Overview
No description available.
Schedule
Can Open Source be Secure by Design?
For twenty years, the tech industry has externalized more and more risk into the digital commons of free and open source software. Despite the undeniable economic benefits of open source collaboration, by withholding security-essential features and under-investing in communities which maintain that commons, industry has invited disaster.In response to the sharp rise in global cybersecurity incidents and the role FOSS has played in some of them, some governments mobilized investments and contemplated regulations — such as SOSSA in the U.S. and the CRA in Europe — to improve the safety of our now-digital world.Æva Black will reflect on historical inflection points that led to these challenges and share their view of how the Cyber Resilience Act could create a once-in-a-generation opportunity to improve the sustainability of open source communities through Voluntary Security Attestations.
Does FOSS Buy Sovereignty? Participation vs. Ownership
Digital sovereignty has become central to EU technology policy, with FOSS frequently positioned as a solution to dependencies on foreign proprietary systems. But simply deploying open source software does not automatically deliver sovereignty.This talk examines what actually confers digital sovereignty, license freedoms or something more demanding: sustained participation in development communities, institutional knowledge, and capacity to shape technological trajectories. The critical distinction is between passive adoption (downloading and deploying FOSS) and active engagement (contributing code, influencing governance, operating critical infrastructure).Analysis of different national strategies reveals a counterintuitive finding: copyright ownership matters less than developmental participation. More provocatively, certain forms of international collaboration enhance rather than compromise strategic autonomy, a concept this talk frames as "interdependent autonomy." Participation in global FOSS communities can strengthen rather than weaken national capabilities.Key takeaways: what sovereignty requires beyond license compliance, why passive adoption often fails to deliver independence, how different FOSS governance models affect sovereignty outcomes, and whether collaborative innovation can compete with proprietary R&D for strategic capabilities. The implications reshape procurement policy, workforce development strategies, and alliance frameworks for technology cooperation.
Success Stories in Open Source: Security Audits with OSTIF
The speaker will talk about the importance of security audits and a process tailored to open source communities, and highlight numerous success stories in improving the security posture of open source projects. Examples include the audit of git, kubernetes, ruby on rails, and php-src. The topic is relevant to the audience because the evidence presented in the talk suggests that a real implementable solution to solve the security and technical debt of software projects is tenable. The main takeaways are as follows: (a)Security audits are an effective tool for helping improve the security posture of projects (b)Projects of all sizes, maturity levels, and complexities have benefited from additional security audit work and (c) OSTIF, as an independent nonprofit, is facilitating and executing security audits for critical open source projects at a high level of effectiveness. While many solutions to the security problems of open source are theoretical and require considerable effort, OSTIF has honed in on a process to help open source projects en masse with a well established best practice: independent expert security review.
Identifying and Addressing Usability Vulnerabilities
Even well-engineered security tools can expose users to risk if design choices make safe actions unclear or burdensome. This talk examines how usability directly shapes security, based on Ura Design’s audits and field studies for SecureDrop, Qubes OS, and Mailvelope.We define a usability vulnerability as a design flaw that predictably leads users to unsafe behavior, despite correct technical implementation. Examples include misleading encryption states, ambiguous trust cues, and compartmentalization patterns that break user mental models.The session introduces a repeatable method for identifying and documenting such vulnerabilities within existing security review cycles. Attendees, including maintainers, designers, and security reviewers, will learn how to integrate usability findings into threat models, triage design issues with the same rigor as code CVEs, and prevent security regressions before they reach production.
Open Source in Local Governments: Lessons from across the EU
As Europe aims for 100% online public services by 2030, local governments face unique challenges in adopting and reusing open source software, particularly when building internal capacity, adapting for the needs of the public sector, working within existing regulations, and collaborating across borders. This talk presents exciting research from a new Open Source Observatory (OSOR) study on open source in local governments, examining five mature European case studies of local government open source collaboration, from Madrid's Consul Democracy platform used globally to Prague's Golemio smart city solution.Participants will discover three critical collaboration archetypes: local governments as adopters, community actors as stewards, and service suppliers as technical enablers. They will learn how cities overcome barriers like conservative procurement practices, limited technical capabilities, and vendor lock-in through innovative governance models and cross-border partnerships. Key takeaways include: proven strategies for designing reusable solutions from day one, funding models that ensure project sustainability, effective roles for local government associations, and recommendations for building capable service supplier ecosystems.Whether you're a policymaker, technologist, or open source advocate, you will gain practical insights for creating and sustaining digital infrastructure through collaborative open source development in the public sector.
Open-Source Stewards Under the CRA: NPO Pitfalls
The EU Cyber Resilience Act (CRA) introduces the Open-Source Software Steward (OSSS) role — a novel legal construct acknowledging entities that systematically support open-source development. While it promises lighter duties than full “manufacturers,” the OSSS label can create unexpected exposure for foundations, associations (e.V.s) and volunteer organizations.This session focuses exclusively on non-commercial actors — not on businesses seeking OSSS qualification — and explores the pitfalls of leveraging the status: • Benefits of OSSS recognition for NPOs: legitimacy, funding leverage, and security-governance credibility. • Problems & Obligations: Article 24 CRA obligations (security policy, vulnerability handling, authority cooperation). • Achieving / Avoiding OSSS classification. • Liability effects: how far the penalty exception in Art. 64 para. 10 CRA could extend to civil liability. • Tax status implications: narrative conflicts between “intended for commercial activities” and non-profit status (Gemeinnützigkeit); mitigation through legal operations and desirable tax legislation. • Other legal angles: antitrust boundaries and GDPR responsibilities. • “OSSS as a Service”: outsourcing as an option for every NPO? And what to keep in mind when signing and executing such an agreement? • Case Studies: ◦ A German Fediverse gGmbH with no non-profit status and it’s U.S. 501(c)(3) counterpart ◦ A Belgian Private Foundation ◦ A German Association with non-profit status
2.5 Years of STA Bug Resilience: how we helped a lot of FOSS
Since October 2023 Neighbourhoodie Software has been the Sovereign Tech Agency’s partner for the Bug Resilience Program and has helped improve a large number of high-profile FOSS projects.For FOSS maintainers, this talk covers how the program works, how you can apply and what you can expect from it.For the generally curious, this talk gives a fascinating insight into the variety of the FOSS landscape, what projects of different sizes, ages and importances struggle with, and how the team at Neighbourhoodie managed to make substantial contributions. The insights begin with the peculiarities of how certain projects organise their project communication, what they think is important to address (versus what the world might think is important) and we’ll cover the gratitude project maintainers send us after a job well done.This talk also covers strategies for how to become a valuable contributor in projects of high complexity and impact in just a couple of days. Communication and honesty are obviously key, but some skill is required and this talk will help you get up to speed, should you want to join and help a project.
Saxony in Action: Supporting a Lasting FOSS Foundation
What happens when a federal state doesn’t just talk about supporting open source - but actually does it?In this talk, we’ll share insights on how the state of Saxony is becoming a pioneer for open source in Germany: with a clear open source strategy and real financial support such as the publicly funded project FOCIS, which enables our non-profit association ALASCA to grow into a more stable, independent home for open source projects.We’ll take you through our journey from a young association supported mostly by volunteers, to a professionally staffed organization that now supports six projects. With public funding, we were able to hire own employees, stabilize and expand existing governance structures, and lay the groundwork for a resilient open source foundation.You’ll learn: How public funding can help in bootstrapping an open source foundation which benefits and support have been established using public funding What other communities or regions can take from this exampleThis talk is for anyone building or supporting open source communities - from maintainers and foundation organizers to policy makers and public sector advocates - who care about long-term sustainability, governance, and funding models.
Building the Open Alternative: DPGs for Digital Sovereignty
Digital sovereignty—the ability for nations, organisations, and individuals to control their own digital future—is one of the key policy priorities of our time. This joint talk, shared between a representative from the Digital Public Goods Alliance (DPGA) and a team member from Mastodon, will explain how Digital Public Goods (DPGs) are a key building block for achieving greater digital sovereignty in the wake of geopolitical insecurity. We will start by unpacking the term "digital sovereignty" and the role open source technologies and digital public goods play in it. We will then discuss the strengths and weaknesses of core EU policies that support the open source ecosystem, mandating interoperability and data portability as key measures to level the playing field and provide opportunities for open alternative solutions. We will use Mastodon as a prime example of a globally recognised, federated DPG that challenges entrenched market powers, discussing practical pathways for seizing the opportunities EU policies provide. We aim to move beyond philosophical debates to offer concrete strategies for leveraging FOSS for the public good, helping to build and maintain a decentralised and democratically controlled internet infrastructure with sovereignty at its heart.
Co-Creating RIECS with Open Source Builders
Open source builders are at the heart of many citizen science initiatives — creating platforms, tools, and data systems that enable communities to participate in real research. Yet, these efforts often face similar challenges: maintaining software, ensuring data quality, and sustaining collaboration.This 60-minute RIECS¹-Concept workshop brings together developers, maintainers, and project organizers to share experiences and identify what kinds of technical services, governance models, and community support are most needed.The insights gathered will inform the concept design of a European research infrastructure for citizen science — connecting open source innovation with participatory research and long-term sustainability.Learn more about the RIECS-Concept: Project Website | Mastodon¹ Research Infrastructure for Excellence in Citizen Science
How open source companies win
When an open source companies abandons their open source license, it's rarely because they are horrible people and more often because they've failed to use open source to their advantage. In this talk, I'll draw on concrete examples from five years of The Business of Open Source, plus my experience as a consultant, to talk about ways that an open source project can give a company an advantage in terms of product development, marketing, sales enablement, internal alignment and more. The goal of this talk is to ultimately prevent more companies from abandoning open source by giving them a concrete roadmap for how to not just mitigate risk but really leverage their open source project to accelerate their business growth over the long term.
How the city of Munich measures digital sovereignty
With 43,000 employees, the City of Munich administration is the largest employer in the city and has its own comprehensive IT provider. With our own data center, we have the opportunity to achieve a high degree of digital sovereignty. In order to systematically increase our digital sovereignty, we have developed a measurement method that evaluates various criteria. In our talk, we will show how the measurement method is used and what measures have been derived from it. We will place a special focus on measures that promote the use of FOSS.
AI-Generated Code: Legal Risks and How to Reduce Them
AI tools such as GitHub Copilot are not creative geniuses – they copy! And they do so more frequently and more demonstrably than many people believe. Anyone who incorporates AI-generated code into their software today is often already acting with conditional intent – and making themselves vulnerable to claims for damages, injunctions, and even criminal consequences.We present current developments, figures on the frequency of plagiarism, and other prominent cases, shed light on the legal situation, and explain why companies urgently need to protect themselves. We provide clear answers to burning questions:1. Why does AI code become a liability risk?2. How can software manufacturers and purchasers still protect themselves?3. What technical and legal measures can prevent a ticking time bomb in your own product? Anyone who uses AI code carelessly in the future will be left to deal with the damage. We show you how to save yourself—before it's too late.Speakers:Chan-jo Jun and Dr. Andreas Kotulla
A Frictionless Inner Source Journey
For Inner Source to thrive and gain contributors, we need to make the experience as frictionless as possible. Often, we have built large frameworks around Inner Source with the intention of maximizing safety and governance, but these frameworks can inadvertently create unintended obstacles for potential contributors. Let us share with you how we can address this challenge. We assessed the full process for contributing to Inner Source within our company, including all requirements, necessary actions, and governance regulations. We analyzed and measured where people spend time in the process, and then came up with suggestions for cutting the red tape and also for automating unloved compliance topics. Finally, for a smooth Inner Source journey, also from an individual project perspective, we need to make it as easy as possible to contribute. We’ll share some examples and suggestions here which can serve as a model for achieving this.
ORT Server: An open source platform to automate CRA checks
It is challenging esp. for small to medium enterprises (SMEs) to understand and deal with the obligations from the Cyber Resilience Act (CRA). While commercial solutions exist, these usually come at a high cost and the risk of a vendor lock-in. This talk provides an overview of how the open source ORT Server platform can help here.The talk will start with a bit of history of the OSS Review Toolkit and ORT Server projects, how they relate to each other, who the target audiences are, and highlight some technical differences between the two solutions.While the ORT Server also has a REST API, the talk will then focus on using its dedicated UI for making the complex compliance topic and legal workflows more accessible to less technical users. At a concrete example project, the talk will guide through how to deal with vulnerabilities and other policy rule violations found in a way that fulfills CRA requirements.Finally, an outlook will be given over the upcoming and planned features for ORT Server, extending it a general platform to automate software compliance checks including and beyond other regulations like NIS2 and DORA.
Stable software needs stable funding — Mapping workshop
Sustaining FOSS projects continues to pose a challenge. As a funder, we are investigating in our research how combining different funding and resource models might offer viable solutions, and where gaps remain. In this workshop, we want to refine a map we are working on that captures different income and resource streams for FOSS projects.We want to engage with the question of which (combinations) of those funding models can sustain which projects or project stages. Next to grants, donations, sales, and capital investments, we map, amongst others, models such as tiered licenses, corporate open source contributions, and contributions by students as part of their coursework. The search for a stable funding model is complicated by better or worse fits of different kinds of communities and software. We are further well aware that none of these models is likely to be a standalone solution to sustain a project and that each of them has its own difficulties.Instead, we want to investigate how combinations of those can balance each other and support different projects and different project stages. In the workshop we want to walk through three tasks in three 10-15min rounds with you: 1. Add models that are missing from the map 2. Specify pros and cons of the models 3. Specify which projects are eligible for which modelsThe session will be closed by taking stock of what is missing: Which demands are not met by the array of listed approaches to sustain projects in the FOSS ecosystem. We welcome everybody interested and invite specifically people who are active in (F)OSS-projects and their support, to participate in reflecting on these questions with us and to contribute to the map. We fund innovative FOSS from society and for society, with funds from the Federal Ministry of Research, Technology and Space. This workshop is part of the research done in our organisation. We intend to make the map openly accessible after the workshop.
Curating Power: FOSS in the Service of National Interests
Open source has long been celebrated as a global commons — a space where collaboration transcends borders. But what happens when states start curating their own open stacks? From India Stack to the emerging “Deutschland Stack,” governments are assembling and exporting open-source components as part of their digital public infrastructure strategies. These stacks aren’t just technical blueprints — they’re instruments of digital sovereignty, industrial policy, and geopolitical influence.This talk explores how open source has become a site of stack diplomacy: where nations intentionally assemble, govern, and export open technologies to shape global standards and alliances. Drawing on examples from India, China, and the EU, we’ll unpack how “stack curation” works — how the choice of APIs, identity frameworks, or governance models can reflect national philosophies, and how this transforms open infrastructure into soft (and sometimes hard) power.We’ll discuss what this means for open source communities:How do we navigate the line between openness and national interest?Can open collaboration coexist with state-led curation?And what responsibilities do open source maintainers have in this new landscape?By the end, participants will have a clearer understanding of how open stacks are reshaping global cooperation — and how the open source community can respond to ensure openness remains a principle, not just a branding tool.
Is InnerSource Commons good for open source?
Using data from hundreds of millions of open source repositories provided by ecosyste.ms we seek to answer the question: is The InnerSource Commons good for open source? We look at data from 800 member companies to answer what might seem like a simple question, in the process unpacking what it means to support, contribute, and maintain open source software. What a 'healthy' open source project looks like, and where and how we can identify and support important projects that need our help.
Fair Share Cost Tokens
The goal of this talk is to provide an overview of the economic component of the CRA attestation project [1].Fair-share cost tokens are cryptographically signed tokens which allow manufacturers to prove that they are making their "fair" contribution to thehealth of their FOSS Ecosystem. Whenever a commercial software producer - a manufacturer in terms of the CRA - includes FOSS code maintained by a legal entity - an Open Source Software Steward in terms of the CRA - the token is used for attestation. Thus, the two parties can create a communication channel in case of a security incident. The same mechanisms should allow to bring resources deeper into the supply chain, as it can also be used by software stewards to allocate resources towards stewards whoms codebase they are using.Frameworks like SCITT [2] and Omnibor [3] could allow for their technical implementation. However, some policy work is required to make the situation of potential FOSS projects in the EU compatible with 501 (c) 3´s in the US.[1] https://github.com/orcwg/cra-attestations[2] https://datatracker.ietf.org/wg/scitt/about/[3] https://omnibor.io/project/
FLOSS Sustainability: Lessons from a Funding Crisis
Since its inception, Decidim has relied primarily on funding from the city of Barcelona, creating a dependency on this public organization. In 2022, following a funding crisis that nearly jeopardized the project, we developed a Sustainability Plan aimed at diversifying funding sources and reducing our dependence on a single funder.Three years after implementing the plan, we have made significant progress toward our goal.This session will reflect on our approach and key learnings. We will explain how we designed this plan, the challenges for sustainability that a FLOSS project faces, the learnings we have made during the process and the main actions we have takenWe will delve into the different strategies we have designed to attract new funders, especially from the private and philanthropic sector, as well as the challenges we face when it comes to receiving funding from public agencies. Finally, we will evaluate the successes and failures of this plan.This is an ideal talk if you are interested in knowing the challenges that FLOSS projects face when seeking funding, want to learn which are the best strategies to diversify your sources of income and ensure a sustainable growth of your project.
From Tires to Code: Building Michelin's OSPO
Launching an OSPO in a global, non-tech-native corporation presents unique cultural, legal, and organizational hurdles. This session provides a practical feedback on how Michelin built and now operates its OSPO.We will walk through the entire journey, covering:* The historical context and business strategy that drove the need for a formal OSPO. * The practical steps of establishing a strong governance model and the OSPO's structure * A deep dive into our multi-faceted program for cultural change. This is now the core of our strategy and includes: * Company-wide training modules (which we are now in the process of open sourcing). * A gamified badging system to incentivise learning and contribution. * The creation and management of an OSS Champions community to scale our efforts. * Our approach to external communication * The tools we use. * And finally, the road ahead us: the significant challenges that remain on our journey.
Get-Together
What better way to end the first day of FOSS Backstage than with a Get Together?Take the opportunity to meet old and new friends or maybe the person to collaborate with on your next project in a relaxed atmosphere.If your Organization want to support us in offering food and drinks at the get together please contact partner@foss-backstage.de or learn more [here](https://26.foss-backstage.de/become-a-partner/).
Tour: c-base a space station under Berlin
10.000 years into the future humanity will venture into the wide realm of space. In order to terraform planets other planets c-base was constructed as an orbital multivoltine space-station. Due to a Flip-Flop of the Asimov-Constant the cybernetic quicksilver reactor failed. Instead of materializing in the orbit of Gliese 12b c-base was thrown back in the space time continuum by 4.5 billion years and crashed on the surface of earth and slowly sank into the Brandenburg sand.That or something like that is what it´s crew members claim to be the origin story of c-base. Founded in 1995 it is Germanys and probably the world oldest hackerspace run by the NGO c-base e.V.Following it´s creed "be future compatible!" c-base understands itself as a space that allows nerds, geeks, hackers, dreamers and data travelers to gather, converse and discuss how to think and act to make a better future possible. Whatever that may be.In this spirit it not only hosted Lounge of the Chaos Communication Congress when it was held in Berlin. Both the "Förderverein für freie Netzwerke e.V." (2003) german first Freifunk chapter as well as the german Pirate Party (2006) were founded at c-base and the very first BerlinBuzzwords (2009) took place there.To end the first evening of the FOSS Backstage, we offer a tour of c-base. Followed the opportunity to enjoy ending the evening at one of it´s recreational modules with a cold beverage at Sprees waterside with a view of c-base center axis know as the Berliner Fernsehturm to the uninitiated.c-base can be found at Rungestraße 20 close to Jannowitzbrücke.
Can Open Source be Secure by Design?
For twenty years, the tech industry has externalized more and more risk into the digital commons of free and open source software. Despite the undeniable economic benefits of open source collaboration, by withholding security-essential features and under-investing in communities which maintain that commons, industry has invited disaster.In response to the sharp rise in global cybersecurity incidents and the role FOSS has played in some of them, some governments mobilized investments and contemplated regulations — such as SOSSA in the U.S. and the CRA in Europe — to improve the safety of our now-digital world.Æva Black will reflect on historical inflection points that led to these challenges and share their view of how the Cyber Resilience Act could create a once-in-a-generation opportunity to improve the sustainability of open source communities through Voluntary Security Attestations.