Aperçu de la conférence "What's Next for Open Source?" (en anglais) événement

Pour ceux qui n'ont jamais entendu cet acronyme, OSPO signifie Open Source Program Office. Cette année, la deuxième édition du symposium OSPOs for Good s'est tenue aux Nations unies à New York les 9 et 10 juillet.

À ce stade, Open Source software est passé de Linux et du CCG, et la différence qu'il apporte à la productivité et à la fourniture de services allant de l'eau potable aux soins de santé avancés est désormais reconnue. L'objectif de cet événement était de cultiver l'intérêt des secteurs privé et public à soutenir le développement de open source et à l'utiliser de manière efficace.

As part of this, a fringe event, “What’s Next for Open Source?” was also held on July 11, which included workshops on the setup and management of OSPOs, as well as issues around dealing with generative AI, cybersecurity, and the sustainability of the open-source ecosystem. I was given the opportunity to talk on a panel organized by the Open Source Security Foundation at the fringe event. I also seized the opportunity to contribute and escape my frigid base in the Southern Hemisphere for a much warmer New York.

Primarily, I was there to talk about sustainability in open source development, but, as someone who has historically approached open source from a developer’s viewpoint I did gain appreciation for how useful a specific open source program office could be for both private and public organizations as a mechanism for being best able to work with and contribute to the open source ecosystem, ensuring both value for money, and that open source software and projects that were being relied on were sustainable and secure in the long term. The Linux Foundation has made many resources available on this, and for anyone interested in how best to apply open source to their organization I would recommend starting by looking at this link describing the business value of an OSPO.

Sustainability for me is still a lot about resourcing and recognizing that for projects to provide their full benefit to industry, things need to be done to ensure there is a tomorrow for a given effort, before the people responsible find themselves burning out or otherwise in trouble. I am pleased to relay that these issues are a lot better understood than they have been in the past and it was of no small significance that the release of M-24-14 “Administration Cybersecurity Priorities for the FY 2026 Budget” was also announced at the event. M-24-14 lists 5 pillars, or budget priorities for US federal government agencies.

Si toutes les sections touchent à la cybersécurité, les deux plus intéressantes pour nous, à Keyfactor, et pour nombre de nos clients, sont le pilier 1, "Défendre les infrastructures critiques", qui comprend une section intitulée "Améliorer Open Source Software la sécurité et la durabilité", et le pilier 4, "Investir dans un avenir résilient", qui comprend une section intitulée "Se préparer à l'avenir post-quantique". Comme il s'agit de deux domaines sur lesquels Keyfactor a travaillé avec diligence, il a été gratifiant et inspirant de voir que l'importance de ces domaines est désormais pleinement reconnue au sein du gouvernement américain.

Restez à l'écoute pour de nouvelles informations sur ce sujet, car nous attendons la publication finale des nouvelles normes de cryptographie post-quantique du NIST d'un jour à l'autre.

If you would like more information about our current efforts around quantum readiness, please also have a look at https://www.keyfactor.com/post-quantum-cryptography-lab/.

Et consultez les pages du projet open source :

Bouncycastle.org

Ejbca.org

Signserver.org