Open Source Summit North America 2024

Back to all conferences

Table of Contents

• AI & ML (17 videos)
• Accessibility (1 videos)
• Architecture (2 videos)
• Blockchain (1 videos)
• Chaos Engineering (1 videos)
• Climate (1 videos)
• Compute (20 videos)
• Conversational AI (1 videos)
• Databases (3 videos)
• Dependency Management (1 videos)
• Developer Experience (74 videos)
• Education (1 videos)
• Energy (1 videos)
• Funding (2 videos)
• GitOps (2 videos)
• Governance (1 videos)
• HPC (1 videos)
• Keynote (7 videos)
• Memory Management (1 videos)
• Networking (4 videos)
• Observability (9 videos)
• Open Source (1 videos)
• Operations (1 videos)
• Performance Engineering (1 videos)
• Reliability, Availability and Serviceability (RAS) (1 videos)
• Responsible AI (1 videos)
• Scaling (1 videos)
• Security (50 videos)
• Serverless (9 videos)
• Software Engineering (1 videos)
• Supply Chain (1 videos)
• Sustainability (3 videos)
• Trademark (1 videos)

AI & ML

Keynote: AI + Open Source: A Philosophy of Changing Expectations - Timothy Jordan This talk explores the challenges and opportunities of open-source AI, highlighting the complexity of balancing open access, innovation, and responsible development. The speaker emphasizes the need for collaboration among the open-source community, policymakers, and security experts to ensure the safe and responsible advancement of AI technology. back to top

Embeddings and Transformers and Tokens, Oh My! - Barron Stone, Defense Unicorns This talk provides a comprehensive overview of the history and development of large language models, including the concepts of tokens, embeddings, and transformers. The speaker also discusses the training and fine-tuning of these models, as well as open-source tools and projects for experimenting with and deploying these technologies. back to top

The Open Source AI Dilemma: Crafting a Clear Definition for Open Source AI- Ofer Hermoni & Mer Joyce The presentation discusses the challenges of defining open-source AI and the efforts by the Linux Foundation AI and the Open Source Initiative to create a clear and globally representative definition. The key focus is on the process of gathering input from diverse stakeholders, including technical experts and ethicists, to determine the required components for an AI system to be considered open-source. back to top

HW, SW, Performance and Costs for Llama-2 70b and Mixtral 8x7b LLM Inference with Low...- Ivan Baldo The presentation discusses the challenges and learnings involved in benchmarking and deploying large language models, such as Llama-2 70B and Mixtral 8x7B, for low-concurrency inference workloads. It highlights the importance of considering hardware requirements, software tools, and cost optimization to effectively run these models in on-premises or cloud environments. back to top

Keeping AI Open: Legal Obstacles in Open-Source AI Code - David Kocan, Nixon Peabody LLP The talk discusses the legal challenges in keeping AI open-source, particularly around copyright, patents, and trade secrets. It highlights the difficulties in protecting AI-generated code and outputs under current copyright and patent laws, and the potential need for new legal frameworks to address the unique aspects of open-source AI development. back to top

Sponsored Session: Beyond the Buzz: Navigating AI's Myths and Realities - Ezequiel Lanza, Intel This talk explores the myths and realities surrounding AI, addressing common misconceptions such as the belief that AI can solve any problem, that it is solely about large language models, and that it will replace all jobs. The speaker emphasizes the importance of understanding the nuances of AI, its capabilities and limitations, and the need for open-source initiatives to drive innovation and accessibility. back to top

Keynote: Bringing Open Source Authenticity to Artificial Intelligence - Cara Delia The talk explores the relationship between open source and artificial intelligence, highlighting the importance of authenticity in both the inputs and outputs of AI systems. It emphasizes the need for open source communities to collaborate and innovate in addressing the challenges and uncertainties surrounding the development and deployment of AI technologies. back to top

The Model Openness Framework: Promoting Completeness and Openness for Reproducibil... - Matt White The talk presents the Model Openness Framework (MOF), a collaborative effort to promote transparency, reproducibility, and openness in the development and sharing of AI models. The framework defines three classes of model openness based on the completeness and licensing of the various model components, aiming to incentivize model producers to release more open and permissively licensed models. back to top

Get to Know PyTorch - A Cutting Edge Open Source AI Framework for Deep Learning - Sahdev Zala, IBM The talk provides an overview of the PyTorch deep learning framework, covering its key concepts, capabilities, and the open-source development ecosystem. The speaker also highlights the framework's support for distributed training, model optimization, and integration with other open-source projects, emphasizing PyTorch's role as a leading deep learning platform. back to top

Creating Versatile AI Agents Through Wasm+Rust - Miley Fu, WasmEdge This talk explores the use of WebAssembly (Wasm) and Rust to create versatile AI agents. The speaker showcases the benefits of Wasm and Rust for building portable, high-performance, and secure AI applications, including large language models, that can be easily deployed across various hardware and software environments. back to top

Keynote: From Open Source OS to Open Source AI: Challenges and Requirements - Dr. Hakim Hacid The speaker discusses the rapid adoption of generative AI and the challenges of open-source AI compared to open-source software. He highlights the need for greater coordination, standardization, and community-building in the open-source AI ecosystem to address issues like data, compute, and intellectual property. back to top

Keynote: OLMo: A Truly Open Language Model - Hanna Hajishirzi This talk presents OLMo, a truly open language model that aims to empower the broader research community by making every step of the process - from data curation to model training and adaptation - open and reproducible. The speaker highlights the project's key components, including the release of high-quality training data, detailed model training and adaptation processes, and comprehensive evaluation frameworks, all of which are designed to drive collaborative progress in language modeling. back to top

Keynote: The Future of AI - Lisa Seacat DeLuca, Senior Director Product The speaker, Lisa Seacat DeLuca, shares her journey in the world of AI and technology, from her early experiences at open-source conferences to her involvement in IBM's cognitive incubation lab and IoT division. She discusses the potential of emerging technologies like blockchain, web3, and artificial general intelligence, highlighting the importance of focusing on the human experience and using technology to enhance our lives. back to top

Empower WebAssembly ML Over Diverse AI Hardware Accelerators Outside the Browser - Tiejun Chen The speaker proposes a solution to empower WebAssembly for machine learning on diverse AI hardware accelerators outside the browser. The key aspects of the solution include leveraging a graph compiler to optimize the deployment of machine learning models on various hardware, and providing a runtime interposition layer to transparently integrate the graph compiler with existing machine learning frameworks. back to top

How We Built DBRX - An Open High-quality LLM - Denny Lee & Ankit Mathur, Databricks Databricks has developed an open-source, high-quality large language model called DBRX, which outperforms many existing models in various benchmarks. The model was built using a mixture of experts architecture and leverages Databricks' open-source tools and platforms, making it a compelling option for enterprises looking to deploy high-performance language models in their applications. back to top

Unraveling Multimodality with Large Language Models - Alex Coqueiro, AWS The presentation explores the advancements in large language models and their application in multimodal intelligence, where text, images, and other modalities are seamlessly integrated to create powerful AI-driven solutions. The speaker showcases real-world examples from healthcare and retail, highlighting the benefits of combining foundation models, multimodal approaches, and orchestration frameworks like Langchain to build scalable and intelligent applications. back to top

Lightning Talk: Open Source GenAI: A Community-Powered Future - Ofer Hermoni, LF AI & Data The presentation highlights the activities of the Linux Foundation AI & Data, focusing on the Generative AI Commons initiative. It emphasizes the organization's efforts to foster a community-driven approach to open-source generative AI, including initiatives such as the Model Openness Framework, educational programs, and collaboration with the open-source community. back to top

Accessibility

Modernizing Accessibility for Desktop Linux - Matt Campbell, GNOME Foundation The presenter discusses a project called Newton, which aims to modernize accessibility for desktop Linux by designing a new Wayland-native accessibility architecture. The proposed architecture uses a push model for interprocess communication, which aims to address the latency and performance issues of the current ATPI protocol used in GNOME and other free desktop environments. back to top

Architecture

The Application of Agile and DevSecOps to Space Systems - Robin Yeman This talk explores the challenges of applying agile and DevSecOps principles to large-scale, safety-critical cyber-physical systems, such as space systems. The speaker proposes strategies to extend these practices, including the use of digital twins, modular architectures, and a common language to bridge the gap between software and hardware development. back to top

Better Outcomes Through Wide Review - Daniel Appelquist, Samsung Daniel Appelquist discusses the importance of wide review in the development of technical standards, emphasizing the need for openness, transparency, and inclusivity to build a better future. He highlights the W3C's approach to wide review, including accessibility, internationalization, privacy, and security considerations, and the role of the Technical Architecture Group in facilitating this process. back to top

Blockchain

Keynote: Open Source and DLT 2.0 - Andrew Aitken, Hedera & Dr. Leemon Baird, Hedera The keynote discusses the practical and functional use cases of Distributed Ledger Technology (DLT) 2.0, highlighting how it enables trust, transparency, and new capabilities that cannot be achieved with traditional databases. The speakers showcase real-world examples, such as supply chain tracking, document signing, democratizing finance, and AI data provenance, demonstrating the tangible benefits of DLT beyond the hype. back to top

Chaos Engineering

Practicing Cloud-Native Resliency Is a Challenge: Decoding It with Chaos... - Prithvi Raj This talk explores the challenges of practicing cloud-native resiliency and decodes the principles of chaos engineering. The speaker introduces the open-source project Litmus Chaos, which provides a platform for running chaos experiments to improve system reliability and resiliency. back to top

Climate

WITNESS: A "What if?" Tool for Exploring Policy Options and Climate Change - Michael Tiemann The presentation discusses the Witness integrated assessment model, an open-source tool for exploring policy options and climate change. It highlights the importance of open data, open source, and open science in informing policy decisions and the need for a collaborative, transparent approach to economic modeling and decision-making. back to top

Compute

HARDWARE in SPACE! The Kernel at the Edge of the Universe - Sen Hastings, Gadfly AI & Sal Kimmich This talk provides a historical overview of the development of computers and software for space exploration, highlighting the challenges faced in designing reliable and fault-tolerant systems for the harsh environment of space. The speaker also discusses the use of commercial off-the-shelf (COTS) components and Linux in recent space missions, such as the Ingenuity helicopter on Mars, and the importance of considering long-term maintenance and accessibility when developing open-source software for space applications. back to top

Refining Data Structure Implementations in the Linux Kernel for Improve..- Jim Huang & Kuan-Wei Chiu This talk presents optimizations to data structures and algorithms in the Linux kernel, focusing on reducing the number of comparisons and swaps in the Min Heap and Heap Sort implementations. The speaker also highlights the need for more comprehensive testing of the kernel's library code to ensure performance and reliability across a wide range of usage scenarios. back to top

Building Serverless AI Workflows with Wasm+Rust - Miley Fu, WasmEdge This talk explores the challenges of building AI workflows, particularly with large language models, and proposes the use of WebAssembly (Wasm) and Rust as a solution. The speaker demonstrates how Wasm and Rust can provide a lightweight, portable, and secure runtime for AI applications, addressing issues like performance, cost, and cross-platform compatibility. back to top

Open Source Cloud Costs: A Deep Dive Into OpenCost's Impact on Enterprise...- Matt Ray & Don O'Neill This talk provides an overview of OpenCost, an open-source project that helps enterprises monitor and manage the costs associated with their Kubernetes and cloud infrastructure. The speakers discuss how OpenCost can help organizations track and allocate costs across different teams, services, and cloud providers, as well as its integration with tools like Prometheus and Grafana. back to top

Sponsored Session: You Don’t Know Jack (and Kashan): Lessons from... - Jack Aboutboul & Khrum Kashan This talk discusses Microsoft's journey with Linux, from its initial reluctance to embrace open source to its current position as a major contributor and supporter of Linux in the Azure cloud. The speakers highlight the challenges and lessons learned from running Linux at hyperscale, including the collaborative efforts with Linux distributions, package management, and end-of-life transitions, as well as the company's investment in quality assurance and a self-service validation portal for the Linux community. back to top

[x86] Linux Kernel Interrupt Delivery Configuration: How the Linux Kernel Interacts...- Adrian Huang This presentation provides a detailed overview of how the Linux kernel interacts with the underlying hardware for interrupt delivery configuration. It covers the interrupt descriptor table (IDT) configuration, the differences between pin-based and MSI interrupt delivery approaches, and the process of finding the best CPU and vector number for upcoming interrupts. back to top

Adding Arm RME/CCA Support in Confidential Containers - Kevin Zhao, Linaro This talk discusses the integration of Arm's Confidential Computing Architecture (CCA) support in Confidential Containers, specifically the Kata Containers project. The speaker covers the key components of CCA, the integration with Kata Containers, and the development of a token verification library (S-token Crate) to enable local and remote attestation for CCA-based confidential containers. back to top

Sharing Reset GPIOs in the Linux Kernel - Krzysztof Kozlowski, Linaro The talk discusses the problem of sharing reset GPIOs in the Linux kernel and proposes solutions using the reset controller framework and GPIO aggregator. It highlights the limitations of the current approaches and the need for better handling of shared reset GPIOs, reset pulses, and GPIO enable counting. back to top

Investigating Checkpoint and Restore for GPU-Accelerated Containers - Nan Lu & Adrian Reber This talk discusses the current state of checkpoint and restore capabilities for GPU-accelerated containers, highlighting the advantages of this technology for AI/ML workloads, HPC applications, and efficient GPU resource utilization. The presenters provide a technical overview of the CRIU (Checkpoint/Restore In Userspace) tool and its integration with Kubernetes, demonstrating live container migration between hosts with GPU support. back to top

Optimizing Scheduler for Linux Gaming - Changwoo Min, Igalia This talk discusses optimizing the Linux scheduler for gaming workloads. The speaker presents a new scheduling algorithm, Latency Criticality Aware Virtual Deadline (LAVD), which leverages task communication patterns and execution characteristics to prioritize latency-critical tasks and improve the gaming experience. back to top

How Our Mainframe-Focused Working Group Solved Our Linux Distribution Maintaine...- Elizabeth Joseph The speaker discusses how a working group was formed to address the isolation felt by Linux distribution maintainers for the s390x architecture, which is used in mainframe computers. The group collaborates to share resources, troubleshoot issues, and ensure continued support for this specialized hardware platform within the broader Linux ecosystem. back to top

Power Measurement and Attribution for Processes and Hardware Devices in the Linux...- Aditya Manglik The speaker presents a framework to accurately measure the energy consumption of processes and hardware devices in the Linux kernel, addressing the limitations of existing power measurement tools. The proposed solution involves developing accurate power models and reliable tools to calculate energy consumption, with the goal of improving energy efficiency and enabling actionable insights for programmers. back to top

The Kernel Report - Jonathan Corbet, LWN.net The speaker discusses the recent developments in the Linux kernel, including the increase in the number of kernel releases, the growing complexity of the kernel, the challenges faced by kernel maintainers, and the introduction of new features such as Rust support and confidential computing. The talk provides insights into the health and future direction of the Linux kernel development. back to top

Reinventing Container Linux for the Wasm Era (and More) with System Extensions - Andrew Randall The speaker discusses the concept of system extensions, a new approach to building Linux distributions that combines the flexibility of general-purpose Linux with the security and manageability benefits of container-optimized Linux. He showcases how system extensions have been used in the Flatcar Container Linux project to improve container runtime management, platform-specific tooling, and Kubernetes cluster provisioning. back to top

Building Resilient Services on Kubernetes - Todd Ekenstam, Intuit The talk discusses building resilient services on Kubernetes, covering client resiliency patterns, the Kubernetes pod lifecycle, readiness gates, pod termination considerations, and pod disruption budgets. The speaker shares insights from running critical systems on Kubernetes at scale over the past 5 years at Intuit. back to top

Translation Augmented Generation - Breaking Language Barriers in RAG... - Raghavan Muthuregunathan The talk explores the language barriers faced by large language models, which are predominantly trained on English data. The speaker proposes a 'translation augmented generation' approach as a potential solution to improve the performance of these models in non-English languages. back to top

Expanding the Memory Limits with CXL Software Stack - Vandana Salve, Micron The presentation discusses how the CXL (Compute Express Link) software stack can be leveraged to expand the memory limits on Linux systems. It covers the different CXL protocols, device types, and how CXL enables memory capacity and bandwidth expansion through techniques like memory tiering and interleaving, utilizing the existing Numa (Non-Uniform Memory Access) architecture in the Linux kernel. back to top

Toolchains for the Future - Victor Rodriguez, Intel The talk covers the latest changes and improvements in the GCC toolchain, including static analysis for security vulnerabilities, support for new hardware instructions, and the introduction of the Semic service for testing upcoming hardware platforms. The speaker highlights the collaboration within the open-source community and the importance of developer feedback to enhance the toolchain capabilities. back to top

Linux Foundation Research Turns Four - Hilary Carter & Anna Hermansen, LF Research The Linux Foundation Research team discusses their mission to measure trends in open source and provide empirical data on the impact of open source collaboration. They highlight their research projects, community engagement, and plans for 2024, including studies on topics like the impact of generative AI on the tech talent market and the economic benefits of open standards. back to top

Accelerate Together: How to Drive Acceleration with Industry Alliances - Alison Richards, Intel The video discusses how the Khronos Group and the SYCL Foundation are collaborating to drive open standards and open-source projects for accelerated computing. The presentation highlights the challenges of building a multi-vendor, multi-architecture ecosystem and the strategies the SYCL Foundation is employing to address these challenges, such as balancing open-source innovation with standardization and forging strategic alliances with other organizations. back to top

Conversational AI

Conversational Assistants that Converse with Each Other - Deborah Dahl, Conversational Technologies The video discusses the Open Voice Interoperability Initiative, which aims to develop standards that allow independent conversational assistants to communicate with each other, similar to how web pages and websites communicate using standards like HTML and HTTP. The initiative's goal is to reduce friction for users by enabling them to seamlessly transition between different assistants to get the information they need, and to enable enterprises to integrate their legacy assistants more efficiently. back to top

Databases

Keynote: Open Source Databases and the Future of GenAI - Sirish Chandrasekaran The speaker discusses Amazon's investment in open-source databases, including making them easier to operate in the cloud and directly contributing to open-source projects. He highlights Amazon's significant contributions to databases like PostgreSQL, Redis, and Apache Kafka, and invites further collaboration with the open-source community. back to top

Milvus: Scaling Vector Data Solutions with Gen AI - Yujian Tang, Zilliz This talk covers the fundamentals of vector databases, their use cases in AI and beyond, and the architecture of Milvus, a distributed vector database solution. The speaker provides interactive exercises to demonstrate the concept of vector similarity and highlights Milvus's capabilities in handling large-scale vector data and ensuring data consistency. back to top

Digging into Valkey - Madelyn Olson & Kyle Davis, Valkey The talk provides an overview of the history and future plans of Valky, an open-source project that emerged as a community-driven alternative to Redis after Redis changed its licensing. The speakers discuss Valky's focus on performance, memory density, improved cluster management, and richer extensibility, while emphasizing the project's commitment to maintaining compatibility and community governance. back to top

Dependency Management

Dependency Management: The Cause of—and Solution to—All Supply...- Josie Anugerah & Eve Martin-Jones This talk discusses the challenges of dependency management in open-source software, exploring the complexities of dependency resolution, the impact of changing dependency graphs, and the difficulties in remediating vulnerabilities. The presenters provide an overview of various tools and strategies to help manage dependencies at scale, emphasizing the need for automated and scalable solutions to address the growing complexity of software supply chains. back to top

Developer Experience

KernelCI - How Can It Impact Your Future? - Paweł Wieczorek, Collabora The talk provides an overview of the KernelCI project, its evolution, and the goals of the new system design. The focus is on engaging the community, improving test quality, and providing reliable test results and relevant reports to kernel developers and maintainers. back to top

Keynote: Welcome & Opening Remarks - Jim Zemlin, The Linux Foundation with Special Guests The Linux Foundation announced several new initiatives, including the Open Wallet Foundation, the Linux Foundation Security portal, and the Linux Foundation Research program. These initiatives aim to enhance project discovery, provide data-driven insights, and increase community engagement for the open source ecosystem. back to top

A Year of Servo Reboot: Where Are We Now? - Rakhi Sharma, Igalia Servo, a web rendering engine written in Rust, was restarted in 2023 by the open-source consultancy Igalia. The talk covers Servo's journey, the decision to focus on the new layout engine, the work on embedding Servo in other projects, and the future roadmap for adding support for Android, improving the embedding API, and continuing to enhance Servo's CSS and layout capabilities. back to top

How Hard Is It to Test the GPU Driver? - David Heidelberg The talk discusses the challenges and strategies involved in testing GPU drivers, particularly in the context of the Mesa 3D graphics library. The speaker covers the testing pipeline, the tools and techniques used, and the importance of building a robust and scalable CI system to ensure the quality of GPU-accelerated software. back to top

Quickly Test Your Kernel with GitLab CI - Helen Koike, Collabora This talk presents a workflow using GitLab CI to quickly test the Linux kernel, addressing the limitations of the traditional kernel testing process. The speaker discusses the implementation of two solutions, DMCI and KCI GitLab, and proposes future enhancements to make the testing process more efficient and collaborative across different kernel subsystems. back to top

Mind the Gap Between the Future and the Present - Taylor Thomas, Cosmonic The talk discusses the integration of WebAssembly (Wasm) with Kubernetes, highlighting the benefits of Wasm over containers, the component model, and the challenges of extending Kubernetes to support Wasm-based workloads. The speaker proposes a 'wrapped' vs 'alongside' approach, demonstrating the latter with the Wasm Cloud platform, which allows for more flexibility and distribution of Wasm-based applications across multiple Kubernetes clusters. back to top

Sponsored Session: Bridging Open Source Developer Platforms: Backstage Meets Coder - Tim Quinlan This talk discusses the integration of two open-source developer platforms, Backstage and Coder, to provide a comprehensive solution for cloud-based development environments. The speaker highlights how Coder's features, such as self-service provisioning, consistent development environments, and support for developer tools, complement Backstage's capabilities in service cataloging, project scaffolding, and developer productivity. back to top

Picking a Winner: How to Pick the Right Dependency (Resolution...- Eve Martin-Jones & Josie Anugerah This talk explores the complexities of dependency resolution in open-source package management, highlighting the challenges in managing the multitude of valid dependency graphs that can arise from a single set of requirements. The presenters discuss the implications for open-source security standards like SBOM and provide recommendations for effective dependency management practices. back to top

Begin an Automation Journey on Software Delivery to Increase..- Valentina Sosa & Christophe Fargette This talk explores how the open-source platform Backstage can help developers overcome the challenges of modern software development and increase their productivity. The presenters demonstrate how Backstage's features, such as a centralized software catalog, plugins, software templates, and search capabilities, can streamline the developer experience and enable platform engineering to solve the problem of cognitive overload. back to top

Quantitative Method for Open Source Contribution Value and Its Imp...- Kazumi Sato & Masayuki Kuwata This presentation discusses a quantitative method for assessing the value of open-source contributions and its impact on Sony's business strategy. The presenters share their approach to convincing executives and engineers about the importance of open-source participation through data-driven analysis and tailored communication. back to top

Evolving Trends & Lessons Learned in Open Source Adoption Across Organizations - Javier Perez This presentation provides an overview of the evolving trends and lessons learned in open source adoption across organizations, based on a comprehensive survey conducted annually. The survey covers various aspects of open source usage, including the growth in adoption, the primary drivers, the most critical open source software, the challenges faced, and the level of maturity in open source practices within organizations. back to top

OpenWallet Foundation: Accelerating Wallet Development Through Open Source - Brian Behlendorf The video discusses the Open Wallet Foundation, a Linux Foundation project focused on accelerating the development of interoperable digital wallets through open-source collaboration. The project aims to create a unified stack of code components that can be adopted and customized by various organizations, governments, and service providers to deliver consumer-facing wallet applications. back to top

Panel Discussion: Bring Your Product Mana...- Nithya Ruff, Mary Wang, John Walker, Nikhita Raghunath The panel discussion explores the importance of involving product managers and business leaders in open source initiatives within organizations. The panelists discuss strategies for engaging the business side, balancing the benefits of contributing to open source with protecting proprietary interests, and various investment avenues to support and sustain open source projects. back to top

What Makes a Good, or Bad, Open Source Experience?! - Ildiko Vancsa & Philip Robb This talk explores the complexities and challenges of the open source ecosystem, highlighting the importance of understanding open source as more than just a licensing model, but as a collaborative community. The speakers discuss the rise of single-vendor projects, license changes, and the need for better education and communication around open source to foster trust and sustainability within the ecosystem. back to top

The State of CDF - Dadisi Sanyika, CDF Governing Board Chair, Apple In this video, Dadisi Sanyika, the CDF Governing Board Chair from Apple, provides an overview of the Continuous Delivery Foundation (CDF), highlighting its mission, projects, and upcoming initiatives. He emphasizes the importance of delivering software securely and efficiently, as well as the CDF's efforts to foster a diverse and engaged community through programs like the Ambassador initiative. back to top

The GitHub Graph: Characterizing Open-Source Collaboration Patterns - Emilie Ma This talk presents a novel graph-based perspective, called the GitHub PR-Issue Graph, for understanding open-source collaboration patterns. The speaker discusses various workflow types identified through the analysis of over 50 large open-source projects, highlighting hidden insights and implications for project management and code review practices. back to top

Adopting CDEvents and Embracing Interoperability - Andrea Frittoli, IBM The talk discusses the challenges of software factory interoperability and how the CDEvents project aims to address them by providing a common specification for continuous delivery events. The speaker highlights the benefits of CDEvents, such as reduced integration complexity, improved developer experience, and enhanced supply chain security through better data collection and analysis. back to top

Bringing CI/CD Practices to Machine Learning with MLOps - Robert Hafner, Comcast This talk discusses how to apply CI/CD practices to machine learning with MLOps. The speaker covers key aspects of the model development cycle, including data preparation, model training, model serving, and observability, and how to incorporate DevOps principles to make these processes more efficient and reliable. back to top

Continuous Delivery Design Patterns - Garima Bajpai, Canada Devops Community of Practice The talk explores the evolution of continuous delivery design patterns, highlighting the business value, the need for continuous innovation, and the challenges of managing these patterns in an open-source environment. The speaker discusses the importance of standardization, the paradox of choice, and the emerging trends in software delivery, emphasizing the need for a holistic approach to address the growing complexity and data-intensive nature of software applications. back to top

Top 3 Deployment Patterns - From Experience! - Alix Klingenberg & Ships Mahindra, Octopus Deploy This talk explores three deployment patterns from the perspective of a SaaS, retail, and finance industry, highlighting the importance of aligning deployment strategies with business goals, solving immediate problems, and ensuring repeatability and maintainability of the deployment process. The speakers share insights gained from their experiences working with over 3,000 customers at Octopus Deploy, providing practical guidance for attendees to develop effective deployment strategies for their own organizations. back to top

Lightning Talk: Standardizing Errors: A Practical Guide with Dapr - Cassie Coyle, Diagrid This talk provides a practical guide to standardizing errors in the Dapr distributed application runtime. It covers the importance of error standardization, the Richer Error Model, the Dapr errors package, and the current state of error standardization efforts in the Dapr project. back to top

EROFS: Past, Present, and Future - Xiang Gao & Tianyi Tang, Alibaba Cloud This talk provides an overview of the EROFS (Enhanced Read-Only File System) and its use cases, including container image management and virtualization. The speakers discuss EROFS's features, performance characteristics, and ongoing development roadmap, highlighting its benefits in terms of security, simplicity, and flexibility. back to top

Panel Discussion: How to Chart Your Own... - Ildiko Vancsa, Dawn Foster, Nithya Ruff, Allison Randal This panel discussion explores the challenges and strategies of navigating an open source career, including balancing work-life dynamics, managing multiple hats, and promoting diversity and inclusion. The panelists share their personal journeys and provide insights on how to effectively advocate for open source contributions within corporate environments. back to top

Sponsored Session: Gitosaurs and Merga-a-dactyls: Starting your Cloud Native Journey - Jorge Castro The speaker discusses the evolution of open source contributions, highlighting the need for long-term thinking and adaptability as the ecosystem grows in complexity. He emphasizes the importance of maintainers, contributors, and organizations working together to ensure the sustainability and health of the open source community. back to top

Who Broke the Build? — Using Kuttl to Improve E2E Testing and Release Faster - Ram Mohan Rao Chukka This talk discusses the use of Kuttl, an open-source tool, to improve end-to-end testing and enable faster releases. The speaker demonstrates how Kuttl can be integrated into a local development environment to run end-to-end tests, reducing the time and effort required to identify and fix issues compared to running these tests in a remote CI/CD environment. back to top

Tutorial: Debugging with Strace - A Peek Behind the Scenes of Linux Processes - Avikam Rozenfeld This tutorial provides an in-depth exploration of the strace tool, which allows users to trace system calls and signals of Linux processes. The presenter covers the basics of system calls, file descriptors, and process management, and then demonstrates how to use strace to diagnose and debug various real-world issues. back to top

The Public Vs Private Sector WAR for Software Talent - Drew Belk & Duong Hang The public and private sectors engage in a lively debate, using memes and humor, to attract top software talent. The discussion covers the pros and cons of working in each sector, highlighting the challenges and opportunities in terms of influence, growth, and compensation. back to top

Software Factory: Beyond Slogan to Maturity - Alan Hohn, Lockheed Martin The presentation discusses the journey of Lockheed Martin in establishing a software factory and the maturity model they have developed to measure and drive improvements in their software development practices. The speaker highlights the importance of metrics, behaviors, and a reference architecture adoption model in achieving software development maturity beyond just tool adoption. back to top

Open Source Success: Learnings from 1 Billion Downloads - Avi Press, Scarf This talk discusses insights gained from analyzing over 1 billion software downloads on the Scarf platform, including trends in open source usage, the disconnect between total downloads and unique users, and the importance of responsible data collection to support open source sustainability. The speaker emphasizes the need for more transparent and actionable usage metrics to help open source maintainers and businesses better understand their user base and make informed decisions. back to top

Sponsored Panel Session: Friends...- Allen Smith, Jeremiah Bascue, Janae Cram, Blake Watt, Jen Wolke This panel discussion explores the relationship between businesses that rely on open-source projects and the communities that sustain them. The panelists, representing various roles within the Umbraco open-source community, discuss the importance of setting boundaries, managing technical debt, and fostering trust, appreciation, and commitment between the community and businesses that utilize the project. back to top

Panel Discussion: Recruiting Overloo... - Tyler Menezes, Kendrick Hang, Kevin Wang, Marianne Goldin This panel discussion explores how community colleges can help recruit and support overlooked open source contributors. The panelists share insights on the challenges and benefits of mentoring students to make meaningful contributions to open source projects, highlighting the value of providing guidance and creating a welcoming environment for non-traditional learners. back to top

Panel Discussion: Navigating the Surge... - Samson Goddy, Oluebube Princess Egbuna, Edidiong Asikpo The panel discussion covers the history, current state, and future of open source in Africa, highlighting the challenges and opportunities in the region. The speakers discuss the growth of open source contributions, the role of communities like Open Source Community Africa (OSCA), and the need for tailored solutions and collaborations to address the unique obstacles faced by African developers. back to top

OSPOs in Academia: Increasing the Impact of Educational Ins... - Stephanie Lieggi & Sayeed Choudhury This talk explores the role of Open Source Program Offices (OSPOs) in academia, highlighting the unique challenges and opportunities they face compared to industry OSPOs. The speakers discuss how OSPOs can help bridge the gap between student research and open source projects, promote open science and open source within universities, and foster collaboration across different academic institutions. back to top

Fannie Mae OSPO Journey - Brittany Istenes, Fannie Mae Fannie Mae's journey in transforming open source culture in a highly regulated industry. The presentation highlights the challenges and successes of Fannie Mae's Open Source Program Office, including initiatives around inner source, community and culture, compliance and governance, and future open source contributions. back to top

Onboarding Doesn’t Have to Suck: Elevating Developer Onbo...- Ana Margarita Medina & Adriana Villela The talk discusses the challenges of developer onboarding and how platform engineering can help streamline the process. It presents two sample workflows for self-contained and local install environments, along with tips and resources for enhancing the developer onboarding experience. back to top

Do We Need Yet Another CD Tool? - Ram Iyengar, Cloud Foundry Foundation The speaker, Ram Iyengar from the Cloud Foundry Foundation, questions the need for the proliferation of continuous delivery (CD) tools in the industry. He shares his personal journey of exploring various CD tools, highlighting the challenges of keeping up with the growing ecosystem and the need for the community to reflect on whether these tools truly serve distinct use cases. back to top

Lessons Learned from Building a Deployment Process for 100+ Devs at a Large Bank - Bob Walker This talk shares lessons learned from building a deployment process for over 150 developers at a large bank. The speaker discusses the challenges of automating a flawed process, the importance of focusing on business rules and consistent processes across environments, and the need for transparency and collaboration in managing deployment workflows. back to top

Unleashing Developer Productivity: Supercharging Zero Day Cloud-Native Developer... - Muktesh Mishra This talk explores how to unleash developer productivity by focusing on creating a superior developer experience. The speaker discusses strategies to identify developer personas, reduce cognitive load, and leverage custom IDE plugins to streamline workflows and provide timely feedback, ultimately leading to improved developer happiness and productivity. back to top

Navigating Paved Paths with an Innersource CI/CD Capability Map - David Kuster, Comcast This talk explores the use of capability maps to navigate and manage the complex landscape of CI/CD practices within an organization. The speaker discusses how these maps can be made actionable, visualized, and leveraged to drive standardization, maturity, and automation, ultimately harnessing the power of inner source to streamline the rollout of new capabilities. back to top

Happy Pipelines... No Need for Lifelines. J.P. Morgan: Our Sleek Approach to Adopt... - Jaime OByrne The presentation outlines how JP Morgan Chase successfully adopted Spinnaker, a cloud-native continuous delivery platform, to manage their large-scale deployment needs. The key strategies discussed include leveraging internal blueprints, conducting market research, and implementing a self-service pipeline template marketplace to drive user adoption and overcome challenges with Spinnaker's extensibility and mutable infrastructure. back to top

How Should Your OSPO Work with InnerSource? - Russell Rutledge, & Ana Jiménez Santamaría The talk discusses the relationship between open-source and inner-source practices, highlighting the similarities and differences in the goals, processes, and tooling used by open-source program offices (OSPOs) and inner-source program offices (ISOPs). The presenters emphasize the importance of aligning the OSPO and ISOP efforts with the organization's overall goals and strategies to ensure the successful adoption and implementation of these practices. back to top

Developer Experience Is Central to DevOps Success - Jeremy Meiss, DevEx Startup The talk explores how developer experience (DevX) is central to the success of DevOps practices, highlighting the evolution of integrated development environments (IDEs) and the impact of DevX on streamlining software development and deployment processes. The speaker emphasizes the importance of fostering a collaborative, communicative, and empowered culture to achieve efficient and effective DevOps through the alignment of DevX and DevOps principles. back to top

Lightning Talk: Building Bridges Through Continuous Delivery - Anna Daugherty, Opsera This talk emphasizes the importance of continuous delivery and advocates for developers to become more visible, collaborative, and aligned with business goals. The speaker provides practical strategies for developers to partner with various teams, leverage metrics, and treat their deliveries as products to demonstrate their value and ensure their relevance within the organization. back to top

Keynote: Rebel to Pioneer: Open Source at Microsoft - Ross Gardler The keynote explores Microsoft's journey from being a perceived closed-source company to embracing open source and becoming a leader in the Linux and open-source ecosystem. The speaker highlights Microsoft's initiatives to strengthen the open-source community, including improving documentation and enabling executable documentation to enhance user onboarding and software development. back to top

Panel Discussion: The 5 Ws and...- Lori Lorusso, Jeremy Meiss, Andrea Frittoli, Aneesha Vallabhaneni This panel discussion explores the benefits and challenges of participating in open-source communities, including the importance of fostering a sense of belonging and collaboration, as well as the strategic value for businesses and organizations to get involved. The panelists share their personal experiences and insights on resolving conflicts, leveraging online and offline spaces, and practical ways for individuals and organizations to contribute to and sustain open-source ecosystems. back to top

Sponsored Session: Enterprise Platform Engineering, the Open Source Way - Bassam Chahine This talk provides an overview of platform engineering and the benefits of open-source technologies, highlighting how Instaclusters' managed services can help enterprises leverage open-source data technologies and streamline their infrastructure management. The speaker also discusses Instaclusters' approach to integrating with existing tools and processes, as well as their acquisition by NetApp and the free trial offer for attendees. back to top

Optimizing Kubernetes Operators and Admission Control with Pepr - Kimberley Schaefer & Casey Wylie Pepr is a powerful tool that simplifies the management of Kubernetes operators and admission control by providing a user-friendly TypeScript-based API, built-in scheduling, and native integration with the Kubernetes API server. The presenters showcase how Pepr can help organizations break down silos, standardize security configurations, and automate complex infrastructure and application deployments across multiple clusters. back to top

Lightning Talk: Backstage CNCF Tech Doc Analysis Update - David Welsch, Expert Support, Inc. This lightning talk provides an update on the CNCF's technical documentation analysis project, focusing on the backstage project. The speaker discusses the project's goals, methodology, and key findings, highlighting the need for user-focused documentation and a smooth onboarding process for open-source projects. back to top

Lightning Talk: A Polyglot's Journey: Insights from My Multilingual Localization... - Julia Furst This lightning talk explores the challenges and opportunities of multilingual localization in the open-source community. The speaker, a global technologist and open-source contributor, shares insights on how to make open-source projects more accessible to non-native English speakers, emphasizing the importance of inclusive practices and leveraging asynchronous communication methods. back to top

Docs as Tests: No More Broken Docs - Manny Silva, Skyflow This talk introduces 'Docs as Tests', a strategy for keeping documentation in sync with the product by automating testing of documentation content. The speaker, Manny Silva, discusses the challenges of maintaining accurate documentation and presents an open-source tool called 'Doc Detective' that enables technical writers to automate documentation testing without requiring extensive programming knowledge. back to top

Learning by Example: Highlights from Google Season of Docs - Erin McKean, Google This talk discusses the highlights and lessons learned from the Google Season of Docs program, a grant program that aims to create high-quality documentation and foster best practices in open-source documentation. The speaker shares insights into the program's goals, the types of documentation projects funded, and the importance of understanding user needs and measuring the impact of documentation efforts. back to top

How to Start Contributing to the Linux Kernel - Kelsey Steele & Allen Pais, Microsoft This video provides a comprehensive overview of how to start contributing to the Linux kernel, covering topics such as recommended knowledge, the kernel development cycle, mailing lists, testing release candidates, reviewing and submitting patches, and finding tasks and bugs to work on. The presenters also discuss common pitfalls that new contributors should be aware of, such as inadequate testing, modifying code without context, and the importance of following coding guidelines and being open to community feedback. back to top

Panel Discussion: Let's Improve - Leverage DORA to Im...- Nathen Harvey & Amanda Lewis & Dave Stanke The panel discussion explores how the DORA (DevOps Research and Assessment) framework can be leveraged to improve software delivery performance. The speakers provide insights into the DORA research, the key metrics it measures, and how teams can use this data to identify and address areas for improvement in their software development and deployment processes. back to top

Spec Editing Tools and Best Practices for IETF Standards - Dave Thaler, Independent This video discusses the tools and best practices for editing specifications for IETF standards. It covers the IETF's ethos, the process of creating Internet Drafts and RFCs, the formats and tooling used, and the integration with GitHub for collaborative editing. back to top

Know Your Audience: A Look Inside the Human Brain - Tina Luedtke, Google The talk covers the cognitive principles behind effective content creation, exploring how the human brain processes information through different memory systems. The speaker provides practical tips and resources for technical writers and documentation teams to create user-friendly and engaging content that aligns with how people learn and retain information. back to top

International Adoption of Open Standards: 10,000 Transp... - Carl Fredlund & Elisabeth Poirier-Defoy The presentation discusses the international adoption of open transportation standards, such as GTFS and GBFS, which are used to improve traveler information and enable seamless mobility. The talk highlights the role of Mobility Data, a non-profit organization, in fostering a diverse community to maintain and advance these standards, as well as the impact of policy initiatives in driving their adoption worldwide. back to top

Effective Specification Programs: Formation to Global Adoption - Seth Newberry & Ann Woodliff This talk provides a comprehensive overview of the key considerations and best practices for forming and managing successful specification programs, highlighting the importance of clear governance, intellectual property management, and community engagement. The speakers emphasize the differences between open-source projects and specification development, and offer practical advice for navigating the complex landscape of standards organizations and ensuring the long-term viability and adoption of technical specifications. back to top

Documentation Quality Score: Findings from DORA Research - Michelle Irvine, Google This presentation discusses the findings from the DORA research program on the importance of documentation quality in software development. The research shows that high-quality documentation significantly improves various technical capabilities, organizational performance, and employee satisfaction, providing a strong case for investing in documentation as a crucial part of software development. back to top

Panel Discussion: The Mentoring Effect: Measurin...- Diane Mueller, Benjamin Evans, Nate Waddington This panel discussion explores the effectiveness of open-source mentoring programs, highlighting the Linux Foundation's CNCF mentoring program and the WordPress project's mentorship initiatives. The speakers discuss the use of data-driven tools like Beria to track and analyze the impact of these programs, including insights into participant engagement, retention, and career progression. back to top

YAML and YAMLScript - Ingy döt Net, YAML LLC This talk explores the history, features, and challenges of YAML, a popular data serialization language. The speaker introduces YAMLScript, a new programming language based on YAML that aims to address the shortcomings of YAML and provide a secure, fast, and consistent YAML loader across multiple programming languages. back to top

Repository Cohorts: How OSPOs... - James Siri, Natalia Luzuriaga, Remy DeCausemaker & Isaac Milarsky This presentation discusses the concept of repository cohorts, which allows open-source program offices (OSPOs) to programmatically categorize and analyze their repositories based on various characteristics. The presenters from Microsoft and the Centers for Medicare and Medicaid Services (CMS) share their approaches to implementing repository cohorts, including the use of maturity models, templates, checklists, and tools like Augur and repo-linter. back to top

Flyte: Production-Grade Data and Machine Learning Orchestration - Shivay Lamba & Ekansh Gupta Flyte is a Kubernetes-native workflow automation platform for production-grade data and machine learning orchestration. The talk covers Flyte's features, including dynamic workflows, resource management, and integration with external services, highlighting its ability to address the challenges of productionizing machine learning at scale. back to top

Thinking Beyond IaC:an OSS Approach to Cloud Agnostic Infr... - Anmol Sachdeva & Kingsley Madikaegbu Failed to generate summary. back to top

Diversity in Open Source, an Asian Perspective - Masae Shida, VMware UK The presentation explores the importance of diversity in open source communities, particularly from the Asian perspective. It highlights the growth of open source in Asia, the barriers to participation, and the need for inclusive open source cultures to foster global participation. back to top

Navigating the Growing Diversity Challenges in OSS - Zixuan Feng & Diane Mueller This talk presents a user-centered diversity and turnover monitoring tool designed to support open-source project maintainers in tracking and improving the diversity and inclusion within their communities. The tool integrates multiple data sources to provide a comprehensive view of project contributions and community engagement, empowering maintainers to identify areas for improvement and monitor the impact of their interventions. back to top

Lightning Talk: Shipping an Open Service - Evan Anderson, Stacklok This lightning talk explores the benefits and challenges of shipping an open-source service, including providing a better user experience, improving the product through operational insights, and navigating decisions around release management, feature flags, and open infrastructure. The speaker highlights the importance of considering the tradeoffs and responsibilities involved in running a service for an open-source project. back to top

Panel Discussion: Mentorship as an On-ramp to Open Source This panel discussion explores the importance of mentorship programs as an on-ramp to open source contributions, highlighting how these programs can benefit both students and open source communities. The panelists share their experiences running various mentorship initiatives, discussing the challenges, metrics for success, and the role of funding and sustainability in maintaining these programs. back to top

Breaking Barriers: Triumphs of Cultural Diversity in Global OS... Rajas Kakodkar & Nikhita Raghunath This talk explores strategies for building a truly global and inclusive open-source community. The speakers discuss various 'OS Stones' - mentorship, leadership, paid open-source, time zones, conferences, and empathy - as key elements to overcoming barriers and fostering a diverse, sustainable, and collaborative open-source ecosystem. back to top

Establishing a Baseline: Repo Metrics, Ma... - Natalia Luzuriaga, Remy DeCausemaker & Isaac Milarsky This talk presents a comprehensive framework for establishing a baseline for open source repository maturity at the Centers for Medicare and Medicaid Services (CMS). The speakers discuss their maturity model, templates, checklists, and tools like cookie cutter and repo linter, which help reduce duplicate work, manage risks, and grow their open source program through early career talent pipelines. back to top

Talking with Management About Open Source - Tom Callaway, AWS This talk provides a comprehensive guide for advocates of open source software to effectively communicate the value and benefits of open source to management, focusing on translating the open source philosophy into business-centric language and metrics that resonate with decision-makers. The speaker emphasizes the importance of understanding management's priorities, building trust, and demonstrating the long-term sustainability and strategic advantages of open source engagement for the company's success. back to top

Beyond the Trend: Authentic Approaches to Fostering Diversity in Open Source - Jessica Tegner The talk explores authentic approaches to fostering diversity, equity, and inclusion in open source communities. The speaker shares personal experiences, perspectives from minority groups, and practical tips for both smaller projects and larger organizations to create welcoming and inclusive environments. back to top

Squashing DEI Bugs in Open Source Projects: How to Find and Resolve Common Barriers to... Georg Link This talk explores strategies for addressing diversity, equity, and inclusion (DEI) challenges in open-source projects. The speaker presents a framework for identifying and resolving common barriers at the technical, social, and process levels, as well as providing practical recommendations for project maintainers and contributors to create more inclusive environments. back to top

Panel Discussion: CHAOSS DEI Project Badging The panel discussion explores the CHAOSS DEI Project Badging initiative, which aims to help open-source projects represent how they center diversity, equity, and inclusion within their projects. The panelists discuss the rationale behind the DEI.MD file, the reflective process of using metrics, and the potential impact of the badging program on open-source communities. back to top

Beyond Code: Recognizing the Crucial Role of 'Glue Work' in Open Source - Zixuan Feng & Julia Furst This presentation explores the crucial but often overlooked role of 'glue work' in open-source communities, highlighting the diverse range of contributions beyond just code, such as documentation, community management, and event organization. The speakers propose a taxonomy of these 'glue work' contributions and discuss strategies to improve their visibility, recognition, and inclusion within open-source projects. back to top

Education

Embracing AI in Education: A Path to Inclusive and Effe... - Juan Pablo Flores & Ashwin Kumar Uppala The presentation explores the impact of AI on education, highlighting the need for a balanced approach that leverages AI as a coach rather than a crutch. It discusses strategies for integrating AI in the classroom, such as personalized learning paths and neuroscience-based systems, while addressing the ethical considerations around data privacy and the potential for AI-driven propaganda. back to top

Energy

Open-Source Energy Storage Management Tools from DOE - Valerio De Angelis, Sandia National Labs The talk discusses the importance of energy storage management tools developed by the Department of Energy to accelerate the development of energy storage systems and address the challenges of integrating renewable energy sources into the grid. The speaker highlights the efforts to create a data hub, develop physics-based and machine learning models, and collaborate with various national laboratories to consolidate battery data and predict battery degradation. back to top

Funding

The State of Funding in Open Source - Kara Sowles, GitHub The talk explores the current state of funding in the open-source ecosystem, highlighting the various platforms, models, and challenges in sustaining open-source projects and maintainers. The speaker provides insights into the role of companies, foundations, grants, and individual contributions in supporting the open-source community, while emphasizing the need for more data, awareness, and resilient funding mechanisms to ensure the long-term sustainability of open-source software. back to top

Funding the Future: Open Source Funding at GitHub - Kevin Crosby, GitHub The talk discusses GitHub's efforts to fund the future of open source development, including the GitHub Fund, an accelerator program, and the GitHub Sponsors platform. The speaker highlights the importance of simplifying funding mechanisms, growing the impact of funded projects, and building partnerships to drive greater reach and impact in the open source ecosystem. back to top

GitOps

Two GitOps Titans, One Powerful Solution: Flamingo (Flux + Argo) - Priyanka Ravi & Joaquin Rodriguez The video presents Flamingo, a solution that integrates the popular GitOps tools Flux and Argo CD, providing a seamless and powerful experience for managing deployments in Kubernetes clusters. The integration of Flux's automation capabilities and Argo CD's user-friendly interface allows users to take advantage of additional features and capabilities not available in either tool individually. back to top

Sponsored Session: Harnessing the Power of Open Source for Cloud Native Developm...- Dr. Mo Haghighi The talk covers how to harness the power of open-source tools, frameworks, and technologies to kickstart your cloud-native journey. It delves into topics like microservices architecture, containerization, orchestration with Kubernetes, Helm, Operators, and OpenShift, as well as observability best practices. back to top

Governance

Open Source Governance by Example - VM (Vicky) Brasseur, Independent This talk discusses the importance of governance in open-source projects, emphasizing that it is the human infrastructure that enables smooth collaboration. The speaker presents a collection of open-source governance documents as a resource for projects to learn from and build upon. back to top

HPC

Vendor-Neutral GPU Programming in Chapel - Jade Abraham, HPE Chapel is an open-source, vendor-neutral programming language that enables productive and scalable distributed GPU programming. The talk showcases Chapel's GPU support, highlighting its ability to leverage multiple GPUs across nodes, provide high-level abstractions for GPU programming, and achieve competitive performance compared to traditional GPU programming approaches. back to top

Keynote

Keynote: Thoughts on Open Source - Kelsey Hightower, Distinguished Software Engineer The keynote explores the evolution of open source software and the challenges faced by maintainers and companies in balancing open collaboration with sustainable business models. The speaker shares personal experiences and insights on the importance of community, empathy, and finding ways to add value in an open ecosystem. back to top

Keynote: Welcome Back - Hilary Carter, SVP Research & Communications, The Linux Foundation The keynote provides an overview of the upcoming events and activities at the Open Source Summit North America, including a diversity lunch, ask the expert sessions, an attendee reception, and an unconference. The keynote also introduces the next speakers, Linus Torvalds, the creator of Linux and Git, and Dirk Hohndel, the head of the Open-Source Program Office at Verizon, for a fireside chat on Linux and open-source. back to top

Keynote: Linus Torvalds, Creator of Linux & Git, in Conversation with Dirk Hohndel Linus Torvalds, the creator of Linux and Git, discusses the challenges and evolution of the Linux kernel, the impact of hardware security vulnerabilities, and the role of AI in software development. He emphasizes the importance of open-source communities and the need for a balanced approach to emerging technologies. back to top

Keynote: Driving Innovation in OpenSearch, the Open Source Approach - Anandhi Bumstead This keynote presentation by Anandhi Bumstead highlights the significant growth and innovation within the OpenSearch project, an open-source search and analytics suite. The talk emphasizes the importance of the thriving OpenSearch community, with diverse contributors and maintainers driving advancements in efficiency, observability, search, machine learning, and generative AI capabilities. back to top

Keynote: Army Special Operations and Innovation - Major General Patrick B. Roberson, US Army Major General Patrick B. Roberson discusses how the U.S. Army Special Operations Command is adapting to a changing battlefield, emphasizing the importance of innovation, technology, and collaboration with industry to address emerging threats and enhance the capabilities of special operations forces. He highlights key focus areas such as irregular warfare, sensor-to-shooter integration, resistance operations, and leveraging space, cyber, and precision strike capabilities to maintain a decisive edge. back to top

Keynote: Welcome Back - Hilary Carter, SVP Research & Communications, The Linux Foundation This keynote address at the Open Source Summit North America provides an overview of the event's exciting program, including interactive pet activities, expert sessions, and a raffle with valuable prizes. The keynote speaker, Lisa Seaducca, will explore how AI is transforming industries and the pivotal role of open source in this process. back to top

cdCon Closing Session The video presents the closing session of the cdCon conference, where the organizers announce various community awards and raffle off books and swag. The session celebrates the contributions of individuals and organizations to the continuous delivery ecosystem, highlighting their dedication and impact. back to top

Memory Management

Memory Page-pooling with Auto Refill Feature for Improved Memory Allocati... - Sudarshan Rajagopalan This talk presents a novel memory page-pooling technique with an automatic refill feature, which aims to improve memory allocation latency and efficiency. The proposed approach automatically refills memory pools when they are depleted, reducing the need for the application to directly allocate memory from the system, and providing more predictable memory access patterns. back to top

Networking

Introduction to eBPF Qdisc and Use Cases - Amery Hung, ByteDance The video presents the development of a flexible and easy-to-use eBPF-based qdisc (queue discipline) for the Linux kernel, which aims to simplify qdisc development and enable new use cases through cross-component communication using eBPF maps and collections. The speaker showcases several examples, including a simple FIFO qdisc, a rate-limiting qdisc that compensates for packet loss, and a qdisc that integrates with a network emulator, demonstrating the potential of this approach. back to top

Follow Those Packets!!! Dive Into Network Foundations For Everyone! - Marino Wijay, Komodor This talk provides a comprehensive overview of network foundations, covering topics such as packet structure, routing, DNS, software-defined networking, and network namespaces. The speaker demonstrates a live Kubernetes networking setup and discusses the importance of network automation and tools like eBPF for efficient network management. back to top

Tutorial: Developing High-performance Networking Applications - Cong Wang, ByteDance This tutorial covers the development of high-performance networking applications, including an overview of asynchronous socket APIs, TCP zero-copy techniques, kernel-bypassing solutions, and recent advancements in TCP and alternative protocols like SCTP, QUIC, and H. The presenter provides examples and insights on leveraging these technologies to achieve optimal networking performance. back to top

Clusterlink: Enabling Fine-Grained and High-Speed Application-Level Connectivity... - Pravein Kannan Clusterlink is a novel approach to enabling fine-grained and high-speed application-level connectivity across multi-cloud and multi-cluster environments, addressing the challenges of divergent perspectives, lack of uniform abstractions, and limited interoperability in traditional networking solutions. The proposed system leverages programmatic APIs, open and extensible design, and connection-oriented principles to provide a flexible and scalable solution for application developers and network administrators to manage cross-domain communication flows. back to top

Observability

Total Visibility: Harnessing Pixie for a Full Observability Landscape - Prerit Munjal This talk introduces Pixie, a powerful observability tool that provides a comprehensive solution for monitoring and troubleshooting applications and infrastructure. The speaker highlights Pixie's key features, including its use of eBPF, pre-built scripts, and seamless integration with Grafana, making it a compelling alternative to traditional observability tools. back to top

Design Observability Solution for Multi-Tenancy Environment - Husni Alhamdani, Censhare The video presents a design for an observability solution for a multi-tenancy environment in Kubernetes. The solution leverages various tools and techniques, including Prometheus, Cortex, Jaeger, and Kube, to address challenges such as resource allocation, data privacy, and security in a multi-tenant setup. back to top

Tales of Adopting OpenTelemetry: A First-Timer Journey - Hope Oluwalolope, Microsoft The speaker shares her journey of adopting OpenTelemetry, highlighting the conceptual, cultural, and technical challenges faced, and provides strategies for overcoming them, such as understanding the system landscape, leveraging the community, and taking an iterative approach to implementation. back to top

DAMO[N,S]?: Implementing Self-Driven Data Access-Aware Efficient Linux System - SeongJae Park The presentation introduces a self-driven data access-aware efficient Linux system called DAMON and DAMOS, which provide low-overhead and high-accuracy access monitoring and optimization capabilities for modern memory-intensive workloads. The system leverages dynamic space and time granularity, user-controllable resource usage, and self-tuning mechanisms to achieve efficient memory utilization while minimizing performance impact. back to top

Lightning Talk: Quantifying Nebraska - Adam Harvey, Rust Foundation This lightning talk explores a holistic approach to quantifying and supporting open-source software dependencies, focusing on the Rust ecosystem. The speaker proposes a scoring system to identify projects that could benefit from additional human and financial support, emphasizing the importance of understanding the human aspect of maintainability beyond just security metrics. back to top

Panel Discussion: OSS Viability and Project...- Gary White, Dawn Foster, Matt Germonprez, Emma Irwin This panel discussion explores the importance of assessing the viability of open-source projects when selecting them for use, highlighting the need for quantitative metrics to complement qualitative assessments. The panelists discuss various factors to consider, such as community health, governance, and maintainer activity, as well as strategies for educating and empowering developers within organizations to make informed decisions about open-source project selection and usage. back to top

What Information Are Package & Container Registries Hiding from You? - Avi Press, Scarf The talk discusses the limitations of container registries in providing detailed usage analytics to maintainers. It proposes a registry gateway solution that can transparently redirect users while providing more granular insights on container usage. back to top

Buzzing Across the eBPF Landscape and Into the Hive - Bill Mulligan, Isovalent The talk provides an overview of eBPF, a Linux kernel technology that enables programmability and flexibility within the kernel. The speaker discusses the benefits of eBPF, including its ability to add new functionality on-the-fly, its safety and performance characteristics, and its real-world use cases in networking, observability, and security. back to top

OSPO Data Pyramid - Cali Dolfi, Red Hat & Sean Goggins, University of Missouri This talk discusses the OSPO (Open Source Program Office) Data Pyramid, a framework for using data analysis to support open source communities, cross-organizational collaboration, and alignment with corporate strategies. The speaker, Cali Dolfi from Red Hat, shares the history of community data analysis at Red Hat and the evolution of the OSPO Data Pyramid, highlighting how data-driven insights can inform decision-making and foster collaboration within and beyond the open source ecosystem. back to top

Open Source

Five Key Requirements for a Successful OSPO - Nithya Ruff, Amazon This talk discusses the key requirements for running a successful Open Source Program Office (OSPO) in an organization. The speaker covers topics such as the importance of OSPO's organizational placement, the need for executive sponsorship, the need for business alignment and language translation, the importance of engaging with internal and external stakeholders, and the need for the OSPO to continuously evolve and adapt to changing market and business needs. back to top

Operations

Toyota's Road to OSPO and It's Destination - Masato Endo, Toyota Motor Corporation Toyota's journey in establishing an Open Source Program Office (OSPO) has been a strategic move to drive open source adoption, collaboration, and innovation within the company. The presentation highlights Toyota's experiences in navigating the challenges of open source management, from addressing intellectual property and security concerns to fostering a culture of open source engagement across the organization. back to top

Performance Engineering

Optimizing Linux Systems: Leveraging Guider for Advanced Performance Analysis and... - Peace Lee This presentation introduces Guider, an open-source performance analysis tool that provides comprehensive monitoring, profiling, and tracing capabilities for Linux systems. The speaker demonstrates Guider's features, including automatic performance monitoring and report generation, as well as methods for analyzing large volumes of performance data across multiple devices to identify system anomalies and optimize performance. back to top

Reliability, Availability and Serviceability (RAS)

Reliability, Availability and Serviceability (RAS) Features on Linux Systems - Vandana Salve, Micron This talk provides an overview of the Reliability, Availability, and Serviceability (RAS) features in Linux systems. It discusses how RAS functionality is implemented across hardware, firmware, operating system, and application levels, using the example of memory devices and the CXL memory technology. back to top

Responsible AI

BOF: Trusted AI - Discussion of Model Evaluation Tools, Guidelines, and Geographic...- Susan Malaika This session discusses the responsible AI work stream within the Generative AI Commons, including the development of a responsible AI framework paper, collaboration with initiatives like NIST AI Safety Consortium, and opportunities for community members to get involved. The session also provides an overview of the broader Generative AI Commons and its various work streams, highlighting the open and collaborative nature of the community. back to top

Scaling

Scaling Kubernetes Application to 1M Users - Mauricio Améndola, netlabs The talk discusses strategies for scaling Kubernetes applications to handle 1 million users, focusing on four key challenges: scaling the application, scaling the infrastructure, managing control plane boundaries, and effective monitoring. The speaker provides detailed insights and solutions for each of these challenges, emphasizing the importance of understanding the underlying mechanisms and boundaries of the Kubernetes ecosystem. back to top

Security

Securing Connections: Defending Telco Workloads in the Cloud Era - Phil Porras, Accuknox The talk discusses the importance of securing 5G networks, particularly in the context of emerging mobile wireless use cases. It covers approaches to securing the edge (devices and base stations) and the control plane, as well as the use of intent-based security and AI/ML techniques to enhance 5G network security. back to top

OSS Supply Chain Threats and Why You Need a Holistic Security Strategy - Adrian Diglio, Microsoft This talk discusses the growing threat of open-source software supply chain attacks and the need for a holistic security strategy to address them. The speaker presents the Secure Software Supply Chain Consumption (S2C2) framework as a solution, outlining its eight practices and maturity model to help organizations secure their open-source dependencies and build more resilient software supply chains. back to top

Panel Discussion: Improving Supply Chain Integrity with Ope...- Arnaud, Jay, Isaac, Michael, Marcela This panel discussion explores the efforts of the Open Source Security Foundation (OpenSSF) to address the growing challenges of open source software supply chain integrity. The panelists discuss several OpenSSF projects, including Salsa, S2C2F, Guac, and FRESA, which aim to improve the security and transparency of the open source software development and deployment process. back to top

Sponsored Session: Benefits of Automated Open-Source Intake Management - Featuring...- Stan Wisseman The video presents a case study on the challenges faced by organizations in managing the intake of open-source components, highlighting the importance of automating the process to address security, compliance, and developer productivity concerns. The speaker showcases an automated solution, Open Source Select, that provides a centralized platform for evaluating open-source projects based on predefined policies, streamlining the intake process and reducing the burden on developers. back to top

A Step Closer to in-Toto’lly Secure: Using in-Toto and OPA Gatekeeper...- Tom Meadows & John Kjell The presentation discusses using in-toto and OPA Gatekeeper to secure software supply chains. It introduces the concept of attestations, the in-toto framework, and the Arista and Witness projects, which enable the generation, storage, and verification of these attestations. back to top

Securing Your Supply Chain with an Open Source Ecosystem - Mike LeBeau, TestifySec This presentation provides a comprehensive overview of securing the software supply chain using open-source tools and frameworks. It covers the various stages of the software supply chain, the associated threats and vulnerabilities, and the regulatory requirements and compliance frameworks that organizations need to consider. back to top

Guarding the ML Galaxy: Beyond Accuracy to Privacy and Security - Jigyasa Grover & Rishabh Misra This talk explores the need to go beyond accuracy and focus on privacy and security in machine learning systems. It discusses various techniques like differential privacy, federated learning, and synthetic data generation to ensure privacy preservation while maintaining data utility. back to top

AI Regulations: A Healthy Tension with Innovation or Stifling Bureaucracy? - Rebecca Lively The talk discusses the complex landscape of AI regulations, highlighting the challenges of creating effective policies that balance innovation and public concerns. The speaker emphasizes the importance of understanding the nuances of regulations, engaging in the policy-making process, and finding a pragmatic approach to navigate the evolving landscape of AI governance. back to top

Introducing the Post-Quantum Cryptography Alliance - Michael Maximilien, IBM & Hart Montgomery The video introduces the Post-Quantum Cryptography Alliance (PQCA), a Linux Foundation project aimed at advancing the adoption of post-quantum cryptography through high-quality implementations and support for the continued development and standardization of new post-quantum algorithms. The PQCA is working to create a pipeline from research to production, with a focus on both experimental and production-ready projects. back to top

Decoding Trust in Confidential Computing: Foundations and Open Source...- Sal Kimmich & Mike Bursell The talk explores the foundations and open-source perspectives of confidential computing, which aims to protect data in use by performing computation in a hardware-based attested trusted execution environment. It discusses the importance of trust chains, endorsing authorities, and the role of the open-source community in ensuring the security and integrity of confidential computing solutions. back to top

Accountability Taxonomy for AI Software Bill of Materials - Arthit Suriyawongkul The talk presents a taxonomy for accountability in AI systems, focusing on the information obligations required by the EU AI Act for registering high-risk AI systems and testing them in real-world conditions. The speaker proposes a standardized set of terms and a proof-of-concept integration with MLflow to demonstrate how this taxonomy can be used to track and manage the required information. back to top

The Ramifications of ISO 5230 (Licensing) and ISO 18974 (Security) for Legal... - Shane Coughlan This talk discusses the ramifications of ISO standards 5230 (licensing) and 18974 (security) for legal professionals in 2024. It covers the adoption of these standards in procurement, mergers and acquisitions, and supply chain management, as well as the support and resources available to help legal professionals navigate these changes. back to top

Using OPA to Ensure Compliant Software Delivery in a Highly Regulated Finance Envi... - Matt Gogerly The presentation discusses how JP Morgan Chase, a highly regulated finance organization, uses Open Policy Agent (OPA) to ensure compliant software delivery in their continuous delivery pipeline. The speaker highlights various use cases and the future plans to empower teams to write their own policies and make the policy enforcement process more dynamic and self-service. back to top

Sponsored Session: Software Composition Risk - Determine Actual Risk and Take Action - Chris Lindsey This talk provides a comprehensive overview of the risks and challenges associated with software composition, including dependency risks, supply chain risks, and the need for effective risk management strategies. The speaker emphasizes the importance of proactive, data-driven approaches to identifying and mitigating these risks, as well as the need for collaboration between security and development teams to ensure secure and reliable software deployments. back to top

Keynote: Empowering Open Source Security and Innovation: The Docker... - Britney Blodget, Docker This keynote presentation by Britney Blodget from Docker highlights the company's commitment to empowering the open-source community through its Docker Hub platform and the Docker Sponsored Open Source Program. The talk emphasizes Docker's responsibility in promoting security awareness and fostering a culture of trust within the open-source ecosystem, particularly by offering tools like Docker Scout to help maintain the long-term security of open-source projects. back to top

Security Showdown: The Overconfident Operator Vs the Nefarious... - Whitney Lee & Lewis Denham-Parry This presentation showcases a security showdown between a confident IT operator and a malicious hacker. It highlights the importance of implementing robust security measures, including private API access, GitOps, service mesh, and runtime security monitoring, to protect a Kubernetes cluster from various attacks. back to top

Guardians of Code: Continuously Monitoring Security and DevOps Compliance - Steve Taylor, DeployHub This talk explores the importance of continuously monitoring security and DevOps compliance in the face of growing supply chain attacks and vulnerabilities. The speaker discusses the need for implementing various tools and practices, such as secure build processes, artifact signing, and automated security checks, to ensure the integrity and compliance of the software development pipeline. back to top

Fortiying Tomorrow’s CD Pipelines: Harnessing the Power of DevSecOps Data Using... - Tracy Ragan The speaker discusses the importance of consolidating data from DevSecOps pipelines to gain meaningful insights and become relevant again in the evolving software development landscape. The talk highlights the use of an Evidence Store, such as the open-source project Oras, to track and analyze data from various tools and workflows, enabling better vulnerability management, open-source inventory control, and security posture management. back to top

Sponsored Session: Cloudy with a Chance of Zero Trust: Navigating Security in the...- Robert Sirchia The presentation explores the concept of zero trust security in the cloud-native ecosystem, highlighting the importance of verifying trust rather than assuming it. The speaker demonstrates the use of the open-source tool 'new Vector' to manage container security, including features for discovery, monitoring, and protection against various security threats. back to top

Application-Aware Layer-7 Security Framework for Cloud APIs Using... - Julian Stephen & Shriti Priya The paper presents an application-aware layer-7 security framework that leverages large language models (LLMs) and WebAssembly to identify the intent of API requests and enforce customizable policies to mitigate application-specific security risks, such as unrestricted resource consumption and restricted access to sensitive business flows. The framework caches the identified intents and associated parameters to optimize the performance of the policy enforcement process. back to top

Keynote: Managing Supply Chain Risk in a World of AI Assisted Developers - Craig McLuckie The talk explores the impact of AI-assisted developers on open-source communities and supply chain risk management. The speaker discusses the benefits and challenges of generative AI, the need for maintainer productivity, and the importance of community-driven initiatives to secure the open-source ecosystem. back to top

Booting a Linux Kernel in a Higher Privilege Level - Thara Gopinath & Anna Trikalinou, Microsoft This talk discusses how the Linux Virtualization Based Security (LVBS) project at Microsoft aims to protect the Linux kernel by running it in a lower privilege level and leveraging the hypervisor to apply security protections. The presenters cover the architecture, booting process, and secure boot aspects of their LVBS implementation. back to top

Developing a Secure, Open Future - Christopher (CRob) Robinson, Intel This talk discusses how open-source software maintainers can integrate simple security techniques and tools to improve the security posture of their projects. The speaker highlights resources and initiatives from the Open Source Security Foundation to help developers and maintainers prepare for and respond to security threats, including educational materials, best practices, and automated tools. back to top

Lightning Talk: Secure Consumption of Open Source Software: Evaluating, Util... - Katherine Druckman This lightning talk discusses the challenges of secure consumption of open-source software, highlighting the prevalence of open-source components in modern software and the associated security risks. It introduces various tools and best practices to help evaluate, utilize, and contribute to open-source projects, emphasizing the importance of taking responsibility as a consumer of open-source software. back to top

Lightning Talk: A Teen’s Perspective on Navigating Open Source Security with GUAC - Nathan Naveen This talk presents GUAC, a project that analyzes software dependencies and identifies the most critical and vulnerable ones, allowing developers to proactively address security risks. The talk focuses on a new feature that combines metrics like dependency count and open-source security scores to provide a comprehensive risk assessment, empowering developers to prioritize and mitigate the most pressing security vulnerabilities. back to top

Panel Discussion: 6 Months In: (Building and) Using the OpenSSF Se...- Sarah Evans, CRob, John Kjell The panel discussion covers the origin story, goals, and current progress of the Open Source Security Foundation's (OpenSSF) Security Tool Belt project. The project aims to provide a set of security tools and processes that can be easily adopted by open-source software maintainers, with a focus on supporting the needs of 'Diana the Weekend Warrior' - a persona representing maintainers with limited time and resources. back to top

TPMs, Merkle Trees and TEEs: Enhancing SLSA with Hardware-Assisted... - Marcela Melara & Chad Kimes The presenters discuss enhancing the SLSA (Secure Software Supply Chain) framework by leveraging hardware-assisted security technologies like Trusted Platform Modules (TPMs), Merkle Trees, and Trusted Execution Environments (TEEs) to provide cryptographic verification of build environments and protect the integrity of build processes. back to top

Tutorial: Who Do You Think You Are? Driving the Need for Identity... - Marino Wijay & Peter Jausovec This tutorial provides a comprehensive overview of identity management and authentication in Kubernetes environments, covering concepts like certificates, Spiffe, Spire, and their integration with the Istio service mesh. The presenters demonstrate hands-on examples of setting up certificate authorities, authorization policies, and leveraging Spire for secure workload identity. back to top

When to Send Flowers? End of Life and End of Support Across the Ecosystem - Allan Friedman, CISA The presentation discusses the challenges of managing end-of-life and end-of-support software across various industries, emphasizing the need for a data-driven approach to address the risks and legal obligations associated with outdated technology. The speaker proposes a framework for purpose-driven transparency, separating data from policy to enable better risk assessment and mitigation strategies. back to top

Lightning Talk: Charting the Course for Secure Software Supply Chain with Guac-AI-Mole! - Ridwan Hoq This talk presents a hackathon project that leverages the Guac-AI-Mole open-source project to provide a natural language interface for querying software supply chain data. The project aims to enhance the visibility and security of software supply chains by integrating Guac-AI-Mole with container registries and Kubernetes clusters. back to top

Lightning Talk: Elephant in the Room: How Supply Chain Security Standards Are Not St... - Kyle Quest This lightning talk discusses the challenges and inconsistencies in the adoption of software bill of materials (SBOM) standards, highlighting the need for a standardized approach to package identity and the use of aliases to address the lack of a single, universal identifier. The speaker emphasizes the importance of improving SBOM generation and quality validation to ensure the reliability and interoperability of SBOM data across different tools and ecosystems. back to top

Structured Scorecard Results: Tailor Your Own Supply-Chain... - Adam Korczynski & David Korczynski This talk introduces a new feature in the OpenSSF Scorecard project that enables customizable software supply chain security policies. The speakers demonstrate how the structured results output from Scorecard can be leveraged to build organization-specific policies that evaluate dependencies and enforce security requirements. back to top

Network Intrusion Detection 101 with OpenWrt and OpenCanary - Tamas Lengyel, Intel This talk presents a comprehensive approach to enhancing network security at home using open-source tools like OpenWrt and OpenCanary. The speaker demonstrates how to set up a decentralized honeypot system on a router to detect and mitigate unauthorized access attempts, providing a simple yet effective way to protect a home network from potential IoT device vulnerabilities. back to top

The Chronic Disease Plaguing the Internet - Robin Ginn, OpenJS Foundation The presentation discusses the chronic disease plaguing the internet - the widespread use of outdated and vulnerable software, particularly in the JavaScript ecosystem. The speaker outlines the challenges faced by open-source projects, the security risks involved, and the efforts of the OpenJS Foundation to address these issues through research, collaboration, and improving security practices. back to top

DHS Supporting Critical Infrastructure Through Op... - Scott Andersen & Juan Lopez & Olga Livingston This video discusses the challenges and trade-offs associated with the widespread use of open-source software (OSS) in critical infrastructure. The presenters outline an effort by the Department of Homeland Security Science and Technology Directorate and CISA to develop a framework that empowers organizations to increase their visibility into OSS within their networks and infrastructure, enabling them to make more informed risk-based decisions. back to top

US Special Operations Forces Leverage Open Source for Decision Advantage - Amanda Mercier This talk explores how US Special Operations Forces are leveraging open-source technologies and talent to gain a decisive information advantage in modern warfare. The speaker highlights the growing permeability of boundaries between government, industry, and academia, enabling greater collaboration and innovation in addressing critical national security challenges. back to top

PETAce - Using Applied Cryptography to Enhance Privacy - Donghang Lu, TikTok This talk presents PETAce, an open-source framework for privacy-enhancing technologies (PETs) developed by TikTok. PETAce provides a comprehensive toolchain for building privacy-preserving applications, including cryptographic primitives, secure multi-party computation protocols, and specialized solutions for use cases like healthcare research and advertising measurement. back to top

Public Sector + OpenSSF: Principles for Package Repository Security - Jack Cable & Zach Steindler This talk discusses the Principles for Package Repository Security framework, a collaboration between the US government's Cybersecurity and Infrastructure Security Agency (CISA) and the Open Source Security Foundation (OpenSSF) working group. The framework aims to help package repositories improve their security practices and enable a more secure open-source ecosystem. back to top

Recruiting and Retaining Hackers in the DoD - Rebecca Lively, Defense Unicorns & Casey Miller The presentation discusses the challenges of recruiting and retaining hackers in the Department of Defense (DoD), highlighting the need to adapt to software-defined warfare and the unique talent distribution of technical professionals. The speakers share their experiences and insights from their time at the 90th Cyberspace Operations Squadron, advocating for changes to the DoD's organizational structure and culture to better support and retain technical talent. back to top

Using CD Events to Capture End to End Application Security Posture - Ashmita & Gopinath Rebala This talk discusses the use of CD (Continuous Delivery) events and Cloud events to capture the end-to-end application security posture, providing visibility into the various stages of the software delivery pipeline. The presenters highlight the challenges of managing application security posture in complex enterprise environments and demonstrate how these standardized events can be leveraged to implement security controls and enable automated compliance reporting. back to top

Case Study: 10+ Years of Developing an SBOM System and the Dos and Don’ts - Mark Gisi This presentation discusses a 10+ year journey of developing an SBOM (Software Bill of Materials) system, highlighting the key requirements, processes, and tooling involved. The speaker emphasizes the importance of starting with requirements, defining a robust process, and then selecting appropriate tools, while also sharing lessons learned and dos and don'ts for building an effective SBOM system. back to top

Lightning Talk: (Micro)Chips and SLSA - Richard Boyd II, Liatrio This talk discusses the growing threat of software supply chain attacks, such as the SolarWinds and XZ incidents, and the importance of securing the software supply chain. It outlines the SLSA framework, software bill of materials (SBOMs), and the use of attestations and Open Policy Agent (OPA) policies to ensure the integrity and security of the software development and deployment process. back to top

Keynote: OpenSSF Security Baseline - Dana Wang, Chief Architect, OpenSSF The talk by Dana Wang, Chief Architect at the OpenSSF (Open Source Security Foundation), discusses the organization's efforts to establish a security baseline for open-source software projects. The baseline aims to provide a minimal, practical, and risk-based approach to enhancing the security of open-source software, leveraging existing technical outcomes and promoting automation and collaboration across the open-source ecosystem. back to top

Logically Securing the Illogically Logical Use of Large Language Models - Sarah Evans & Jay White The presentation discusses how to logically secure the use of large language models, which are emerging and rapidly evolving technologies. The speakers emphasize the importance of applying existing security controls and frameworks, such as NIST 800-53 and the AI Risk Management Framework, to manage the risks and ensure responsible development and deployment of these AI systems. back to top

Securing Git Repositories with Gittuf - Aditya Sirish A Yelgundhalli & Billy Lynch This presentation discusses the importance of securing Git repositories, the limitations of current Git security features, and the introduction of Gittuf - a tool that leverages the Update Framework (TUF) to provide enhanced security properties for Git repositories, such as verifiability, key management, and multi-party authorization. back to top

Fresh SLSA and GUAC Starts with Knowing Your Ingredients - Michael Lieberman & Melissa McKay The video discusses the challenges of securing the software supply chain, including the prevalence of open-source dependencies, vulnerability management, and the need for a comprehensive approach involving both producers and consumers of software. The presenters introduce a range of open-source tools and frameworks, such as SLSA, GUAC, and S2C2F, that aim to address these challenges and improve the security of the software development lifecycle. back to top

Who Is Using, Who Is Abusing? a Primer on Open Source Licensing - Ram Iyengar The talk discusses the challenges and complexities of open source licensing, highlighting recent controversies around projects like MongoDB, Elasticsearch, and HashiCorp. The speaker emphasizes the importance of understanding licensing terms and the need for more transparent and diverse governance models to protect the open source ethos. back to top

"Harvest Now, Decrypt Later” - Addressing Quantum-Safe Crypto... - Alex Bozarth & Michael Maximilien The talk discusses the threat of quantum computing to current cryptography and the need for quantum-safe cryptography. The speaker demonstrates how to integrate quantum-safe algorithms into OpenSSL and use them in applications like cURL and HAProxy. back to top

Tutorial: Passkeys to the People: Building a Modern MFA Application with Open Source... - Cody Salas The presentation covers the implementation of a modern multi-factor authentication (MFA) application using open-source technologies, focusing on the adoption of passkeys as a replacement for traditional passwords. The speaker discusses the technical details of passkeys, their benefits, and the architectural considerations for building a passkey-enabled application, providing a step-by-step guide and a live demonstration of the sample application. back to top

Managing Software Supply Chain Risks in a Large Organization - Tom Bedford & Alyssa Wright This presentation discusses the importance of managing software supply chain risks in a large organization like Bloomberg. It highlights the key principles of understanding dependencies, implementing preventative measures, and fostering a culture of collective responsibility for open-source sustainability. back to top

Serverless

Revolutionizing Cloud Native: WebAssembly's Role in Serverless... - MacKenzie Adam & Kate Goldenring The talk discusses how WebAssembly can revolutionize serverless computing by addressing the limitations of current serverless solutions, such as slow startup times and bloated deployment artifacts. The presenters introduce Spin, an open-source project that provides a developer-friendly experience for building and deploying WebAssembly-based serverless applications on Kubernetes. back to top

Empowering Continuous Delivery with Spinnaker: A State of th...- Cameron Motevasselani & David Byron This talk provides an overview of the current state of the Spinnaker project, highlighting key initiatives and challenges the team is addressing. The presentation covers topics such as continuous delivery event integration, monorepo management, improved testing strategies, artifact storage optimization, and community engagement efforts to drive the project forward. back to top

Introducing Open Platform for Enterprise AI - Ramakrishna Karamsetty & Arun Gupta, Intel Corporation Intel introduces the Open Platform for Enterprise AI, a collaborative effort to address the complexity of building and deploying generative AI solutions in enterprises. The platform aims to provide a standardized, composable, and cloud-native framework for enterprises to rapidly develop and scale their AI applications. back to top

Unleashing Agility: How Capital One Embraced COTS for NextG... - Nagesh Vinnakota & Gokul Prabagaren This video discusses how Capital One embraced components-of-the-shelf (COTS) to enhance agility in their technology landscape. The presenters highlight the benefits of COTS, such as accelerated development, risk mitigation, and specialized expertise, and also address common challenges and design considerations when implementing a COTS-based architecture. back to top

Phippy’s Field Guide to Wasm - Karen Chu & Matt Butcher, Fermyon The talk discusses the history and evolution of web assembly, a binary format for applications that provides a secure, cross-platform, and fast execution environment for cloud computing. The speakers highlight how web assembly's component model allows for the composition of applications from different languages, enabling developers to leverage the best tools and libraries for their needs. back to top

LoRAX: Serve 1000s of Fine-Tuned LLMs on a Single GPU - Travis Addair, Predibase, Inc. LoRAX is a production-ready serving stack for large language model (LLM) inference, designed to efficiently serve thousands of fine-tuned LLMs on a single GPU. The project addresses the challenges of cost and complexity associated with deploying multiple specialized LLMs, offering techniques like dynamic adapter loading, heterogeneous continuous batching, and support for parameter-efficient fine-tuning to enable scalable and cost-effective LLM serving. back to top

A Greener, Cost-Effective Cloud with Serverless WebAssembly - Kate Goldenring This talk explores how serverless and WebAssembly can enable a greener, more cost-effective cloud infrastructure. It discusses the benefits of serverless, the challenges with current serverless implementations, and how WebAssembly can address these issues to achieve the potential of serverless for sustainable software development. back to top

Fetching and Running Container Images on Browsers - Kohei Tokunaga, NTT Corporation This talk presents an experimental approach called 'Container to WASM' that enables running unmodified Linux-based containers on web browsers, including the ability to distribute OCI container images directly to browsers. The speaker also demonstrates a VS Code extension that leverages this technology to run containers within the browser-based IDE. back to top

SBOM in SaaS Environments: An Update - Nisha Kumar, Oracle This talk provides an update on the efforts of the CISA working group to define an SBOM (Software Bill of Materials) standard for SaaS (Software as a Service) environments. The speaker discusses the challenges faced in adapting the existing NTIA minimum elements for SBOM to the complex and rapidly changing world of SaaS, and outlines the working group's proposed roles, definitions, and future areas of focus to address the unique requirements of the SaaS ecosystem. back to top

Software Engineering

Software in Space: Lessons Every Developer Can Learn From - Joe Winchester, IBM This talk explores lessons for software developers from various space missions, including the Ariane 5 rocket failure due to a software bug, the Cassini-Huygens mission's challenges with Doppler shift, and the Mars Climate Orbiter and Mars Lander failures due to units mismatch and other issues. The key takeaways emphasize the importance of understanding numbers, testing edge cases, and avoiding single points of failure when building complex software systems. back to top

Supply Chain

Sustainable Supply Chains: Digital Trust for Organizational Identities in the Minin...- Nancy Norris This presentation discusses the development of a digital trust system for sustainable supply chains, particularly in the mining sector. It explores the use of verifiable credentials to address challenges around data sharing, transparency, and greenwashing, and outlines a UN project aimed at creating a global transparency protocol for tracing supply chain data. back to top

Sustainability

One Year On: Linux Foundation & Sustainability - Hilary Carter & Anna Hermansen The Linux Foundation's research program has been exploring the intersection between open-source software and sustainability, identifying how open-source projects can accelerate the achievement of the United Nations Sustainable Development Goals. The presentation highlights various open-source initiatives in healthcare, energy, and environmental conservation, showcasing the potential of open-source technology to address pressing global challenges. back to top

How to Build an Open-Source, Non-Profit Creating Hardware and Software for Climate - Keenan Johnson The presentation discusses the journey of building an open-source, non-profit organization called Rivet Network, which aims to create hardware and software for climate action. The speaker shares insights into the challenges of measuring greenhouse gas emissions, the process of starting a non-profit, and the technical and organizational progress made by the organization. back to top

Sustainably Automate Manual Cell-Staining with Innovative Open-Sour...- Neethu Simon & Elizabeth Lee This talk presents a solution to sustainably automate the manual cell-staining process in the biopharma industry using an innovative open-source, microservices-based architecture deployed at the edge. The solution leverages computer vision and AI techniques to eliminate the need for toxic chemicals and complex processes, enabling efficient and scalable cell analysis for various applications. back to top

Trademark

What’s in a Name? The Highs and Lows of OSS Trademark Policy Dev...- Rebecca Rumbul & Gracie Gregory The Rust Foundation's attempt to update its trademark policy led to a backlash from the community due to poor communication and transparency. The foundation has learned valuable lessons about the importance of community consultation, crisis management, and providing clear explanations for policy changes in open-source projects. back to top