Conclusiones del evento "What's Next for Open Source?" (¿Qué viene ahora?) Evento

Para quienes no hayan oído antes las siglas, OSPO significa Open Source Program Office, y este año se celebró la segunda edición del Simposio OSPOs for Good en la sede de las Naciones Unidas en Nueva York los días 9 y 10 de julio.

A estas alturas, Open Source software ha superado a Linux y GCC, y ya se reconoce la diferencia que está suponiendo para la productividad y la prestación de servicios de todo tipo, desde agua potable hasta atención sanitaria avanzada. El objetivo del acto era seguir cultivando el interés tanto privado como público por apoyar el desarrollo de open source , así como por hacer un uso eficaz del mismo.

As part of this, a fringe event, “What’s Next for Open Source?” was also held on July 11, which included workshops on the setup and management of OSPOs, as well as issues around dealing with generative AI, cybersecurity, and the sustainability of the open-source ecosystem. I was given the opportunity to talk on a panel organized by the Open Source Security Foundation at the fringe event. I also seized the opportunity to contribute and escape my frigid base in the Southern Hemisphere for a much warmer New York.

Primarily, I was there to talk about sustainability in open source development, but, as someone who has historically approached open source from a developer’s viewpoint I did gain appreciation for how useful a specific open source program office could be for both private and public organizations as a mechanism for being best able to work with and contribute to the open source ecosystem, ensuring both value for money, and that open source software and projects that were being relied on were sustainable and secure in the long term. The Linux Foundation has made many resources available on this, and for anyone interested in how best to apply open source to their organization I would recommend starting by looking at this link describing the business value of an OSPO.

Sustainability for me is still a lot about resourcing and recognizing that for projects to provide their full benefit to industry, things need to be done to ensure there is a tomorrow for a given effort, before the people responsible find themselves burning out or otherwise in trouble. I am pleased to relay that these issues are a lot better understood than they have been in the past and it was of no small significance that the release of M-24-14 “Administration Cybersecurity Priorities for the FY 2026 Budget” was also announced at the event. M-24-14 lists 5 pillars, or budget priorities for US federal government agencies.

Aunque todas las secciones se referían a la ciberseguridad, las dos que más nos interesaban en Keyfactor, y a muchos de nuestros clientes, eran el pilar 1, "Defender las infraestructuras críticas", que incluía una sección titulada "Mejorar la seguridad y la sostenibilidad de Open Source Software ", y el pilar 4, "Invertir en un futuro resiliente", que incluía una sección titulada "Prepararse para el futuro poscuántico". Dado que ambos se refieren a áreas en las que Keyfactor ha estado trabajando diligentemente, fue gratificante e inspirador ver que la importancia de estas áreas es ahora plenamente reconocida en todo el gobierno de Estados Unidos.

Esté atento a las novedades al respecto, ya que esperamos la publicación definitiva de las nuevas normas de criptografía post-cuántica del NIST en cualquier momento.

If you would like more information about our current efforts around quantum readiness, please also have a look at https://www.keyfactor.com/post-quantum-cryptography-lab/.

Y consulte las páginas de proyectos de open source :

Bouncycastle.org

Ejbca.org

Signserver.org