On Feb 11, 2022, at 21:22, Shane Coughlan <scoughlan@...> wrote:



Earlier today you should have received calendar invitations (via this list) for our forthcoming OpenChain Security Summit 2022. This event (as always) is free to attend. It will be a pivotal event in showing where the industry is positioned and where OpenChain in this space. I highly recommend that you and your security teams attend. Sharing link:

https://www.openchainproject.org/featured/2022/02/10/security-summit-2022

OpenChain Security Summit 2022 – 17/18th February

Learn About OpenSSF In The Current Landscape From Brian Behlendorf, General Manager Open Source Security Foundation

OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all.

Learn About SPDX In The Current Landscape From Kate Stewart, VP, Dependable Embedded Systems At The Linux Foundation

SPDX is an open standard for communicating software bill of material information, including provenance, license, security, and other related information.

And Learn More About Industry Responses To Log4J With Practical Cases Studies From User And Vendor Companies

The Security Summit will take place on February 17th 2022 at 17:00 PST / February 18th 2022 02:00 UTC / 10:00 CST / 11:00 JST. It will be hosted on Zoom and it will be free to attend. It will also be recorded. Join the event here:

• https://zoom.us/j/4377592799

You can expect to come away with a clear understanding of market conditions, how the Linux Foundation is addressing them, and where OpenChain fits into the picture. The goal – as always – is to ensure you have the information necessary to make informed, effective decisions around the open source supply chain.

We seek to build trust in the quality of programs used by you, your customers and your suppliers. We are proud to have taken significant strides in our field throughout 2021. We expect to push the boundaries of what is possible once again in 2022. You can learn more about what we are doing around security – including our reference assurance guide – here:

• https://www.openchainproject.org/news/2022/01/19/openchain-on-security

On Feb 6, 2022, at 19:17, Shane Coughlan <scoughlan@...> wrote:

The OpenChain Bi-Weekly Webinar is quite special this time around. We have Dr. Till Jaeger of the law firm JBB joining us to talk through the recent settlement between the Netfilter Project and Patrick McHardy, a notorious "copyright troll.” If you work includes any aspect of legal activity around open source this is a must-see.

Join us:
https://zoom.us/j/4377592799

Timezone:
Monday 7th February @ 06:00 PST / 14:00 UTC / 14:00 BST / 15:00 CET / 19:30 IST / 22:00 CST / 23:00 KST + JST

== What is this about? ==

Patrick McHardy, a previous contributor to the Netfilter Project, is estimated to have received settlements from more than 80 companies leveraging cease and desist letter. He is the first “copyright troll” to have emerged in the Linux ecosystem. The Netfilter Project have addressed his actions in a court of law by preventing this individual sending cease and desist letters without a majority vote of active core team members. These terms also apply to previous cease and desist letters.

== What did the project say? ==

Pablo Neira Ayuso <pablo@...>:
"The netfilter project announces a settlement with Patrick McHardy. This settlement is legally binding and it governs any legal enforcement
activities concerning all programs and program libraries published by the netfilter/iptables project on its website [1] as well as the Linux kernel [2]. Please, see the court order [3] (in German) and/or the translation of the court order for further details [4].”
https://lore.kernel.org/netdev/Ye6jCQm7z0Yr3bqA@salvia/

[1] https://www.netfilter.org
[2] https://www.kernel.org
[3] https://www.netfilter.org/files/2022-01-24-Beschluss_und_Vergleich.pdf
[4] https://www.netfilter.org/files/2022-01-24-Translation_Court_Order_and_Settlement.pdf

On Feb 3, 2022, at 16:28, Gergely Csatari <gergely.csatari@...> wrote:



Hi,

 

Uh-oh, for some reason I do not see these meetings in the calendar [1]. Can you please advise how to get an invite?

 

Thanks,

Gergely

 

[1]: https://lists.openchainproject.org/g/telco/calendar

 

From: telco@... <telco@...> On Behalf Of Jimmy Ahlberg via lists.openchainproject.org
Sent: Wednesday, February 2, 2022 11:00 PM
To: telco@...
Subject: [telco] Tomorrows Telco Group meeting

 

Dear Telco group subscribers, welcome all to tomorrows Telco Group meeting.

 

I would like to share with you a bit of the thinking that currently exists around the Telco Group as well as our tentative agenda for tomorrow.

 

In the meetings we ran last year we exchanged experiences and best practices around open source in the telco field, my sincere thanks to everyone who so freely shared of their experiences and wisdom to the group. I for one learned a lot and have a lot more to learn still. Going forward we will have our meetings regularly at the first Thursday of each month, one meeting in the morning (for those of us based in Europe) and one in the afternoon so that we ensure that everyone has a chance to participate regardless of time zone. We can change this cadence later and have ad hoc meetings as needed but this way we have a standing appointment in the calendar. At least initially we will run the meetings with identical agendas, so no one should feel obliged to join both meetings, even if you are welcome to do so if you want to.

 

Last year we also discussed in our meetings and in emails some concrete things we could do in the telco sector to simplify open source management in our industry. The conclusion was that it seems that documenting harmonizing best practices for SBoM management was a low hanging fruit we could reach for. There exists great tools already such as SPDX, Cyclone DX, the OpenChain specification itself, the idea is not to reinvent these wheels but rather to see what we can build on top of that that would be of use to our industry. The group and this list remains a place to exchange experiences and best practices,

we should not lose track of that. At the same time, we are from the telco industry, standardization, harmonization, and interoperability is part of our DNA so I think this more actionable work is a natural expression of this.

 

With this in mind I would like to propose the following agenda for our meeting tomorrow.

 

1. Welcome & “round the table” introduction of who is who.
2. Agree on cornerstone principles for our work on “Telco Standard SBoM” going forward. (below are my proposals, if  you would like to add further suggestion feel free to do so during the meeting or over email).
1. We do not aim to change the OpenChain specification or fork it.
2. To implement the “Telco standard for SBoM” you need not be OpenChain conformant.
3. The solution in its entirety needs to adhere to the US federal requirements.
3. Is there a need for a formal Terms Of Reference style document?
4. Work items: The suggestion is that we discuss some of the major points that was brought up during our brainstorming sessions.
1. SBoM Dataformat: Suggestions so far include that the “Telco standard for SBoM” should mandate SPDX in its latest version, SPDX in its ISO format, Cyclone DX (no version suggested), or that we remain agnostic to the issue of dataformat.
2. File format (What should we use for the machine readable SBoM, one format or many? What format should we use for the human readable version?) Do we want to support that these on a voluntary basis are transactable separately from the binary/source?
3. Timing, when should the SBoM be delivered?
4. Template contract clauses to reference our “Telco Standard for SBoM”/playbooks.
5. Any other additions to the above?
5. AoB.
6. Close of the meeting.

 

Feel free to suggest alterations to this agenda if you think there are other things that are more urgent to discuss.

 

Looking forward to seeing you all virtually at any of the meetings tomorrow.

 

Best Regards Jimmy Ahlberg

 

 

Jimmy Ahlberg LL.M

Director Open Source Policy

 

Group Function Technology Standards & Industry Initiatives

 

Phone: +46107198055

Mobile: +46725838055

jimmy.ahlberg@...

 

Ericsson

Lindholmspiren 11

417 56, Göteborg

Sweden

ericsson.com

 

 

Our commitment to Technology for Good and Diversity and Inclusion contributes to positive change.
Follow us on: Facebook LinkedIn Twitter

Legal entity:ERICSSON AB registration number 556056-6258, registered office in Stockholm.
This communication is confidential. Our email terms: www.ericsson.com/en/legal/privacy/email-disclaimer

 

On Jan 31, 2022, at 17:30, Shane Coughlan <scoughlan@...> wrote:

Our regular bi-weekly meeting takes place today. We will be talking about:
Forthcoming summits
Security + the specification
What you (as users) want to see from the partner ecosystem

Dial in:
https://zoom.us/j/4377592799

Check your time
14:00 UTC 2022-01-31 (today) - 06:00 PST / 14:00 BST / 15:00 CET / 19:00 IST / 22:00 CST / 23:00 KST+JST