Open Source, Encryption and Export Regulations & The New Compliance Frontier
summary
Claims that software export compliance mostly hinges on identifying cryptography and that automation plus targeted training is the practical path forward. Uses Fossology ECC and an in-house Python crypto-detector that does keyword and API matching and emits JSON. Scans of ~1,200 packages show many packages with zero hits but hundreds with hits and a high false positive rate, so human review and a growing evidence database are still required; tool is queued for open sourcing pending export clearance.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 1:12Disclaimer
- 1:35Open Source
- 2:47Busybox
- 3:50Export Compliance
- 5:25Export Clearance Workflow
- 9:29The Chasm
- 11:31Plan A
- 12:23Plan B
- 13:04Plan C
- 14:03Tooling
- 16:08Crypto Detector Demo
- 20:18The Silo Effect
- 21:44TeeD
- 22:04Faceology
- 22:38API Matching
- 23:00Output File
- 23:30Demo
- 27:40Analysis
- 29:35Delivery
- 29:51Executive Summary
- 30:19Report
- 34:18Summary
- 35:37Encryption Evidence
- 36:10Export Trade Groups
- 36:29New Methods
- 37:35Multiple Methods
- 38:27Database
- 40:13SPDX
- 41:49The Real Problem
related talks
26mThe FOSSology Project – Open Source Software for Open Source License Compliance
26mThe FOSSology Project – Open Source Software for Open Source License Compliance
24mLicense compliance with AI assisted coding
28mFOSS and Security Risk Management
18mThe Current State of Open Source Security Compliance Tooling Is … Well, Sad.
36mSecurity compliance: A global perspective
18mExploration of Compliance Governance Based on Operating Systems
45mRegulated and Sovereign : Impact to the Open Source Developer