Archive for the ‘Strategy’ Category
The Open Source Community is Building Cybersecurity Processes for CRA Compliance
tl;dr – Apache Software Foundation, Blender Foundation, OpenSSL Software Foundation, PHP Foundation, Python Software Foundation, Rust Foundation, and Eclipse Foundation are jointly announcing our intention to collaborate on the establishment of common specifications for secure software development based on existing open source best practices.
In an effort to meet the real challenges of cybersecurity in the open source ecosystem, and to demonstrate full cooperation with, and to support the implementation of, the European Union’s Cyber Resilience Act (CRA), Apache Software Foundation, Blender Foundation, OpenSSL Software Foundation, PHP Foundation, Python Software Foundation, Rust Foundation, and Eclipse Foundation are announcing an initiative to establish common specifications for secure software development based on open source best practices.
This collaborative effort will be hosted at the Brussels-based Eclipse Foundation AISBL under the auspices of the Eclipse Foundation Specification Process and a new working group. As Europe’s largest open source foundation, which also supports a robust open specification process, the Eclipse Foundation is a natural home for this effort. Other code-hosting open source foundations, SMEs, industry players, and researchers are invited to join in as well. The starting point for this highly technical standardisation effort will be today’s existing security policies and procedures of the respective open source foundations, and similar documents describing best practices. The governance of the working group will follow the Eclipse Foundation’s usual member-led model but will be augmented by explicit representation from the open source community to ensure diversity and balance in decision-making. The deliverables will consist of one or more process specifications made available under a liberal specification copyright licence and a royalty-free patent licence.
The reasons for this collaboration extend beyond compliance. In an era where software, particularly open source software, plays an increasingly vital role in modern society, the need for reliability, safety, and security has steadily increased. New regulations, exemplified by the impending CRA, underscore the urgency for secure by design and robust supply chain security standards well before the new regulation comes into force in 2027.
While open source communities and foundations generally adhere to and have historically established industry best practices around security, their approaches often lack alignment and comprehensive documentation. The open source community and the broader software industry now share a common challenge: legislation has introduced an urgent need for cybersecurity process standards.
The CRA will lead to numerous standards requests from the Commission to the European Standards Organisations. And these are only the European requirements – additional demands from the US and other regions can be anticipated.
The CRA also creates a new type of economic actor – the “Open Source Software Steward”. It is in this context that we, as open source foundations, want to respond to the challenge of establishing common specifications for secure software development.
This challenge is compounded by the following:
- Today’s global software infrastructure is over 80% open source. The software stack that underpins any product with digital elements is typically built using open source software. As a result, it is fair to say that when we discuss the “software supply chain,” we are primarily, but not exclusively, referring to open source.
- Traditional standards organisations have had limited interactions with open source communities and the broader software/IT industry. To make matters more complicated, their governance models currently do not provide opportunities for open source communities to engage.
- Open source communities have a limited history of dealing with traditional standards organisations. To make matters more complicated, their resource constraints make it difficult for them to engage.
- Standards setting is typically a long process, and time is of the essence.
So while these new cybersecurity standards must be developed with the requirements of open source development processes and communities in mind, there is no clear path on how to do so in the time available. It is also important to note that it is similarly necessary that these standards be developed in a manner that also includes the requirements of proprietary software development, large enterprises, vertical industries, and small and medium enterprises.
Despite these challenges, a foundation for progress exists. The leading open source communities and foundations have for years developed and practised secure software development processes. These are processes that have often defined or set industry best practices around things such as coordinated disclosure, peer review, and release processes. These processes have been documented by each of these communities, albeit sometimes using different terminology and approaches. We hypothesise that the cybersecurity process technical documentation that already exists amongst the open source communities can provide a useful starting point for developing the cybersecurity processes required for regulatory compliance.
We hope that our specifications could inform the formal standardisation processes of at least one of the European Standards Organisations. Given the tight time horizon for implementation of the CRA, we believe that this immediate start will provide a constructive environment to host the technical discussions necessary for the stewards, contributors, and adopters of open source to meet the requirements set forth in these new regulations.
We invite you to join our collaborative effort to create specifications for secure open source development: Contribute your ideas and participate in the magic that unfolds when open source foundations, SMEs, industry leaders, and researchers combine forces to tackle big challenges. To stay updated on this initiative, sign up for our mailing list.
Eclipse Software Defined Vehicle: Building the Future of Automotive
Today the Eclipse Foundation is announcing a new working group dedicated to developing a new and innovative software platform for the world’s automotive industry. The Eclipse Software Defined Vehicle (SDV) initiative has the support of leading companies across the automotive, IT, cloud, and services industries, all of which are necessary to create the platform and ecosystem that will drive innovation for the next generation of mobility solutions.
The automotive industry today is undergoing a radical transformation. Electrification, autonomous vehicles, advanced driver assistance systems, and ever-increasing consumer expectations about their in-car digital experience, are all happening at once. These trends are dramatically transforming the system architectures embedded in vehicles. Automotive architectures are moving from networks of special purpose devices to something that more closely resembles servers on wheels, where more powerful general purpose computers are responsible for implementing and coordinating the various systems in the automobile, including the ones which keep us and our families safe on the road. And these systems architectures are rapidly changing how automotive software needs to be built.
The vision of SDV is to radically transform the automotive industry by collaboratively developing a common software platform that all participants in the automotive industry can use in an openly licensed, royalty-free manner. From an IT technology perspective this is not particularly radical. After all, open source platforms and “software defined everything” (e.g. storage, networking, data center, radio, etc.) are two of the defining trends in the IT industry over the past decade (or more). In the case of open source platforms the trend has been driven by eliminating the cost of non-differentiating software, decreasing the time to market in delivering complex systems, and reducing risk by relying on proven software platforms and components. “Software defined everything” has largely been driven by Moore’s Law and the resulting cost savings of replacing special purpose devices with general purpose computers running special purpose software.
But from an industry perspective, the technical implications of an openly licensed SDV software platform for the automotive industry are very radical. It will dramatically reshape the automotive industry similar to how software-defined networking reshaped the telecommunications industry. Free software platforms which provide a software stack for the core non-differentiating technologies will quickly lead to disruptive technical and business innovations across the value chain in any industry.
The Eclipse SDV initiative is primarily radical because it is among the first truly open industry collaborations in automotive. Historically, automotive industry groups have delivered standards or specifications available only to members of their respective consortia. Often these innovations were encumbered with FRAND-style licensing arrangements which hindered wide adoption. Eclipse SDV is going to provide a radical departure from this “business as usual” approach in automotive by focusing on open source software stacks, liberally licensed software specifications, and a community-based, collaborative approach to innovation rather than the top-down, architecture-driven, consensus-based models of the past. The mantra of Eclipse SDV is “code first”, and that is definitely a radical idea in automotive. We are humbled by the trust that Accenture, Arm, AVL, Bosch, Capgemini, Continental Automotive, DMI, ETAS, Futurewei Technologies, Karakun, Microsoft, Red Hat, Reycom, SUSE, and ZF are placing in the Eclipse Foundation to act as the steward for this exciting initiative.
I want to sincerely thank everyone who helped get this initiative off the ground and raise awareness about its value to organizations across the automotive industry.
I also want to encourage automotive industry stakeholders of all sizes and with any goals to consider joining the working group. The breadth and depth of in-vehicle software creates opportunities across every area of automotive development — from deployment, configuration, and communications to monitoring, safety, and security. If you or your organization are interested in learning more joining Eclipse SDV, please contact us.
With the Eclipse Foundation’s commitment to transparency, vendor neutrality, and a shared voice, all participants have an equal opportunity to shape the future of the SDV Working Group and play a vital role in the future evolution of the automotive industry.
To learn more about getting involved in the Software-Defined Vehicle Working Group, visit sdv.eclipse.org or email us at membership@eclipse.org.
Welcome to the Eclipse Foundation AISBL
Today, we’re announcing that the Eclipse Foundation has successfully completed all of the necessary formalities and has formally established the Eclipse Foundation AISBL, an international non-profit association based in Brussels, Belgium.
As a European-based global organization, the Eclipse Foundation is in the ideal position to build on the growing momentum of strategic open source in Europe and on our strength in the region to support open source innovation globally.
Today’s announcement is the culmination of months of work, since we first announced our intent to establish ourselves as European in May 2020. I want to thank everyone who has had a hand in making our legal transition to Europe a reality. There have been many aspects to consider and a lot of work behind the scenes to get all of the required pieces in place. And the journey isn’t over yet! I will be publishing a second blog post shortly discussing what this means for our members and committers. Tl;dr: keep doing what you’re doing.
Building on Our Strength in Europe Advances Open Source Innovation Globally
The Eclipse Foundation is the largest open source software foundation in Europe in terms of staff, projects, developers, and members. We have more than 170 members and more than 900 committers based in Europe. And we’re already home to a number of publicly funded European research projects that enable academics, subject matter experts, and large organizations to collaborate and build on research results to benefit corporations and the public.
We see a huge opportunity to build on our strong membership base, active developer community, and strong institutional relationships in Europe to enable the free flow of open software innovation throughout the world. Everyone will benefit from more choices and greater diversity of open source software technologies to build on.
As the Eclipse Foundation continues to grow — we added 75 new members in 2020 alone — the choices, diversity, and benefits will multiply. The future of open source has never looked brighter.
Europe Has Embraced Open Source Software
The strategic value of open source software is recognized across European government organizations, corporations, and publicly funded institutions:
- The European Commission considers open source initiatives to be strategically important to drive digital and industrial transformations that will help to shape Europe’s digital future.
- Leading European corporations, including Bosch, Daimler TSS, IBM, and SAP — all founding members of the Eclipse Foundation AISBL — see open source collaboration as an important way to accelerate innovation and increase their competitive edge.
- Academic and research institutions are increasingly using open source software as a catalyst for innovation.
All of these organizations see the benefits of joining forces with each other, and with organizations around the world, to collaborate on open source software innovation. Many already see the Eclipse Foundation as the right place to foster global industry collaboration on open source projects in strategic technology areas, such as cloud, edge computing, artificial intelligence, connected vehicles, telecom, and IoT.
Get More Information
To provide more insight into our legal move to Europe and what it means for Eclipse Foundation members, we’ve developed a number of resources we think you’ll find helpful. I will also be providing an additional post tomorrow with additional details for members.
- Frequently asked questions.
- A new case study that describes the business benefits Obeo has gained as a member of the Eclipse Foundation alongside much larger companies.
- A free white paper that explains the Eclipse Foundation’s role at the center of European open source innovation: Enabling Digital Transformation in Europe Through Global Open Source Collaboration.
- A helpful overview presentation about the Eclipse Foundation AISBL.
This is a big day for the Eclipse Foundation and its community. I want to thank all of my colleagues on the staff and our Board that helped make this possible.
What’s ahead for Open Source in 2021 and beyond
For some reason, the tradition amongst most technology pundits is to spend the waning weeks and days of the past year making prognostications about what’s to come. I’m all for introspection, but making guesses right before the holidays usually means I’m going to forget what I said (wrote?) after my holiday break. Besides, I’d much rather focus on beginnings than endings. That’s why I’m opening the new year here at the Eclipse Foundation with some thoughts on what’s to come for open source software in general, but also specific insights into the technology segments the Eclipse community is focused on: enterprise Java, the IoT and Edge computing, developer tooling, and automotive design.
Let’s start with a very general prediction, but a critically important one: the open source model for collaborative innovations will continue its growth, particularly with enterprises and industrials. Open source is already the dominant model for collaboration amongst companies in the IT and software technology sectors. But it is quickly becoming mainstream among every company working on a digitalization strategy. The pace of innovation and level of collaboration enabled by the open source model simply cannot be matched.
Many European companies have largely missed out on this value to date. In order to create the new platforms necessary for future prosperity, both governments and industry need to become software-centric and master the process of innovating and contributing via the open source model. You’re going to see a lot of that in 2021, particularly as we shift our own legal headquarters to Brussels early this year.
Now, let’s get a little bit more specific …
Cloud Native Java Predictions
The Java EE ecosystem will switch to Jakarta EE
With the release of Jakarta EE 9 on December 8 of last year, the enterprise Java ecosystem will move to the new jakarta.* namespace. It will be gradual at first, but much of the industry will come around surprisingly quickly. We are already seeing rapid adoption of the new jakarta namespace by the vast ecosystem of open source projects built on Jakarta EE specifications.
Now the focus is on innovation, and the pace of development for Jakarta EE will speed up with the community focusing on delivering both Jakarta EE 9.1 and 10 releases. In addition, the successful transition to the jakarta.* namespace cracks open the door on further integrating Jakarta EE with the world of microservices and containers. The community is already working on increasing the alignment of MicroProfile and Jakarta EE to meet this challenge.
The inexorable rise of community-supported Java binaries will continue
With the move of AdoptOpenJDK to the Eclipse Foundation and its birth as Eclipse Adoptium, the industry will have a single, vendor-neutral source of high-quality open source Java runtimes. Expect to see adoption accelerate as developers use the project’s high quality binaries and technologies across the Java ecosystem.
2021 will serve as the “tipping point” for cloud-based development tools
A wholesale move to the cloud driven by the era of COVID-19 and remote work, combined with the release of new cloud-based tools like Eclipse Theia, Eclipse Che, and Github Codespaces, accelerates the trend towards cloud-based development tools Traditional desktop tools will have a long tail, but the proverbial tipping point has been reached.
IoT and Edge Computing Predictions
As Edge Computing architectures and the Internet of Things (IoT) continue to proliferate throughout multiple vertical markets, one trend that enterprises have made abundantly clear is that, in 2021, they expect many edge computing solutions and IoT technologies to leverage open source. This was confirmed in the most recent Eclipse IoT Commercial Adoption survey published in March 2020, which found that 60% of the organizations surveyed are factoring open source into their deployment plans.
One guiding factor to these trends is that businesses want to tailor information technology (IT) and operational technology (OT) builds to meet their specific requirements while avoiding vendor lock-in. This is best accomplished with solutions based on an open source model. In other words: while businesses certainly appreciate the cost and time savings open source offers, what they truly need is the control and flexibility it affords.
Open source will help solve SCADA software interoperability
This prediction is a bit specific to the Industrial IoT (IIoT), but given the size of this market, everyone from Chevron to Intel are carefully building solutions based on open source to address this issue. While SCADA providers have fully embraced IoT as a concept, sector growth has been limited by lack of interoperability between proprietary systems. Open source IoT solutions, such as Sparkplug, will enable new innovations that finally allow for true widespread interoperability.
2021 will mark the rise of the Hybrid Edge
Hybrid cloud was definitely one of the biggest buzzwords of 2020, but in 2021, we believe this concept will be applied to edge computing architectures. Just as hybrid cloud requires orchestration between public, private, and distributed compute architectures, so too will enterprises that may be deploying their own edge networks, using edge compute offerings from a cloud provider, and operating separate edge networks for different use cases (AI vs. IoT for example). What is needed to fulfill this vision is an open source platform for Edge computing that the industry can rally around.
Cloud providers will embrace open source edge computing
Late 2020 saw all three major cloud providers – AWS, Azure, and GCP – deliver their own edge offerings. We believe 2021 will not only see a continuation of this trend, but also see providers embrace open source edge solutions as a means of differentiation and to speed innovation within their own development efforts.
For organizations looking to leverage both edge computing and IoT, they need to carefully evaluate their strategies and the open source alternatives that will enable their software-defined initiatives to thrive. By doing so, they will enable not just near-term efficiency, but lay a foundation upon which future innovations can be built for years to come.
Automotive Software Predictions
Of all the market segments I’ve written about today, none have been as slow to adopt the open source model as the automotive industry. Open source is potentially a life saver for this industry given its many challenges.
Automakers will respond to the impact of the pandemic by accelerating their digital transformation.
By and large, OEMs in the global auto sector have recognized a deep need to move on from development models of a bygone era. The global economic impact of the pandemic is forcing their hand to quickly pivot to meet the needs of a new economy. They know this. What will change in 2021 is the realization that mastering the art of open source is a necessary step in their digital transformation.
OSS will serve as the primary catalyst in most automakers digital transformation.
We’re already seeing this shift begin in 2020. The traditional automakers are embracing open source to establish industry-scale collaboration on core frameworks, toolchains, and systems for interoperability, simulation, testing, validation, and certification. We expect to see accelerating OSS innovation in areas like AI for autonomous driving, with some companies contributing AI elements to the open ecosystem.
In 2021, the challenges of autonomous vehicle design will force the industry to turn to community-based collaboration in order to reach its full potential.
Currently, the majority of firms choose to perform their development completely in-house. 2021 will see some of these organizations become aware that they cannot do everything alone. We predict more partnerships and potentially some consolidation in the market as well. Firms will shift to a more collaborative approach that leverages the entire industry, with the OSS model serving as a mechanism to enable this transition.
And let’s not forget the best part about open source; you can participate in the process and help guide the outcome. The Eclipse Foundation is just one means to this end, but you want to find out more, visit here – https://www.eclipse.org/membership/#tab-membership
In the meantime, I’m looking forward to engaging with many of you as we all work to build more positive outcomes for 2021. Happy New Year everyone!
Life at Eclipse 