Complex Made Simple
summary
Argues that open source is the computing fabric and governance must focus on supply-chain processes: typical device supply chains have 9–27 hops, over 70% of Linux commits come from corporate projects, and every one of the test purchases run by compliance teams found problems (100%). Presents OpenChain as an ISO‑9000 style checklist for inbound/internal/outbound processes and lists practical tooling—SPDX, ScanCode, Fossology, ClearlyDefined, SW360, Quartermaster—with ~8–9 major projects enabling automated end‑to‑end governance.
AI-written summary · about
chapters (11)
- 0:00Introduction and welcome
- 1:01Open source as a shared fabric
- 3:11Early governance challenges
- 5:18Patrick McCarty case and copyright trolling
- 9:13Interdependence and shared norms
- 12:06Open Chain project overview
- 17:48Supply chain problems and solutions
- 20:16Future of open source governance
- 23:31Progress and optimism in compliance
- 24:54Asia update on license compliance
- 36:31China's role in open source governance
related talks
38mPanel: Open Source Management Based on Open Source
42mOpen Source Compliance Management - Removing the Thorn from...
16mOpen Source Consumption/ Adoption Manifesto
36mBuilding the Digital Commons for Software Supply Chain
31mOperationalizing Open Source Projects: When the Rubber Meets the Road
29mTrusted Supply Chains - How OpenChain Makes a Difference in a...
09mSecuring the Software Supply Chain with Open Source
44mNavigating Open Source and Open Standards for Better Cybersecurity