Mehdi Snene  

What is Open Source in AI? What does it mean? What are the foundational pieces? How far along is the data? There is mention of weights, and data skills. How can we truly understand what Open Source in AI is? Today, joining us, we’ll have someone who can help us understand what Open Source in AI means and where we are heading. Stefano, can you offer your insights?

Stefano Maffulli  

Thanks. We have some thoughts on this. We’ve been pondering these questions since they first emerged when GPT started to appear. We asked ourselves: How do we transfer the principles of permissionless innovation and the immense value created by the Open Source ecosystem into the AI space?

After a little over two years of research and global conversations with multiple stakeholders, we identified three key elements. Firstly, permissionless innovation needs to be ported to AI, but this is complex and must be broken down into smaller components.

We realized that, as developers, users, and deployers of AI systems, we need to understand how these systems are built. This involves studying all components carefully, being able to run them for any purpose without asking for permission (a basic tenet of Open Source), and modifying them to change outputs based on the same inputs. These basic principles include being able to share these modifications with others.

To achieve this, you need data, the code used for training and cleaning the data (e.g., removing duplicates), the parameters, the weights, and a way to run inference on those weights. It’s fairly straightforward. However, the challenge lies in the legal framework.

Now, the complicated piece is how Open Source software has had a very wonderful run, based on the fact that the legal framework that governs Open Source is fairly simple and globally accepted. It’s built on copyright, a system that has worked wonderfully in both ways. It gives exclusive rights to the content creators, but also the same mechanism can be used to grant rights to anyone who receives the creation.

With data, we don’t have that mechanism. That is a very simple and dramatic realization. When we talk about data, we should pay attention to what kind of data we’re discussing. There is data as content created, and there is data as facts; like fires, speed limits, or traces of a road. Those are facts, and they have different ways of being treated. There is also private data, personal information, and various other kinds of data, each with different rules and regulations around the world.

Governments’ major role in the future will be to facilitate permissionless innovation in data by harmonizing these rules. This will level the playing field, where currently larger corporations have significantly more power than Open Source developers or those wishing to create large language models. Governments should help create datasets, remove barriers, and facilitate access for academia, smaller developers, and the global south.

Mehdi Snene  

We already have open data and Open Source. Now, we need to create open AI and open models. Are we bringing these two domains together and keeping them separate, or are we creating something new from scratch when we talk about open AI?

Stefano Maffulli 

This is a very interesting and powerful question. I believe that open data as a movement has been around for quite a while. However, it’s only recently that data scientists have truly realized the value they hold in their hands. Data is fungible and can be used to build new things that are completely different from their original domains.

We need to talk more about this and establish platforms for better interaction. One striking example is a popular dataset of images used for training many image generation AI tools, which contained child sexual abuse images for many years. A research paper highlighted this huge problem, but no one filed a bug report, and there was no easy way for the maintainers of this dataset to notice and remove those images.

There are things that the software world understands very well, and things that data scientists understand very well. We are starting to see the need for more space for interactions and learning from each other.

The conversation is extremely complicated. Alex and I have had long discussions about this. I don’t want to focus entirely on this, but I do want to say that Open Source has never been about pleasing companies or specific stakeholders. We need to think of it as an ecosystem where the balances of power are maintained.

While Open Source software and Open Source AI are still evolving, the necessary ingredients—data, code, and other components—are there. However, the data piece still needs to be debated and finalized. Pushing for radical openness with data has clear drawbacks and issues. It’s going to be a balance of intentions, aiming for the best outcome for the general public and the whole ecosystem.

Mehdi Snene  

Thank you so much. My next question is about the future. What are your thoughts on the next big technology?

Stefano Maffulli 

From the perspective of open innovation, it’s about what’s going to give society control over technology. The focus of Open Source has always been to enable developers and end-users to have sovereignty over the technology they use. Whether it’s quantum computers, AI, or future technologies, maintaining that control is crucial.

Governments need to play a role in enabling innovation and ensuring that no single power becomes too dominant. The balance between the private sector, public sector, nonprofit sector, and the often-overlooked fourth sector—which includes developers and creators who work for the public good rather than for profit—must be maintained. This balance is essential for fostering an ecosystem where all stakeholders have equal interests and influence.

If you would like to listen to the panel discussion in its entirety, you can do so here (the Open Source AI panel starts at 1:00:00 approximately).

Keynote: Welcome & Opening Remarks

Ibrahim Haddad, Executive Director of the LF AI & Data Foundation, provided an overview of the major challenges in Open Source AI, which include:

• Lack of a common understanding of openness in AI
• Open Source software licenses used on non-software assets
• Diverse restrictions including the use of Acceptable Use Policies
• Lack of understanding of licenses and implications in the context of AI models
• Incomplete release of model components

To address some of these challenges, Haddad introduced the Model Openness Framework (MOF) and announced the official launch of the Model Openness Tool (MOT) at the conference.

Introducing the Model Openness Framework: Achieving Completeness and Openness in a Confusing Generative AI Landscape

Anni Lai, Matt White, and Cailean Osborne delved into the Model Openness Framework, a comprehensive system for evaluating and classifying the completeness and openness of Machine Learning models. This framework assesses which components of the model development lifecycle are publicly released and under what licenses, ensuring an objective evaluation. Matt White, Executive Director of the Pytorch Foundation and author of the MOF white paper, went on to demonstrate the Model Openness Tool, which evaluates each model across 3 classes: Open Science (Class I), Open Tooling (Class II), and Open Model (Class III).

The Open Source AI dilemma: Crafting a clear definition for Open Source AI

Ofer Hermoni, founder of the LF AI & Data Foundation, continued examining the Model Openness Framework and explained how this framework and its list of components serve as the basis for OSI’s Open Source AI Definition (OSAID). The OSAID evaluates each component on the four fundamental freedoms of Open Source:

• To use the system for any purpose and without having to ask for permission
• To study how the system works and inspect its components
• To modify the system for any purpose, including to change its output
• To share the system for others to use with or without modifications, for any purpose

Toward AI Democratization with Digital Public Goods

Lea Gimpel and Daniel Brumund from the Digital Public Goods Alliance (DPGA) emphasized the importance of democratizing AI through digital public goods, including Open Source software, open AI models, open data, open standards, and open content. Lea highlighted that, while open data is desirable, it is not conditional. She supported the OSI’s Open Source AI Definition, as it helps the DPGA navigate legal uncertainties around data sharing and broadens the pool of potential solutions that can be recognized, marketed, and made available as digital public goods, thereby offering more opportunities to positively impact people’s lives.

Conclusion

It was clear throughout this conference that the work to create a standard Open Source AI Definition that upholds the fundamental freedoms of Open Source is vital for addressing some of the key challenges in AI and ML development and democratization. The OSI appreciates Linux Foundation’s collaboration toward this goal and its commitment to host another successful event to facilitate these important discussions.

OSAID Workshop: compiling a FAQ to make the definition clear and easy to use

The OSI has embarked on a co-design process with multiple stakeholders to arrive at the Open Source AI Definition (OSAID). This process has been led by Mer Joyce, the co-design expert and facilitator, and Stefano Maffulli, the executive director of the OSI.

At the workshop organized at PyCon US, Mer provided an overview of the co-design process so far, summarized below.

The first step of the co-design process was to identify the freedoms needed for Open Source AI. After various online and in-person activities and discussions, including five workshops across the world, the community identified four freedoms:

1. To Use the system for any purpose and without having to ask for permission.
2. To Study how the system works and inspect its components.
3. To Modify the system for any purpose, including to change its output.
4. To Share the system for others to use with or without modifications, for any purpose.

The next step was to form four working groups to initially analyze four AI systems. To achieve better representation, special attention was given to diversity, equity and inclusion. Over 50% of the working group participants are people of color, 30% are black, 75% were born outside the US and 25% are women, trans and nonbinary.

These working groups discussed and voted on which AI system components should be required to satisfy the four freedoms for AI. The components we adopted are described in the Model Openness Framework developed by the Linux Foundation.

The vote compilation was performed based on the mean total votes per component (μ). Components which received over 2μ votes were marked as required and between 1.5μ and 2μ were marked likely required. Components that received between 0.5μ and μ were marked likely not required and less than 0.5μ as not required.

The working groups evaluated legal frameworks and legal documents for each component. Finally, each working group published a recommendation report. The end result is the OSAID with a comprehensive definition checklist encompassing a total of 17 components. More working groups are being formed to evaluate how well other AI systems align with the definition.

After providing an overview of the co-design process, Mer went on to organize an exercise with the participants to compile a FAQ.

The questions raised at the workshop revolved around the following topics:

• End user comprehension: how and why are AI systems different from Open Source software? As an end-user, why should they care if an AI system is open?
• Datasets: Why is data itself not required? Should Open Source AI datasets be required to prove copyright compliance? How can one audit these systems for bias without the data? What does data provenance and data labeling entail?
• Models: How can proper attribution of model parameters be enforced? What is the ownership/attribution of model parameters which were trained by one author and then “fine-tuned” by another?
• Code: Can projects that include only source code (no data info or model weights) still use a regular Open Source license (MIT, Apache, etc.)?
• Governance: For a specific AI, who determines whether the information provided about the training, dataset, process, etc. is “sufficient” and how?
• Adoption of the OSAID: What are incentives for people/companies to adopt this standard?
• Legal weight: Is the OSAID supposed to have legal weight?

These questions and answers raised at the workshop will be important for enhancing the existing FAQ, which will be made available along with the OSAID.

Community Booth: gathering feedback on the “Unlock the OSAID” visualization

At the community booth, the OSI held two activities to draw in participants interested in Open Source AI. The first activity was a quiz developed by Ariel Jolo, program coordinator at the OSI, to assess participants’ knowledge of  Python and AI/ML. Once we had an understanding of their skills, we went on to the second and main activity, which was to gather feedback on the OSAID using a novel way to visualize how different AI systems match the current draft definition as described below.

Making it easy for different stakeholders to visualize whether or not an AI system matches the OSAID is a challenge, especially because there are so many components involved. This is where the visualization concept we named “Unlock the OSAID” came in. 

The OSI keyhole is a well recognized logo that represents the source code that unlocks the freedoms to use, study, modify, and share software. With the Unlock the OSAID, we played on that same idea, but now for AI systems. We displayed three keyholes representing the three domains these 17 components fall within: code, model and data information.

Here is the image representing the “code keyhole” with the required components to unlock the OSAID:

On the inner ring we have the required components to unlock the OSAID, while on the outer ring we have optional components. The required code components are: libraries and tools; inference; training, validation and testing; data pre-processing. The optional components are: inference for benchmark and evaluation code. 

To fully unlock the OSAID, an AI system must have all the required components for code, model and data information. To better understand how the “Unlock the OSAID” visualization works, let’s look at two hypothetical AI systems: example 1 and example 2.

Let’s start looking at example 1 (in red) and see if this system unlocks the OSAID for code:

Example 1 only provides inference code, so the key (in red) doesn’t “fit” the code keyhole (in green).

Now let’s look at example 2 (in blue):

Example 2 provides all required components (and more), so the key (in blue) fits the code keyhole (in green). Therefore, example 2 unlocks the OSAID for code. For example 2 to be considered Open Source AI, it would also have to unlock the OSAID for model and data information: 

We received good feedback from participants about the “Unlock the OSAID” visualization. Once participants grasped the concept of the keyholes and which components were required or optional, it was easy to identify if an AI system unlocks the OSAID or not. They could visually see if the keys fit the keyholes or not. If all keys fit, then that AI system adheres to the OSAID.

Final thoughts: engaging with the community and promoting Open Source principles

For me, the highlight of PyCon US was the opportunity to finally meet members of the OSI and the Python community in person, both new and old acquaintances. I had good conversations with Deb Nicholson (Python Software Foundation), Hannah Aubry (Fastly), Ana Hevesi (Uploop), Tom “spot” Callaway (AWS), Julia Ferraioli (AWS), Tony Kipkemboi (Streamlit), Michael Winser (Alpha-Omega), Jason C. MacDonald (OWASP), Cheuk Ting Ho (CMD Limes), Kamile Demir (Adobe), Mariatta Wijaya (PSF), Loren Clary (PSF) and Miaolai Zhou (AWS). I also interacted with many folks from the following communities: Python Brazil, Python en Español, PyLadies and Black Python Devs. It was great to bump into great legends like Seth Larson (PSF), Peter Wang (Anaconda) and Guido van Rossum.

I loved all the keynotes, in particular from Sumana Harihareswara about how she has improved Python Software Foundation’s infrastructure, and from Simon Willison about how we can all benefit from Open Source AI.

We also had a special dinner hosted by Stefano to celebrate this special milestone of the OSAID, with Stefano, Mer and I overlooking Pittsburgh.

Overall, our participation at PyCon US was a success. We shared the work OSI has been doing toward the first release candidate of the Open Source AI Definition, and we did it in an entertaining and engaging way, with plenty of connection throughout.

Photo credits: Ana Hevesi, Mer Joyce, and Nick Vidal

Practical Open Source is a program developed to facilitate the discussions about doing business with and for Open Source. The 2024 edition consists of:

1. A series of blog posts on OpenSource.net, to be published between July and October
2. A panel discussion at All Things Open, in October

If you run a business producing Open Source products or your company’s revenue depends on Open Source in any way, we want to hear your insights on:

• How you balance the needs of paying customers with those of partners and non-paying users
• How you organize your sales, marketing, product and engineering teams to deal with your communities
• What makes you decide where to draw the lines between pushing fixes upstream and maintaining a private fork
• Where do you see the value of copyleft in software-as-a-service
• Why you chose a specific license for your product offering and how do you deal with external contributions
• What trends do you see in the ecosystem and what effects are these having

We want to hear about these and other topics, from personal experiences and research. Our hope is to provide the business ecosystem with accessible resources to better understand the Open Source business problem space and find solutions.

How it works

We’d like to promote  articles that further the collective knowledge. We want to hear stories from protagonists, people who balance community and commercial interests every day and share them to the widest possible base. After publishing the articles on OpenSource.net we’re going to have a panel at All Things Open.

Join the program

• You’ll send your proposals as pitches to OpenSource.net, a title and abstract (300 words max) and a short bio.
• Our staff will review the pitches and get back to you, selecting as many articles as deemed interesting for publication.
• We’ll also pick the authors of five of the most interesting articles to be speakers at a panel discussion at ATO, on October 29 in Raleigh, NC. Full conference passes will be offered. 
• Authors of accepted pitches to write a full article (1,200-1,500 words) to be published leading up to ATO.
• We’ll also select other pitches worth developing into full-length articles but, for any reason, didn’t fit into the panel discussion.

Note: Please read and follow the guidelines carefully before submitting your proposal.

Submission Requirements

• Applications should be submitted via web form
• Add a title and a pitch, 300 words maximum
• Include a brief bio, highlighting why you’re the right person to write about this topic
• Submissions should be well-structured, clear and concise

Evaluation Criteria

• Relevance to the topic
• Originality and uniqueness of the submission
• Clarity and coherence of argumentation
• Quality of examples and case studies
• Presenter’s expertise and track record in the field
• Although the use of generative AI is permitted, pitches evidently written by AI won’t be considered

Timeline

• Submission deadline: June 17, 2024
• Notification of acceptance: June 28, 2024
• Accepted authors must submit their full article by July 26, 2024
• Articles will be published on OpenSource.net between Aug 12 and October 10, 2024
• The authors of the selected articles will be invited to join a panel by Aug 12, 2024
• Event dates: Oct 28, 29, 2024 (Panel will be held on the 29th –remote participation is possible)

What to Expect

• Your submission will be reviewed by a panel of experts in the field
• If accepted, you will be asked to produce a full article that will be published at OpenSource.net

We look forward to receiving your submission!

Follow the Open Source Initiative:

• Mastodon
• LinkedIn
• X/Twitter
• Bluesky

During this two day event, members from startups like Double Open and NexB, as well as large corporations like Mercedes-Benz, Volkswagen, CARIAD, Porsche, Here Technologies, EPAM, Deloitte, Sony, Zeiss, Fraunhofer, and Roche, came together to discuss best practices around software supply chain compliance.

The ClearlyDefined community had an important presence at the event, represented by E. Lynette Rayle and Lukas Spieß from GitHub and Qing Tomlinson from SAP. I had the pleasure to represent the Open Source Initiative as the community manager for ClearlyDefined. The mission of ClearlyDefined is to crowdsource a global database of licensing metadata for every software component ever published. We see the ORT community as an important partner towards achieving this mission.

Relevant talks

There were several interesting talks at ORT Community Days. These are the ones I found most relevant to ClearlyDefined:

Philippe Ombredanne presented ScanCode, a project of great importance to ClearlyDefined, as we use this tool to detect licenses, copyrights, and dependencies. Philippe gave an overview of the project and its challenges. For ClearlyDefined, we would like to see better accuracy and performance improvements. 

Sebastian Schuberth presented the Double Open Server (DOS) companion for ORT. DOS is a server application that scans the source code of open source components, stores the scan results for use in license compliance pipelines, and provides a graphical interface for manually curating the license findings. I believe there’s an opportunity to integrate DOS with ClearlyDefined by providing access to our APIs to fetch licensing metadata and allowing the sharing of curations.

Marcel Kurzmann and Martin Nonnenmacher presented Eclipse Apoapsis, another ORT server that makes use of its integration APIs for dependency analysis, license scanning, vulnerability databases, rule engine, and report generation. Again, I feel we could also integrate Eclipse Apoapsis with ClearlyDefined the same way as with DOS.

Till Jaeger gave an excellent talk about curation of ORT output from the perspective of FOSS license compliance. He highlighted the Cyber Resilient Act (CRA), which brings legal provisions for SBOMs, and which will likely increase the need for tools like ORT. Till shared the many challenges in the curation process, particularly the compatibility issues from dual licensing, and went on to showcase the OSADL compatibility matrix.

Presenting ClearlyDefined

I had the privilege of presenting ClearlyDefined together with E. Lynette Rayle from GitHub and we got some really good feedback and questions from the audience.

With the move towards SBOMs everywhere for compliance and security reasons, organizations will face great challenges to generate these at scale for each stage on the supply chain, for every build or release. Additionally, multiple organizations will have to curate the same missing or wrongly identified licensing metadata over and over again.

ClearlyDefined is well suited to solve these problems by serving a cached copy of licensing metadata for each component through a simple API. Organizations will also be able to contribute back with any missing or wrongly identified licensing metadata, helping to create a database that is accurate for the benefit of all.

GitHub is well aware of these challenges and is interested in helping its users in this regard. They recently added 17.5 million package licenses sourced from ClearlyDefined to their database, expanding the license coverage for packages that appear in dependency graph, dependency insights, dependency review, and a repository’s software bill of materials (SBOM).

To make use of ClearlyDefined’s data, a user can simply make a call to its API service. For example, to fetch licensing metadata from the lodash library on npm at version 4.17.21, one would call:

curl -X GET "https://api.clearlydefined.io/definitions/npm/npmjs/-/lodash/4.17.21" -H "accept: */*"

This API call would be processed by the service for ClearlyDefined, as illustrated in the diagram below. If there’s a match in the definition store, then that definition would be sent back to the user. Otherwise, this request would trigger the crawler for ClearlyDefined (part of the harvesting process), which would download the lodash library from npm, scan the library, and write the results to the raw results store. The service for ClearlyDefined would then read the raw results, summarize it, and create a definition to be written in the definition store. Finally, the definition would be served to the user.

The curation process is done through another API call via PATCHes. For example, the below PATCH updates a declared license to Apache-2.0:

"contributionInfo": {
      "summary": "[Test] Update declared license",
      "details": "The declared license should be Apache as per the LICENSE file.",
      "resolution": "Updated declared license to Apache-2.0.",
      "type":"incorrect",
      "removeDefinitions":false
  },

This curation is handled by the service for ClearlyDefined, as illustrated in the diagram below. The curation would trigger the creation of a PR in ClearlyDefined’s curated-data repository, which would be reviewed by and signed off by two curators. The PR would then be merged and written in the curated-data store.

GitHub has deployed its own local Harvester for ClearlyDefined, as illustrated in the diagram below. GitHub’s OSPO Policy Service posts requests to GitHub’s Harvester for ClearlyDefined, which downloads any components and dependencies from various package managers, scans these components, and writes the results directly to ClearlyDefined’s raw results store. GitHub’s OSPO Policy Service fetches definitions from the service for ClearlyDefined as well as licenses and attributions from GitHub’s Package License Gateway. GitHub maintains a local cache store which is synced with any updates from ClearlyDefined’s changes-notifications blob storage.

ClearlyDefined’s development has seen an increased participation from various organizations this past year, including GitHub, SAP, Microsoft, Bloomberg, and CodeThink.

Currently, maintainers of ClearlyDefined are focused on ongoing maintenance. Key goals for ClearlyDefined in 2024 include:

• Publishing periodic releases and switching to semantic versioning
• Bringing dependencies up to date (in particular using the latest scancode)
• Improving the NOASSERTION/OTHER issue
• Advancing usability and the curation process through the UI 
• Enhancing the documentation and process for creating a local harvest

Our slides are available here.

Relevant breakout sessions

ORT Community Days provided several breakout sessions to allow participants to discuss pain points and solutions.

A special discussion around curations was led by Sebastian Schuberth and E. Lynette Rayle. The ORT Package Curation Data can be broken down into two categories: metadata interpretations and legal curations. The group discussed their thoughts about the curation process and its challenges, including handling false positives and the sharing of curations.

Nowadays, no conference would be complete without at least one talk or discussion about Artificial Intelligence. A group gathered to discuss the potential use of AI to improve user experience as well as for OSS compliance. The majority of attendees believed ORT’s documentation could be improved through the use of AI and even an assistant would be helpful to answer the most common questions. As for the use of AI for OSS compliance, there’s a lot of potential here, and one idea would be to use ClearlyDefined’s curation dataset to fine tune a LLM.

Conclusion

The second edition of ORT Community Days represented a unique opportunity for the ClearlyDefined community to better engage with the ORT community. We were able to meet the maintainers and members of ORT and learn from them about the current and future challenges. We were also able to explore how our communities can further collaborate. 

On behalf of the ClearlyDefined community, I would like to thank the organizers of this wonderful event: Marcel Kurzmann, Nikola Babadzhanov, Surya Santhi, and Thomas Steenbergen. I would also like to thank E. Lynette Rayle, Lukas Spieß and Qing Tomlinson from the ClearlyDefined community who have accepted my invitation to participate in this conference.

If you are interested in Open Source supply chain compliance and security, I invite you to learn a bit more about the ClearlyDefined and the ORT communities. You might also be interested in my report from FOSS Backstage.

Community health and growth

While there were several interesting talks, one of the highlights of the “Community health and growth” track was Tom “spot” Callaway’s talk embracing your weird: community building through fun & play. Tom shared some really interesting ideas to help members bond together: a badge program, a candy swap activity, a coin giveaway, a scavenger hunt, and a karaoke session.

FOSS Backstage this year was special because I got to finally meet 3 members from the ClearlyDefined community who have given a new life to this project: E. Lynette Rayle and Lukas Spieß from GitHub and Qing Tomlinson from SAP. While we did not go into a scavenger hunt or a karaoke session (that would have been fun), we spent most of our time during the week having lunch and dinner together, watching talk sessions together, networking with old and new acquaintances, and even going for some sightseeing in Berlin. This has allowed us to not only share ideas about the future of ClearlyDefined, but most importantly to have fun together and create a strong bond between us.

Please find below a list of interesting talks from this track:

• Dr. Wolfgang Gehring: a journey to inner source
• Tom “spot” Callaway: embracing your weird: community building through fun & play
• Kyle J. Davis: how you write matters in Open Source
• Bertrand Delacretaz: distributed teams that actually work!
• Carmen Delgado: how contribution programs benefit mentors and participants
• Celeste Horgan: more than developers: growing your maintainer community
• Brian Proffitt: measuring the impact of community events
• Divya Mohan: navigating the gold rush: of influencer economies and FOSS
• Zainab Daodu, Omotola Enice Omotayo: docs for all: improving Open Source accessibility
• Mayank Jindal: Open Source inclusivity: empowering newcomers

Project governance and sustainability

In last year’s FOSS Backstage, I had the opportunity to meet Thomas Steenbergen for the first time. He’s the co-founder of ClearlyDefined and the OSS Review Toolkit (ORT) communities. Project governance and sustainability is something Thomas deeply cares about, and I was honored to be invited to give  a talk together with him for this year’s conference.

Our talk was about aligning wishes of multiple organizations into an Open Source project. This is a challenge that many projects face: oftentimes they struggle to align wishes and get commitment from multiple organizations towards a shared roadmap. There’s also the challenge of the “free rider” problem, where the overuse of a common resource without giving back often leads to the tragedy of the commons. Thomas shared the idea of a collaboration marketplace and a contributor commitment agreement where organizations come together to identify, commit, and implement a common enhancement proposal. This is a strategy that we are applying to ORT and ClearlyDefined.

Our slides are available here.

Please find below a list of interesting talks from this track:

• Dawn Foster: a strategic approach to assessing viability of OSS projects
• Ruth Cheesley: changing the governance model of an established project
• Rich Bowen: talking with management about Open Source
• Schlomo Schapiro, Gratien Dhaese: why is there no new release? Nobody pays for the basics
• Giacomo Tenaglia: CERN’s Open Source Program Office
• Per Ploug Krogslund: has Open Source outgrown the OSPO?
• Tarus Balog: adventures with Open Source business models
• Dirk Gernhardt, Klaus Mueller: Open Source excellence: Munich’s journey towards public code
• Paloma Oliveira, Fiona Krakenbuger, Lina Bocker, Thomas Steenbergen: freedom vs sustainable business: a candid necessary debate
• Shane Curcuru: who funds FOSS foundations?
• Dawn Wages: success through a thousand emails: fundraising and outreach
• Peer Heinlein, Daniel Zielke: the cuckoo in bidding: when manufacturer loses to itself
• Nick Vidal, Thomas Steenbergen: aligning wishes of multiple orgs into an Open Source project

Supply chain compliance and security

Under the “supply chain compliance and security” track, I was happy to watch a wonderful talk from my friend Ana Jimenez Santamaria entitled looking at Open Source security from a community angle. She has been leading the TODO Group at the Linux Foundation for quite a few years now, and it was interesting to learn how they are helping OSPOs (Open Source Program Offices) to create a trusted software supply chain. Ana highlighted three takeaways:

• OSPOs integrate Open Source in an organization’s IT infrastructure.
• Collaboration between employees, Open Source staff, and security teams with the Open Source ecosystem offers a complete security coverage across the whole supply chain.
• OSPOs have the important mission of achieving digitalization, innovation and security in a healthy and continuous way.

Please find below a list of interesting talks from this track:

• Melanie Rieback: when business models are conflicting with security
• Ana Jimenez Santamaria: looking at Open Source security from a community angle
• Mirko Boehm: EU cybersecurity regulation and Open Source governance
• Fukami: FOSS and security risk management
• Lina Bocker, Angelika Wittek: Open Source contributions in today’s world
• Petteri Kivimaki: automating Open Source license compliance

Bonus: Open Source AI

Nowadays, no conference would be complete without at least one talk about Artificial Intelligence, so Frank Karlitschek’s keynote what the AI revolution means for Open Source and our society was very welcome! Frank demonstrated that Open Source AI can indeed compete with proprietary solutions from the big players. He presented Nextcloud Assistant that runs locally, and that can be studied and modified. This assistant offers several exciting features: face recognition in photos, text translation, text summarization, text generation, image generation, speech transcript, and document classification –  all this while preserving privacy.

It’s worth pointing out that the Open Source Initiative is driving a multi-stakeholder process to define an “Open Source AI” and everyone is welcome to be part of the conversation.

Conclusion

I had a wonderful time at FOSS Backstage and I invite everyone interested in community, governance, and supply chain to join this amazing event next year. I would like to thank the organizers who work “backstage” to put together this conference. Thank you Paul Berschick, Sven Spiller, Alexander Brateanu, Isabel Drost-Fromm, Anne Sophie Riege, and Stefan Rudnitzki. A special thanks also to the volunteers, speakers, sponsors, and last but not least to all attendees who made this event special.

If you are interested in Open Source supply chain compliance and security, I invite you to learn a bit more about the ClearlyDefined and the ORT communities. Be sure to check out my report from the ORT Community Days.

Results of the Open Source AI workshop

There was a fair amount of agreement that the wording as illustrated was fairly good but required some tweaks. Most of the tables were eager to widen the scope of the Definition to include principles of ethics.

Some of the most notable comments:

• In order to study the AI system it must be possible to understand the design assumptions behind the AI system and another group suggested adding a reference to explainability of its outcomes. 
• One group highlighted that the purpose of studying the AI system is to gain confidence, understand the risks it poses, its limits and provide a path to improve it. They recommended a more extensive wording to clarify that being able to inspect its components (datasets, assumptions, code, etc) is important. They also added that data is not strictly necessary to be fully made available, putting privacy as one reason.
• On the “modify” question, the group suggested simplifying the wording, replacing … with “outputs”.
• On “sharing”, the group recommended to limit the shareability to responsible purposes, extending the scope of their recommendations also to the Use.
• There needs to be a fifth principle to “do no harm”

A surprising outcome came from a group that felt that the verbs (study, use, modify, share) in the draft definition are not sufficient and new ones are necessary for AI. They brainstormed and came up with an initial list: train, tend (curate and store), evaluate (its capabilities) and evoke the model. This was a fascinating conversation that I promised to continue with its main proponent.

The comments received gave me a chance to close the workshop explaining why the Open Source Definition doesn’t prescribe respecting the law and avoids discussing ethics and why the OSI recommends moving these issues outside of licenses and into project governance and policies. 

It was energizing to see DPGA members having such a good opinion of Open Source and its power to be positively transformative that people want it to do more good with it. But injecting ethical principles into open definitions overloads them massively. The OSI will have to do more to explain that a definition should no more be dictating “acceptable use” than Meta, Alphabet or anyone else. Ethical considerations are highly contextual and there are rarely clear answers that a universal standard like the Open Source Definition and the future Open Source AI Definition cannot reasonably cover. The DPG Standard, on the other hand, is a more suitable document to include ethical considerations because it’s more contextual to deployment of technologies.

Notes from the Community of Practice meeting

The second half of the afternoon saw the Community of Practice on AI systems as digital public goods, co-hosted by the DPGA and UNICEF. They showed their first approach to distinguish the degrees of openness of an AI system’s components. The CoP has a very difficult task with two major obstacles. The first is they have to come up with a proposal to update the DPG Standard to cover AI before a well established definition of Open Source AI exists. The second is that they need to look at the intersection of responsible and open AI, balancing the values of “open” with a set of risks that are not yet fully understood either. All while technology evolves rapidly and the AI business ecosystem spreads FUD in all directions.

I’ve been highly skeptical about this gradient approach, which is not too different from what Irene Solaiman at Hugging Face proposed. As someone in the audience said: Introducing a gradient approach for DPG AI risks creating an opening to also have a gradient for software, diluting the mandate for Open Source software in the DPG Standard. With the race to create “quasi-open-source” licenses, the threat is too real to dismiss.I believe that Open Source AI can be as binary as Open Source software and the way to achieve that is to look not at the individual components of AI systems but at the whole. The next phase of OSI’s work on the Open Source AI Definition will explore exactly this aspect, diving deeper into practical examples. What do I need in order to study, use, share and modify something like LAIoN’s Open Assistant?

Keynote speakers included Megan Smith, former U.S. CTO and assistant to the President; Jon “maddog” Hall, board chair for the Linux Professional Institute; and Douglas Crockford, author of the data format JSON (JavaScript Object Notation).

The Open Source Initiative (OSI) was kindly invited to present the “25 years of Open Source.” As community manager at the OSI, I gave an overview of the rich and interconnected history of both the Free Software and Open Source movements, and later looked towards the future to reimagine a new world where openness and collaboration prevail. In my presentation I explored the challenges and opportunities ahead, including Open Source’s key role in fostering collaboration and innovation in emerging areas such as AI/ML.

One of the high points of the conference was the keynote from Megan Smith: “Accelerating solution making through inclusion.” Megan shared her vision for a more productive, innovative, multi-disciplinary and positively-impactful technology community that accomplishes this mission through including and building for all of humanity. Openness and inclusion were a big focus of her presentation, where she highlighted how Open Source, open collaboration, open innovation, open education and open government can help bring different people and perspectives together.

Sysarmy organized several social and inclusive activities as part of Nerdearla. The event adopted a hybrid approach, where participants who could not attend in person were able to watch the presentations and interact with others online. Kids were also invited to be part of the conference by participating in activities like the Roboteam experience. 

While technology was the main focus of the event, adjacent topics like mathematics and astronomy were also incorporated into the program, including a “night at the planetarium.” Finally, there was also a special “women in technology” social event where both new and experienced participants could share their experiences with other colleagues.

In my opinion, Nerdearla is one of the best conferences in the world with a vibrant community. The event relies solely on sponsors and tickets are 100% free for attendees, who gain the opportunity to learn from top class speakers. Please visit: https://nerdear.la/

The Open Source AI discussion

Open Source AI has been a hot topic since the beginning of the year, but there’s no clear definition of what’s actually “Open Source AI”. To address this question, the OSI has created an open process gathering opinions and comments from individual developers, lawyers, researchers, non-profit organizations, companies and government officials developing and using AI systems. As part of this open process, the OSI is organizing a series of events, both online and in-person. Having a presence at the Open Source Summit Europe was important to gather the perspectives from different stakeholders, particularly from the European community.

Our first activity was at the LLM Avalanche Bilbao event that happened prior to the main conference. This event was a follow-up from the very successful LLM Avalanche San Francisco that took place in the Bay area in June. The OSI presented an overview of the recent discussions and got some important feedback from the audience, among which a suggestion for the OSI to participate in other events tailored for AI researchers and scientists.

As part of the keynotes at the main conference, “Open Source AI” was a big focus, with many exciting announcements from the Linux Foundation, including the launch of the Generative AI Commons and the Unified Acceleration Foundation. Nithya Ruff, head of the AWS Open Source Programme Office (OSPO), also kindly highlighted the work from the OSI in this space at her keynote.

The launch of OpenSource.net

The OSI officially announced the launch of OpenSource.net at the Open Source Summit Bilbao. With the decision from Red Hat to halt the publication of new articles at Opensource.com, the community of authors that have gathered around this site for the past 12 years were at risk of disappearing. The OSI stepped in to provide this community with a neutral home where they can continue to share knowledge and engage with other members.

At the OSI’s booth, postcards from OpenSource.net were being distributed to attendees so they could be shared with friends. The launch was well received and new articles are expected to be published in the coming weeks. OpenSource.net welcomes new contributions under a Creative Commons Attribution-Share Alike 4.0 International License.

The future of ClearlyDefined

Finally, the OSI also had important discussions about the future of ClearlyDefined, which aims to create a global database of licensing metadata for every Open Source software component ever published. Nick Vidal, community manager of ClearlyDefined, held productive conversations with Justin Colannino, OSI board member and assistant general counsel at Microsoft, and Thomas Steenbergen, co-founder of the ClearlyDefined and OSS Review Toolkit (ORT) projects.

ClearlyDefined is currently undergoing a process of adopting a more open governance model, where different stakeholders can have a say in the direction of the project. This process started at the first ORT Community Day held in Berlin about 6 months ago. Since then, new members have shown interest in being more involved with the ClearlyDefined community, in particular GitHub, who has recently added 17.5 million package licenses to their database. The hope is that by the end of the year a more open governance model will be established and soon after a new release of ClearlyDefined will be released with input from the community. 

Conclusion

OSI’s participation at the Open Source Summit Europe was very important. The OSI was able to gather valuable feedback from the community around three efforts currently underway and further straighten the partnership with the Linux Foundation.

If you are interested in learning more about all of OSI’s programs, please check our website and get involved. The OSI is currently hosting a webinar series as part of the “Deep Dive: Defining Open Source AI”. In October, the OSI will host a special track at All Things Open including five sessions covering Open Source licenses, policy, security and a double session to draft a definition for “Open Source AI”.

Building community momentum and support

We’ve gathered a significant amount of support from groups all over the world. Most recently, Google has increased its financial commitments to support this urgent initiative. Timothy Jordan, Director of Open Source and Developer Relations at Google, stated “Google is excited to continue our support of the Open Source Initiative and, more broadly, of open source developers. We look forward to the open collaboration involved in drafting the Definition of Open Source AI and hope it will help accelerate innovation in this space.” 

For Catherine Stihler, executive director of Creative Commons “It’s critical to develop shared definitions about what it means to contribute to the commons, including through open source. The participatory process organized by the OSI is an important way to find the common values shared by the widest variety of organizations and people around the world.” 

While Mark Collier, COO, OpenInfra Foundation said that “The next decade of open infrastructure will be built hand-in-hand with AI. The OpenInfra Foundation and the community engaged with its projects, including OpenStack, Kata Containers, and StarlingX, is focused on defining how AI will play its role. We’re excited to participate in OSI’s process to find—as soon as possible—a common baseline and definition that all of us can rely on to further the values of ‘open’ to the AI field.”  

Other organizations, like GitHub, Amazon, OSS Capital, Weaviate and Sourcegraph also believe in this effort and are supporting the process with generous donations. OSI also welcomes individual donations.

“Deep Dive: Defining Open Source AI” webinars

After gathering a group of people from Mozilla Foundation, Creative Commons, Wikimedia Foundation, Internet Archive, Linux Foundation Europe, OSS Capital, and the OSI board in June 2023 in San Francisco, OSI is kicking off our webinar series to hear from more experts.

The presentations series identifies foundational principles of “Open” in the context of AI and will contribute to the conversations and collective thinking. The topics were selected for their focus on precise problem areas in AI and offer clear suggestions for solutions based on their expertise in many areas. 

Webinars will be held Tuesday through Thursday between September 26 and October 12 (daily schedule coming soon). Each session will include a live Q&A with attendees. Registration is free and single registration gains you access to all webinars in the series. 

Comment on the Draft of the “Open Source AI Definition”
A draft of the Open Source AI Definition will be available for public discussion at All Things Open, on October 17. Interested parties can review the full schedule of the global drafting and review process.