RE: https://mastodon.social/@FreeBSDFoundation/116676767603367392

2026 Open Source Security and Risk Analysis Report – Software Governance in the AI Era – Black Duck Software, Inc.

https://www.blackduck.com/content/dam/black-duck/en-us/reports/rep-ossra.pdf

― a direct link to the freely-available report that's mentioned in the joint statement from Apereo Foundation, Open Source Initiative (OSI), Open Source Technology Improvement Fund (OSTIF), and FreeBSD Foundation.

"The “Open Source Security and Risk Analysis” (OSSRA) report has been the industry’s definitive look at the state of open source code for a decade. Each year, we analyze anonymized findings from commercial codebases audited by the Black Duck Audit Services team, and this provides an unmatched, real-world view of how open source is used—and sometimes misused—across every major industry. This year’s findings document a pivotal moment: The explosion of AI-assisted development has fundamentally altered the risk landscape for software and the baseline for compliance with new regulatory initiatives such as the EU Cyber Resilience Act (CRA) and the Digital Operational Resilience Act (DORA). …"

#AI #CRA #DORA #OSI #OSTIF #FreeBSD #OSSRA

@cybervegan in fairness to the four signatories, the statement is suitably:

― terse
― professional
― non-aggressive.

I'm not the target audience, but I can see how the statement might grab the attention of individuals and groups who are targeted.

There is, amongst other things, an element of https://xkcd.com/2347/ (xkcd: Dependency) – without explicitly stating "Don't fuck this up.".

Cc @jay_chi @FreeBSDFoundation

#OSI #OSTIF #Apero #FreeBSD #ageattestation

When it came to Open Source AI, the #OSI's #OSAID was the inspiration for the work. That means models’ weights,
deployment code, training code, and at least data information (but preferably training data).

I defended the #OSI view that Data Information is a necessary compromise for cases where data sharing is impossible for technical or legal reasons (copyright, data protection etc..), to ensure legal certainty.

But also shared that a part of the community has reservations about the approach⬇️

I'll get on to the outcome in a second, but there is one more nice surprise to get into: as we got towards the end of the process, the French Presidency asked me if the OSI's Executive Director would be willing to address the #G7 Ministers, outlining the work we've been doing and the benefits of Openness.

We naturally accepted, and #OSI's new #ED found himself giving a speech in a suit around the table with Government Ministers of G7 Members!

As I am based in #Brussels, and Paris is a short train journey away, I was sent as #OSI's representative in negotiations. (I'm also trilingual (🇬🇧 🇫🇷 🇩🇪 ) which helps!)

Negotiations took place at the Ministry of Economy, not far from where I used to live in Paris.

Unrelated trivia: The building also has an interesting feature: it has pipes that transport liquid soap to all bathrooms. ⬇️