The Linux Foundation Member Summit

The landscape of computing has changed and the majority of software developers are looking to use architectures with multiple types of processors, in particular GPUs. The emergence of modern AI techniques has further accelerated the usage of GPUs and new AI processor architectures to achieve the performance required by neural networks. The challenge developers are seeing is that different architectures often require unique languages, tools and libraries, adding complexity and limiting code reuse. The solution is to provide a single way to develop across these architectures, and the basis for this must be rooted in an open, standards-based programming model and libraries. The UXL Foundation was formed to tackle this, and we are working together to build a solution to these challenges – providing an open, standards-based way to develop software and deploy across vendors. This presentation will show how the UXL Foundation is evolving its projects to meet the vendor neutral demands of software developers by adopting open standards and open source, and how our members are using the projects to enable projects like PyTorch and TensorFlow.

As the JDF nears its 10 year anniversary, we have built a strong track record advancing specification efforts alongside open source projects. This session will provide examples and case studies for how LF Open Source projects and JDF Specifications projects are collaborating on internationally relevant Standards. We will also highlight findings from our State of Open Standards Report, and share some of the programs and resources the JDF have been developing to support open source projects interested in Standards.

Picture the WHOLE software supply chain, beginning to end; it's a little like that olde tyme classic, "Candyland". Designed NOT with preschoolers in mind, AI Supply Chain Candy Land is for everyone interested in learning about the software supply chain for AI/ML. Travel through exotic locations like The Peppermint Forest of swirly-twirly dependencies, The Fudgy Swamp of Compliance, and much more! AI/ML is a fast-moving space within technology. However, everything we've learned in software engineering of the last few decades ALSO applies to this "new" world of AI/ML. We'll apply traditional software supply chain security techniques and, wherever able, tools to help developers and consumers win AI Supply Chain Candyland. Through an enjoyable and colorful game, with useful examples taken from standards and frameworks, the audience will have a better appreciation and ability to apply supply chain security concepts and tools to the development and support of AI/ML-based solutions.

Linux functions as the foundational infrastructure within mission-critical systems across sectors such as energy, transportation, healthcare, and industrial automation. These systems are essential to our society and must operate reliably for decades while adapting to the evolving landscapes of Smart Cities and IoT. Interconnectivity, while enriching our lives, presents significant challenges in managing vulnerabilities and system upgrades, necessitating adherence to international standards and the maintenance of system compatibility and integrity. The Civil Infrastructure Platform (CIP) project addresses these challenges by providing Industrial Grade Linux that enables robust, secure, and sustainable operations. Over the past seven years, CIP has demonstrated a commitment to meeting current operational needs and addressing future threats and challenges. This presentation will explore the value of CIP, focusing on its pivotal role in strengthening cyber resilience while enhancing system reliability. Attendees will gain insights into how utilizing CIP can help build sustainable systems, ensuring they are well-equipped to meet future challenges.

“Perfect is the enemy of good.” Whether it was Voltaire or Aristotle who said it first, it’s true for risk management in open source software.

For both vulnerability mitigation and license compliance, risk management is always a sliding scale. How do you define or apply practical policies to focus identification and mitigation for the highest risk vulnerabilities in the context of your technology stack? And for the highest risk licenses in the context of how you deploy or distribute products or applications?

In this talk, Michael will discuss setting priorities for open source software compliance and how to avoid the pitfalls of focusing on low value / high cost activities, based on over 15 years of experience running Software Composition Analysis projects. The best advice? Focus on accuracy over precision.

If you had a collection of every kind of animal on earth, from mules to narwhals to goldfish, how would we pick out just the housepets? And how does AI distinguish between a pack mule and a Moscow Mule?

Embeddings are numerical representations that capture the essential features and relationships of objects, like words or images, in a continuous vector space, enabling tasks such as semantic search, clustering, and recommendations. We'll explore the core concepts of embeddings, using relatable examples to make advanced ideas accessible.

Legal professionals may find embeddings particularly relevant due to their ability to distinguish between different entities and concepts with nuance. Such capability is crucial for addressing legal issues like data privacy, bias mitigation, and intellectual property.

By understanding how embeddings distinguish between concepts, attendees can draw parallels to their own legal reasoning processes, gaining insights into how these AI mechanisms intersect with legal frameworks. This session encourages legal professionals to explore the intellectual and professional possibilities that embeddings present, deepening an understanding of AI’s role in law

You're making decisions about open source project funding, hiring, travel, and overall engagement. But do you have the latest data to get internal buy-in for your open source engagement and resourcing needs? This session will point you to the most current and compelling data and insights from dozens of LF Research studies that drive open source project budgets and strategy, that illustrate the value proposition for open source collaboration, and that highlight examples and resources for you to leverage to set your organization up for success, no matter the industry or technology domain.

Enterprises are eager to adopt Generative AI to increase their productivity. OPEA, the Open Platform for Enterprise AI, is a new project with the Linux Foundation. It provides a framework of composable microservices for state-of-the-art GenAI systems including LLMs, data stores, and prompt engines. It provides blueprints of end-to-end workflows for popular usage such as ChatQnA, CodeGen, and RAG systems. OPEA applications leverage cloud-native architecture to simplify deployment. It even includes a friendly high-level pipeline definition language for deployment on Kubernetes. This session will introduce OPEA, key component microservices, and how GenAI applications can be composed using those microservices. The attendees will learn to start with OPEA by deploying their GenAI application on a k8s cluster. Explicit contribution opportunities will be shared with the attendees. You'll also see an open source OPEA playground running on k8s, and how to contribute your components to it.

As Open Source continues to grow in functionality & adoption, so does the likelihood & risks of patent attacks. OIN protects OSS through a unique cross-license whereby OIN’s members agree to not sue each other for use of their Linux & Open Source related patents. The cross-license is defined in scope by over 4,5o0 core Linux & Open Source technology packages known as the Linux System which is updated & expanded every 18-24 months. Newly released in August 2024, Linux System Table 12 covers cloud-native computing, enterprise software, IoT, networking, automotive, embedded systems & hardware development technologies, among others. Table 13 is open for nominations from Linux Foundation members and the greater open source community.

Are you leveraging the Linux Foundation membership benefit? Hitachi is a member of the Linux Foundation(LF) since its launch and has been collaborating with LF in various aspects. Yuichi Nakamura, responsible for OSS strategy in Hitachi and Japan evangelist of LF, introduces a case study of how to accelerate business with LF as its member company. He will talk lessons learned from a failure case of OSS business, then introduce OSS strategy for business. The most important part of the strategy is to find and take new OSS into our business timely. Hitachi is working with LF to expand utilization of OSS. LF leaders/LF Japan provide forecast of market and technology trends in consultation for members, navigate new projects by connecting with key people and work together to launch local communities. By such support, Hitachi can utilize new OSS projects to business quickly. He introduces detail of collaboration in examples of CNCF, OpenSSF and FinOps Foundation.

This Ask Me Anything session connects attendees to the TODO Steering Committee. The TODO Group is an open community of practitioners who aim to create, share knowledge and collaborate on best practices on open source management in organizations to run successful Open Source Program Offices Members of the committee will assist the audience through the best practices, guides, and tools made by and for open source managers to help them in their day-to-day responsibilities, as well as share their first-hand experiences and lessons learned in building and operating OSPOs. Additionally, attendees will learn ways to connect with the TODO Group – the largest OSPO community dedicated to building best practices in open source management – as well as with the SIGs and working groups from the foundations and projects across the LF ecosystem. The session will also provide information on accessing OSPO mentorship in their local regions.

Africa still is the forgotten continent, even if all the means are there to have African talent participating in the world wide Open Source movement. Governments are using proprietary software, implemented by expensive foreign consultants, because of the lack of local people that have received the proper education. The Living Open Source Foundation aims at changing that by empowering individuals through training in Open Source techniques and attitude. In this session you will learn how the Living Open Source Foundation has been offering education to talent in different African countries since 2019. On that journey, different problems were encountered and lessons were learned. Just bringing education is not enough, the educated talent needs to have access to jobs in local economies once educated and certified. That is why Living Open Source Foundation focusses on enabling local economies by using Open Source software. In this session you'll learn how we work, and how you can participate in bringing Open Source to Africa.

In the great hall of The Open Source, gathered together from the cosmic reaches of the multiverse are some of the greatest heroes of open source security ever assembled. Their mission, to fight injustice, to right that which is wrong, and to serve all mankind by helping make open source software more secure. In this session, attendees will learn from the OpenSSF about simple techniques, tactics, and tools that can help improve the overall security posture of their project, help them better defend against attackers, and react more quickly when the inevitable vulnerability report lands in their inbox. Key Takeaways - Learn about steps that can be taken to prepare your project to respond effectively to security findings - Learn about industry standards such as CVE, CVSS, VEX, CVD, and others that will help contextualize external and downstream interest in security - Learn about resources available to learn valuable secure coding techniques and concepts - Learn about community resources that are available to help triage, coordinate, and disclosure discovered vulnerabilities in your codebase, dependencies, and your supply chain

It's been about 20 years since cloud computing in its modern form debuted. Open source has been around longer but that's also about the point when open source matured beyond being a cheaper Unix replacement to being the source of development and technology innovation that it has become. There are important lessons in those 20 years. Lessons about standardization. Lessons in flexibility. Lessons in cooperation. Lessons in developing ecosystems. Lessons in what not to do. Indeed, for all the success of Linux, the cloud has arguably been the great showcase for open source success over the past couple of decades. As a result, it's useful to think about the lessons there and how they apply to AI and other important areas of innovation going forward.

The threat of quantum computers to cryptography and, more broadly, computer security, is something that gets a little closer to reality every passing day. But what this means for real-world software can be confusing. When (and how) do we need to be ready? What do we need to do now to be ready when quantum computers come? In this talk, Hart Montgomery will explain what open source software projects, companies, and anyone who relies on cryptography need to do to protect themselves against the quantum threats of the future. He will explain projected timelines of when quantum attacks against cryptography could be viable, and then discuss what this means for software and data today. By the end of the talk, attendees will understand how to “threat model” quantum computing for their software or company needs and be better informed on how to make decisions regarding updating cryptography. In addition, Hart will explain how the tools of the LF’s PQCA project can be used to mitigate quantum threats. This talk will require no mathematical or cryptographic background to understand and will be aimed at business leaders who need to lead their companies in the transition to post-quantum cryptography.

Open Source options have had a difficult time gaining visibility and uptake by game developers, particularly when compared to commercial options. The talk will discuss the various tools and options available to game developers, challenges faced by open source in gaining adoption, and some ideas on how visibility and viability of options can be improved. It is important that open source tooling owners work together to raise visibility across the game development industry.