Building the Digital Commons for Software Supply Chain

on YouTube ↗36m

" summary

Argues for treating critical open source infrastructure as shared highways, proposing actionable building blocks: SPDX, OpenChain, OpenSSF for metadata and tooling, SBOMs and package URLs (purl) for consistent component IDs, and open datasets like ScanCode and ClearlyDefined to stop duplicate scanning. Gives concrete numbers: npm publishes ~50 packages/hour, delta scanning can cut cloud costs ~60–80%, and computable coordinates (purls) let independent parties match components reliably. Shows emerging bundles (octet) and gaps in C/C++ package metadata.

AI-written summary · about

" chapters (9)

1. 0:00Supply chain security challenges
2. 3:10Supply chain management pentagon
3. 8:44Ecosystem solutions for challenges
4. 13:37Open data foundation
5. 18:10Engineering standards importance
6. 22:26Need for open data
7. 26:38Collaborating on processes
8. 29:51Voting with wallet
9. 30:14Q&A: Digital commons

" related talks

• 39mComplex Made SimpleShane Coughlan, Lucien Cheng-hsia Lin · Linaro Connect Hong Kong 2018
• 09mSecuring the Software Supply Chain with Open SourceDan Lorenc · Cloud Native Security Conference North America 2021
• 44mNavigating Open Source and Open Standards for Better CybersecurityArnaud J Le Hors, Jeffrey Borek · OpenGovCon @ Open Source Summit North America 2023
• 16mOpen Source Consumption/ Adoption ManifestoBiju K Nair · IndiaFOSS 3.0
• 39mSOS: Sustainable Open SourceFloor Drees · Conf42 DevSecOps 2022
• 38mLowering the Cost of Open Source by Increasing TransparencyJulia Ferraioli · OSPOCon @ Open Source Summit Europe 2022
• 36mFreedom vs Sustainable Business: A Candid Necessary DebateThomas Steenbergen, Fiona Krakenbürger, Paloma Andrade de Oliveira, Lina Böcker · FOSS Backstage 2024
• 32mOpen Source Contributions in Today’s WorldLina Böcker, Angelika Wittek · FOSS Backstage 2024