folks,

352
00:13:40,897 --> 00:13:43,440
and we'll go down the line
again here in a second.

353
00:13:43,440 --> 00:13:46,110
If we have the convener
and we have the funder,

354
00:13:46,110 --> 00:13:50,700
we also have this big lens,
this public good view,

355
00:13:50,700 --> 00:13:53,880
this national security or
security of the country,

356
00:13:53,880 --> 00:13:56,550
much broader frame than a
single product, a single vendor,

357
00:13:56,550 --> 00:13:58,170
a single user base.

358
00:13:58,170 --> 00:14:00,360
And so I wonder if we
could of reverse the flow,

359
00:14:00,360 --> 00:14:02,013
start with Jack and come down.

360
00:14:04,020 --> 00:14:06,780
Where is there an existing
program or an opportunity

361
00:14:06,780 --> 00:14:09,390
for an activity that really
leverages one of these three,

362
00:14:09,390 --> 00:14:10,710
or another, if you've got a thought.

363
00:14:10,710 --> 00:14:11,790
One of these three constructs of

364
00:14:11,790 --> 00:14:13,950
where government really does play a role

365
00:14:13,950 --> 00:14:15,810
in the technology
ecosystem in public policy?

366
00:14:15,810 --> 00:14:19,590
- Mhm, yeah, I would say to
that that at least one area

367
00:14:19,590 --> 00:14:21,270
I think the government can help contribute

368
00:14:21,270 --> 00:14:23,670
is kind of understanding
just at a base level,

369
00:14:23,670 --> 00:14:26,370
how and where open
source software is used,

370
00:14:26,370 --> 00:14:28,920
and what is in need of the most support.

371
00:14:28,920 --> 00:14:30,750
And there's been some great work already,

372
00:14:30,750 --> 00:14:34,350
like at Open SSF, the
scorecards for instance,

373
00:14:34,350 --> 00:14:37,860
to evaluate the security of a
given open source component,

374
00:14:37,860 --> 00:14:39,450
but just the nature of the government.

375
00:14:39,450 --> 00:14:42,960
We have hundreds of agencies
all using open source software,

376
00:14:42,960 --> 00:14:45,810
there's tons and tons
of information out there

377
00:14:45,810 --> 00:14:49,189
around what packages are
used, where they're used,

378
00:14:49,189 --> 00:14:51,060
looking even further say,

379
00:14:51,060 --> 00:14:52,620
across critical infrastructure,

380
00:14:52,620 --> 00:14:56,373
government might be able to do
some coalescing around there,

381
00:14:57,315 --> 00:15:01,560
kind of with input from
organizations in those sectors.

382
00:15:01,560 --> 00:15:05,733
So kind of taking the government's
picture of kind of this,

383
00:15:06,690 --> 00:15:08,130
both across the government,

384
00:15:08,130 --> 00:15:10,170
but then also across other sectors.

385
00:15:10,170 --> 00:15:12,937
And being able to say,
"This is the state of play

386
00:15:12,937 --> 00:15:15,360
"and this is where we need to do better."

387
00:15:15,360 --> 00:15:17,040
I think is at least a starting point,

388
00:15:17,040 --> 00:15:20,610
because if we don't understand
what's most in need,

389
00:15:20,610 --> 00:15:22,860
then it's gonna be
difficult to address that.

390
00:15:24,570 --> 00:15:25,920
- To build on Jack's point,

391
00:15:26,820 --> 00:15:29,550
you all are familiar
with the acronym OSPO,

392
00:15:29,550 --> 00:15:30,750
Open Source Program Office?

393
00:15:30,750 --> 00:15:33,180
This is a type of organization,

394
00:15:33,180 --> 00:15:34,830
many large companies have set up

395
00:15:34,830 --> 00:15:36,379
and increasingly smaller companies...

396
00:15:36,379 --> 00:15:37,760
Do you lead Microsoft's OSPO?

397
00:15:37,760 --> 00:15:39,205
Or you're, okay, you're not welcome.

398
00:15:39,205 --> 00:15:41,194
(indistinct)
Okay.

399
00:15:41,194 --> 00:15:43,830
But almost every large
company has them now,

400
00:15:43,830 --> 00:15:46,140
even folks like Walmart,
and Starbucks, and Nike,

401
00:15:46,140 --> 00:15:46,973
and those kinds of things.

402
00:15:46,973 --> 00:15:48,376
And this is an office
charter with understanding

403
00:15:48,376 --> 00:15:51,963
how a company is using open
source code, and what policies,

404
00:15:51,963 --> 00:15:53,700
what licenses are allowed.

405
00:15:53,700 --> 00:15:55,860
And then as their
developers are feeding back,

406
00:15:55,860 --> 00:15:57,750
whether it's reporting a bug,

407
00:15:57,750 --> 00:16:00,690
but hopefully submitting
patches or releasing new code,

408
00:16:00,690 --> 00:16:02,760
what are the policies and
the right ways to do that.

409
00:16:02,760 --> 00:16:06,630
And then OSPO is a really
useful leverage point

410
00:16:06,630 --> 00:16:08,370
to understand, not only internally,

411
00:16:08,370 --> 00:16:09,510
where is this being used?

412
00:16:09,510 --> 00:16:12,390
And to do some of that SBOM
style kind of inventory taking,

413
00:16:12,390 --> 00:16:14,160
but also outbound,

414
00:16:14,160 --> 00:16:16,470
how do we up-level our own contributors

415
00:16:16,470 --> 00:16:18,450
so that they're taking security classes.

416
00:16:18,450 --> 00:16:21,810
They're not inadvertently
going to release something

417
00:16:21,810 --> 00:16:22,770
that causes a lot of problems,

418
00:16:22,770 --> 00:16:25,800
or maybe you pair up so that
a bad actor on your staff

419
00:16:25,800 --> 00:16:28,050
doesn't end up creating a
reputation problem for you.

420
00:16:28,050 --> 00:16:30,699
Every government agency
should have an OSPO too,

421
00:16:30,699 --> 00:16:33,450
as a component of the CIO's office

422
00:16:33,450 --> 00:16:35,580
or the CISO's office made, arguably

423
00:16:35,580 --> 00:16:38,250
that again, is chartered with
helping encourage that agency

424
00:16:38,250 --> 00:16:39,990
to consume our open source,

425
00:16:39,990 --> 00:16:42,630
but then also start feeding
that back upstream as well,

426
00:16:42,630 --> 00:16:45,570
whether it's through
contractors or directly.

427
00:16:45,570 --> 00:16:47,250
So I think that's prep,

428
00:16:47,250 --> 00:16:49,200
from one useful thing that
governments could think about.

429
00:16:49,200 --> 00:16:50,490
But secondly, I'm really inspired

430
00:16:50,490 --> 00:16:52,920
by the thought of opensource
software as a public good.

431
00:16:52,920 --> 00:16:55,920
If anyone's familiar with the
economist, Mariana Mazzucato,

432
00:16:55,920 --> 00:16:58,530
she's been really one
of the leading thinkers

433
00:16:58,530 --> 00:17:00,090
in the domain of public goods

434
00:17:00,090 --> 00:17:03,540
that actually serve as
accelerators for economic growth

435
00:17:03,540 --> 00:17:04,451
at the same time.

436
00:17:04,451 --> 00:17:07,440
And the role that that government
has historically played

437
00:17:07,440 --> 00:17:08,273
in helping that.

438
00:17:08,273 --> 00:17:10,140
I mean, you could even
consider the highway system

439
00:17:10,140 --> 00:17:12,065
as economical example of that.

440
00:17:12,065 --> 00:17:14,580
And so in the government today,

441
00:17:14,580 --> 00:17:15,780
there are organizations

442
00:17:15,780 --> 00:17:17,370
like the National Science Foundation.

443
00:17:17,370 --> 00:17:19,800
I mean it's arguably kind
of quasi independent,

444
00:17:19,800 --> 00:17:22,450
but there's still a ton of
government funding in NSF, right?

445
00:17:22,450 --> 00:17:24,090
There's NASA.

446
00:17:24,090 --> 00:17:27,170
I mean, orange juice from the
moon program kind of thing

447
00:17:27,170 --> 00:17:29,290
is a little bit of a silly example, but...

448
00:17:29,290 --> 00:17:30,600
With tang, I'm sorry,

449
00:17:30,600 --> 00:17:32,951
Tang from Moon Program.

450
00:17:32,951 --> 00:17:36,090
But I think there's these
parts of the federal government

451
00:17:36,090 --> 00:17:38,490
that have played this
role in more basic R&D.

452
00:17:38,490 --> 00:17:39,810
Basic kinds of funding

453
00:17:39,810 --> 00:17:42,810
that don't necessarily have
direct kind of implementation

454
00:17:42,810 --> 00:17:44,670
as their primary prerogative,

455
00:17:44,670 --> 00:17:45,900
that are useful to think about

456
00:17:45,900 --> 00:17:47,070
perhaps directing some of that funding

457
00:17:47,070 --> 00:17:49,620
towards open source software development,

458
00:17:49,620 --> 00:17:51,693
but also specifically towards hardening.

459
00:17:57,510 --> 00:17:58,950
- Oh.
- I think we're gonna go,

460
00:17:58,950 --> 00:18:00,008
it's fine.

461
00:18:00,008 --> 00:18:04,078
- You want (indistinct) to
clear his answer on the point?

462
00:18:04,078 --> 00:18:04,911
- Are we...

463
00:18:04,911 --> 00:18:05,744
Okay, okay.

464
00:18:05,744 --> 00:18:07,493
So I'll build a little
bit on Brian's suggestion,

465
00:18:07,493 --> 00:18:12,060
we love the OSPO in government suggestion.

466
00:18:12,060 --> 00:18:16,410
I also wanna highlight
that one of the factors

467
00:18:16,410 --> 00:18:19,740
that I think has led to
the lack of security state

468
00:18:19,740 --> 00:18:20,677
that we're in right now,

469
00:18:20,677 --> 00:18:24,600
and the sort of rapid increase
in major vulnerabilities

470
00:18:24,600 --> 00:18:26,280
we've seen in the past 10 years.

471
00:18:26,280 --> 00:18:28,142
And we didn't have as much adoption,

472
00:18:28,142 --> 00:18:32,490
but also velocity and amount
of code came from the VC cycle.

473
00:18:32,490 --> 00:18:33,720
Starting in about 2008,

474
00:18:33,720 --> 00:18:37,590
we saw a huge amount of funding
flow in through the sort of,

475
00:18:37,590 --> 00:18:39,651
whether it's a big company or a startup,

476
00:18:39,651 --> 00:18:44,070
rapidly pumping money into
building a open source company,

477
00:18:44,070 --> 00:18:45,213
in air quotes,

478
00:18:46,230 --> 00:18:48,210
that produced an open source project,

479
00:18:48,210 --> 00:18:49,590
maybe a whole bunch of projects

480
00:18:49,590 --> 00:18:51,540
and then walked away from them.

481
00:18:51,540 --> 00:18:54,420
And that creates these pockets

482
00:18:54,420 --> 00:18:56,007
where there are few maintainers

483
00:18:56,007 --> 00:18:59,910
who still know how to continue
to update, and secure,

484
00:18:59,910 --> 00:19:01,910
and fix some of these critical projects.

485
00:19:01,910 --> 00:19:03,810
Or projects that have
been forgotten about,

486
00:19:03,810 --> 00:19:07,560
buried deep in the sub
stratum of our infrastructure,

487
00:19:07,560 --> 00:19:11,340
that, and ultimately developer burnout.

488
00:19:11,340 --> 00:19:13,950
We have a sustainability
problem in open source

489
00:19:13,950 --> 00:19:15,630
that's leading to a lot of these issues,

490
00:19:15,630 --> 00:19:18,720
where the companies that
are funding the work today

491
00:19:18,720 --> 00:19:20,580
are funding it on a growth model

492
00:19:20,580 --> 00:19:22,560
and not on a sustainability model.

493
00:19:22,560 --> 00:19:23,730
And I think there's a real opportunity

494
00:19:23,730 --> 00:19:24,792
for government to come in,

495
00:19:24,792 --> 00:19:28,260
whether it's to fund research
and studies into that,

496
00:19:28,260 --> 00:19:30,780
into developer burnout, into velocity.

497
00:19:30,780 --> 00:19:33,120
And what are the incentives being applied

498
00:19:33,120 --> 00:19:36,251
that are not leading to
good security practices.

499
00:19:36,251 --> 00:19:40,050
And to take a public good
view on how do we address

500
00:19:40,050 --> 00:19:42,990
sustainability of open
source maintainership

501
00:19:42,990 --> 00:19:45,450
for all projects, big and small.

502
00:19:45,450 --> 00:19:49,863
Because if you've all seen
the XKCD meme of the Nebraska,

503
00:19:50,730 --> 00:19:53,160
the issue isn't that
Nebraska is a problem,

504
00:19:53,160 --> 00:19:55,980
it's that every single
block in that diagram

505
00:19:55,980 --> 00:19:57,843
is part of critical infrastructure.

506
00:19:58,890 --> 00:20:01,830
The big block might be a
Kubernetes or Linux Kernel

507
00:20:01,830 --> 00:20:05,640
that has tons of funding, and
tons of eyeballs on it today.

508
00:20:05,640 --> 00:20:06,810
But if you drill into that,

509
00:20:06,810 --> 00:20:08,940
there are subsystems in each of those

510
00:20:08,940 --> 00:20:11,580
that are also Nebraska's.

511
00:20:11,580 --> 00:20:15,480
The issue is sustainability
of maintainers,

512
00:20:15,480 --> 00:20:17,220
and their desire to keep
working in that role

513
00:20:17,220 --> 00:20:18,120
and not get burned out.

514
00:20:18,120 --> 00:20:23,120
So how do we measure that and
address that as a public good?

515
00:20:26,160 --> 00:20:26,993
- That's awesome.

516
00:20:26,993 --> 00:20:28,620
We'll come back, we'll do a rundown, Eric.

517
00:20:28,620 --> 00:20:29,453
Your turn.
- All right,

518
00:20:29,453 --> 00:20:31,320
well, I'll try to be brief
to get the questions,

519
00:20:31,320 --> 00:20:34,020
also because they in fact
covered a bunch of the things

520
00:20:34,020 --> 00:20:34,870
that I might say.

521
00:20:36,090 --> 00:20:37,250
So it's definitely...

522
00:20:38,220 --> 00:20:41,250
The points made here
about contributing back

523
00:20:41,250 --> 00:20:44,303
and about being able to
take the long term view,

524
00:20:44,303 --> 00:20:45,180
those are things

525
00:20:45,180 --> 00:20:47,430
that really can play to
the government's strengths,

526
00:20:47,430 --> 00:20:51,180
where when the government
knows that it should.

527
00:20:51,180 --> 00:20:53,610
So it should be incredibly normal

528
00:20:53,610 --> 00:20:57,360
for people and federal agencies to,

529
00:20:57,360 --> 00:21:01,680
as they invest in the development
of their own software,

530
00:21:01,680 --> 00:21:03,630
of their custom software
through their contractors.

531
00:21:03,630 --> 00:21:06,840
It should be considered not a waste

532
00:21:06,840 --> 00:21:09,390
and a sort of fun routine act

533
00:21:09,390 --> 00:21:11,790
to also be contributing back
to some of the libraries

534
00:21:11,790 --> 00:21:14,760
that make up the things that
they use and benefit from.

535
00:21:14,760 --> 00:21:19,620
And the intuition to do that is stronger

536
00:21:19,620 --> 00:21:23,700
for things that aren't software,
inside federal agencies.

537
00:21:23,700 --> 00:21:28,080
It's just sort of more,

538
00:21:28,080 --> 00:21:30,810
this is just something that
only a much smaller slice

539
00:21:30,810 --> 00:21:32,310
of a federal agency understands,

540
00:21:32,310 --> 00:21:36,138
and that understanding tends
to go less high up the chain.

541
00:21:36,138 --> 00:21:37,483
Long term thinking,

542
00:21:37,483 --> 00:21:42,240
and the ability to just
fund tooling is absolutely,

543
00:21:42,240 --> 00:21:44,760
that's a core governmental mission

544
00:21:44,760 --> 00:21:48,480
and something where it's
sort of there by design,

545
00:21:48,480 --> 00:21:49,470
to be a counterweight

546
00:21:49,470 --> 00:21:51,450
to some of the more
growth oriented incentives

547
00:21:51,450 --> 00:21:53,280
on the private sector.

548
00:21:53,280 --> 00:21:55,530
One of the things that I
know Brian has talked about,

549
00:21:55,530 --> 00:21:57,900
and maybe we'll talk
about here a little bit.

550
00:21:57,900 --> 00:21:59,760
That is one of the places

551
00:21:59,760 --> 00:22:01,950
that I know we wanna see more investment

552
00:22:01,950 --> 00:22:04,080
in software security generally,

553
00:22:04,080 --> 00:22:07,650
and especially opensource
software is memory and safety.

554
00:22:07,650 --> 00:22:12,650
And that is an excellent
example of a decades long effort

555
00:22:12,780 --> 00:22:17,040
that both the government
and private sector

556
00:22:17,040 --> 00:22:20,562
could be doing work to shave
years off of that timeline.

557
00:22:20,562 --> 00:22:24,030
And to turn something that
could without much effort

558
00:22:24,030 --> 00:22:25,500
be a 30 or 40 year problem

559
00:22:25,500 --> 00:22:28,200
into something more like
a 15 or 20 year problem.

560
00:22:28,200 --> 00:22:31,800
And that's how the government
can think of things

561
00:22:31,800 --> 00:22:32,849
when it wants to.

562
00:22:32,849 --> 00:22:35,249
And that's something we'd
certainly like to see.

563
00:22:39,570 --> 00:22:42,300
- So Trey summed it up very well

564
00:22:42,300 --> 00:22:43,770
when he talked about the three roles

565
00:22:43,770 --> 00:22:44,626
that the government can play,

566
00:22:44,626 --> 00:22:48,210
the convening authority, the
funding, and the public good.

567
00:22:48,210 --> 00:22:51,330
From the funding perspective
and the resourcing perspective,

568
00:22:51,330 --> 00:22:53,670
again, just echoing what Eric had said,

569
00:22:53,670 --> 00:22:55,380
the government is a producer,

570
00:22:55,380 --> 00:22:58,140
as well as a consumer
of open source software.

571
00:22:58,140 --> 00:22:59,280
In a past life,

572
00:22:59,280 --> 00:23:02,220
I ran the president's cup
cybersecurity competition.

573
00:23:02,220 --> 00:23:03,840
We developed a platform

574
00:23:03,840 --> 00:23:06,410
to run hands on cybersecurity competition.

575
00:23:06,410 --> 00:23:07,800
It was critical to us

576
00:23:07,800 --> 00:23:10,140
that we open source
everything that we developed,

577
00:23:10,140 --> 00:23:11,760
because we felt that it contributed back

578
00:23:11,760 --> 00:23:12,630
to that public good.

579
00:23:12,630 --> 00:23:14,760
And now there are cyber
security competitions

580
00:23:14,760 --> 00:23:16,140
all over the country
that are using the code

581
00:23:16,140 --> 00:23:17,280
and the challenges that we developed.

582
00:23:17,280 --> 00:23:19,500
So we're really, really happy with that.

583
00:23:19,500 --> 00:23:20,970
And we really understand the value

584
00:23:20,970 --> 00:23:23,940
that providing these
resources as open source

585
00:23:23,940 --> 00:23:28,940
and allowing people to
use them at their will

586
00:23:30,120 --> 00:23:31,920
has really paid dividends.

587
00:23:31,920 --> 00:23:33,540
One of the things that Eric said,

588
00:23:33,540 --> 00:23:35,040
that I would also like to piggyback on,

589
00:23:35,040 --> 00:23:36,870
on the memory safety piece,

590
00:23:36,870 --> 00:23:38,220
and it ties a little bit back

591
00:23:38,220 --> 00:23:40,050
to the convening function that we have.

592
00:23:40,050 --> 00:23:41,907
We had a,

593
00:23:41,907 --> 00:23:44,030
one of the other hats that I wear at ONCD

594
00:23:44,030 --> 00:23:46,260
is for workforce education and training.

595
00:23:46,260 --> 00:23:49,197
We had a summit about
a month and a half ago

596
00:23:49,197 --> 00:23:52,140
where we convened a large body of CEOs,

597
00:23:52,140 --> 00:23:52,973
government officials,

598
00:23:52,973 --> 00:23:55,590
to talk about the cyber workforce,

599
00:23:55,590 --> 00:23:57,300
to talk about the cyber workforce crisis

600
00:23:57,300 --> 00:23:58,890
and the shortage of skilled professionals

601
00:23:58,890 --> 00:24:00,040
that we have out there.

602
00:24:00,990 --> 00:24:03,750
And in that discussion, memory
safety specifically came up

603
00:24:03,750 --> 00:24:06,570
when we were talking about how
we train software developers.

604
00:24:06,570 --> 00:24:07,874
And there was an individual

605
00:24:07,874 --> 00:24:10,770
who worked very closely with
colleges and universities

606
00:24:10,770 --> 00:24:12,660
who asked one of his professors,

607
00:24:12,660 --> 00:24:15,904
why are we not emphasizing
memory safe languages?

608
00:24:15,904 --> 00:24:18,457
And he says, "We don't
have the curriculum.

609
00:24:18,457 --> 00:24:19,867
"This is what the book says we teach.

610
00:24:19,867 --> 00:24:21,450
"So that's what we teach."

611
00:24:21,450 --> 00:24:24,210
So there's a lot of roles
that the government can play

612
00:24:24,210 --> 00:24:27,120
that may seem like ancillary
or secondary order of effects

613
00:24:27,120 --> 00:24:28,650
that can really have a big impact.

614
00:24:28,650 --> 00:24:31,743
And when we talk about memory
safety in the workforce,

615
00:24:32,640 --> 00:24:34,920
understanding how we
can influence developers

616
00:24:34,920 --> 00:24:37,320
who have been coding in
a particular language

617
00:24:37,320 --> 00:24:39,060
for 15, 20 years,

618
00:24:39,060 --> 00:24:41,520
and they may not have as strong as skills

619
00:24:41,520 --> 00:24:42,960
as some of these newer
memory-safe languages.

620
00:24:42,960 --> 00:24:44,550
How do we make them more comfortable

621
00:24:44,550 --> 00:24:46,560
and get them up to speed
to be able to contribute

622
00:24:46,560 --> 00:24:48,600
to some of these projects?

623
00:24:48,600 --> 00:24:49,740
I'll keep my remarks brief.

624
00:24:49,740 --> 00:24:51,420
I know there are some
questions floating around,

625
00:24:51,420 --> 00:24:53,160
so I'll turn it over.

626
00:24:53,160 --> 00:24:54,154
- Awesome, thank you all for that.

627
00:24:54,154 --> 00:24:55,890
One linking theme, which
just interesting here

628
00:24:55,890 --> 00:24:58,260
is government shaping the market, right?

629
00:24:58,260 --> 00:25:00,150
Shaping the ability for
others to have transactions

630
00:25:00,150 --> 00:25:01,950
in a way that accumulates
in a positive fashion,

631
00:25:01,950 --> 00:25:04,230
build curricula, change incentives, right?

632
00:25:04,230 --> 00:25:06,270
Change the way that we approach code.

633
00:25:06,270 --> 00:25:08,460
Sir, let's come to you
for the first question

634
00:25:08,460 --> 00:25:09,893
and then we'll come back down to you.

635
00:25:12,184 --> 00:25:13,017
- [Darius] Hey, greetings folks.

636
00:25:13,017 --> 00:25:16,380
I'm Darius, I'm a UX/UI
designer at Microsoft,

637
00:25:16,380 --> 00:25:19,350
opinions are my own
however, nice to be here.

638
00:25:19,350 --> 00:25:21,030
So this is a bit of an esoteric question.

639
00:25:21,030 --> 00:25:22,350
Maybe one that we should have asked

640
00:25:22,350 --> 00:25:23,970
in the very beginning of this,

641
00:25:23,970 --> 00:25:27,600
what do we mean when we
say open source software,

642
00:25:27,600 --> 00:25:30,274
and how important is it that
we have a shared understanding

643
00:25:30,274 --> 00:25:33,330
of what that is in this context?

644
00:25:33,330 --> 00:25:36,210
And especially as we try
to scale these things.

645
00:25:36,210 --> 00:25:37,050
- Anybody wants to take that one?

646
00:25:37,050 --> 00:25:38,513
You're free to jump.

647
00:25:38,513 --> 00:25:39,810
- I mean, I'll grab that

648
00:25:39,810 --> 00:25:41,520
as a board member on the organization

649
00:25:41,520 --> 00:25:44,940
that literally defines what
is open source software.

650
00:25:44,940 --> 00:25:48,510
Any software published under
a license approved by the OSI

651
00:25:48,510 --> 00:25:49,713
is open source software.

652
00:25:52,710 --> 00:25:54,923
Did you mean, was there
more to your question?

653
00:25:54,923 --> 00:25:57,234
- [Darius] I mean, this is a
bit of a controversial topic,

654
00:25:57,234 --> 00:26:02,234
like free software, open
source software, GPL, MIT,

655
00:26:02,340 --> 00:26:04,203
like, are they all open source?

656
00:26:07,560 --> 00:26:11,100
- There's a list of
licenses on the LSI site

657
00:26:11,100 --> 00:26:13,413
and it is a superset, I believe.

658
00:26:14,430 --> 00:26:16,803
Yeah, yeah, it's a
superset of the FSFs list.

659
00:26:18,300 --> 00:26:19,740
- [Darius] So do you think the minutia

660
00:26:19,740 --> 00:26:21,873
between these two licenses
is important moving forward?

661
00:26:21,873 --> 00:26:24,625
- I do not think it is relevant to this,

662
00:26:24,625 --> 00:26:26,850
but if you think it is,

663
00:26:26,850 --> 00:26:28,920
I'd love to understand how
you think it's relevant.

664
00:26:28,920 --> 00:26:30,464
- [Darius] Oh, I could
talk all day about that.

665
00:26:30,464 --> 00:26:31,440
- Oh.
- [Darius] Let's go offline.

666
00:26:31,440 --> 00:26:33,660
- Okay, so to frame that differently,

667
00:26:33,660 --> 00:26:35,373
I think what you're asking is,

668
00:26:36,390 --> 00:26:38,310
should there be a policy decision

669
00:26:38,310 --> 00:26:41,160
around whether to use strong copyleft

670
00:26:41,160 --> 00:26:42,780
or permissive licenses?

671
00:26:42,780 --> 00:26:44,438
Is that what you're asking?
- [Darius] Exactly.

672
00:26:44,438 --> 00:26:45,631
- Okay.

673
00:26:45,631 --> 00:26:46,854
- Eric, you wanna weigh in?

674
00:26:46,854 --> 00:26:49,693
- Not particularly, but I will anyway.

675
00:26:49,693 --> 00:26:50,714
- Keep floating the light.

676
00:26:50,714 --> 00:26:52,952
- Yeah, I mean, I'll just say,

677
00:26:52,952 --> 00:26:56,040
for what we were talking about today,

678
00:26:56,040 --> 00:26:58,260
everything that we've gone over.

679
00:26:58,260 --> 00:27:02,100
I think just speaking how we engage on it,

680
00:27:02,100 --> 00:27:06,180
the distinction that's
sort of a practical matter

681
00:27:06,180 --> 00:27:07,950
is whether it's something
that you're going

682
00:27:07,950 --> 00:27:10,980
and developing a private
contract with an organization

683
00:27:10,980 --> 00:27:13,080
to produce for you or doing in-house,

684
00:27:13,080 --> 00:27:15,900
versus something where
your levers of control,

685
00:27:15,900 --> 00:27:18,780
and review, and production
are much more indirect.

686
00:27:18,780 --> 00:27:20,820
And, or something that's just sort of

687
00:27:20,820 --> 00:27:23,040
outside the traditional procurement

688
00:27:23,040 --> 00:27:25,283
and commissioning process of
a thing that you're doing.

689
00:27:25,283 --> 00:27:29,310
So that is just as a practical construct

690
00:27:29,310 --> 00:27:30,840
for how we're looking at it.

691
00:27:30,840 --> 00:27:32,730
- There's actually one
other nuance that I'll add

692
00:27:32,730 --> 00:27:34,500
to the way you're framing it.

693
00:27:34,500 --> 00:27:38,163
If the government is incentivizing
the creation of software,

694
00:27:39,150 --> 00:27:41,850
the license has a direct influence

695
00:27:41,850 --> 00:27:45,390
on who retains IP control
patents and trademarks

696
00:27:45,390 --> 00:27:46,467
of the resulting work.

697
00:27:46,467 --> 00:27:48,510
And that I think is an
interesting question.

698
00:27:48,510 --> 00:27:49,620
- Yeah, several hats ago,

699
00:27:49,620 --> 00:27:51,150
I worked for the Sunlight Foundation,

700
00:27:51,150 --> 00:27:52,980
which was a government
transparency organization

701
00:27:52,980 --> 00:27:55,470
and it did quite a bit of
advocacy to the government

702
00:27:55,470 --> 00:27:56,820
on the licensing it should use.

703
00:27:56,820 --> 00:27:58,290
And then at GSA,

704
00:27:58,290 --> 00:28:00,330
we did a whole thing around

705
00:28:00,330 --> 00:28:03,723
basically having all of our
staff come outta CC0 with,

706
00:28:04,560 --> 00:28:06,900
without disturbing sort
of local US government

707
00:28:06,900 --> 00:28:07,950
public domain stature.

708
00:28:07,950 --> 00:28:11,280
So definitely, there's a lot
we could talk about that.

709
00:28:11,280 --> 00:28:12,180
It is the sort of thing

710
00:28:12,180 --> 00:28:14,517
that could totally
derail this conversation

711
00:28:14,517 --> 00:28:17,100
(all laughing)

712
00:28:18,840 --> 00:28:19,673
if we let it.

713
00:28:19,673 --> 00:28:20,790
But really,

714
00:28:20,790 --> 00:28:25,440
I think just from down to
the security point of it,

715
00:28:25,440 --> 00:28:27,150
I know one of the things that really,

716
00:28:27,150 --> 00:28:29,010
folks are looking at from
a systemic point of view

717
00:28:29,010 --> 00:28:31,890
is how do you generate
better security outcomes

718
00:28:31,890 --> 00:28:33,690
with less direct,

719
00:28:33,690 --> 00:28:35,370
the traditional kind of control

720
00:28:35,370 --> 00:28:38,910
that organizations are accustomed
to having to effect those?

721
00:28:38,910 --> 00:28:40,907
- So I think if we have time,
let's come back to this,

722
00:28:40,907 --> 00:28:45,150
'cause the question around, I
think the control of the IP,

723
00:28:45,150 --> 00:28:46,470
the piece that you mentioned as well,

724
00:28:46,470 --> 00:28:47,490
do have some implications

725
00:28:47,490 --> 00:28:50,790
for both the economic model
downstream, as well as security.

726
00:28:50,790 --> 00:28:52,590
When we talk about ownership
and relative authorities,

727
00:28:52,590 --> 00:28:53,423
that is, it is,

728
00:28:53,423 --> 00:28:55,500
it's not a trivial question,
which I think is a good one,

729
00:28:55,500 --> 00:28:57,650
but it is interesting where
it has been fought over

730
00:28:57,650 --> 00:28:59,370
in some really significant ways already.

731
00:28:59,370 --> 00:29:01,493
So I know you've waited
patiently, let's come to you.

732
00:29:02,910 --> 00:29:04,748
- So I'm just gonna start with,

733
00:29:04,748 --> 00:29:06,810
I'm here in my personal capacity

734
00:29:06,810 --> 00:29:09,690
as a longtime member of
the DEF CON community,

735
00:29:09,690 --> 00:29:12,420
but my comments are going to
be government inside baseball.

736
00:29:12,420 --> 00:29:13,927
So one of the things

737
00:29:13,927 --> 00:29:18,000
that I can say as someone
inside of agencies,

738
00:29:18,000 --> 00:29:20,580
is that actually the licensing model

739
00:29:20,580 --> 00:29:22,860
is one that fundamentally derails

740
00:29:22,860 --> 00:29:26,220
the ability to support
open source software,

741
00:29:26,220 --> 00:29:28,620
you cannot get past acquisitions.

742
00:29:28,620 --> 00:29:29,587
Very similarly,

743
00:29:29,587 --> 00:29:34,500
the ability to provide
a grant or a contract.

744
00:29:34,500 --> 00:29:35,460
Open source developers

745
00:29:35,460 --> 00:29:37,500
are often not interested
in standing up a business,

746
00:29:37,500 --> 00:29:40,200
to be able to continue
doing what they love.

747
00:29:40,200 --> 00:29:42,440
And that is actually a
fundamental impairment

748
00:29:42,440 --> 00:29:44,797
of the ability to do that.

749
00:29:44,797 --> 00:29:48,060
And so just in terms of policy

750
00:29:48,060 --> 00:29:51,720
and trying to make it a
kinda question to look at

751
00:29:51,720 --> 00:29:53,430
is just sort of,

752
00:29:53,430 --> 00:29:55,980
trying to find ways to
deal with the fact that

753
00:29:55,980 --> 00:29:58,293
government workers work is public domain.

754
00:29:59,130 --> 00:30:01,860
The government has the ability
to buy code scanning tools,

755
00:30:01,860 --> 00:30:05,550
but what is the implication
of taking a commercial product

756
00:30:05,550 --> 00:30:08,220
and then applying it against
an open source project,

757
00:30:08,220 --> 00:30:09,690
and have the output of the work

758
00:30:09,690 --> 00:30:11,842
potentially be under a public domain

759
00:30:11,842 --> 00:30:14,670
or CC0 kind of license.

760
00:30:14,670 --> 00:30:17,940
And how does that integrate
in if the project is GPL?

761
00:30:17,940 --> 00:30:19,950
And yet all of this comes back to,

762
00:30:19,950 --> 00:30:21,870
fundamentally, what we're talking about

763
00:30:21,870 --> 00:30:24,210
is this is critical
infrastructure software,

764
00:30:24,210 --> 00:30:25,620
and the ability of the government

765
00:30:25,620 --> 00:30:28,980
to contribute to those
projects for federal staff,

766
00:30:28,980 --> 00:30:31,290
for contract staff, et cetera.

767
00:30:31,290 --> 00:30:32,760
Those are big questions that actually,

768
00:30:32,760 --> 00:30:36,390
often the inability to
answer that question

769
00:30:36,390 --> 00:30:39,120
will derail that entire conversation

770
00:30:39,120 --> 00:30:41,320
and the ability to
actually contribute back.

771
00:30:43,170 --> 00:30:44,003
- Appreciate that.

772
00:30:44,003 --> 00:30:47,192
I mean, if you wanna take
the mic down here on corner.

773
00:30:47,192 --> 00:30:49,830
- [Panel Member] So it's not
all, finally some comments.

774
00:30:49,830 --> 00:30:51,220
- Yeah, if you guys wanna...

775
00:30:52,254 --> 00:30:55,830
- I think sometimes the
debates about licenses

776
00:30:55,830 --> 00:30:58,590
become a proxy for what is
actually debate about agency.

777
00:30:58,590 --> 00:30:59,670
And I don't mean government agency.

778
00:30:59,670 --> 00:31:02,490
I mean, who has control authority

779
00:31:02,490 --> 00:31:05,893
or even influence over the
given piece of software?

780
00:31:05,893 --> 00:31:08,310
I think we've tended
to think of software...

781
00:31:08,310 --> 00:31:09,360
Look when I use software,

782
00:31:09,360 --> 00:31:11,760
sometimes I choose which package to use

783
00:31:11,760 --> 00:31:12,593
based a little bit more

784
00:31:12,593 --> 00:31:14,520
on how much I trust the
developers behind it

785
00:31:14,520 --> 00:31:16,410
than necessarily what
the features are in it.

786
00:31:16,410 --> 00:31:18,750
And I think a lot of
open source developers

787
00:31:18,750 --> 00:31:21,300
make these very uneasy
kind of judgments too,

788
00:31:21,300 --> 00:31:23,553
out of these kind of weak social signals.

789
00:31:23,553 --> 00:31:25,530
And there's some groups like KaOS

790
00:31:25,530 --> 00:31:27,810
that have tried to
define community metrics

791
00:31:27,810 --> 00:31:30,720
to try to describe user
healthy open source project,

792
00:31:30,720 --> 00:31:32,520
that's more likely to generate code

793
00:31:32,520 --> 00:31:34,650
that is likely to be higher quality

794
00:31:34,650 --> 00:31:37,770
by virtue of having multiple
people signing off on releases

795
00:31:37,770 --> 00:31:39,323
and that kind of thing.

796
00:31:39,323 --> 00:31:41,490
And with an Open SSF,
we have a couple things

797
00:31:41,490 --> 00:31:44,130
like the best practices
badge, and scorecards,

798
00:31:44,130 --> 00:31:47,610
and other things that are
varying degrees of automated ways

799
00:31:47,610 --> 00:31:50,880
to try to evaluate, is this
project more likely to lead

800
00:31:50,880 --> 00:31:53,160
to better quality software?

801
00:31:53,160 --> 00:31:55,320
I do think there's more
that can and should be done

802
00:31:55,320 --> 00:31:57,780
down that path to help
developers make decisions

803
00:31:57,780 --> 00:32:00,330
about what dependencies to incorporate,

804
00:32:00,330 --> 00:32:01,830
what platforms to build on top of.

805
00:32:01,830 --> 00:32:04,350
Potentially as well for
other actors to say,

806
00:32:04,350 --> 00:32:06,315
what's my total risk in my enterprise

807
00:32:06,315 --> 00:32:08,610
from the use of this code, right?

808
00:32:08,610 --> 00:32:10,050
And where in this collection

809
00:32:10,050 --> 00:32:12,030
of thousands of components
I'm using might be,

810
00:32:12,030 --> 00:32:13,859
there be that Lib Nebraska, right?

811
00:32:13,859 --> 00:32:15,270
Or was it?
- Live Nebraska.

812
00:32:15,270 --> 00:32:16,103
- Live Nebraska, sorry,

813
00:32:16,103 --> 00:32:18,660
Live Nebraska that is
the problematic thing

814
00:32:18,660 --> 00:32:19,560
that's gonna end up,

815
00:32:19,560 --> 00:32:22,470
'cause it's one developer
behind it who has gone to Fiji,

816
00:32:22,470 --> 00:32:24,240
or worse, has sold their
credentials on GitHub

817
00:32:24,240 --> 00:32:27,960
to a black hat, and it's
gonna cause some problems.

818
00:32:27,960 --> 00:32:29,070
So I...

819
00:32:29,070 --> 00:32:31,200
That's I think, a better path

820
00:32:31,200 --> 00:32:33,480
to getting to answer some
of these questions is,

821
00:32:33,480 --> 00:32:35,970
how do you, and for
government trying to decide

822
00:32:35,970 --> 00:32:37,650
when they're using software,

823
00:32:37,650 --> 00:32:39,540
who am I really building
a relationship with?

824
00:32:39,540 --> 00:32:41,310
Am I building a
relationship with a vendor,

825
00:32:41,310 --> 00:32:43,650
who's gonna buffer some
of that wellness for me?

826
00:32:43,650 --> 00:32:45,210
And if they improve it

827
00:32:45,210 --> 00:32:47,070
they'll depend on them to upstream it,

828
00:32:47,070 --> 00:32:49,500
or how much are my developers in-house

829
00:32:49,500 --> 00:32:51,150
going to engage directly?

830
00:32:51,150 --> 00:32:53,370
And I'm encouraged by what I see as signs

831
00:32:53,370 --> 00:32:55,110
in the federal government
and other governments

832
00:32:55,110 --> 00:32:57,870
to more directly allow
their own state employees

833
00:32:57,870 --> 00:33:00,030
to use software, and make
those kinds of decisions

834
00:33:00,030 --> 00:33:00,900
to contribute upstream,

835
00:33:00,900 --> 00:33:04,770
whether it's USDS, 18F,
those kinds of organizations.

836
00:33:04,770 --> 00:33:08,700
So yeah, I'd rather detach it a bit

837
00:33:08,700 --> 00:33:11,430
from some of the more political

838
00:33:11,430 --> 00:33:12,780
and emotional kinds of things,

839
00:33:12,780 --> 00:33:15,240
that I think have kept us from succeeding,

840
00:33:15,240 --> 00:33:16,893
as I think you've noted.

841
00:33:18,180 --> 00:33:19,290
- Yeah, and I'll add,

842
00:33:19,290 --> 00:33:21,510
that I think the licensing, as you said,

843
00:33:21,510 --> 00:33:23,130
is a proxy for control.

844
00:33:23,130 --> 00:33:26,170
It's a proxy also for
who can profit from it,

845
00:33:26,170 --> 00:33:27,900
and who controls the IP

846
00:33:27,900 --> 00:33:30,120
that comes out of the
research of building it.

847
00:33:30,120 --> 00:33:31,260
We see this in the medical field

848
00:33:31,260 --> 00:33:34,350
where gov incentivizes
research into things,

849
00:33:34,350 --> 00:33:35,880
vaccines, et cetera.

850
00:33:35,880 --> 00:33:37,893
And then companies retain that IP.

851
00:33:38,940 --> 00:33:41,160
If well, different license models

852
00:33:41,160 --> 00:33:43,650
will result in different
patterns there for industry,

853
00:33:43,650 --> 00:33:45,819
and education, and
government collaboration.

854
00:33:45,819 --> 00:33:47,660
I think that's--
- Stallman invented the GPL,

855
00:33:47,660 --> 00:33:49,620
so what is your reaction
to the Bayh-Dole Act?

856
00:33:49,620 --> 00:33:51,509
I don't remember which Bayh-Dole,

857
00:33:51,509 --> 00:33:53,520
somebody who's a historian

858
00:33:53,520 --> 00:33:54,930
probably can describe this better than I,

859
00:33:54,930 --> 00:33:58,560
but federal funded research
used to generally be available

860
00:33:58,560 --> 00:34:00,540
to anybody who wanted to commercialize it.

861
00:34:00,540 --> 00:34:02,940
The Bayh-Dole Act in '84, '86,

862
00:34:02,940 --> 00:34:03,780
something like that,

863
00:34:03,780 --> 00:34:07,140
steered policy towards
exclusive licensing.

864
00:34:07,140 --> 00:34:10,590
So in the interest of
commercialization as a better,

865
00:34:10,590 --> 00:34:15,107
faster path to market
than a lower IP regime.

866
00:34:16,020 --> 00:34:19,770
So in some respects,
GPL was about trying to,

867
00:34:19,770 --> 00:34:21,300
I don't wanna say keep
people from profiting

868
00:34:21,300 --> 00:34:23,580
because you can profit
tons off the Linux Kernel.

869
00:34:23,580 --> 00:34:24,750
- Absolutely.
- Right?

870
00:34:24,750 --> 00:34:26,460
But from locking things back down.

871
00:34:26,460 --> 00:34:29,850
- To keep things open in the public good.

872
00:34:29,850 --> 00:34:30,970
In getting a snowball effect going.

873
00:34:30,970 --> 00:34:32,563
- Yeah, yeah.

874
00:34:32,563 --> 00:34:34,980
(indistinct)

875
00:34:39,660 --> 00:34:41,820
- [Panel Member] Okay, can you hear me?

876
00:34:41,820 --> 00:34:44,370
Not licensing or propriety,

877
00:34:44,370 --> 00:34:46,620
not propriety related question,

878
00:34:46,620 --> 00:34:50,280
and just an area that I thought

879
00:34:50,280 --> 00:34:52,558
the observations of this
wonderful panel of experts

880
00:34:52,558 --> 00:34:53,850
would be wonderful,

881
00:34:53,850 --> 00:34:55,800
not a specific question for me.

882
00:34:55,800 --> 00:35:00,800
So definitely I think on the
open source security questions

883
00:35:01,110 --> 00:35:04,710
we have seen certainly globally
a number of approaches.

884
00:35:04,710 --> 00:35:06,690
We obviously have the federal procurement

885
00:35:06,690 --> 00:35:08,760
and the executive order underlying that.

886
00:35:08,760 --> 00:35:11,940
And of course, NDAA potentially as well,

887
00:35:11,940 --> 00:35:14,550
looking into measures
of creating incentives

888
00:35:14,550 --> 00:35:16,140
for that vehicle in the United States,

889
00:35:16,140 --> 00:35:17,520
but also broader conversations

890
00:35:17,520 --> 00:35:20,280
around critical infrastructure,

891
00:35:20,280 --> 00:35:23,880
baseline security measures,
and best practices.

892
00:35:23,880 --> 00:35:26,573
So focusing in addition
to follow procurement

893
00:35:26,573 --> 00:35:28,920
on the critical infrastructure sector,

894
00:35:28,920 --> 00:35:32,064
but we also seen, especially in Europe,

895
00:35:32,064 --> 00:35:34,860
NAS too, and the CRA,

896
00:35:34,860 --> 00:35:36,330
so it's the cyber resilience act.

897
00:35:36,330 --> 00:35:38,400
An approach that is looking into,

898
00:35:38,400 --> 00:35:40,740
based on security measures
for connected devices

899
00:35:40,740 --> 00:35:43,320
that is putting a much more bigger focus

900
00:35:43,320 --> 00:35:46,080
on open source transparency, and SBOM,

901
00:35:46,080 --> 00:35:48,750
and even additional
requirements for developers,

902
00:35:48,750 --> 00:35:51,219
as well as potential expansion in the NAS

903
00:35:51,219 --> 00:35:53,220
to additional sectors.

904
00:35:53,220 --> 00:35:56,580
And I was just wondering to
get this panel perspective

905
00:35:56,580 --> 00:36:01,230
on those different segments
as vehicles for incentives,

906
00:36:01,230 --> 00:36:02,820
whether it's through federal procurement

907
00:36:02,820 --> 00:36:05,670
or much broader kind of regulation

908
00:36:05,670 --> 00:36:07,290
on critical infrastructure providers,

909
00:36:07,290 --> 00:36:11,100
or for a specific sector
that is identified as risk

910
00:36:11,100 --> 00:36:13,410
like connected products
or through approaches

911
00:36:13,410 --> 00:36:17,760
that are creating kind of more
market adoption mechanisms

912
00:36:17,760 --> 00:36:18,840
like labeling.

913
00:36:18,840 --> 00:36:21,510
What are your views in terms
of the different options

914
00:36:21,510 --> 00:36:24,390
that government policymakers globally have

915
00:36:24,390 --> 00:36:26,880
to advance open source security.

916
00:36:26,880 --> 00:36:29,070
And just, what are the considerations

917
00:36:29,070 --> 00:36:31,860
when you're thinking about
these different alternatives?

918
00:36:31,860 --> 00:36:34,860
And I think the other comment,

919
00:36:34,860 --> 00:36:37,020
but I'm not sure that
we will have time is,

920
00:36:37,020 --> 00:36:37,857
I'm very curious.

921
00:36:37,857 --> 00:36:41,850
One of my observation is that
open source security is also,

922
00:36:41,850 --> 00:36:44,910
and the issues that we
have identified there

923
00:36:44,910 --> 00:36:46,980
kind of underlying the intersection

924
00:36:46,980 --> 00:36:49,500
of most of the policy priorities
we are tackling right now.

925
00:36:49,500 --> 00:36:50,910
So whether it's supply chain security,

926
00:36:50,910 --> 00:36:53,345
workforce development, current
vulnerability, disclosure,

927
00:36:53,345 --> 00:36:54,615
and incident response.

928
00:36:54,615 --> 00:36:57,810
So how do you see all this
conversations coming together

929
00:36:57,810 --> 00:37:01,500
and specifically interacting
with the unique challenges

930
00:37:01,500 --> 00:37:03,090
that are on the table for open source,

931
00:37:03,090 --> 00:37:06,173
and specifically the
OSSF mobilization plan?

932
00:37:06,173 --> 00:37:07,205
I think that touches

933
00:37:07,205 --> 00:37:09,780
and kind of informs all those
different conversations.

934
00:37:09,780 --> 00:37:10,613
Thanks.

935
00:37:12,796 --> 00:37:13,883
- Do anybody wanna start?

936
00:37:15,000 --> 00:37:17,190
- Sure, and will, you wanna
say anything too Harry?

937
00:37:17,190 --> 00:37:19,113
- No.
- All right, great.

938
00:37:20,250 --> 00:37:22,560
So yeah, I mean you
named a couple of spaces.

939
00:37:22,560 --> 00:37:25,290
I think I'll just talk about one a little,

940
00:37:25,290 --> 00:37:29,730
which is there is an
effort right now to really,

941
00:37:29,730 --> 00:37:30,870
and I think, you know,

942
00:37:30,870 --> 00:37:33,630
you named federal procurement
through the executive order,

943
00:37:33,630 --> 00:37:36,240
there's absolutely an effort
to increase incentives

944
00:37:36,240 --> 00:37:38,340
around secure software development a lot.

945
00:37:38,340 --> 00:37:41,670
There's a bunch of policy
work being done in that area.

946
00:37:41,670 --> 00:37:43,220
I really would...

947
00:37:44,460 --> 00:37:47,250
The federal government has a nasty habit

948
00:37:47,250 --> 00:37:52,250
of asking for so much, for
putting vetting and review,

949
00:37:53,556 --> 00:37:57,510
and demanding that it
get the most reviewed

950
00:37:57,510 --> 00:37:59,940
and tight form of things,
and then ending up

951
00:37:59,940 --> 00:38:02,943
with the slowest and worst form of things.

952
00:38:04,080 --> 00:38:06,344
And so there's a lot of
well-intentioned government things

953
00:38:06,344 --> 00:38:07,890
that can end up having

954
00:38:07,890 --> 00:38:10,113
some significant second order effects.

955
00:38:11,250 --> 00:38:12,870
And I think everybody wants this

956
00:38:12,870 --> 00:38:14,070
to not be an example of that.

957
00:38:14,070 --> 00:38:16,980
And I really would
encourage folks to engage.

958
00:38:16,980 --> 00:38:19,980
I think NASA's gonna do a
workshop later this summer

959
00:38:19,980 --> 00:38:21,870
around software development,

960
00:38:21,870 --> 00:38:25,290
and how to apply the secure
software development framework

961
00:38:25,290 --> 00:38:28,020
with an eye towards open source software.

962
00:38:28,020 --> 00:38:30,000
Any sort of major action
the government takes

963
00:38:30,000 --> 00:38:33,000
will almost invariably have
a public comment process

964
00:38:33,000 --> 00:38:34,620
associated with it.

965
00:38:34,620 --> 00:38:37,110
I really would encourage
folks to get involved

966
00:38:37,110 --> 00:38:41,763
and take advantage of the political role

967
00:38:41,763 --> 00:38:43,633
that exists to create
some good incentives,

968
00:38:43,633 --> 00:38:45,960
but to have that be done in a way

969
00:38:45,960 --> 00:38:48,450
that is in connection with the reality

970
00:38:48,450 --> 00:38:49,470
of how things turn out.

971
00:38:49,470 --> 00:38:51,090
This just as a high level thing,

972
00:38:51,090 --> 00:38:53,794
would really just
encourage folks to engage.

973
00:38:53,794 --> 00:38:56,403
- If I can follow up on that.

974
00:38:57,480 --> 00:38:59,910
To just of backstop Eric's point,

975
00:38:59,910 --> 00:39:02,970
there is this broader political
will that exists right now.

976
00:39:02,970 --> 00:39:04,710
There's a lot of attention and movement,

977
00:39:04,710 --> 00:39:06,390
and it really feels like

978
00:39:06,390 --> 00:39:07,860
we are moving in the right direction,

979
00:39:07,860 --> 00:39:11,580
and we have the capacity
to do some good things

980
00:39:11,580 --> 00:39:12,600
in this space.

981
00:39:12,600 --> 00:39:15,074
So engaging now is,

982
00:39:15,074 --> 00:39:18,930
it's a good time to be
engaged in this effort.

983
00:39:18,930 --> 00:39:21,810
And you did touch on one
thing that I'm going to echo

984
00:39:21,810 --> 00:39:25,050
in regards to sector specific guidance,

985
00:39:25,050 --> 00:39:27,300
which I'm glad that you
used the word guidance,

986
00:39:27,300 --> 00:39:29,790
and not the dreaded R word,

987
00:39:29,790 --> 00:39:32,580
that often is thrown around in this space.

988
00:39:32,580 --> 00:39:34,890
But it is important to know

989
00:39:34,890 --> 00:39:37,050
that the government has
a unique responsibility

990
00:39:37,050 --> 00:39:38,400
when it comes to ensuring the safety

991
00:39:38,400 --> 00:39:39,780
and security of Americans.

992
00:39:39,780 --> 00:39:41,460
And there is a nexus
and intersection there

993
00:39:41,460 --> 00:39:43,380
with open source software,

994
00:39:43,380 --> 00:39:47,370
and cybersecurity practices
more broadly in the sectors.

995
00:39:47,370 --> 00:39:49,461
- And she did throw out the R
word Harry, just so you know.

996
00:39:49,461 --> 00:39:51,600
- Oh, she did?
- Yeah.

997
00:39:51,600 --> 00:39:52,890
- Just to add on to that.

998
00:39:52,890 --> 00:39:53,723
So yeah, I agree.

999
00:39:53,723 --> 00:39:54,781
I think we need to be thinking about this

1000
00:39:54,781 --> 00:39:57,810
both at an ecosystem wide scale

1001
00:39:57,810 --> 00:40:00,930
of how are we gonna lift the tide on the,

1002
00:40:00,930 --> 00:40:02,310
across open source ecosystem,

1003
00:40:02,310 --> 00:40:05,190
but also in these individual instances,

1004
00:40:05,190 --> 00:40:07,560
whether it's consumer
products or other areas

1005
00:40:07,560 --> 00:40:11,340
where open source software
is inevitably tied in.

1006
00:40:11,340 --> 00:40:13,890
And I think even as we
address the ecosystem,

1007
00:40:13,890 --> 00:40:16,350
open source software is gonna be around.

1008
00:40:16,350 --> 00:40:17,690
The security of open source software

1009
00:40:17,690 --> 00:40:19,380
is gonna be something we deal with.

1010
00:40:19,380 --> 00:40:21,330
And there's just as,
there's unique benefits

1011
00:40:21,330 --> 00:40:23,550
of open source software for security,

1012
00:40:23,550 --> 00:40:25,320
there's also unique challenges.

1013
00:40:25,320 --> 00:40:27,961
And I think that needs to
be fed into the conversation

1014
00:40:27,961 --> 00:40:32,131
for anything that could
involve open source software.

1015
00:40:32,131 --> 00:40:34,407
So it is something that
is kind of top of mind,

1016
00:40:34,407 --> 00:40:36,510
and not just something we can say,

1017
00:40:36,510 --> 00:40:38,520
okay, we're kind of
throwing some money at it.

1018
00:40:38,520 --> 00:40:42,390
So we can stop thinking about
open source software security.

1019
00:40:42,390 --> 00:40:45,447
And then on the kind of
ecosystem wide scale,

1020
00:40:45,447 --> 00:40:48,900
and this ties into some
of what Eric and Harry

1021
00:40:48,900 --> 00:40:50,490
were getting at with memory safety,

1022
00:40:50,490 --> 00:40:51,840
I think we do need to be thinking

1023
00:40:51,840 --> 00:40:53,220
about how can the government

1024
00:40:53,220 --> 00:40:55,920
most effectively use its resources

1025
00:40:55,920 --> 00:41:00,870
to advance the state of security
with open source software,

1026
00:41:00,870 --> 00:41:03,180
as in what are the...

1027
00:41:03,180 --> 00:41:04,013
Essentially,

1028
00:41:04,013 --> 00:41:05,640
how can we get the
biggest bang for our buck,

1029
00:41:05,640 --> 00:41:06,870
wherever that is?

1030
00:41:06,870 --> 00:41:08,730
What are these long term improvements

1031
00:41:08,730 --> 00:41:09,810
that aren't just say,

1032
00:41:09,810 --> 00:41:13,440
patching individual
vulnerabilities in single project,

1033
00:41:13,440 --> 00:41:17,520
but leading to say, for the
example of memory safety,

1034
00:41:17,520 --> 00:41:19,620
something that once you've
done it, you're done,

1035
00:41:19,620 --> 00:41:23,550
and you've eliminated entire
classes of vulnerabilities.

1036
00:41:23,550 --> 00:41:26,340
So kind of continuing
to identify those areas

1037
00:41:26,340 --> 00:41:28,817
where we can get a solid
return on investment,

1038
00:41:28,817 --> 00:41:33,453
that can then ensure
this long term security.

1039
00:41:36,300 --> 00:41:40,110
- So to speak specifically
about SBOMs first,

1040
00:41:40,110 --> 00:41:43,230
I think it was incredibly
helpful to have a clear signal

1041
00:41:43,230 --> 00:41:45,480
from the White House
and from the government,

1042
00:41:45,480 --> 00:41:48,750
and Executive Order 14028 last year May

1043
00:41:48,750 --> 00:41:50,610
that said SBOMs are important.

1044
00:41:50,610 --> 00:41:53,190
I mean, even before log4shell,
like SBOMS are important.

1045
00:41:53,190 --> 00:41:54,738
We need to be able to take inventory.

1046
00:41:54,738 --> 00:41:56,910
There isn't anything else
out there that does it.

1047
00:41:56,910 --> 00:41:58,320
It's like buying a bottle of ketchup,

1048
00:41:58,320 --> 00:42:01,036
you expect the ingredients
on that list, right?

1049
00:42:01,036 --> 00:42:03,750
And it was a wake up call to industry

1050
00:42:03,750 --> 00:42:05,297
which had kind of dragged its feet

1051
00:42:05,297 --> 00:42:09,183
in talking about standards,
talking about implementations.

1052
00:42:09,183 --> 00:42:10,980
And the open source community

1053
00:42:10,980 --> 00:42:13,350
had done nothing really on SBOMs,

1054
00:42:13,350 --> 00:42:15,900
I mean, we had some
libraries, had some tooling,

1055
00:42:15,900 --> 00:42:17,670
CycloneDX, SPDX.

1056
00:42:17,670 --> 00:42:20,580
But even to this point, the vast majority,

1057
00:42:20,580 --> 00:42:22,470
I mean, we'd love to get numbers on this,

1058
00:42:22,470 --> 00:42:25,140
but I believe the vast majority
of open source software

1059
00:42:25,140 --> 00:42:27,360
does not contain a bill of
materials in every package

1060
00:42:27,360 --> 00:42:28,500
and when they ship out.

1061
00:42:28,500 --> 00:42:31,331
So a mandate like that can
have one or two effects.

1062
00:42:31,331 --> 00:42:34,110
It can be something that's satisfied

1063
00:42:34,110 --> 00:42:35,940
by the end of the supply chain,

1064
00:42:35,940 --> 00:42:40,940
where the vendors think of it
like Ubuntu, Red Hat, or IBM,

1065
00:42:41,040 --> 00:42:44,370
or whoever is distributing
the software the last mile,

1066
00:42:44,370 --> 00:42:45,630
go through tremendous effort

1067
00:42:45,630 --> 00:42:48,750
to inventory everything
in that package by hand,

1068
00:42:48,750 --> 00:42:53,040
and then create a beautiful
SBOM at tremendous cost.

1069
00:42:53,040 --> 00:42:54,750
Which then they will be incentivized

1070
00:42:54,750 --> 00:42:56,940
and tempted to lock down.

1071
00:42:56,940 --> 00:43:01,620
Or we get SBOM generation and
consumption permeated upstream

1072
00:43:01,620 --> 00:43:02,688
as far as we can.

1073
00:43:02,688 --> 00:43:06,150
And that means less cost to the tail end,

1074
00:43:06,150 --> 00:43:07,200
less likelihood

1075
00:43:07,200 --> 00:43:09,780
that becomes part of the
proprietary value add

1076
00:43:09,780 --> 00:43:10,890
of the last mile.

1077
00:43:10,890 --> 00:43:14,370
So at the Open SSF, part
of this mobilization plan

1078
00:43:14,370 --> 00:43:15,300
that I made mentioned,

1079
00:43:15,300 --> 00:43:16,470
this was something we've put together.

1080
00:43:16,470 --> 00:43:20,160
We released in May, 10
different streams of ways

1081
00:43:20,160 --> 00:43:23,034
that we would like to improve
the state of software secur-

1082
00:43:23,034 --> 00:43:26,040
Open source software
security in the supply chain

1083
00:43:26,040 --> 00:43:29,048
meeting kind of top-down
with resources and plans.

1084
00:43:29,048 --> 00:43:31,920
The bottoms-up, stuff going
on inside the Open SSF

1085
00:43:31,920 --> 00:43:33,840
on a number of different domains.

1086
00:43:33,840 --> 00:43:36,570
On SBOMs, the whole
premises how do we get,

1087
00:43:36,570 --> 00:43:39,630
channel just the right degree
of funding into tooling,

1088
00:43:39,630 --> 00:43:41,670
into the default build systems,

1089
00:43:41,670 --> 00:43:44,490
the default ways that
software is distributed

1090
00:43:44,490 --> 00:43:46,770
through the chains so
that it's almost zero lift

1091
00:43:46,770 --> 00:43:49,800
for the developers, or as
minimal lift as possible

1092
00:43:49,800 --> 00:43:52,530
to get that as far upstream
and make that pervasive,

1093
00:43:52,530 --> 00:43:53,880
make it ubiquitous.

1094
00:43:53,880 --> 00:43:57,329
Make it something that is
as standard as a readme.txt

1095
00:43:57,329 --> 00:43:59,209
in the route directory.

1096
00:43:59,209 --> 00:44:01,688
And so that's a place
where government nudging

1097
00:44:01,688 --> 00:44:04,200
and government, even
requirements at one point

1098
00:44:04,200 --> 00:44:07,410
are useful kind of stick to
get us to think about things,

1099
00:44:07,410 --> 00:44:09,780
but there's still a lot for
the private sector to do

1100
00:44:09,780 --> 00:44:11,640
to figure out, how do
we get the shape of that

1101
00:44:11,640 --> 00:44:14,220
to be as equitable and easy

1102
00:44:14,220 --> 00:44:15,660
for all of us to consume as possible.

1103
00:44:15,660 --> 00:44:17,720
And that's why we're
trying to organize funding,

1104
00:44:17,720 --> 00:44:19,920
to get the libraries to be great,

1105
00:44:19,920 --> 00:44:23,010
to think about inter-op
between CycloneDX and SPDX,

1106
00:44:23,010 --> 00:44:26,130
and to get it into every
language ecosystem out there,

1107
00:44:26,130 --> 00:44:27,420
into the default build tools.

1108
00:44:27,420 --> 00:44:28,440
It's not a small project,

1109
00:44:28,440 --> 00:44:29,280
but it's one that I think

1110
00:44:29,280 --> 00:44:30,837
we've got some really good starts on.

1111
00:44:30,837 --> 00:44:33,120
And I can talk about the other
nine streams at some point,

1112
00:44:33,120 --> 00:44:35,580
they include memory safety,
they include education,

1113
00:44:35,580 --> 00:44:37,630
but it's a pretty fun and ambitious plan.

1114
00:44:38,820 --> 00:44:40,853
- So building on the topic of SBOMs,

1115
00:44:41,899 --> 00:44:42,990
I have a little bit of
different perspective,

1116
00:44:42,990 --> 00:44:45,020
and Brian and I often go
back and forth on this.

1117
00:44:45,020 --> 00:44:49,200
The last mile cannot
solve this effectively.

1118
00:44:49,200 --> 00:44:53,160
It is an incredible cost
and decreasing accuracy

1119
00:44:53,160 --> 00:44:55,200
the further down a supply chain

1120
00:44:55,200 --> 00:44:56,800
you try to do that inventory in.

1121
00:44:57,990 --> 00:44:59,280
One of the biggest problems today

1122
00:44:59,280 --> 00:45:01,110
is even those companies and projects

1123
00:45:01,110 --> 00:45:02,700
that are producing an SBOM

1124
00:45:02,700 --> 00:45:06,120
are only doing it at a depth of maybe one

1125
00:45:06,120 --> 00:45:08,010
or two, if they're lucky.

1126
00:45:08,010 --> 00:45:11,970
The minimum elements as defined
by MTA are inadequate today.

1127
00:45:11,970 --> 00:45:14,130
And I chat with Alan
about this all the time.

1128
00:45:14,130 --> 00:45:15,060
It's a starting point.

1129
00:45:15,060 --> 00:45:16,140
It's a good starting point,

1130
00:45:16,140 --> 00:45:20,107
but it is not sufficient for
what we need as an industry.

1131
00:45:20,107 --> 00:45:23,970
It's a throuple of three
items that are not unique.

1132
00:45:23,970 --> 00:45:26,943
They're not canonical,
they're not immutable.

1133
00:45:28,200 --> 00:45:30,630
And the minimum depth is only one,

1134
00:45:30,630 --> 00:45:33,240
which really doesn't tell you if log4j

1135
00:45:33,240 --> 00:45:34,380
is in your product, right?

1136
00:45:34,380 --> 00:45:35,520
It doesn't go down all the way.

1137
00:45:35,520 --> 00:45:38,640
To do that, to Brian's point,

1138
00:45:38,640 --> 00:45:42,690
we have to move the generation
of SBOMs up that supply chain

1139
00:45:42,690 --> 00:45:45,180
and at zero cost to the developers,

1140
00:45:45,180 --> 00:45:47,250
to the maintainers of
these small projects.

1141
00:45:47,250 --> 00:45:51,240
If it costs them time, money,
or attention, and skill,

1142
00:45:51,240 --> 00:45:52,073
they won't do it.

1143
00:45:52,073 --> 00:45:54,420
'Cause a lot of 'em are doing
it as a hobby, just for fun,

1144
00:45:54,420 --> 00:45:56,940
or it's not incentivized
right now in some way

1145
00:45:56,940 --> 00:46:01,513
for the non-commercial production
of open source software.

1146
00:46:01,513 --> 00:46:03,420
To address it, to add it there,

1147
00:46:03,420 --> 00:46:06,420
I think the focus area
should be have it built,

1148
00:46:06,420 --> 00:46:08,232
have something maybe not an SBOM,

1149
00:46:08,232 --> 00:46:11,250
but some sort of an
artifact dependency graph

1150
00:46:11,250 --> 00:46:13,860
automatically generated by every compiler,

1151
00:46:13,860 --> 00:46:15,822
linker build tool.

1152
00:46:15,822 --> 00:46:17,790
And not just the CI systems

1153
00:46:17,790 --> 00:46:20,220
that are doing the last mile of testing,

1154
00:46:20,220 --> 00:46:24,150
but actually like your GCC, LLVM, LD,

1155
00:46:24,150 --> 00:46:25,650
the actual compiler itself

1156
00:46:25,650 --> 00:46:29,490
all the way up through the
runtime compile languages

1157
00:46:29,490 --> 00:46:31,540
like JavaScript and Python.

1158
00:46:31,540 --> 00:46:35,850
If we could instrument
that across the industry,

1159
00:46:35,850 --> 00:46:37,950
then it becomes
transparent, and zero cost,

1160
00:46:37,950 --> 00:46:40,320
and zero friction for all developers,

1161
00:46:40,320 --> 00:46:42,900
whether they're working
for fun or for profit.

1162
00:46:42,900 --> 00:46:44,820
And then at the last mile,

1163
00:46:44,820 --> 00:46:47,520
you have that dependency
graph all the way back

1164
00:46:47,520 --> 00:46:52,380
to which you can correlate all
the extra metadata you need.

1165
00:46:52,380 --> 00:46:54,573
I think that solves these two parts.

1166
00:46:56,160 --> 00:46:58,440
And then to go back to one
of the questions you raised

1167
00:46:58,440 --> 00:47:00,510
about, are there verticals?

1168
00:47:00,510 --> 00:47:01,950
Smart devices, I think,

1169
00:47:01,950 --> 00:47:04,380
is a particularly
interesting one to look at

1170
00:47:04,380 --> 00:47:06,450
as a fulcrum for a lot of this,

1171
00:47:06,450 --> 00:47:10,620
because if we do not
have product labeling,

1172
00:47:10,620 --> 00:47:11,580
not just in the sense of

1173
00:47:11,580 --> 00:47:13,830
what's the ingredient
list in this ketchup,

1174
00:47:13,830 --> 00:47:17,640
but was there a salmonella
outbreak in the factory

1175
00:47:17,640 --> 00:47:19,710
for one of the ingredients
of this ketchup?

1176
00:47:19,710 --> 00:47:22,530
We have that capability for
food in the food industry,

1177
00:47:22,530 --> 00:47:24,180
for medical devices, and cars.

1178
00:47:24,180 --> 00:47:26,425
If there's a recall on brake pads,

1179
00:47:26,425 --> 00:47:29,490
I don't need an ingredient
or inventory list

1180
00:47:29,490 --> 00:47:30,870
of what brake pad is in my car,

1181
00:47:30,870 --> 00:47:33,690
but my dealer's gonna call
me if there's a recall.

1182
00:47:33,690 --> 00:47:38,580
We need a comparable capacity
for smart home devices, IOTs,

1183
00:47:38,580 --> 00:47:40,230
smart vehicles, all of that.

1184
00:47:40,230 --> 00:47:42,540
So that when there is a critical issue

1185
00:47:42,540 --> 00:47:44,340
that cannot be easily remediated,

1186
00:47:44,340 --> 00:47:46,680
you can notify the customers
to say, Hey, come in,

1187
00:47:46,680 --> 00:47:48,060
get this thing patched in person,

1188
00:47:48,060 --> 00:47:49,593
or replaced, or whatever.

1189
00:47:53,433 --> 00:47:56,250
- I guess just a small
thing to jump way back

1190
00:47:56,250 --> 00:47:58,473
to do you think levers are needed?

1191
00:48:00,060 --> 00:48:02,130
My experience as a
working software engineer,

1192
00:48:02,130 --> 00:48:04,440
as a web developer for about a decade

1193
00:48:04,440 --> 00:48:06,753
was that I did not care
about security at all.

1194
00:48:08,040 --> 00:48:11,254
And I mean,

1195
00:48:11,254 --> 00:48:14,760
I ran pip install with root
privileges on my laptop

1196
00:48:14,760 --> 00:48:16,230
like it was going outta style.

1197
00:48:16,230 --> 00:48:18,270
And eventually,

1198
00:48:18,270 --> 00:48:23,220
once I got into the
security space more broadly

1199
00:48:23,220 --> 00:48:25,950
and just developed a little
sense of adversarial thinking,

1200
00:48:25,950 --> 00:48:28,020
and just became a little
bit more familiar,

1201
00:48:28,020 --> 00:48:28,853
it was my own...

1202
00:48:28,853 --> 00:48:31,590
And applied that thinking
to my own practices,

1203
00:48:31,590 --> 00:48:34,290
I changed and incorporated that

1204
00:48:34,290 --> 00:48:35,700
as one of the things I
cared about the most,

1205
00:48:35,700 --> 00:48:40,056
but most people don't
and shouldn't have to go,

1206
00:48:40,056 --> 00:48:44,760
become into security in order to care

1207
00:48:44,760 --> 00:48:46,590
and understand about
those sorts of things.

1208
00:48:46,590 --> 00:48:49,680
It's not very scalable
and it's not reasonable.

1209
00:48:49,680 --> 00:48:53,430
I also spent a lot of time working on,

1210
00:48:53,430 --> 00:48:56,250
just encrypting the web
generally, there was,

1211
00:48:56,250 --> 00:48:59,900
especially even like 2013 to 2019,

1212
00:48:59,900 --> 00:49:01,620
it was probably like a peak period

1213
00:49:01,620 --> 00:49:04,260
where a ton of organizations
on the internet,

1214
00:49:04,260 --> 00:49:06,908
web browsers, governments, individuals,

1215
00:49:06,908 --> 00:49:11,908
people working very hard
to change the default

1216
00:49:12,030 --> 00:49:13,590
for how the web worked.

1217
00:49:13,590 --> 00:49:17,970
And it was interesting to
me that one of the places

1218
00:49:17,970 --> 00:49:20,130
where the backlash was most significant

1219
00:49:20,130 --> 00:49:23,850
was whenever Firefox would
tighten the reins on something,

1220
00:49:23,850 --> 00:49:26,820
and they would get a huge
backlash from software engineers

1221
00:49:26,820 --> 00:49:28,050
and web developers

1222
00:49:28,050 --> 00:49:29,860
about how their lives were
being made harder for it.

1223
00:49:29,860 --> 00:49:32,910
It is very similar to when
automatic updates came up

1224
00:49:32,910 --> 00:49:34,860
as a concept in the web browser community

1225
00:49:34,860 --> 00:49:36,570
about a decade ago.

1226
00:49:36,570 --> 00:49:38,490
Where it was the software
engineer community

1227
00:49:38,490 --> 00:49:41,340
that pushed back on it for
a sense of self control.

1228
00:49:41,340 --> 00:49:42,960
And it took a while

1229
00:49:42,960 --> 00:49:44,670
and other organizations to get in the mix

1230
00:49:44,670 --> 00:49:46,347
before that eventually became the norm.

1231
00:49:46,347 --> 00:49:48,200
And that is...

1232
00:49:49,260 --> 00:49:52,680
The best form of all
this is for the community

1233
00:49:52,680 --> 00:49:57,357
to look upon itself
and prioritize security

1234
00:49:58,530 --> 00:49:59,363
and think about it

1235
00:49:59,363 --> 00:50:01,064
in the way that they
think about performance,

1236
00:50:01,064 --> 00:50:04,050
and scalability, and
all of the other things

1237
00:50:04,050 --> 00:50:07,140
that feel more visceral to
the individuals involved.

1238
00:50:07,140 --> 00:50:09,510
But it has been the norm that
there have had to be at least

1239
00:50:09,510 --> 00:50:13,470
some kind of external pokes
on the system to get security,

1240
00:50:13,470 --> 00:50:15,930
to be taken seriously.

1241
00:50:15,930 --> 00:50:17,550
And that's just been my
experience as a professional

1242
00:50:17,550 --> 00:50:19,064
for a while.

1243
00:50:19,064 --> 00:50:20,220
- Yeah, so--
- Go for it.

1244
00:50:20,220 --> 00:50:21,714
- If I can just, real quick.

1245
00:50:21,714 --> 00:50:24,263
One of the interesting
things about this discussion,

1246
00:50:24,263 --> 00:50:25,680
the one we're talking about,

1247
00:50:25,680 --> 00:50:27,930
especially using the car
example in the brake pads,

1248
00:50:27,930 --> 00:50:29,280
I think that's a really good one.

1249
00:50:29,280 --> 00:50:31,950
The car manufacturer will call
the dealership to call you

1250
00:50:31,950 --> 00:50:33,134
because the car manufacturer

1251
00:50:33,134 --> 00:50:35,970
has substantial liability in this case.

1252
00:50:35,970 --> 00:50:38,490
And I think it's a good question to ask.

1253
00:50:38,490 --> 00:50:41,610
I'm not going to propose
any broad policy proposals

1254
00:50:41,610 --> 00:50:43,440
or solutions and its Chatham House rules,

1255
00:50:43,440 --> 00:50:44,310
just as a reminder,

1256
00:50:44,310 --> 00:50:46,740
but who owns the risk
of open source software?

1257
00:50:46,740 --> 00:50:51,030
I mean, is it the responsibility
of the hobbyist developer

1258
00:50:51,030 --> 00:50:54,150
who pulled together a package
to solve a personal problem,

1259
00:50:54,150 --> 00:50:56,550
or is it the responsibility
of the organization

1260
00:50:56,550 --> 00:50:58,500
that then took that package
and put it in software,

1261
00:50:58,500 --> 00:51:01,200
that they sold to critical
infrastructure providers

1262
00:51:01,200 --> 00:51:03,720
to healthcare manufacturers,
device manufacturers,

1263
00:51:03,720 --> 00:51:04,553
et cetera.

1264
00:51:05,940 --> 00:51:06,773
- To me, the answer is pretty simple.

1265
00:51:06,773 --> 00:51:08,154
It's the second one.

1266
00:51:08,154 --> 00:51:11,400
(Aeva chuckling)

1267
00:51:11,400 --> 00:51:12,480
- Sure, go ahead.

1268
00:51:12,480 --> 00:51:13,313
- Yeah.

1269
00:51:16,833 --> 00:51:18,330
- [Panel Member] Like I
know some of the agencies

1270
00:51:18,330 --> 00:51:20,414
are working very hard on
this, and getting even below,

1271
00:51:20,414 --> 00:51:23,640
way below more than one
or two levels right now,

1272
00:51:23,640 --> 00:51:25,014
some come from that.

1273
00:51:25,014 --> 00:51:26,340
Is there any effort in the government

1274
00:51:26,340 --> 00:51:27,982
to take that list to SBOMs,

1275
00:51:27,982 --> 00:51:32,730
and to give bellies to fix them
in the open source software?

1276
00:51:32,730 --> 00:51:35,010
And also if you look at all these little,

1277
00:51:35,010 --> 00:51:36,210
especially the smaller guys,

1278
00:51:36,210 --> 00:51:38,492
they have no idea how
to add something to the,

1279
00:51:38,492 --> 00:51:40,665
report a CV to the database.

1280
00:51:40,665 --> 00:51:44,100
To democratize that CV,

1281
00:51:44,100 --> 00:51:45,502
a little process or something like that,

1282
00:51:45,502 --> 00:51:47,940
of this whole list of SBOMs
that we have in the government.

1283
00:51:47,940 --> 00:51:51,033
So if any of those are updated instead of,

1284
00:51:51,900 --> 00:51:53,730
that's disclosed, right?

1285
00:51:53,730 --> 00:51:54,810
No problem.

1286
00:51:54,810 --> 00:51:56,493
So the belly and disclosure.

1287
00:51:57,510 --> 00:51:58,887
- So I wanna throw two things here

1288
00:51:58,887 --> 00:52:00,090
and open this up to the panel,

1289
00:52:00,090 --> 00:52:01,283
and then we'll hit some other questions.

1290
00:52:01,283 --> 00:52:03,600
And do you think, one,
Aeva mentioned recall,

1291
00:52:03,600 --> 00:52:05,662
and this second one
around lateral awareness

1292
00:52:05,662 --> 00:52:07,860
is a really, really important distinction.

1293
00:52:07,860 --> 00:52:10,740
It's not part of the SBOM
discussion necessarily right now,

1294
00:52:10,740 --> 00:52:12,360
but is an interesting role for government.

1295
00:52:12,360 --> 00:52:15,992
So is CISA in a position
potentially to come out and say,

1296
00:52:15,992 --> 00:52:19,410
we understand patterns in vulnerability

1297
00:52:19,410 --> 00:52:20,907
because we have this view of SBOMs.

1298
00:52:20,907 --> 00:52:21,990
And the federal government

1299
00:52:21,990 --> 00:52:23,220
can then start to mirror those out

1300
00:52:23,220 --> 00:52:25,890
or share that information
with large corporations,

1301
00:52:25,890 --> 00:52:27,570
with others in the ecosystem.

1302
00:52:27,570 --> 00:52:28,522
But I think the recall piece

1303
00:52:28,522 --> 00:52:31,530
comes back ironically back
to the licensing issue,

1304
00:52:31,530 --> 00:52:33,360
because it is a question of control,

1305
00:52:33,360 --> 00:52:35,820
and what the relationship is
gonna be between the developer

1306
00:52:35,820 --> 00:52:37,110
and the users of those code.

1307
00:52:37,110 --> 00:52:39,000
Am I pushing fixes,

1308
00:52:39,000 --> 00:52:41,610
or am I responsible for
trying to pull back,

1309
00:52:41,610 --> 00:52:44,370
and have an active, ongoing
relationship with that product?

1310
00:52:44,370 --> 00:52:46,680
And so if it's something
like a piece of hardware,

1311
00:52:46,680 --> 00:52:49,770
maybe that we're okay with
the recall, with the pull.

1312
00:52:49,770 --> 00:52:50,820
If it's a piece of software,

1313
00:52:50,820 --> 00:52:53,070
I think historically
it's mostly been push,

1314
00:52:53,070 --> 00:52:55,080
and it's up to you to figure
out how to either mitigate

1315
00:52:55,080 --> 00:52:56,700
or pull that patch down.

1316
00:52:56,700 --> 00:52:58,290
So I'm curious to come back to that,

1317
00:52:58,290 --> 00:53:00,030
but one other note, I think
just on the SBOM piece,

1318
00:53:00,030 --> 00:53:03,000
Heather Atkins, just for
informative purposes,

1319
00:53:03,000 --> 00:53:04,920
Heather Atkins is the, works at Google,

1320
00:53:04,920 --> 00:53:07,500
is one of the co-chairs of
the cyber safety review board,

1321
00:53:07,500 --> 00:53:09,750
which is a DHS chartered entity

1322
00:53:09,750 --> 00:53:12,030
that is intended to do sort
of after action reviews

1323
00:53:12,030 --> 00:53:13,980
on major cybersecurity incidents.

1324
00:53:13,980 --> 00:53:15,900
And she and the other co-chair Rob Silver

1325
00:53:15,900 --> 00:53:18,870
were briefing out their
findings on log4shell,

1326
00:53:18,870 --> 00:53:20,130
at Black Hack just a few days ago.

1327
00:53:20,130 --> 00:53:22,320
And one of the very specific
things that she called out

1328
00:53:22,320 --> 00:53:24,990
as a limiting factor in
their recommendations

1329
00:53:24,990 --> 00:53:26,820
was the difficulty of using SBOMs

1330
00:53:26,820 --> 00:53:29,250
for deep dependency chain analysis.

1331
00:53:29,250 --> 00:53:30,630
And it was something that
came up as a question

1332
00:53:30,630 --> 00:53:31,463
from a couple of people.

1333
00:53:31,463 --> 00:53:32,296
And so I think coming back

1334
00:53:32,296 --> 00:53:35,860
to where Eric and Harry
were talking through,

1335
00:53:35,860 --> 00:53:38,700
there is a bit of a tendentious
relationship right now

1336
00:53:38,700 --> 00:53:42,510
over how responsible do I
wanna be as a developer,

1337
00:53:42,510 --> 00:53:45,450
for how my code gets
used when it's well past,

1338
00:53:45,450 --> 00:53:46,470
when it's left my hands.

1339
00:53:46,470 --> 00:53:48,150
And I think I agree
with Aeva, with respect,

1340
00:53:48,150 --> 00:53:49,320
when I'm packaging and selling,

1341
00:53:49,320 --> 00:53:51,240
I bear a lot of responsibility.

1342
00:53:51,240 --> 00:53:52,650
But it's a very, to my ears,

1343
00:53:52,650 --> 00:53:54,540
a very reasonable question

1344
00:53:54,540 --> 00:53:57,692
for someone who solved one
problem, wrote one tool to say,

1345
00:53:57,692 --> 00:53:58,927
"I'm not signing up

1346
00:53:58,927 --> 00:54:01,650
"to support critical
infrastructure forever."

1347
00:54:01,650 --> 00:54:02,490
I think that's okay.

1348
00:54:02,490 --> 00:54:03,870
And I think this is one of the things

1349
00:54:03,870 --> 00:54:05,280
we're trying to manage here.

1350
00:54:05,280 --> 00:54:06,840
The power of government is substantial,

1351
00:54:06,840 --> 00:54:09,390
and the power to crush
that kind of relationship

1352
00:54:09,390 --> 00:54:10,410
is a serious risk here.

1353
00:54:10,410 --> 00:54:12,040
If we say every time you
write a piece of code,

1354
00:54:12,040 --> 00:54:14,850
you're responsible for
how everybody else uses it

1355
00:54:14,850 --> 00:54:16,200
in perpetuity.

1356
00:54:16,200 --> 00:54:18,030
And so I want you to use MFA.

1357
00:54:18,030 --> 00:54:19,680
I don't want you to feel
like you're obligated

1358
00:54:19,680 --> 00:54:20,940
to protect that thing forever.

1359
00:54:20,940 --> 00:54:23,760
And the SBOMs starts to reveal
some of these relationships

1360
00:54:23,760 --> 00:54:25,080
in a way that's more detailed

1361
00:54:25,080 --> 00:54:27,180
and potentially more troubling
than we've had before.

1362
00:54:27,180 --> 00:54:28,860
I think for once everybody
agree with something I said,

1363
00:54:28,860 --> 00:54:31,170
so I'll shut up and let people chat.

1364
00:54:31,170 --> 00:54:32,003
- [Panel Member] I have
a question on the carrot.

1365
00:54:32,003 --> 00:54:35,070
Is there any effort of the
government to give the carrot?

1366
00:54:35,070 --> 00:54:36,150
You know what I mean, you can have hacked,

1367
00:54:36,150 --> 00:54:37,553
I mean, with the billion dollars which is,

1368
00:54:37,553 --> 00:54:39,330
I mean, I know what the budgets are,

1369
00:54:39,330 --> 00:54:41,260
whatever the minimum is, right?

1370
00:54:41,260 --> 00:54:44,670
For all the critical programs in the SBOM,

1371
00:54:45,590 --> 00:54:48,000
as we have across the
government will have thousands,

1372
00:54:48,000 --> 00:54:49,569
whatever, you know.

1373
00:54:49,569 --> 00:54:51,551
You fix anything in one of these thousands

1374
00:54:51,551 --> 00:54:54,450
of open source, free open source projects.

1375
00:54:54,450 --> 00:54:55,717
We'll give you XYZ.

1376
00:55:00,490 --> 00:55:02,010
- Let me go to Jack for
that one in a second

1377
00:55:02,010 --> 00:55:02,843
and then we'll come to Aeva.

1378
00:55:02,843 --> 00:55:05,040
- Yeah, just so I'm
understanding your question.

1379
00:55:05,040 --> 00:55:07,063
So is basically what you're proposing

1380
00:55:07,063 --> 00:55:08,970
kind of funneling out money

1381
00:55:08,970 --> 00:55:13,350
to just developers of
open source projects?

1382
00:55:13,350 --> 00:55:15,750
- [Panel Member] Yeah, anybody
can find the vulnerability.

1383
00:55:15,750 --> 00:55:16,920
- Yeah, yeah, so I agree.

1384
00:55:16,920 --> 00:55:17,957
And I think are,

1385
00:55:17,957 --> 00:55:21,150
so are you getting a kind
of a bounty model for...

1386
00:55:21,150 --> 00:55:22,066
Yeah, so I think,

1387
00:55:22,066 --> 00:55:25,990
and there's been things
like internet bug bounty,

1388
00:55:25,990 --> 00:55:28,950
trying this out for open source projects.

1389
00:55:28,950 --> 00:55:32,290
I think we do have to consider

1390
00:55:33,600 --> 00:55:38,280
both the finder of whoever
finds the vulnerability,

1391
00:55:38,280 --> 00:55:40,080
but then it's also
someone's responsibility

1392
00:55:40,080 --> 00:55:42,690
to go and patch that vulnerability.

1393
00:55:42,690 --> 00:55:45,870
And if we had say a bounty-like model

1394
00:55:45,870 --> 00:55:48,363
that was only for
discovering vulnerabilities,

1395
00:55:49,200 --> 00:55:52,710
I think that that could lead to some areas

1396
00:55:52,710 --> 00:55:55,644
where we are so focused on
identifying vulnerabilities

1397
00:55:55,644 --> 00:55:57,210
and getting those out,

1398
00:55:57,210 --> 00:55:59,250
that we kind of lose the longer term view

1399
00:55:59,250 --> 00:56:01,800
of how can we drive down
the root cause of these

1400
00:56:01,800 --> 00:56:03,240
in the first place.

1401
00:56:03,240 --> 00:56:05,520
So I think there can be
helpful ways to do it,

1402
00:56:05,520 --> 00:56:07,080
but we need to do so in a way

1403
00:56:07,080 --> 00:56:10,978
that doesn't lose sight of the end goal,

1404
00:56:10,978 --> 00:56:15,300
of having vulnerabilities be
less common in the first place,

1405
00:56:15,300 --> 00:56:19,117
rather than just playing Whac-A-Mole

1406
00:56:19,117 --> 00:56:23,583
and kind of knocking out
vulnerabilities continuously.

1407
00:56:25,410 --> 00:56:28,150
- If I can build on that and all.

1408
00:56:28,150 --> 00:56:31,537
I do, I'm reminded of the
"Dilbert" cartoon where,

1409
00:56:31,537 --> 00:56:33,120
"Hey, I'm announcing a bug bounty!"

1410
00:56:33,120 --> 00:56:33,953
And Dilbert goes,

1411
00:56:33,953 --> 00:56:36,420
"Or else I'm gonna code
myself up a new minivan."

1412
00:56:36,420 --> 00:56:37,740
I think there is,

1413
00:56:37,740 --> 00:56:40,860
maybe the word moral hazard
is overstating the case,

1414
00:56:40,860 --> 00:56:44,460
but I think some degree
of danger of trying to,

1415
00:56:44,460 --> 00:56:46,530
I mean, certainly on the software

1416
00:56:46,530 --> 00:56:47,640
that the government depends upon.

1417
00:56:47,640 --> 00:56:49,290
If it knows that there's weaknesses

1418
00:56:49,290 --> 00:56:52,470
through some objectively
measurable differentiation

1419
00:56:52,470 --> 00:56:53,520
between this kind of project

1420
00:56:53,520 --> 00:56:55,110
and that kind of project,

1421
00:56:55,110 --> 00:56:57,330
channeling money to try
to make improvements,

1422
00:56:57,330 --> 00:56:59,820
and some underlying piece or whatever,

1423
00:56:59,820 --> 00:57:00,709
makes a lot of sense.

1424
00:57:00,709 --> 00:57:03,637
I'm generally not a fan
of the idea of saying,

1425
00:57:03,637 --> 00:57:05,077
"Here's a piece I depend upon.

1426
00:57:05,077 --> 00:57:07,127
"Let's just write a check and walk away."

1427
00:57:08,160 --> 00:57:11,550
If there are, there's so
many different motives

1428
00:57:11,550 --> 00:57:13,020
for why people write open source code,

1429
00:57:13,020 --> 00:57:15,386
but making money on the
side like a gig economy,

1430
00:57:15,386 --> 00:57:18,810
like a Lyft driver is
generally not one of them.

1431
00:57:18,810 --> 00:57:19,643
Generally speaking,

1432
00:57:19,643 --> 00:57:21,240
people are working in open source code

1433
00:57:21,240 --> 00:57:22,629
because they're solving bigger problems

1434
00:57:22,629 --> 00:57:25,200
where they see a bug in something
and they wanna improve it.

1435
00:57:25,200 --> 00:57:28,141
There's these intrinsic motivators

1436
00:57:28,141 --> 00:57:30,067
that are generally separate from,

1437
00:57:30,067 --> 00:57:33,540
"I wanna earn another $100 this week."

1438
00:57:33,540 --> 00:57:34,620
And we have found actually

1439
00:57:34,620 --> 00:57:36,300
when there have been problematic projects,

1440
00:57:36,300 --> 00:57:38,280
just writing a check to the maintainers

1441
00:57:38,280 --> 00:57:40,950
tends not to get those problems fixed.

1442
00:57:40,950 --> 00:57:42,480
Well, but coming in and saying,

1443
00:57:42,480 --> 00:57:44,250
there are some procedures,
there's some policies,

1444
00:57:44,250 --> 00:57:46,080
there's some specific things we wanna do.

1445
00:57:46,080 --> 00:57:48,630
There's a person that we wanna
bring on to that project,

1446
00:57:48,630 --> 00:57:52,680
is generally a much better way
to try to up-level a project

1447
00:57:52,680 --> 00:57:54,667
than going, "Oh, you seem under resourced.

1448
00:57:54,667 --> 00:57:57,801
"Here's $500" or something like that.

1449
00:57:57,801 --> 00:58:01,200
So I think direct funding
of open source projects

1450
00:58:01,200 --> 00:58:02,190
can be made to work,

1451
00:58:02,190 --> 00:58:06,390
but I think it needs to be
attached to something concrete,

1452
00:58:06,390 --> 00:58:07,920
something measurable
as an end result of it.

1453
00:58:07,920 --> 00:58:08,753
- [Panel Member] Maybe I wasn't clear,

1454
00:58:08,753 --> 00:58:10,980
like you have two hats, one,
the person's developing it.

1455
00:58:10,980 --> 00:58:13,230
So work in several
companies, Silicon Valley,

1456
00:58:13,230 --> 00:58:16,710
you got 50 developers and eight testers.

1457
00:58:16,710 --> 00:58:17,850
All these open source projects,

1458
00:58:17,850 --> 00:58:19,714
they might not have eight testers.

1459
00:58:19,714 --> 00:58:21,660
I mean, that's the weak point, right?

1460
00:58:21,660 --> 00:58:22,510
It's the testing.

1461
00:58:23,400 --> 00:58:26,040
- You also might have one
person just kind of doing it

1462
00:58:26,040 --> 00:58:27,780
in their spare of time.

1463
00:58:27,780 --> 00:58:30,450
So I think there's a real
risk with the bug bounties

1464
00:58:30,450 --> 00:58:32,040
for open source vulnerabilities.

1465
00:58:32,040 --> 00:58:33,270
There's several,

1466
00:58:33,270 --> 00:58:36,210
they all sort of fall
under, its unsustainable.

1467
00:58:36,210 --> 00:58:41,070
And if it were scaled up, generalized,

1468
00:58:41,070 --> 00:58:44,400
we could easily overwhelm
open source projects

1469
00:58:44,400 --> 00:58:48,570
and contributors with trivial noise that,

1470
00:58:48,570 --> 00:58:50,550
people saying, "This thing's
bad, this thing's bad."

1471
00:58:50,550 --> 00:58:53,887
And you've got a hobbyist
who's like, "I don't care.

1472
00:58:53,887 --> 00:58:55,410
"It doesn't affect me."

1473
00:58:55,410 --> 00:58:57,760
Who's doing the work to
fix it, to maintain it?

1474
00:58:59,100 --> 00:59:01,500
It doesn't lead to sustainable processes

1475
00:59:01,500 --> 00:59:04,029
to secure these projects over time.

1476
00:59:04,029 --> 00:59:06,240
- So I'll just be the one to say it too.

1477
00:59:06,240 --> 00:59:08,730
That in that general unconstrained setting

1478
00:59:08,730 --> 00:59:10,020
with hobbyists doing that there's,

1479
00:59:10,020 --> 00:59:11,550
becomes a significant incentive for them

1480
00:59:11,550 --> 00:59:14,310
to introduce vulnerabilities
in the first place.

1481
00:59:14,310 --> 00:59:15,143
- Yep.

1482
00:59:15,143 --> 00:59:17,520
- Well, there's another aspect of this

1483
00:59:17,520 --> 00:59:19,800
and another weak point here
that we talk about much less

1484
00:59:19,800 --> 00:59:21,270
because we have less control over it.

1485
00:59:21,270 --> 00:59:24,180
And that's, once a patch is written

1486
00:59:24,180 --> 00:59:25,770
and pushed out to the community.

1487
00:59:25,770 --> 00:59:27,840
People actually applying the patch

1488
00:59:27,840 --> 00:59:32,190
and updating their assets appropriately.

1489
00:59:32,190 --> 00:59:34,590
We talk about it a lot less
because I think in some aspects

1490
00:59:34,590 --> 00:59:35,423
we have a little bit,

1491
00:59:35,423 --> 00:59:38,456
it's a lot easier for us to
focus energy and resources

1492
00:59:38,456 --> 00:59:42,450
to developing a new patch, to
fix a critical vulnerability.

1493
00:59:42,450 --> 00:59:46,053
It's a lot harder for us to
create incentives around,

1494
00:59:47,970 --> 00:59:48,870
sad to say this,

1495
00:59:48,870 --> 00:59:51,293
basic cyber hygiene of
keeping your servers patch.

1496
00:59:51,293 --> 00:59:53,400
- There's a real risk to,

1497
00:59:53,400 --> 00:59:55,980
especially system integrators
downstream from those,

1498
00:59:55,980 --> 00:59:58,590
once that patch of
vulnerability is disclosed,

1499
00:59:58,590 --> 01:00:00,720
what's the time until
it's actually integrated

1500
01:00:00,720 --> 01:00:02,953
into the products out in the wild?

1501
01:00:02,953 --> 01:00:05,460
For the larger projects and
vendors that work together,

1502
01:00:05,460 --> 01:00:07,650
there are vulnerability
disclosure processes

1503
01:00:07,650 --> 01:00:09,060
to do all that under embargo.

1504
01:00:09,060 --> 01:00:12,030
That's usually restricted
to the big integrators,

1505
01:00:12,030 --> 01:00:13,290
and the big projects,

1506
01:00:13,290 --> 01:00:18,290
and having perhaps more
help with that coordination.

1507
01:00:18,420 --> 01:00:19,650
That might be an interesting lever.

1508
01:00:19,650 --> 01:00:21,060
I don't think the bug bounty is the lever.

1509
01:00:21,060 --> 01:00:23,430
I think the coordination
might be an interesting lever

1510
01:00:23,430 --> 01:00:24,270
to explore.

1511
01:00:24,270 --> 01:00:26,652
- I just wanted to add one thing.

1512
01:00:26,652 --> 01:00:31,050
So one of the 10 streams and
the Open SSF mobilization plan

1513
01:00:31,050 --> 01:00:35,850
is focused on funding
third party audits on...

1514
01:00:35,850 --> 01:00:36,683
The goal ultimately,

1515
01:00:36,683 --> 01:00:39,954
is the top 200 most critical
open source projects.

1516
01:00:39,954 --> 01:00:41,580
Now a third party audit

1517
01:00:41,580 --> 01:00:43,440
on an average sized open source project,

1518
01:00:43,440 --> 01:00:44,804
and they're all over the map,

1519
01:00:44,804 --> 01:00:49,050
but we've ballpark 50 to
$100,000, but it's not enough

1520
01:00:49,050 --> 01:00:51,427
just to show up to an open
source project and say,

1521
01:00:51,427 --> 01:00:53,467
"Here's where your pants are down.

1522
01:00:53,467 --> 01:00:54,630
"Here's a problem."

1523
01:00:54,630 --> 01:00:57,015
You have to also show up with resources,

1524
01:00:57,015 --> 01:00:59,472
at least on offer, to help with the fix,

1525
01:00:59,472 --> 01:01:02,160
if not, perhaps the remediation itself.

1526
01:01:02,160 --> 01:01:05,700
So we actually budgeted $200,000 per fix.

1527
01:01:05,700 --> 01:01:09,720
I do that for 200 projects
and that's for $40 million,

1528
01:01:09,720 --> 01:01:14,400
but that $40 million will
pay out in value creation,

1529
01:01:14,400 --> 01:01:16,383
but I think well beyond that each year.

1530
01:01:17,455 --> 01:01:21,000
So that's where in each one of
these streams we come up with

1531
01:01:21,000 --> 01:01:23,183
anything that created an obligation

1532
01:01:23,183 --> 01:01:28,080
or created a thing that we
would require developers to do,

1533
01:01:28,080 --> 01:01:30,960
we felt it was important to
also resource that activity

1534
01:01:30,960 --> 01:01:31,890
to fund it.

1535
01:01:31,890 --> 01:01:33,120
So that we weren't seen

1536
01:01:33,120 --> 01:01:34,830
as showing up to open source projects

1537
01:01:34,830 --> 01:01:36,900
with a bunch of new demands,
or a bunch of noise,

1538
01:01:36,900 --> 01:01:39,238
or a bunch of things that
would embarrass them.

1539
01:01:39,238 --> 01:01:41,670
It's about helping uplift all of them.

1540
01:01:41,670 --> 01:01:43,800
- I do wanna just real
quick, pop back to a comment

1541
01:01:43,800 --> 01:01:48,287
I heard over here about SBOMs
being kind of unwieldy, large.

1542
01:01:51,780 --> 01:01:55,560
One study I saw on building an SBOM

1543
01:01:55,560 --> 01:01:58,350
at full depth for the Linux Kernel

1544
01:01:58,350 --> 01:02:02,087
came out around 700 megabytes of text.

1545
01:02:02,087 --> 01:02:04,230
Pick a large product,

1546
01:02:04,230 --> 01:02:07,080
build the full dependency
graph to infinite depth.

1547
01:02:07,080 --> 01:02:10,560
It's gonna be gigantic and a
real burden to do analysis on,

1548
01:02:10,560 --> 01:02:12,180
and parse it even,

1549
01:02:12,180 --> 01:02:13,440
and keep it up to date.

1550
01:02:13,440 --> 01:02:16,681
What I'm proposing to folks to do instead,

1551
01:02:16,681 --> 01:02:19,740
of all of that metadata that is in an SBOM

1552
01:02:19,740 --> 01:02:22,920
that doesn't need to be there
for dependency resolution

1553
01:02:22,920 --> 01:02:25,001
is to use a compact binary format.

1554
01:02:25,001 --> 01:02:27,091
One of the ones we're prototyping,

1555
01:02:27,091 --> 01:02:31,358
it comes out for the comparable
size is 1000 times less.

1556
01:02:31,358 --> 01:02:35,223
700 kilobytes for the same product.

1557
01:02:36,512 --> 01:02:38,562
- Ma'am let's come to you if you wanna...

1558
01:02:39,660 --> 01:02:40,493
Oh, perfect.

1559
01:02:40,493 --> 01:02:41,540
We'll go here and then here.

1560
01:02:42,929 --> 01:02:46,039
- Oh, I don't know who was first.

1561
01:02:46,039 --> 01:02:47,146
Okay.

1562
01:02:47,146 --> 01:02:50,479
(indistinct chattering)

1563
01:02:55,053 --> 01:02:58,484
- Because then I wanna
go after you. (chuckling)

1564
01:02:58,484 --> 01:03:00,870
- [Panel Member] This might
be an oversimplification,

1565
01:03:00,870 --> 01:03:04,492
but my general question is
we know, I think it's on now.

1566
01:03:04,492 --> 01:03:05,733
(chuckling) Thank you.

1567
01:03:06,750 --> 01:03:08,340
So we know that we're here

1568
01:03:08,340 --> 01:03:11,394
because whatever model
we have is not working,

1569
01:03:11,394 --> 01:03:16,260
but in terms of newbies
to open source development

1570
01:03:16,260 --> 01:03:19,440
and our ideal of where
this goes in the future,

1571
01:03:19,440 --> 01:03:21,750
we used to have
Schoolhouse Rock for Bills.

1572
01:03:21,750 --> 01:03:23,910
So I'm just a Bill on Capitol Hill.

1573
01:03:23,910 --> 01:03:28,260
So if we were to oversimplify
what is a very complex issue

1574
01:03:28,260 --> 01:03:30,780
and have an ideal version

1575
01:03:30,780 --> 01:03:33,270
of what we want to happen in the future,

1576
01:03:33,270 --> 01:03:36,135
not what happens to open source coders,

1577
01:03:36,135 --> 01:03:39,540
but when you have a software library

1578
01:03:39,540 --> 01:03:41,340
or a piece of software code,

1579
01:03:41,340 --> 01:03:45,000
what is the life cycle
that we wish would happen?

1580
01:03:45,000 --> 01:03:48,750
Is it that it starts in
a hobbyist basement or,

1581
01:03:48,750 --> 01:03:51,060
I don't code in the basement,
I code in my living room.

1582
01:03:51,060 --> 01:03:53,760
There's lots of light,
does it start there?

1583
01:03:53,760 --> 01:03:57,150
Do they then join Apache or
Open Source Software Foundation,

1584
01:03:57,150 --> 01:03:59,730
or wherever it goes,

1585
01:03:59,730 --> 01:04:01,950
how do the vulnerabilities then come in?

1586
01:04:01,950 --> 01:04:03,450
What does that look like,

1587
01:04:03,450 --> 01:04:06,060
the ideal version that
we're headed towards?

1588
01:04:06,060 --> 01:04:08,100
And are we all unified

1589
01:04:08,100 --> 01:04:10,893
on what that ideal vision
of the future looks like?

1590
01:04:14,160 --> 01:04:14,993
- Great question.

1591
01:04:14,993 --> 01:04:17,640
I think there's a bifurcation
that we have today

1592
01:04:17,640 --> 01:04:18,786
that I don't think is bad,

1593
01:04:18,786 --> 01:04:22,470
between people who are
writing open source software

1594
01:04:22,470 --> 01:04:23,880
to scratch their own itch,

1595
01:04:23,880 --> 01:04:25,507
a hobbyist, or just someone who's like,

1596
01:04:25,507 --> 01:04:26,887
"Yeah, I'm gonna tinker
with this thing for fun.

1597
01:04:26,887 --> 01:04:28,050
"Share it with friends."

1598
01:04:28,050 --> 01:04:29,880
Versus folks who are paid professionally

1599
01:04:29,880 --> 01:04:31,770
to work on a piece of software,

1600
01:04:31,770 --> 01:04:34,110
where either the entirety
or some component of it

1601
01:04:34,110 --> 01:04:35,700
is also open source.

1602
01:04:35,700 --> 01:04:38,817
Those are often, but not
always part of the foundation.

1603
01:04:38,817 --> 01:04:43,800
And I think large foundations
like Apache, Eclipse CNCF,

1604
01:04:43,800 --> 01:04:46,020
Open Infra, et cetera,

1605
01:04:46,020 --> 01:04:49,510
they do serve a really valuable function

1606
01:04:50,640 --> 01:04:52,230
to enable collaboration,

1607
01:04:52,230 --> 01:04:54,900
common IP pooling for
companies to work together,

1608
01:04:54,900 --> 01:04:57,900
or to establish norms and
standards of processes.

1609
01:04:57,900 --> 01:05:02,130
Apache and Eclipse are much
heavier on the process norms

1610
01:05:02,130 --> 01:05:05,340
for how to build software
together as hobbyists,

1611
01:05:05,340 --> 01:05:07,380
more like CNCF and Linux Foundation,

1612
01:05:07,380 --> 01:05:08,970
more so for corporations.

1613
01:05:08,970 --> 01:05:10,260
That's not entirely true.

1614
01:05:10,260 --> 01:05:12,240
I'm totally generalizing here,

1615
01:05:12,240 --> 01:05:13,980
but I do think there's a
natural bifurcation there.

1616
01:05:13,980 --> 01:05:16,923
I don't think we need to change that,

1617
01:05:19,366 --> 01:05:23,520
but I think a big chunk of this
is the traceability, right?

1618
01:05:23,520 --> 01:05:25,830
When someone is choosing to integrate

1619
01:05:25,830 --> 01:05:30,150
an open source component
into a service, a product,

1620
01:05:30,150 --> 01:05:33,306
a device, whether it's
government or industry,

1621
01:05:33,306 --> 01:05:38,306
the traceability back that
chain to not who wrote it,

1622
01:05:38,385 --> 01:05:42,030
but each piece along the
way, and how it was modified,

1623
01:05:42,030 --> 01:05:43,830
and what environment it was compiled in,

1624
01:05:43,830 --> 01:05:46,260
and was that environment compromised.

1625
01:05:46,260 --> 01:05:48,810
That traceability is missing today.

1626
01:05:48,810 --> 01:05:49,920
And if I have my ideal,

1627
01:05:49,920 --> 01:05:52,160
one thing to change with a
magic wand, it'd be that.

1628
01:05:52,160 --> 01:05:55,111
Is the traceability of
where the code came from,

1629
01:05:55,111 --> 01:05:58,470
how it was modified, how it was built,

1630
01:05:58,470 --> 01:06:00,450
all the way down to that end point

1631
01:06:00,450 --> 01:06:03,360
when it's integrated into
a product or a system.

1632
01:06:03,360 --> 01:06:06,963
I think that enables so much
more of what we wanna do.

1633
01:06:08,040 --> 01:06:10,290
- So on that note, I'd
like to add something,

1634
01:06:10,290 --> 01:06:11,613
maybe going back to the,

1635
01:06:11,613 --> 01:06:14,313
this SPOM software bill of material,

1636
01:06:15,990 --> 01:06:20,750
there seems to be a big
problem of well, Simon, well...

1637
01:06:22,350 --> 01:06:25,230
Liability and trust here
are a big issue, right?

1638
01:06:25,230 --> 01:06:27,420
Because we talked about it a little bit.

1639
01:06:27,420 --> 01:06:28,800
I mean, you guys talked
about it a little bit

1640
01:06:28,800 --> 01:06:31,320
in the context of vulnerabilities,

1641
01:06:31,320 --> 01:06:35,763
how do we track things back,
whose responsibility is it,

1642
01:06:37,142 --> 01:06:38,550
and so on,

1643
01:06:38,550 --> 01:06:41,310
but I find it difficult
to have this discussion

1644
01:06:41,310 --> 01:06:43,860
without really talking
about the SBOM itself.

1645
01:06:43,860 --> 01:06:44,850
Who generates that,

1646
01:06:44,850 --> 01:06:48,690
who's responsible for
having a trustable SBOM.

1647
01:06:48,690 --> 01:06:51,480
What about an SBOM that might be malicious

1648
01:06:51,480 --> 01:06:55,132
or not exactly reflect what's going on,

1649
01:06:55,132 --> 01:06:57,000
and how can we scale this up?

1650
01:06:57,000 --> 01:07:00,210
I think I heard somebody mention audits

1651
01:07:00,210 --> 01:07:03,450
as a possible way to enforce that,

1652
01:07:03,450 --> 01:07:05,460
but it doesn't sound very scalable.

1653
01:07:05,460 --> 01:07:07,530
So it might be appropriate

1654
01:07:07,530 --> 01:07:10,470
for very critical pieces of the software,

1655
01:07:10,470 --> 01:07:12,123
but how do we make it more of,

1656
01:07:14,040 --> 01:07:16,050
how do we generalize
this to the large scale

1657
01:07:16,050 --> 01:07:18,150
without involving too much manual effort,

1658
01:07:18,150 --> 01:07:22,140
and while maintaining trust
and having a liability model

1659
01:07:22,140 --> 01:07:24,660
that integrates everything together?

1660
01:07:24,660 --> 01:07:26,643
Sounds like a very difficult question,

1661
01:07:28,470 --> 01:07:30,813
but also something we
need to move forward.

1662
01:07:33,510 --> 01:07:36,780
- I think we're still a
small digit number of years

1663
01:07:36,780 --> 01:07:38,460
away from the tooling,

1664
01:07:38,460 --> 01:07:41,820
the default build tooling to
be zero lift for developers,

1665
01:07:41,820 --> 01:07:43,890
to generate these SBOMs.

1666
01:07:43,890 --> 01:07:46,350
The ideal is that it's a natural byproduct

1667
01:07:46,350 --> 01:07:47,190
of the build process,

1668
01:07:47,190 --> 01:07:50,160
or it's a single flag that you
add, or something like that.

1669
01:07:50,160 --> 01:07:52,590
But the second question
is how do you verify them?

1670
01:07:52,590 --> 01:07:56,472
I think your question is
really how can you trust them?

1671
01:07:56,472 --> 01:07:58,650
Well for open source software,

1672
01:07:58,650 --> 01:08:00,450
it's gonna be reproducible, right?

1673
01:08:00,450 --> 01:08:02,010
If I build from the same sources,

1674
01:08:02,010 --> 01:08:05,130
I should be able to arrive
at the same SBOM, right?

1675
01:08:05,130 --> 01:08:07,380
And that might allow us to be able to go,

1676
01:08:07,380 --> 01:08:09,870
well, if it's not correct in the package

1677
01:08:09,870 --> 01:08:12,540
that the organization around this package

1678
01:08:12,540 --> 01:08:14,543
or the developers around
this package have released,

1679
01:08:14,543 --> 01:08:16,170
what's the motivation?

1680
01:08:16,170 --> 01:08:17,790
Are they, was it it a bug,

1681
01:08:17,790 --> 01:08:20,160
in which case I'll file a bug about it?

1682
01:08:20,160 --> 01:08:21,690
Was it some attempted fraud

1683
01:08:21,690 --> 01:08:23,910
or some attempt at cutting
corners or something like that?

1684
01:08:23,910 --> 01:08:26,310
Well then maybe what we
need is a leaderboard

1685
01:08:26,310 --> 01:08:29,130
to try to name and shame the bad ones

1686
01:08:29,130 --> 01:08:29,963
or something like that.

1687
01:08:29,963 --> 01:08:30,930
But I don't know.

1688
01:08:30,930 --> 01:08:32,610
I hope we won't have to go that far.

1689
01:08:32,610 --> 01:08:34,530
I hope that the automation
built into the tools

1690
01:08:34,530 --> 01:08:37,890
will make it so that it's
not for reasons of laziness

1691
01:08:37,890 --> 01:08:40,135
that people create and complete SBOMs,

1692
01:08:40,135 --> 01:08:41,400
or it might be

1693
01:08:41,400 --> 01:08:43,950
because they don't wanna
include 700 megabytes of text

1694
01:08:43,950 --> 01:08:44,850
or something.

1695
01:08:44,850 --> 01:08:46,260
I hope it's never that burdensome,

1696
01:08:46,260 --> 01:08:50,310
but I mean, what's the
scenario you're worried about,

1697
01:08:50,310 --> 01:08:51,508
I guess actually?
- I guess.

1698
01:08:51,508 --> 01:08:56,508
So the definition of what an
SBOM is may also matter here

1699
01:08:59,250 --> 01:09:01,200
because there's what we currently consider

1700
01:09:01,200 --> 01:09:03,975
as the sort of dependency graph

1701
01:09:03,975 --> 01:09:06,720
of what a piece of software contains,

1702
01:09:06,720 --> 01:09:09,090
which we can automate with
tooling, and compilers,

1703
01:09:09,090 --> 01:09:10,110
and so on.

1704
01:09:10,110 --> 01:09:11,910
But what is the future of the SBOM?

1705
01:09:11,910 --> 01:09:15,303
Should they also include
things that are a bit more,

1706
01:09:17,100 --> 01:09:17,970
how can I say this,

1707
01:09:17,970 --> 01:09:20,310
that maybe give you a
little more information

1708
01:09:20,310 --> 01:09:21,600
about what your software,

1709
01:09:21,600 --> 01:09:23,520
your piece of software should be doing.

1710
01:09:23,520 --> 01:09:26,230
Maybe like something manifest

1711
01:09:26,230 --> 01:09:29,552
of the functional aspects of your code.

1712
01:09:29,552 --> 01:09:33,570
Does this code, I don't
know, talk to the network?

1713
01:09:33,570 --> 01:09:35,038
Does this code handle this kind of data?

1714
01:09:35,038 --> 01:09:38,205
Does this code do this or that?

1715
01:09:38,205 --> 01:09:39,720
- I have seen proposals.

1716
01:09:39,720 --> 01:09:40,997
And this is some of what's been going on

1717
01:09:40,997 --> 01:09:42,870
in the security-specific work

1718
01:09:42,870 --> 01:09:46,434
about using SBOMs to trace capabilities.

1719
01:09:46,434 --> 01:09:49,320
Should this component be
expected to talk to the network?

1720
01:09:49,320 --> 01:09:50,153
No.

1721
01:09:50,153 --> 01:09:52,350
And if it does, then it's
probably been compromised, right?

1722
01:09:52,350 --> 01:09:54,870
There's I think some
non-trivial risk of SBOMs

1723
01:09:54,870 --> 01:09:58,830
being overloaded for all
sorts of other use cases

1724
01:09:58,830 --> 01:10:02,010
that are probably without bounds,

1725
01:10:02,010 --> 01:10:03,798
as a generalized metadata carrier.

1726
01:10:03,798 --> 01:10:07,890
And I fear that probably
would slow us down.

1727
01:10:07,890 --> 01:10:10,266
In fact, I think some of the slowness

1728
01:10:10,266 --> 01:10:13,326
in the standardization work
around SPDX has been because

1729
01:10:13,326 --> 01:10:16,650
SPDX started as a
licensing conformance tool,

1730
01:10:16,650 --> 01:10:19,440
as a way to know that everything
in my package is licensed

1731
01:10:19,440 --> 01:10:21,390
under compatible open source licenses

1732
01:10:21,390 --> 01:10:22,620
and what the end result of that should be.

1733
01:10:22,620 --> 01:10:25,213
And it's from authorized
sources, and that kind of thing.

1734
01:10:25,213 --> 01:10:28,980
And we are now adding a bunch
of security use cases to it

1735
01:10:28,980 --> 01:10:30,524
for inventory.

1736
01:10:30,524 --> 01:10:34,380
It should had also add
capabilities as a use case.

1737
01:10:34,380 --> 01:10:37,680
I would hesitate to have
that slow down progress

1738
01:10:37,680 --> 01:10:41,910
on answering the issue, where
am I running log4j, right?

1739
01:10:41,910 --> 01:10:43,594
Answering that kind of question feels

1740
01:10:43,594 --> 01:10:45,660
first order important now.

1741
01:10:45,660 --> 01:10:47,804
- Okay, no, I think that's
the media fair answer.

1742
01:10:47,804 --> 01:10:48,637
(indistinct)

1743
01:10:48,637 --> 01:10:51,930
- Well, if I could maybe take that up

1744
01:10:51,930 --> 01:10:55,243
just out of the SBOM
conversation specifically,

1745
01:10:55,243 --> 01:10:57,630
you're raising the concept of basically

1746
01:10:57,630 --> 01:11:01,110
capabilities based permission
systems around software,

1747
01:11:01,110 --> 01:11:02,790
which is an interesting concept,

1748
01:11:02,790 --> 01:11:04,980
whether it's open source software or not,

1749
01:11:04,980 --> 01:11:08,880
and also bears I think some similarities

1750
01:11:08,880 --> 01:11:11,910
to some of the major security
innovations in other places

1751
01:11:11,910 --> 01:11:14,850
where sort of third party
code is expected to run.

1752
01:11:14,850 --> 01:11:17,029
So sometimes when we talk about

1753
01:11:17,029 --> 01:11:21,330
why we would like agencies to
use the commercial cloud more

1754
01:11:21,330 --> 01:11:24,873
is not just because maybe it's
cheaper, maybe it's faster,

1755
01:11:24,873 --> 01:11:26,404
depending on what they're doing.

1756
01:11:26,404 --> 01:11:29,414
It's also, from a security perspective,

1757
01:11:29,414 --> 01:11:32,894
the availability of what cloud providers

1758
01:11:32,894 --> 01:11:35,524
have done with permissioning.

1759
01:11:35,524 --> 01:11:40,170
What I am from Amazon Web
Services did, and represents,

1760
01:11:40,170 --> 01:11:44,220
has sort of carved out this
space of dynamic permissioning

1761
01:11:44,220 --> 01:11:46,020
as a sea change, I think,

1762
01:11:46,020 --> 01:11:48,450
in being able to create complex systems

1763
01:11:48,450 --> 01:11:49,461
whose privileges you could manage.

1764
01:11:49,461 --> 01:11:53,048
Similarly, I think the way,

1765
01:11:53,048 --> 01:11:56,310
maybe a more relatable
example for regular people

1766
01:11:56,310 --> 01:12:01,050
is how their mobile phones work,
and the differences between

1767
01:12:01,050 --> 01:12:02,910
what permissions an app has on your phone,

1768
01:12:02,910 --> 01:12:06,420
versus what it has on a
conventional sort of laptop.

1769
01:12:06,420 --> 01:12:09,796
Those are considered to be foundational

1770
01:12:09,796 --> 01:12:12,545
and dramatic security improvements.

1771
01:12:12,545 --> 01:12:14,970
And thinking about ways

1772
01:12:14,970 --> 01:12:16,980
to apply that kind of model
to software, generally,

1773
01:12:16,980 --> 01:12:19,440
whether it has any intersection
with SBOM standards

1774
01:12:19,440 --> 01:12:22,185
or whatever level of
coupling is appropriate

1775
01:12:22,185 --> 01:12:24,305
is certainly intriguing.

1776
01:12:24,305 --> 01:12:26,733
It's the way we should
be thinking about things.

1777
01:12:28,440 --> 01:12:29,820
- I know we're coming up on time,

1778
01:12:29,820 --> 01:12:31,320
so we're gonna take two
more from the audience.

1779
01:12:31,320 --> 01:12:33,390
We have one more quick
question before we wrap.

1780
01:12:33,390 --> 01:12:34,290
I know, sir, you've been waiting,

1781
01:12:34,290 --> 01:12:36,240
and Miermer, I see your hand down here?

1782
01:12:37,260 --> 01:12:39,210
- [Panel Member] So I just
wanted to actually circle back

1783
01:12:39,210 --> 01:12:40,770
to what this gentleman had suggested.

1784
01:12:40,770 --> 01:12:43,410
'Cause what I had actually heard from him

1785
01:12:43,410 --> 01:12:48,410
was not actually necessarily
a vulnerability project,

1786
01:12:48,540 --> 01:12:51,990
but more of an intent
to find a way to patch

1787
01:12:51,990 --> 01:12:54,120
known pieces of software

1788
01:12:54,120 --> 01:12:55,560
that came outta the
software bill of material,

1789
01:12:55,560 --> 01:12:56,940
so critical things.

1790
01:12:56,940 --> 01:13:00,780
But just to tail into that,
what I found interesting was,

1791
01:13:00,780 --> 01:13:02,100
one of the things you had opened with

1792
01:13:02,100 --> 01:13:06,030
was that we don't know how
to fund open source software.

1793
01:13:06,030 --> 01:13:06,930
But then you mentioned

1794
01:13:06,930 --> 01:13:09,660
that sometimes writing the
blank check to the developer,

1795
01:13:09,660 --> 01:13:11,460
isn't a good way to do that.

1796
01:13:11,460 --> 01:13:12,990
And then you've got audits

1797
01:13:12,990 --> 01:13:15,660
and coming back in with additional funding

1798
01:13:15,660 --> 01:13:17,970
to help resource fixing it.

1799
01:13:17,970 --> 01:13:22,470
But it still sounds like we
have kind of an uncertainty

1800
01:13:22,470 --> 01:13:23,499
in terms of,

1801
01:13:23,499 --> 01:13:26,693
is there a way for the government
to meaningfully come in,

1802
01:13:26,693 --> 01:13:29,070
identify these are
critical software project

1803
01:13:29,070 --> 01:13:33,060
that we're going to proactively
attempt to help improve

1804
01:13:33,060 --> 01:13:36,690
the general state of
being, and how to do so.

1805
01:13:36,690 --> 01:13:38,740
And so I'm just curious in your comments.

1806
01:13:42,900 --> 01:13:43,733
- No.

1807
01:13:44,580 --> 01:13:46,290
Uh-huh, yeah, go ahead.

1808
01:13:46,290 --> 01:13:47,750
If you guys need to talk about that.

1809
01:13:47,750 --> 01:13:49,137
My comment's on the last one.

1810
01:13:49,137 --> 01:13:50,343
- Don't worry, go ahead.

1811
01:13:50,343 --> 01:13:51,870
- Just a quick comment on the last one,

1812
01:13:51,870 --> 01:13:54,020
which you were touching
on a little bit was

1813
01:13:56,820 --> 01:13:58,140
capability detection,

1814
01:13:58,140 --> 01:14:00,900
capability labeling of components.

1815
01:14:00,900 --> 01:14:03,240
That might make sense in some spaces,

1816
01:14:03,240 --> 01:14:05,040
but it certainly is not generalizable

1817
01:14:05,040 --> 01:14:07,260
across everything an SBOM would apply to.

1818
01:14:07,260 --> 01:14:09,554
Think about the Linux
Kernel as a whole, right?

1819
01:14:09,554 --> 01:14:11,133
It does everything.

1820
01:14:12,328 --> 01:14:15,000
If you're labeling sub
component capabilities

1821
01:14:15,000 --> 01:14:17,370
at the level of the Kernel's SBOM,

1822
01:14:17,370 --> 01:14:20,490
those sub component
capabilities are meaningless.

1823
01:14:20,490 --> 01:14:23,940
So generalizing, this
doesn't work as well,

1824
01:14:23,940 --> 01:14:27,450
but for product labeling
or component labeling,

1825
01:14:27,450 --> 01:14:29,640
I think a security model
totally makes sense.

1826
01:14:29,640 --> 01:14:31,170
And we do see this in some areas,

1827
01:14:31,170 --> 01:14:34,530
you see it on mobile phones,
and some operating systems,

1828
01:14:34,530 --> 01:14:36,000
you see it in cloud need of computing.

1829
01:14:36,000 --> 01:14:39,750
There are whole frameworks
for labeling capabilities

1830
01:14:39,750 --> 01:14:41,700
and then flagging if something
is accessing the network

1831
01:14:41,700 --> 01:14:42,533
they shouldn't.

1832
01:14:42,533 --> 01:14:43,366
So that's great,

1833
01:14:43,366 --> 01:14:45,924
but I think it's very separate from SBOMs.

1834
01:14:45,924 --> 01:14:49,257
(indistinct chattering)

1835
01:14:50,460 --> 01:14:51,720
- I'm sorry.
- Don't mind.

1836
01:14:51,720 --> 01:14:52,553
- Thank you.

1837
01:14:53,670 --> 01:14:54,503
Could you say a little more

1838
01:14:54,503 --> 01:14:58,740
about why it doesn't
scale in the Linux Kernel?

1839
01:14:58,740 --> 01:15:00,570
- Well, it's mine.

1840
01:15:00,570 --> 01:15:02,550
SBOMs roll up, right?

1841
01:15:02,550 --> 01:15:03,780
You start from a small component,

1842
01:15:03,780 --> 01:15:05,160
you combine many small components

1843
01:15:05,160 --> 01:15:06,390
to make bigger and bigger things.

1844
01:15:06,390 --> 01:15:08,640
You get a tree form, right?

1845
01:15:08,640 --> 01:15:13,020
And the capability of sub
components may modulate

1846
01:15:13,020 --> 01:15:15,720
as it gets combined with other components.

1847
01:15:15,720 --> 01:15:19,710
So it doesn't make sense
to say all components

1848
01:15:19,710 --> 01:15:23,640
and pieces of software must
be labeled with capabilities

1849
01:15:23,640 --> 01:15:24,660
as part of the SBOM,

1850
01:15:24,660 --> 01:15:28,290
because when you roll up the
SBOM, it's irrelevant now.

1851
01:15:28,290 --> 01:15:30,510
You need to relabel that at each step

1852
01:15:30,510 --> 01:15:33,420
and purge that data from the...

1853
01:15:33,420 --> 01:15:36,660
It doesn't work in the way
SBOMs are used by industry.

1854
01:15:36,660 --> 01:15:39,670
- So maybe the solution here
is not maybe exactly the SBOM,

1855
01:15:39,670 --> 01:15:41,433
maybe something slightly different, but--

1856
01:15:41,433 --> 01:15:42,270
- Yes, there,

1857
01:15:42,270 --> 01:15:44,100
it is valid.

1858
01:15:44,100 --> 01:15:45,510
And there are things that do that today,

1859
01:15:45,510 --> 01:15:47,220
they're just not SBOMs.

1860
01:15:47,220 --> 01:15:48,270
- Okay, I understand.

1861
01:15:49,710 --> 01:15:51,247
- Ma'am, can you...
- Yeah, thank you.

1862
01:15:51,247 --> 01:15:52,470
I'm gonna take us

1863
01:15:52,470 --> 01:15:54,930
in a little bit of a
different direction, maybe.

1864
01:15:54,930 --> 01:15:57,240
So you said one of the
three things was funding,

1865
01:15:57,240 --> 01:16:00,270
and I heard various discussions
about how to fund people

1866
01:16:00,270 --> 01:16:01,374
to build better stuff,

1867
01:16:01,374 --> 01:16:05,970
but I've also heard some
pretty aspirational ideas here

1868
01:16:05,970 --> 01:16:09,780
about automating development
of SBOMs, automating,

1869
01:16:09,780 --> 01:16:11,370
finding the vulnerabilities.

1870
01:16:11,370 --> 01:16:13,140
I mean, there's a lot of stuff

1871
01:16:13,140 --> 01:16:15,794
and at very, very, very large scale.

1872
01:16:15,794 --> 01:16:19,350
And so then I'll look
particularly to people

1873
01:16:19,350 --> 01:16:21,450
that are talking to NSF, or DARPA,

1874
01:16:21,450 --> 01:16:22,717
or the different agencies.

1875
01:16:22,717 --> 01:16:27,264
It seems to me that there needs
to be significant investment

1876
01:16:27,264 --> 01:16:31,440
in the research, so that
five years from now,

1877
01:16:31,440 --> 01:16:33,810
we're not having the same
conversation over and over.

1878
01:16:33,810 --> 01:16:36,390
'Cause almost everything
talked about for the last hour

1879
01:16:36,390 --> 01:16:38,040
has been pretty manual,

1880
01:16:38,040 --> 01:16:41,460
pretty much people just doing things.

1881
01:16:41,460 --> 01:16:44,820
And yeah, we've got zillions
of people with open source,

1882
01:16:44,820 --> 01:16:48,510
but instead we need to build
more sophisticated approaches

1883
01:16:48,510 --> 01:16:50,010
to managing this,

1884
01:16:50,010 --> 01:16:53,700
and that's gonna take major
investment of research funding.

1885
01:16:53,700 --> 01:16:57,870
- And I would love to just
add one call to build on that,

1886
01:16:57,870 --> 01:16:59,604
and sustainable work.

1887
01:16:59,604 --> 01:17:03,720
To connect your two points,
could somewhere like the NSF

1888
01:17:03,720 --> 01:17:08,010
or anywhere else fund the sustaining work,

1889
01:17:08,010 --> 01:17:10,440
that doesn't get funded
through bug bounty programs,

1890
01:17:10,440 --> 01:17:12,240
through just a one time code audit.

1891
01:17:12,240 --> 01:17:13,860
Where can we locate?

1892
01:17:13,860 --> 01:17:17,550
Is it in the industry
academia or otherwhere,

1893
01:17:17,550 --> 01:17:19,950
the long term work to
maintain these projects?

1894
01:17:19,950 --> 01:17:21,050
- That's pretty great.

1895
01:17:22,584 --> 01:17:23,730
- Well, one of the,

1896
01:17:23,730 --> 01:17:25,050
we've we've been doing some work

1897
01:17:25,050 --> 01:17:26,490
and it's been great working with Eric

1898
01:17:26,490 --> 01:17:28,620
on the open source software
security initiative

1899
01:17:28,620 --> 01:17:31,380
that we've been co-leading
from the White House.

1900
01:17:31,380 --> 01:17:35,640
But one of the things that
we've been very focused on

1901
01:17:35,640 --> 01:17:36,810
as we move forward with this effort

1902
01:17:36,810 --> 01:17:38,520
is the overall software ecosystem.

1903
01:17:38,520 --> 01:17:39,353
When we talk about the resources

1904
01:17:39,353 --> 01:17:42,625
that the government brings to
bear and how we play a role,

1905
01:17:42,625 --> 01:17:46,680
it goes beyond just grant
funding that's provided,

1906
01:17:46,680 --> 01:17:49,680
which typically is for specific R&D.

1907
01:17:49,680 --> 01:17:51,060
There are a couple
grant programs out there

1908
01:17:51,060 --> 01:17:51,893
that are very unique

1909
01:17:51,893 --> 01:17:53,400
because they're looking at the ecosystem.

1910
01:17:53,400 --> 01:17:54,960
They're looking at governance structures.

1911
01:17:54,960 --> 01:17:56,760
There's one out of the NSF,

1912
01:17:56,760 --> 01:17:59,813
the POSE grant program,
that exclusively focuses

1913
01:17:59,813 --> 01:18:02,550
on the governance of open source software.

1914
01:18:02,550 --> 01:18:04,517
And we think that this is
a really good first step,

1915
01:18:04,517 --> 01:18:07,440
more resources are certainly
needed in this area,

1916
01:18:07,440 --> 01:18:09,300
but it's a great start,
and we're very excited

1917
01:18:09,300 --> 01:18:11,673
to be working with our
NSF colleagues on that.

1918
01:18:14,413 --> 01:18:15,493
- Sorry, Brian.
- Never mind.

1919
01:18:15,493 --> 01:18:16,583
- Keep going.

1920
01:18:16,583 --> 01:18:18,255
(indistinct)

1921
01:18:18,255 --> 01:18:20,940
It's okay.
- Okay, all right.

1922
01:18:20,940 --> 01:18:21,960
- Yeah.

1923
01:18:21,960 --> 01:18:26,400
A plus, totally agree.
(all laughing)

1924
01:18:26,400 --> 01:18:29,010
- So really appreciate, I
think everybody coming in,

1925
01:18:29,010 --> 01:18:30,240
and especially at DEF CON,

1926
01:18:30,240 --> 01:18:31,380
this is one of these conversations

1927
01:18:31,380 --> 01:18:33,540
it's very hard to get this
kind of diversity of folks

1928
01:18:33,540 --> 01:18:34,373
in the room.

1929
01:18:34,373 --> 01:18:36,600
I will say, so this
session is one of a couple

1930
01:18:36,600 --> 01:18:38,280
that's occurring as a
result of a partnership

1931
01:18:38,280 --> 01:18:41,010
between the Atlantic
Council, a think tank in DC,

1932
01:18:41,010 --> 01:18:43,230
and the DEF CON Policy Village.

1933
01:18:43,230 --> 01:18:45,180
We together with a number of
the folks that you see here

1934
01:18:45,180 --> 01:18:48,750
are working to build out an
open source policy network

1935
01:18:48,750 --> 01:18:51,330
of folks like yourselves
who are interested in this,

1936
01:18:51,330 --> 01:18:52,350
doing security research,

1937
01:18:52,350 --> 01:18:54,570
contributing back to open source projects,

1938
01:18:54,570 --> 01:18:57,139
and want to be part of addressing
some of these questions

1939
01:18:57,139 --> 01:18:59,009
about open source
infrastructure and governance

1940
01:18:59,009 --> 01:19:01,410
over the next year and-a-half, and beyond.

1941
01:19:01,410 --> 01:19:03,780
If that sounds interesting to
you and you'd like to be part

1942
01:19:03,780 --> 01:19:06,930
of the next couple of these conversations,

1943
01:19:06,930 --> 01:19:08,910
please find us on the web
or come up and talk to me.

1944
01:19:08,910 --> 01:19:10,560
I'm happy to give you email.

1945
01:19:10,560 --> 01:19:12,120
We'd love to get
everybody in here engaged.

1946
01:19:12,120 --> 01:19:12,953
I think as we go,

1947
01:19:12,953 --> 01:19:15,360
this is obviously not a
small set of problems.

1948
01:19:15,360 --> 01:19:16,560
I'd also just ask very quickly,

1949
01:19:16,560 --> 01:19:18,840
If you can join me in thinking
the panelists who are here,

1950
01:19:18,840 --> 01:19:20,949
for making it out to the
desert, surviving so far.

1951
01:19:20,949 --> 01:19:23,532
(all clapping)