OSPOlogyLive Apeldoorn - Roundtable Meeting Notes (Day 1)

[anajsana]

Creating a thread for Roundtable leaders to share their meeting notes (leaving a comment) gathered during their roundtable sessions on day 1 (Wednesday 28)

[anajsana]

OSPOs in the Public Sector: Let's Get Practical - Roundtable B (Day 1)

Section 1: Scope

Introducing Cooperative Digital Infrastructure in Public Administrations idea:
OSPO can go beyond software code (as a soft infrastructure). For instance, to achieve policy goals such as interoperability:

OSPOs can serve as the "Public API" to translate and connect between stakeholders and other OSPOs.

What are the practical needs of the OSPOs being established in the public sector needs in Europe?

How can OSPOs in the public sector get together to work on projects and open source solutions and not just share best practices and be another network? How to get together to work on something more goal-oriented.

we can't have evangelism to get practical

Section 2: Group intros

• 19 members from the OSPOlogyLive attendee list participated

Disclaimer: Following Chatham House Rules, group participants name's are not being added to the notes unless they ask to be acknowledged in these notes

Section 3: Future Group Brainstorm:

What are the best ways of an OSPO on a global level (outa space):

• Perception of open source: Organizations are not sure how integrated is open source in the whole technology stack.
• Emphasis on the collaborative mindset
• OSPO = Office of Collaboration
• Building higher-level cooperation
• Example of organizations in the space sector
  • Quite driven by money

Challenge 1 priority: Finding the shared values and Benefits
Problem 1 priority: Politics

Section 4: Practical Group Brainstorm:

Practical to-do list:

• SBOM - Standard + additional info
• Procurement
• Know what you have Automated / frictionless processes to support OS Projects (e.g tools for dependency management)
• Baby steps:
  • lifecycle management
  • make visible what OS you use
  • Produce from CI/CD pipelines
  • developer guidelines
• Create awareness internally in the organization for developers within the organization to use for instance:
  • Blog
  • Discussion about professional developer guidelines
  • Promote SBOM course
  • License Guidelines
• Architecture (IT Landscape / Architecture control)

Section 5: Wrap up

[geekygirldawn]

Sustainability of stewards (CRA definition of Steward) - Unconference Roundtable Day 1

• It’s very hard for gov’t to pay for things that can be gotten for free. Strategically, they’d like to pay for things, but…
• Very careful about asking for money as that could create problems.
• Could there be specific infrastructure that could be provided to make it easier for stewardship orgs?
• Tragedy of the Commons also applies to OSS world - some users consume more than others
• Different between selling services vs accepting donations. Concept of selling (or a paywall) wouldn’t be popular in the open source world
• At my non-profit stewardship foundation, we won’t put the CE-mark on the project. We do have the management of the vulnerability reporting. If one company wants to use it, it is up to them to comply. They have an obligation to check all these boxes of the new policy.
• Would it work to establish a community norm that an SBOM delivery isn’t costless. Imagine it’s 10K dollar budget. Establishing this norm, there are models that show the cost of compliance is going up. It might be this size of the community.
• maybe suggest yearly donation based on company size or something, since compliance costs are going up.
• This is the reason why my organisation wants to invest in open source. Risk mitigation. Specific security analysis and we donate the results to those that are a “member”. Maybe the CRA has something like this?
• One way we can do this is to give money to XX and then they distribute this to OSS projects.
• I asked XX but they said it’s only for internet infrastructure
• Currently discussions between potential funders and people who would like to be funded are happening privately? You could miss out on people that would like to be paid vs those who want to pay - as well as the constraints the funders/stewards might be operating under.
• Foundations are so different such as Linux Foundation, Python, Drupal Association, Eclipse, Apache. They don’t currently talk to each other.
• Money discussions get weird very quickly - people get jealous, and commercial interests can get intrusive.
• Subscription model is perfect: onboarding costs can be high, so set and forget until they say no.
• Could you distribute SBOMs earlier to member/supporter orgs?
• But you need to be careful not to become a commercial actor.
• Selling SBOMs would also make you a commercial actor.
• You become reliant on internal open source advocates.
• Positioning OSS as charity makes it impossible for companies to give money, but rather, there are strong business reasons to invest. Drupal and Wikipedia did this. Something Nook did this with a bait and switch.
• Govt contracts have been written specifying Terraform, and can’t easily be rewritten to specify ‘open source based on Terraform’ (eg OpenTofu).
• What could also be interesting if there could be “able to be subsidized” (subsidiabel in Dutch) because it’s for the public good/has a public benefit, for instance, we might be allowed to pay money to organize conferences. The government is allowed to spend money to someone as a grant for organizing events. (as government). Comes with reporting obligations re how the money’s been spent, and you have to give back what you didn’t spend. Central gov’t org has to prove that granting this money isn’t an economic act (an act of consumption).
• The concept described above may be limited to nat’l gov’t with political responsibilities. A province of the Netherlands instead organizes open source conferences. We don’t pay the community directly, We make donations in kind.
• Current shortcut: give SIDN funds and NLnet money to go spend wisely, but that’s at 1 remove, rather than directly investing strategically.
• Is there a role for gov’t to take care of existing open source produced by others? This is the logic of the German sovereign tech fund.
• EU is considering making open source a requirement for Horizon funding? Could the EU mandate funding for stewards, not companies?
• State of Open Con conference where someone said that every open source project should go beyond a paywall and only undo it when they would be paid fairly.
  • Keynote by Bruce Perens: https://www.youtube.com/watch?v=suUfS0-p5Yg
  • Argument that people would certainly pay.
• Some up and coming projects in XX have VC funding. Still not everyone is happy about that.
• For example, Django is very underfunded. A lot of big companies use this, but they’re still struggling with funding. They have some staff but it’s very minimal. Staff are seriously underpaid (almost volunteer).
• Common in the OSS world, also see it in the CNCF. Some projects are very popular, and some people are struggling to maintain it.
• etdc lost a bunch of maintainers, but was fundamental to Kubernetes.
• With CRA, vendors need to either fork it and do all the testing on the fork, or fix it upstream. But CRA will hopefully force big companies to contribute back.
• A vulnerability could force big companies to recognize how dependent they are, and how much at legal risk if they don’t contribute upstream.
• Gov’ts have contracts with courses that any employee can take - can we get training hosted by OSS stewards / foundations into these arrangements, which provides funding for org while training for employees. A lot of these procurement processes are public and you can see what they are paying for.

[winandsBLD]

Building an Open Source Foundation for Your Container Capabilities - Roundtable A (Day 1)

Lead by John Leegte - Dutch Tax Administration (Belastingdienst)

Discussions around the adoption of open source software (OSS) for container orchestration, particularly Kubernetes, and its implications for IT strategy in organizations. The key points revolve around the transition from commercial software to open source platforms, the advantages of Open Source Program Offices (OSPO) and container hosting, and various considerations when deploying Kubernetes or integrating additional OSS capabilities for enterprise use.

Group Intro's

Companies represented:

• Suse
• Rijkswaterstaat (Department of Waterways and Public Works)
• Albert Heijn
• Alliander
• Kadaster
• Géoportail
• IND
• SAP

IT Challenges Dutch Tax Office

• Flexibility has to be much higher
• Agility has to be on a higher level
• We need a agile devops way of working in place
• Maintenance backlog - Get rid of technical depts, such as getting rid of coolgen applications

Summary

Transition to Open Source Software:
The discussion highlights a pivotal shift towards open source software, driven by the desire to escape the constraints of commercial software procurement. This transition enables organizations to leverage ready-to-use OSS without being tied to specific vendors or commercial agreements.

Advantages of OSPO and Container Hosting:
OSPOs and container hosting environments provide significant benefits, including container capabilities and infrastructure support. Teams dedicated to container infrastructure, such as image repositories and platform enablement, work closely with OSPOs. Initiatives like CPET aim to publish self-built operators, such as the PaaS Operator, to automate tasks like initiating namespaces or projects on Kubernetes platforms.

Discussion Topics

Commercial vs. Open Source for Kubernetes Deployment
The debate centers on whether to follow premium advisors' recommendations to use commercial versions of services for Kubernetes deployment or explore other options. With a plethora of Kubernetes distributions available, the choice is complex. The discussion underscores the need for a balance between leveraging open source software's benefits and acknowledging the moral obligation to support its development, even if it is free.

Choosing Additional OSS Capabilities
When integrating additional capabilities into commercial Kubernetes-based platforms, several factors influence the decision-making process. These include the popularity of the OSS, the number of contributors, vendor support, adherence to formal standards like OpenTelemetry, and the broader CNCF landscape. The discussion also touches on concerns about copyright control and the risks of centralized code ownership.

Maturity and Reliability of OSS for Enterprise Use
The final topic delves into whether OSS capabilities are mature enough to meet enterprise requirements for speed, robustness, and reliability. The conversation suggests that while commercial vendors can offer support, there's no guarantee of success. Organizations must have skilled teams capable of handling the complexities of container orchestration and Kubernetes to ensure resilience.

Final Thoughts:

The roundtable concludes with reflections on the challenges of finding skilled personnel, the importance of comprehensive education in these technologies, and strategic considerations for software lifecycle management, including the dilemmas of "lift and shift" versus "lift, migrate, and shift" approaches.

[nicorikken]

https://tweakers.net/plan/4002/de-belastingdienst-als-it-werkgever-cloud-native-wordt-de-standaard.html Container Platform Enable Team (CPET), operator Project as a Service (PaaS)