Keynote: Open Source, Open Internet, and Open Standards

### Overview In this keynote address, Emilio Salvador from Google's Open Source Programs Office (OSPO) outlines Google's historical journey, ongoing contributions, and evolving strategy regarding open source, open internet, and open standards. Emilio emphasizes that sustaining an open, fair, free, and safe internet requires balancing four foundational elements: technology, people (the community), standards, and security. He discusses how Google actively participates across the open source ecosystem, highlights community dynamics and challenges like burnout, examines the role of standards bodies, and presents Google's structured framework for enhancing open source software supply chain security.

### Key Topics - **Google OSPO Mission and History**: Founded around the principle of bringing the value of open source to Google and Google's resources to open source, Google's involvement began with early Linux patches in 2001, its first open source project release in 2004, and subsequent landmark releases including Android, Chromium, TensorFlow, and Kubernetes (2015). - **Scale of Open Source Engagement**: 75% of the open source projects Google participates in are non-Alphabet projects (e.g., Apache Spark, Arrow, Envoy). Roughly 10% of Alphabet employees actively participate in open source across more than 70,000 repositories, of which only 10,000 are Google-hosted. - **Community and Human Factors**: Open source time commitment is roughly split 50/50 between personal and professional time. People often join to learn skills but stay for community. However, developer burnout and time constraints represent significant threats to project sustainability. - **Open Standards**: Standards provide necessary guidelines as technology and communities scale. Emilio differentiates standards into regulatory standards (legally binding), industry standards (widely used technologies), and formally certified standards from bodies like IETF, ISO, and IEEE. - **Security and the 'Know, Prevent, Fix' Framework**: Overview of initiatives undertaken by Google's dedicated open source security team and collaborations under the OpenSSF.

### Technical Details - **Niche and Recent Open Source Projects**: Releases mentioned include new network libraries for topology optimization, a C++ sorting library offering up to a 10x performance improvement over standard quicksort, the OpenROAD hardware initiative (sponsoring open-source PDK-based chip production), El Carro for running Oracle databases on Kubernetes, and Cirq/Quantum Computing v1 (Python framework for quantum computing). - **OpenSSF and Foundation Partnerships**: Google joined the Linux Foundation in 2005, the Apache Foundation board in 2006, and OpenSSF approximately one year prior to the talk. - **Security Framework Components**: - *Standard Vulnerability Format*: Adopted across languages such as Python, Go, and Rust to provide a common syntax and language for tracking known vulnerabilities. - *Open Source Insights*: Launched in 2021 to map code dependencies and surface associated vulnerabilities. - *Scorecard*: Developed under OpenSSF to evaluate project risk profiles, currently scanning over 1,000,000 projects with community help from partners like Cisco and Datadog. - *Sigstore*: Created to facilitate cryptographic code signing and provenance verification; adopted by Kubernetes starting in April for all official releases.

### Takeaways - Open source security requires systematic tooling across three pillars: knowing dependencies and vulnerabilities, preventing insecure code from entering the supply chain, and fixing flaws efficiently. - Developers and organizations should adopt automated evaluation tools (like Scorecard) and code provenance signing (like Sigstore) to strengthen software supply chains. - Organizations must account for the human factor in open source, mitigating burnout for contributors who frequently split their time between professional and personal hours. - Individual security practices matter; attendees are encouraged to implement multifactor authentication using hardware security keys to protect developer accounts and projects.