WEBVTT

00:00.000 --> 00:07.000
Hello, Boston.

00:07.000 --> 00:09.000
Thanks for having me.

00:09.000 --> 00:14.000
This is a great talk, a great room, a great conference, let's have fun.

00:14.000 --> 00:15.000
My name is Julian.

00:15.000 --> 00:18.000
I'm from the set of digital sovereignty in Germany.

00:18.000 --> 00:20.000
I will explain that in a second.

00:20.000 --> 00:21.000
Development lead.

00:21.000 --> 00:25.000
I care about developing our new products, our new services,

00:25.000 --> 00:29.000
and whatever is relevant to foster the digital sovereignty.

00:29.000 --> 00:32.000
In Germany.

00:32.000 --> 00:35.000
A little bit about me, so it can put me in a box.

00:35.000 --> 00:38.000
I started out with post-gascar mostly,

00:38.000 --> 00:41.000
and then I went more towards open chain,

00:41.000 --> 00:44.000
the Linux Foundation project, for management systems,

00:44.000 --> 00:50.000
for open source, and have then transitions to zenders,

00:50.000 --> 00:52.000
and care about more infrastructure things.

00:52.000 --> 00:55.000
I'm an advocate for public money public code,

00:55.000 --> 00:58.000
but in the recent years I've slowly started to change this

00:58.000 --> 01:00.000
to infrastructure.

01:00.000 --> 01:02.000
But infrastructure in a different sense,

01:02.000 --> 01:06.000
I think we have used in this room before.

01:06.000 --> 01:09.000
To me, infrastructure is, for instance,

01:09.000 --> 01:13.000
what things like a Debian project give us,

01:13.000 --> 01:18.000
when you look at things like training maintainers,

01:18.000 --> 01:21.000
but you think about supporting maintainers,

01:21.000 --> 01:26.000
building systems of trust of what it means to build a coherent system.

01:26.000 --> 01:28.000
This for me is infrastructure.

01:28.000 --> 01:31.000
It's also infrastructure in terms of legal systems,

01:31.000 --> 01:35.000
or in terms of public services like code work,

01:35.000 --> 01:37.000
or things where you can store.

01:37.000 --> 01:40.000
This is also infrastructure, but I care a lot about

01:40.000 --> 01:45.000
the more software side of infrastructure.

01:45.000 --> 01:48.000
I come from Zendis, the Center for Digital sovereignty,

01:48.000 --> 01:50.000
and the public administration in Germany.

01:50.000 --> 01:53.000
So I have to put that into perspective,

01:53.000 --> 01:55.000
so you can understand where I'm coming from,

01:55.000 --> 01:58.000
and why it's rather important that I say it.

01:58.000 --> 02:01.000
The Zendis is a 100% state owned.

02:01.000 --> 02:04.000
We were founded by the Ministry of Interior and Germany,

02:04.000 --> 02:09.000
and right now we are owned by the Ministry of Digital Affairs.

02:09.000 --> 02:18.000
We were founded to combat the lack of digital sovereignty.

02:18.000 --> 02:24.000
So I'm not speaking as an NGO who has a political agenda in a certain way.

02:24.000 --> 02:29.000
I have a task, we have a job, and the job is to create digital sovereignty,

02:29.000 --> 02:33.000
or more directly speaking as a disarmition,

02:33.000 --> 02:40.000
enabling a way to reduce the dependencies that we have.

02:40.000 --> 02:45.000
By that, open source wouldn't be our,

02:45.000 --> 02:48.000
let's put it this way, we are not an OSPOL.

02:48.000 --> 02:53.000
But surprisingly, open source is the one tool we choose for nearly everything.

02:53.000 --> 02:56.000
Because digital sovereignty has various definitions.

02:56.000 --> 03:00.000
We were given one, I think, like five to six years back,

03:00.000 --> 03:05.000
and since then, multiple criteria and definitions of digital sovereignty have arised.

03:05.000 --> 03:10.000
But in my understanding, they always fall down really to the four freedoms.

03:10.000 --> 03:11.000
They really are.

03:11.000 --> 03:16.000
If you look at the government, they have to have the right to use the software really.

03:16.000 --> 03:19.000
And regardless of sanctions, we have seen that with the ICC.

03:19.000 --> 03:23.000
We have to have the right to modify the software.

03:23.000 --> 03:25.000
This is where digitalization happens, right?

03:25.000 --> 03:28.000
Well, we create new workflows, new things.

03:28.000 --> 03:32.000
And we have to have the right to, at one point,

03:32.000 --> 03:36.000
where we have to have the right to study the software,

03:36.000 --> 03:38.000
to understand it, right?

03:38.000 --> 03:43.000
This is where I said, on point, because the guy from the Ministry of Security came in.

03:43.000 --> 03:44.000
Anywho.

03:45.000 --> 03:47.000
The Ministry is agency.

03:47.000 --> 03:50.000
But anyway, right, these are the freedoms.

03:50.000 --> 03:53.000
This is what it entails. This is why it's important.

03:53.000 --> 03:58.000
This is why open source for us is the only way really into digital sovereignty.

03:58.000 --> 04:01.000
And so, basically, all we do is open source.

04:01.000 --> 04:04.000
I have to put our basic things first.

04:04.000 --> 04:06.000
One thing is open desk, you have heard it before,

04:06.000 --> 04:08.000
so I kind of have to just point it out.

04:08.000 --> 04:10.000
It exists.

04:10.000 --> 04:12.000
And it does one thing.

04:12.000 --> 04:18.000
To create digital sovereignty, if I say we have to use open source solutions,

04:18.000 --> 04:20.000
we have to make them work.

04:20.000 --> 04:24.000
We have to create an offering for the users,

04:24.000 --> 04:28.000
for the municipalities, for anyone who cares for the software.

04:28.000 --> 04:30.000
It has to be enterprise-grade.

04:30.000 --> 04:34.000
It doesn't, it's pointless if I have ten different solutions

04:34.000 --> 04:37.000
that the municipality has to stitch together.

04:37.000 --> 04:40.000
It doesn't matter how well it can be integrated.

04:40.000 --> 04:42.000
They shouldn't be the ones doing it.

04:42.000 --> 04:44.000
And this is precisely what open desk does.

04:44.000 --> 04:48.000
We took the pre-existing open source solutions,

04:48.000 --> 04:51.000
as you see from mail to calendar to project management,

04:51.000 --> 04:53.000
to chat, of course.

04:53.000 --> 04:56.000
And just create a coherent thing,

04:56.000 --> 04:59.000
basically what the same as last week,

04:59.000 --> 05:01.000
or mind-brew in the Netherlands.

05:01.000 --> 05:03.000
The problem is the same.

05:03.000 --> 05:05.000
Create, take the existing open source

05:05.000 --> 05:07.000
and just make a coherent system,

05:07.000 --> 05:09.000
such that we can use it.

05:11.000 --> 05:12.000
We have open code.

05:12.000 --> 05:14.000
This is more where I really want to focus on today.

05:14.000 --> 05:17.000
Open code is our platform for software.

05:17.000 --> 05:20.000
It is code, it's a GitLab.

05:20.000 --> 05:22.000
It's a GitLab for the public administration

05:22.000 --> 05:24.000
to work on software.

05:24.000 --> 05:28.000
Our shared infrastructure for the German public administration

05:28.000 --> 05:31.000
to write store-in-hands software.

05:31.000 --> 05:33.000
It's open to the public,

05:33.000 --> 05:36.000
although we have to have to make sure that the project is on there.

05:36.000 --> 05:39.000
In the interest of the public administration,

05:39.000 --> 05:42.000
yet we'd have about 5,000 replos at the moment.

05:42.000 --> 05:44.000
And it's designed for the public administration

05:44.000 --> 05:46.000
to make open source,

05:46.000 --> 05:49.000
well, a requirement really.

05:49.000 --> 05:53.000
In addition to this being just a hosted,

05:53.000 --> 05:56.000
available GitLab for the public administration,

05:56.000 --> 06:00.000
we provide things like guidelines and policies.

06:00.000 --> 06:02.000
Software stored on open code.

06:02.000 --> 06:05.000
This platform has to be open source.

06:06.000 --> 06:08.000
And by checkbox exercise,

06:08.000 --> 06:11.000
we went down the rabbit hole of the legal requirements

06:11.000 --> 06:13.000
on what is it to be,

06:13.000 --> 06:15.000
what does it mean to be open source?

06:15.000 --> 06:17.000
There is the open source definition.

06:17.000 --> 06:21.000
And there is a list, but the list is all but complete.

06:21.000 --> 06:23.000
So we enhance this.

06:23.000 --> 06:25.000
We took what is available, for instance,

06:25.000 --> 06:27.000
on the Linux Foundation's SPDX side,

06:27.000 --> 06:30.000
on what are similarities and licenses.

06:30.000 --> 06:32.000
Basically, now you can have a checkbox exercise

06:32.000 --> 06:34.000
and say, right, this is open source,

06:34.000 --> 06:36.000
which isn't anything new, right?

06:36.000 --> 06:37.000
But it made it simple.

06:37.000 --> 06:39.000
You don't need a legal guy anymore.

06:39.000 --> 06:41.000
You can check its open source.

06:41.000 --> 06:42.000
And if it's stored on open code,

06:42.000 --> 06:44.000
it has to be open source by policy.

06:44.000 --> 06:47.000
And if it's distributed artifacts,

06:47.000 --> 06:49.000
the artifacts have to be open source as well.

06:49.000 --> 06:54.000
So this way, if we were to use open source

06:54.000 --> 06:57.000
in a tender, for instance, we could now say,

06:57.000 --> 06:59.000
whatever you're creating for me,

06:59.000 --> 07:02.000
has to be developed or not developed as a hardware.

07:02.000 --> 07:04.000
Has to be provided by open code.

07:04.000 --> 07:06.000
So it's available for the rest of the public administration

07:06.000 --> 07:09.000
just to see, just to maybe collaborate, whatever.

07:09.000 --> 07:11.000
And if I want to be hard,

07:11.000 --> 07:13.000
I have to download it by open code.

07:13.000 --> 07:16.000
So I know that dependencies are also open source.

07:16.000 --> 07:19.000
Right? So this is basically our way to make it simpler.

07:19.000 --> 07:22.000
Such as the municipality doesn't have to understand

07:22.000 --> 07:27.000
what exactly it requires to make something open source.

07:29.000 --> 07:35.000
In addition to that, we do a few more things.

07:35.000 --> 07:38.000
We have the context of security.

07:38.000 --> 07:40.000
Where the security is sweet and bad at?

07:40.000 --> 07:44.000
I think 1730 is the next start to think about that.

07:44.000 --> 07:46.000
Yeah?

07:46.000 --> 07:50.000
Where we try to provide open source solutions to what security.

07:50.000 --> 07:54.000
Just to make it easier for the municipality just to tick that box.

07:54.000 --> 07:56.000
We have an inventory.

07:56.000 --> 07:59.000
Two or three talks before we had the question in here on,

07:59.000 --> 08:04.000
how can we avoid writing the same software over and over again

08:04.000 --> 08:07.000
or compete on a municipal and federal level

08:07.000 --> 08:10.000
on just the same solutions all over again?

08:10.000 --> 08:14.000
Well, show the citizens that the software exists.

08:14.000 --> 08:16.000
And this is literally what we do.

08:16.000 --> 08:22.000
We have a large inventory of 250 components right now

08:22.000 --> 08:25.000
who are just listed there as right.

08:25.000 --> 08:28.000
This is an open source tool like this.

08:28.000 --> 08:31.000
It can be used by the public administration.

08:31.000 --> 08:34.000
So if I create something new, I have to talk.

08:34.000 --> 08:36.000
My citizens can see that.

08:36.000 --> 08:38.000
They can see there is a solution.

08:38.000 --> 08:40.000
Why are we writing a new thing?

08:40.000 --> 08:42.000
So visibility is one way to combat this.

08:42.000 --> 08:44.000
Not the only way, but I think it helps.

08:44.000 --> 08:45.000
It helps to have this.

08:45.000 --> 08:48.000
And the same software inventory, by the way, is mirrored

08:48.000 --> 08:50.000
on a European level by join up.

08:50.000 --> 08:55.000
So I think this software inventory is a slowing rising.

08:55.000 --> 08:58.000
One more thing is badges.

08:58.000 --> 09:03.000
But down here, this is where I want to get to now.

09:03.000 --> 09:07.000
Badges are our way to grade software, so to speak.

09:07.000 --> 09:11.000
But first off, I have just a general question.

09:11.000 --> 09:15.000
And don't answer wrong.

09:16.000 --> 09:20.000
Who in here would trust Debian, for instance, for a production server?

09:20.000 --> 09:23.000
And I don't care if you have a different flavor.

09:23.000 --> 09:26.000
Who would trust Debian mainline?

09:26.000 --> 09:29.000
Most of the hands, I expect it all.

09:29.000 --> 09:32.000
At the point I'm trying to make it, it shouldn't take an expert

09:32.000 --> 09:33.000
to trust open source.

09:33.000 --> 09:39.000
But if I were to ask my mother, should I use the project Debian,

09:39.000 --> 09:41.000
the open source project Debian as the production server?

09:41.000 --> 09:44.000
She wouldn't know what that means, but you get my point.

09:44.000 --> 09:49.000
Most people do not understand the quality that is inside open source.

09:49.000 --> 09:52.000
Sometimes there isn't quality, this is different topic,

09:52.000 --> 09:55.000
but many open source projects are very great from the get go.

09:55.000 --> 09:57.000
Of course, you still need an integrator.

09:57.000 --> 10:03.000
But give them the choice to use it and to use it in a professional manner.

10:03.000 --> 10:06.000
And this is why we started the batch program.

10:06.000 --> 10:11.000
The batch program is designed to be integrated into catalogs,

10:11.000 --> 10:16.000
not to support the developer on what is the next thing they have to achieve.

10:16.000 --> 10:18.000
What's the next metric to improve?

10:18.000 --> 10:20.000
This isn't really the point.

10:20.000 --> 10:22.000
The point is credit, we're credit is due.

10:22.000 --> 10:26.000
Tell the world what on the open source world is already there.

10:26.000 --> 10:28.000
Try to show.

10:28.000 --> 10:29.000
Sorry.

10:29.000 --> 10:34.000
Don't try to be the next 50 minutes.

10:34.000 --> 10:40.000
Don't try to be the next authority on what is good software.

10:40.000 --> 10:41.000
This is not our job.

10:41.000 --> 10:46.000
But we can tell the world that the software that we have fits into certain criteria.

10:46.000 --> 10:47.000
It isn't bad.

10:47.000 --> 10:49.000
And this is exactly where it comes in.

10:49.000 --> 10:50.000
Just one thing.

10:50.000 --> 10:55.000
The Center for Digital to Solventy in Germany is precisely targeted at Germany.

10:55.000 --> 10:57.000
This is exactly who we are responsible for.

10:57.000 --> 10:59.000
Hence, I'm very sorry.

10:59.000 --> 11:01.000
Most things are not translated to English.

11:01.000 --> 11:03.000
That's the reason, because we don't like it.

11:03.000 --> 11:09.000
Some are, but this is really not who we have to focus on.

11:10.000 --> 11:12.000
So the batch program.

11:12.000 --> 11:15.000
As I said, it's intended to be embedded into software catalog.

11:15.000 --> 11:18.000
Show people that a given software project isn't bad.

11:18.000 --> 11:21.000
It's supposed to be automatic.

11:21.000 --> 11:26.000
There's one thing that actually requires a human, but you will see why.

11:26.000 --> 11:33.000
I tried to take as many boxes from a technologically automatically to help for procurement, for instance,

11:33.000 --> 11:36.000
or help people get an idea that this software isn't bad.

11:36.000 --> 11:39.000
And we look at legal, security adoption and project maintenance.

11:39.000 --> 11:43.000
You will see, indeed, that they are not as bad as they seem.

11:43.000 --> 11:45.000
The first one is the open source batch.

11:45.000 --> 11:46.000
This is very simple.

11:46.000 --> 11:48.000
For us, it's very simple.

11:48.000 --> 11:51.000
Every project on open code by policy is open source.

11:51.000 --> 11:53.000
So we don't have to do the diligence at the moment.

11:53.000 --> 11:56.000
But to be fair, there is.

11:56.000 --> 12:01.000
We could dive deeper into, for instance, the question.

12:01.000 --> 12:05.000
Can we automate the question of whether or not artifacts are 100% open source?

12:05.000 --> 12:06.000
Or not.

12:06.000 --> 12:09.000
This is where things can grow into.

12:09.000 --> 12:13.000
Right now, it's very simple for us policy defines.

12:13.000 --> 12:15.000
And that we can refer to at the moment.

12:15.000 --> 12:17.000
We have the maintenance batch.

12:17.000 --> 12:22.000
The maintenance batch, just on a very high level, tells you, this software isn't dead.

12:22.000 --> 12:26.000
It's maintained, where people are actively answering issues.

12:26.000 --> 12:31.000
On the first level, the later levels, the crisis proof.

12:31.000 --> 12:37.000
This crisis proof, for us, means there's more than one code developer.

12:37.000 --> 12:44.000
And that code developer is anyone who has more than 20, 30% on the commit ratio.

12:44.000 --> 12:49.000
So really, we should try to figure out what is it that people really need.

12:49.000 --> 12:54.000
And if I have a project where they quite actively answer all the issues,

12:54.000 --> 12:58.000
where the reason they are released is just now and then.

12:58.000 --> 13:02.000
I have more than just one guy, right?

13:02.000 --> 13:03.000
Three badges.

13:03.000 --> 13:04.000
Go for it.

13:04.000 --> 13:05.000
That's an information.

13:05.000 --> 13:09.000
There are more things we check, but really this is the information we want to give out.

13:09.000 --> 13:10.000
Right?

13:10.000 --> 13:13.000
This is more than most proprietary products have.

13:13.000 --> 13:18.000
With the reuse batch, and this is one of the more important ones.

13:18.000 --> 13:19.000
Ready for reuse?

13:19.000 --> 13:21.000
Quite simple.

13:21.000 --> 13:22.000
It has packages.

13:22.000 --> 13:23.000
It has really users.

13:23.000 --> 13:25.000
Is there something available you could use?

13:25.000 --> 13:26.000
But this is boring.

13:26.000 --> 13:28.000
The important one is actively use.

13:28.000 --> 13:31.000
This is where I say that we need humans.

13:31.000 --> 13:35.000
On open code, everyone in the public administration can just take, I'm using this.

13:35.000 --> 13:40.000
And I had to add this one, example from a few talks before, right?

13:40.000 --> 13:50.000
If I were to tell you that, for instance, any federal government agency runs, open WRT, at scale.

13:50.000 --> 13:54.000
As a proof of concept, but let's say I would say that.

13:54.000 --> 13:59.000
This provides a different level of assurance towards whether or not immigration can be assumed.

13:59.000 --> 14:00.000
Right?

14:00.000 --> 14:06.000
If this information doesn't exist, most municipalities wouldn't even consider open WRT.

14:06.000 --> 14:08.000
This changes the field.

14:08.000 --> 14:12.000
And this is why this kind of batch is for us, one of the more important ones.

14:12.000 --> 14:17.000
Just to show the world that things exist.

14:18.000 --> 14:21.000
Yeah, this is how it can look.

14:21.000 --> 14:24.000
Everyone in open code is allowed to do this.

14:24.000 --> 14:32.000
There's the one can say what company they come from for, in short, in short,

14:32.000 --> 14:33.000
a form.

14:33.000 --> 14:38.000
And if they really want to, they can even be listed as a contact person.

14:38.000 --> 14:46.000
Ah, it's not mentioned, but it's a security batch.

14:46.000 --> 14:49.000
That's wrong, I was confused.

14:49.000 --> 14:54.000
The last one is the security batch, where we care about security basic practices.

14:54.000 --> 15:01.000
For instance, some of our users said, people don't trust open source, because anyone can commit.

15:01.000 --> 15:03.000
Of course, that's not the case.

15:03.000 --> 15:05.000
This is what we're checking, right?

15:05.000 --> 15:07.000
No, not everyone can commit, right?

15:07.000 --> 15:12.000
Yeah, you have some, I think branch protections, even level two, stuff like that.

15:12.000 --> 15:19.000
Provide people with the basic understanding that normal open source ecosystems are not unmentained,

15:19.000 --> 15:22.000
unsecure, and not in the use by anyone.

15:22.000 --> 15:26.000
They are in production, they are secure, most not all of them.

15:26.000 --> 15:29.000
And many are maintained, very well maintained.

15:29.000 --> 15:34.000
Now give them a chance just to go there and be used in the production.

15:34.000 --> 15:39.000
Because I am going to be faster than that.

15:39.000 --> 15:49.000
The last batch that we got, this is the first time we actually look for instance at attestations.

15:49.000 --> 15:56.000
I have to point out at the moment that we are very focused on containers and container infrastructures,

15:56.000 --> 16:01.000
because in Germany we have a larger cloud strategy put it this way.

16:01.000 --> 16:07.000
So this is the first batch where we actually say right on the last image that we see.

16:07.000 --> 16:11.000
We look at the attestation, like the OCI attestation, the signed one.

16:11.000 --> 16:16.000
We look if there is an s-bomb, if there is an s-bomb, a trustworthy one.

16:16.000 --> 16:20.000
And it has CV information and effects information.

16:20.000 --> 16:22.000
We want to see that this is managed.

16:22.000 --> 16:27.000
We want to see that the last release does not have high or critical CVs.

16:27.000 --> 16:29.000
This is necessary check.

16:29.000 --> 16:32.000
No, but now I can say, this is secure.

16:32.000 --> 16:36.000
There is no known vulnerability for this software in this release.

16:36.000 --> 16:40.000
This information is quite important to have.

16:40.000 --> 16:44.000
It is quite important to put on a sticker on a software inventory,

16:44.000 --> 16:46.000
because right now you can just look at it and say,

16:46.000 --> 16:50.000
obviously there is a way to use this in a secure way.

16:50.000 --> 16:53.000
If you don't get the batch, of course, different topic.

16:57.000 --> 17:00.000
Taking this one step further.

17:00.000 --> 17:05.000
This is the latest project that we started.

17:05.000 --> 17:06.000
I have to read it.

17:06.000 --> 17:08.000
I know I haven't spelled it out.

17:08.000 --> 17:11.000
This is a secure government container initiative.

17:11.000 --> 17:12.000
Yes.

17:12.000 --> 17:13.000
Yes.

17:13.000 --> 17:14.000
Find it.

17:14.000 --> 17:16.000
The bullet point.

17:16.000 --> 17:21.000
This is our way to create a Docker hub,

17:21.000 --> 17:24.000
that isn't a geopolitical playball.

17:24.000 --> 17:27.000
A Docker hub that cannot be taken down.

17:27.000 --> 17:29.000
A supply chain for the public administration,

17:29.000 --> 17:32.000
just to use containers to redistribute containers.

17:32.000 --> 17:35.000
And as I said before, we look at it as stations.

17:35.000 --> 17:37.000
For instance, one of our policies is,

17:37.000 --> 17:40.000
we only distribute containers that are actively maintained.

17:40.000 --> 17:44.000
And the actively maintained now means that all higher CVs,

17:44.000 --> 17:49.000
high 7 plus and upwards, are a have Vex attestations.

17:49.000 --> 17:52.000
Now that Vex can say you big problem, sorry.

17:52.000 --> 17:56.000
All that Vex attestation can be definitely not affected.

17:56.000 --> 17:59.000
But this is what we consider to be maintained.

17:59.000 --> 18:02.000
If the software doesn't have new builds, I don't care.

18:02.000 --> 18:06.000
But I care if the software has no vulnerabilities that nobody looks at.

18:06.000 --> 18:08.000
This is what I call on maintained.

18:08.000 --> 18:15.000
And this is now our way to basically create this kind of infrastructure.

18:15.000 --> 18:18.000
I have to mention that this isn't necessarily a service

18:18.000 --> 18:20.000
that we put out to the public administration.

18:20.000 --> 18:26.000
This is an initiative that we started from our own needs with various players.

18:26.000 --> 18:29.000
The open desk, I mentioned it, of course, is container-based.

18:29.000 --> 18:31.000
We have about a hundred containers in it.

18:31.000 --> 18:33.000
We have to harden these containers.

18:33.000 --> 18:37.000
This is where we put the containers for others to reuse.

18:37.000 --> 18:45.000
And the Ministry of Foreign Affairs has joined in.

18:45.000 --> 18:49.000
They have publishing containers as well for their own needs.

18:49.000 --> 18:54.000
So what we try to do is we create this new supply chain that is resilient.

18:54.000 --> 18:58.000
That is sovereign, if I dare say.

18:58.000 --> 19:02.000
And provides a way for the public administration just to collaborate with each other.

19:02.000 --> 19:06.000
Just to push something in a very safe space, I would like to say.

19:06.000 --> 19:16.000
And pull it out again the way that we intend and that doesn't violate any kind of policies.

19:16.000 --> 19:19.000
And now I have time for questions.

19:27.000 --> 19:29.000
Hans, I heard that one first.

19:29.000 --> 19:30.000
Yes.

19:30.000 --> 19:34.000
Is there any kind to support commercial corporations in this world?

19:34.000 --> 19:37.000
Or is this just a public sector?

19:37.000 --> 19:38.000
Ah.

19:38.000 --> 19:43.000
The question was, is it planned that we support private corporations as well?

19:43.000 --> 19:44.000
Yes.

19:44.000 --> 19:45.000
And it's necessarily.

19:45.000 --> 19:52.000
It's a follow-up question, because a large part of the cooperation in Europe is actually,

19:52.000 --> 19:58.000
it has to work for Europe to function as an area.

19:58.000 --> 20:05.000
And I think for some of the banks, it could be atostations, as it could stores.

20:06.000 --> 20:19.000
So the question really is, how do we include the North Public Administration into this?

20:19.000 --> 20:22.000
I can't say the supply chain, just for me.

20:22.000 --> 20:23.000
Yes.

20:23.000 --> 20:25.000
And no.

20:25.000 --> 20:27.000
We are reaching out wherever we can.

20:27.000 --> 20:30.000
We try to make this accessible to anyone.

20:30.000 --> 20:34.000
The thing is right now, we are kind of bound by just legal matters.

20:34.000 --> 20:40.000
We are not responsible for private sectors in the way that we are for the public administration.

20:40.000 --> 20:42.000
We are getting out to that.

20:42.000 --> 20:47.000
We are, at the very least, it's very simple to join that supply chain and read from it,

20:47.000 --> 20:49.000
because it's always read public.

20:49.000 --> 20:50.000
But participate.

20:50.000 --> 20:54.000
This is something that we are currently building up on how does it work,

20:54.000 --> 20:57.000
because this needs steering.

20:57.000 --> 21:00.000
We need a sovereign market in Europe.

21:00.000 --> 21:01.000
Yes.

21:01.000 --> 21:02.000
Yes.

21:02.000 --> 21:10.000
And this would be just, so we need, the comment was we need a market for sovereign solutions.

21:10.000 --> 21:13.000
This is one anchor point to this.

21:13.000 --> 21:14.000
Right.

21:14.000 --> 21:19.000
And if we have a larger market, we are going to just talk on if that's possible.

21:19.000 --> 21:22.000
Uh, five minutes.

21:22.000 --> 21:23.000
Yes.

21:23.000 --> 21:25.000
There.

21:25.000 --> 21:27.000
Yeah.

21:28.000 --> 21:29.000
No.

21:29.000 --> 21:31.000
I also worked for a company Germany whole thing.

21:31.000 --> 21:33.000
So there's a lot of chance to work on that.

21:33.000 --> 21:37.000
And sometimes I see a bit of respect to open a code,

21:37.000 --> 21:39.000
but I think it's open.

21:39.000 --> 21:43.000
And also, to understand that this public infrastructure,

21:43.000 --> 21:45.000
I'll see going to the market.

21:45.000 --> 21:49.000
So, and I also request by the number of reports,

21:49.000 --> 21:52.000
where there is that 10 is less or less great possible.

21:52.000 --> 21:55.000
Can we just share, obviously,

21:56.000 --> 21:58.000
how can you do that?

21:58.000 --> 22:01.000
I think the opening work on the market was all in.

22:01.000 --> 22:03.000
How can you, uh,

22:03.000 --> 22:05.000
uh, on this level?

22:05.000 --> 22:07.000
Or do you do this thing?

22:07.000 --> 22:10.000
The point is, the budget is just,

22:10.000 --> 22:13.000
I think, to explain this to,

22:13.000 --> 22:15.000
I think that two things to this.

22:15.000 --> 22:17.000
One is, um, reusing the software.

22:17.000 --> 22:19.000
This is where the batch comes in.

22:19.000 --> 22:21.000
Um, publishing something.

22:21.000 --> 22:22.000
Also, sorry.

22:22.000 --> 22:24.000
The, the question basically was, how do you,

22:24.000 --> 22:26.000
do you convince the, the public administration,

22:26.000 --> 22:28.000
or anyone just to go there,

22:28.000 --> 22:30.000
uh, and just to participate?

22:30.000 --> 22:32.000
But the, the funny thing is,

22:32.000 --> 22:36.000
um, finding someone who's willing to publish the code for me,

22:36.000 --> 22:37.000
this seems very simple.

22:37.000 --> 22:40.000
Uh, because we put out, put out this place.

22:40.000 --> 22:43.000
Um, we make the barriers as simple as possible.

22:43.000 --> 22:46.000
And, um, I think we have quite high,

22:46.000 --> 22:48.000
high visibility,

22:48.000 --> 22:50.000
um, actors on the platform.

22:50.000 --> 22:52.000
Like the, the, the, the Dutch unstack,

22:52.000 --> 22:56.000
the German stack, the, the idea on what exactly is a cloud platform in Germany.

22:56.000 --> 23:00.000
This is actively developed by the federal ministry of digital affairs,

23:00.000 --> 23:02.000
whatever, um, on open code.

23:02.000 --> 23:06.000
So we, we have some visibility in that regard.

23:06.000 --> 23:10.000
So, I, I assume there's still very many projects

23:10.000 --> 23:14.000
who would like to, to leave their proprietary realm.

23:14.000 --> 23:16.000
Um, I have the discussions,

23:16.000 --> 23:20.000
and usually the, it's, it has become very easy to reach to get out

23:20.000 --> 23:24.000
because the important guys are already doing it.

23:24.000 --> 23:26.000
Just just as an idea, right?

23:26.000 --> 23:28.000
This is, um, by, by the way, we have,

23:28.000 --> 23:32.000
apart, apart from the, the documentation that we publish.

23:32.000 --> 23:36.000
Um, our members, or our people on the platform,

23:36.000 --> 23:40.000
are, uh, a successfully patch, um,

23:40.000 --> 23:42.000
publishing, uh, workflows,

23:42.000 --> 23:44.000
and how to actually publish the PTV,

23:44.000 --> 23:48.000
the, the, the, the, the, the Ministry, I don't know, for technical and physical stuff.

23:48.000 --> 23:52.000
Um, they have published a guideline on how, what exactly do they have to

23:52.000 --> 23:56.000
run through from a legal perspective to publish things as open source.

23:56.000 --> 24:00.000
Right? So, so slowly it becomes just easier to go there.

24:00.000 --> 24:04.000
But I don't have to convince people anymore.

24:04.000 --> 24:10.000
Yeah.

24:10.000 --> 24:12.000
Yeah.

24:12.000 --> 24:14.000
Uh, first of all,

24:14.000 --> 24:16.000
is the extension to be, like,

24:16.000 --> 24:20.000
a draftman, a replacement for the document,

24:20.000 --> 24:22.000
which, uh, that can be a good thing.

24:22.000 --> 24:26.000
Private, uh, of course.

24:26.000 --> 24:28.000
Uh, one second.

24:28.000 --> 24:30.000
Our question is,

24:30.000 --> 24:34.000
is this only talking about the German,

24:34.000 --> 24:36.000
the government's ecosystem,

24:36.000 --> 24:40.000
or is the intention to open it up to,

24:40.000 --> 24:46.000
all the member states, uh,

24:46.000 --> 24:50.000
uh, also that, uh, the intention of this project is,

24:50.000 --> 24:54.000
uh, independent of geopolitical, uh,

24:54.000 --> 24:56.000
uh,

24:56.000 --> 25:04.000
one of the three great questions.

25:04.000 --> 25:06.000
Let me first try to, um,

25:06.000 --> 25:09.000
uh, first, so it's about to contain any initiative.

25:09.000 --> 25:12.000
Uh, first one is, is it supposed to be a drop in the replacement

25:12.000 --> 25:14.000
to existing registries?

25:14.000 --> 25:15.000
And yes, it is.

25:15.000 --> 25:17.000
Uh, absolutely, especially for the public administration.

25:17.000 --> 25:18.000
This is the job I have to fulfill.

25:18.000 --> 25:22.000
At the same time, we don't try to, to scope anyone out.

25:22.000 --> 25:25.000
I have to make sure the public administration can use this

25:25.000 --> 25:27.000
on a sovereign way.

25:27.000 --> 25:29.000
Time's up.

25:29.000 --> 25:32.000
Um, there is a big paper, just let me finish that word.

25:32.000 --> 25:34.000
Um, SSDLC.

25:34.000 --> 25:35.000
Maybe, maybe, I hope it's just, I hope,

25:35.000 --> 25:39.000
I think it's just in German, but Google translate goes along way.

25:39.000 --> 25:41.000
Uh, SSDLC on open code.

25:41.000 --> 25:43.000
This is a large paper that we have, uh,

25:43.000 --> 25:46.000
with the BSI together on what exactly has to change

25:46.000 --> 25:50.000
to make this kind of supply chains resilient.

25:50.000 --> 25:51.000
Thank you.

25:51.000 --> 25:53.000
Thank you.