This is the last session of today withthe exception of the wrap up remarks.
So I'm pleased to introduce BrentAsh with supply, software, supply
chain, security, and risk management.
Why the future will be federated.
So, Brent has been working withWordPress since the days when it was.
Still called B two, and I've learnedthat that was a long time ago.
I didn't know that he waswriting COBOL programs.
Wow.
On punch cards.
I remember the punch cards in high school.
Over the past 25 years he, he'sworked across nearly every corner of
it from dial up ISPI remember that.
Broadband from static HTML to modernPHP and from Linux advocacy to running
a mandatory press hosting company.
Today he co-owns and operates a WordPressfocused agency in Winnipeg, while also
contributing to projects like Aspire Pressand the Fair Web Foundation to strengthen
WordPress's package management ecosystem.
I will let you take it away.
Thank you.
Oh, yes.
Alright,
I, so I, I might need to, to talk quickly.
I'm gonna try and.
Cover a lot of ground because I onlycut half of what I wanted to say.
So, uh, and I'm, I do hope thatI can leave time for questions.
So why am I not,
this worked like 20 minutes ago.
Hmm.
Alright.
Okay, so who am I?
And this is partlycovered already very well.
Um, but, uh, uh, I came toWordPress, um, as a, as a B two user.
So I've been around for a littlewhile, um, seen some things.
Um, and in the meantime I've worn a lotof different hats, um, from, uh, uh,
well, they're, they're popping up there.
That's, uh, differentthings that I've been doing.
Um, I, uh.
I started as a, uh, running aLinux advocacy website, like 1999,
2000, so early two thousands.
And, um, uh, and I've been running aLinux desktop for over two decades now.
So, uh, that's sort of my opensource, uh, uh, you know, bent.
Um, so it, um.
Early two thousands, Istarted a WordPress site.
It was a, it was a very kindof a niche site, but I, and I
just started writing for me.
As, as bloggers often do.
Um, I was writing to process a wholebunch of different things and ended up
with 2000 daily viewers and, uh, thatwas a little bit of a surprise to me.
But, um, uh, but it got me intoWordPress and I, uh, I kind of went
away from blogging for a while.
Uh, or I blogged 140 characters ata time and, uh, uh, re I've returned
a little bit to doing some long formwriting as time permit permits now.
So, um.
More recently, the Aspire Pressand, uh, fair projects and, uh,
um, you know, uh, the day jobs and,
um, you know, still being very old school.
Um, I, um,
I'll just have to give up on that.
Uh, so.
We're gonna explore why I spent thelast 12 months, uh, trying to, uh,
or working towards decentralizingWordPress software distribution.
So before my career in.
It and all things internet.
Um, I, um, I was in the, uh, generalinsurance industry and I held a
professional designation there.
Um, so one of the things that, uh, thatI learned in moving into managing IT
projects and managing risk in it isthat, um, risk management principles
are, are fairly transferable.
Um, and obviously the first step tomanaging the risk is to identify it.
So we, uh, we have to domore than identify risk.
We have to, uh, in some way quantify it.
So measuring risk, uh, and in riskmanagement, we, we do that in two ways.
One is frequency.
That's sort of the statisticalword, how often something occurs.
But think of it as probability.
How likely is it?
Um, the, the second measureis severity, um, or impact.
How bad could this get?
So what's the worst that could happen?
Is a good question.
Um, followed by what can we do about it?
Um, I, I put in some cartoon slides'cause it's, you know, end of the
day and I want you to stay awake.
So,
um.
So actually managing the risk startswith mitigation strategies, um,
to re reduce both the probabilityand the impact of the, you know,
bad things that could happen.
So.
Uh, risk mitigation strategies.
Um, number one, you can makesomebody else responsible, which
is easier than it sounds becausethat's the basis of insurance and
many other types of contracts.
Mm-hmm.
Um, sometimes that's, you know, justnot enough because, you know, if the
thing happens, even in, you know,even insurance or someone else, being
responsible is a poor consolation.
So you want to reduce therisk to an acceptable level.
You know what is an acceptable level isanything that you can take in stride.
So what, and it, so it'll be differentaccording to, you know, whatever
the risk is and to your situation.
But whatever you can take in strideis acceptable, uh, as a risk.
So you can reduceprobability by prevention.
And this is where we putin, you know, security.
Like we think well, uh, you know, don'tlet the hackers in and we put up the
firewall, um, and then reduce the impact.
So the um, um, the difference betweenreducing probability and reducing
impact here is, uh, I gotta keepthe hackers off my network so they
don't get the credit card numbers.
Reducing impact is not storingthe credit card numbers.
So, uh, if you, uh, ifyou're able to do both.
You know, that's even better.
Um, and then spread of risk is somethingwe'll talk about a little bit because it's
um, uh, it's an underappreciated tactic
and you already know what it is.
Um, you understand it becauseyour mother explained it to you.
She said, don't put allyour eggs in one basket.
Um, so in it, we call ita single point of failure.
The supply chain callsit single vendor risk.
So in the insurance industry, you canbuy a business interruption insurance
so that if the only place that you canbuy a certain part or product, if that,
if their factory burns down, you canhave insurance for that even though it's
not, nothing happened to you directly.
Um, and that is what, um, how youmight cover off a single vendor
risk in that, in that context.
I told you you knew what this was.
Um, because, uh, XKCD calls itdependency, um, and you've all
seen the comic, uh, I'm sure.
So, um, spread of risk would be havingmore than one of these little, uh,
you know, pillars propping things up.
So if you're not man, um, mitigatingrisk, you're not managing it.
You're just accepting it.
So this is, uh, this is where itstarts to get interesting because
we're gonna supply, uh, apply thisto our supply chain for software.
So, um, software does have aparticular kind of a supply chain.
Uh, it's has nothing to do with, uh,you know, trucks moving boxes anymore.
But, um, we have a specific,uh, way of looking at it.
And in most.
Uh, diagrams.
It looks basically like this.
Um, so, uh, digital goods have, you know,a specific type of supply chain that
gets from the, the developer who programsit all the way to, um, the end user.
So.
You can split this upin sort of two areas.
We look at source integrity and buildintegrity so you can kind of recognize
what's happening with, you know, actuallydeveloping the software as the source.
And then what happens when youassemble it for distribution.
So, so, uh, we can, we can actuallygroup these into four areas.
So we have source threats, build threats.
Usage threats and dependency threats.
And this is how we sort of break downthe, uh, um, uh, the supply chain to
look at different risks that can occur.
So you have attack vectorshere, here, here, here.
And they just pop in like that.
They're, um, all these different areasthat you need to ensure are secured.
So these are a whole bunchof different kinds of.
Uh, attacks that can, um, thatcan come against the supply chain.
And we are seeing a lot of, uh, talk aboutthe software supply chain and the, the
different attacks that that have occurred.
So, um, in, um, um, for example, the,um, the long con is not the, uh, not.
It doesn't normally appear on these,um, types of, um, diagrams or slides
because, uh, it's generally, it's,it's a difficult one to deal with.
But, um, yes, I'm thinking of the XZhack and, and I say XZ because I'm, we're
in Canada, so um, X utils is that one.
Yeah.
So, um.
So, and those are very difficultbecause, you know, the attacker was
able to, you know, play the long gameand, and gain a position of trust.
So those are hard to, to dealwith, but they're not impossible.
What's missing from thosediagrams is single vendor risk.
And as of a year ago,people started looking at.
wordpress.org as a single vendor riskfor where we obtain our software updates.
Um, and the thing about supplychains is that they hate uncertainty.
Uh, and this is something that wehave had a lot of in the past year.
Um.
With, with, uh, an uncertain scenario,risk is just hard to quantify.
So whether that's, um, you know,legal actions or, um, you know, the,
the potential of having your, um,your supply chain cut off, uh, as
happened to one host, um, or even, youknow, innocently through outages or
anything like that, um, having only onevendor, um, becomes a, a risk to, um.
43% of the internet.
Uh, and it's not just WordPress,so not picking on WordPress, uh,
because this just happened in, uh,in the Ruby community, uh, where the,
um, Ruby Central sort of assertedcontrol, um, over, uh, Ruby Gems.
Um, but you can already bypass that,um, because this is how the internet
responds to that sort of thing.
So centralized repositories,centralized attacks.
If all the gold is in FortKnox, that's where all the
break-ins are, uh, or attempted.
So, um, uh.
Uh, so in this case, um, um,you know, we're looking at the,
uh, um, the NPM uh, attacks.
And here GitHub stepped in and didsome, uh, some hardening to the,
uh, supply chain, even though theyweren't the primary attack vector.
You know, some of the attackswere using GitHub actions.
And so GitHub, uh, stepped in and,and, um, made some improvements there.
Um.
And as of last month, um, a number of,it's almost a dozen groups, uh, signed a
joint letter saying, Hey, uh, it's prettyexpensive to run these repositories.
Um, and, you know, thiscan't be sustainable.
Uh, so I wanted to be really clearabout this one because, uh, people
already talk about it a little bit as.
Um, as the tragedy of the commons.
But don't be fooled 'causethis is a centralization risk.
Like this is, um, this isa centralization problem.
It's not a, um, you know, it'snot the tragedy of the commons.
'cause that is still the biggest mythaffecting, um, uh, open source software.
Um, so yeah, we're looking for a littlereassurance, a little bit of, uh.
Um, a little bit more certainty.
So let's go back to our supply chain, uh,and remember the, all the different areas.
So we have, uh, we have certaintactics that we can use in each of
these areas, um, uh, to, um, youknow, to harden the supply chain.
But WordPress has a verydifferent kind of supply chain.
Um, and you can see, uh, let's see here.
We've got, uh, we've got two extra stepsin the build stage where the, we've got
the plugin review team, which vets all ofthe, the packages, plugins, and themes.
Um, and we've got, uh, the official,uh, subversion repo, um, which is
in most cases, that is now separatefrom whatever developers are doing.
Uh, on their own, becausedevelopers prefer GitHub or GI
or wherever they're using data.
Nobody really likes SVN.
So, uh, this is, this is a wayas, um, a result is that we end
up having two repositories foreach package that is distributed.
Um, and all of that's internal to.org.
So we have the same threats and thesame, you know, attack vectors, but.
Now we have more surface areabecause we've got two different
repositories now that could beattacked for the same package.
Um, so this, this sort of spreadsout the risk, but it's still in
the same chain, so it doesn't giveyou the benefits of spreading risk.
Um, and so we, um, the issuehere is that we get, um, uh.
We get a bit of, um, um,
sorry, I lost where I was.
Uh,
right.
The, so the attack vectors thatwe've added don't really have
reliable safeguards or they are opa.
Because this is all internal to.org.
Um, and so there are, you know,some people within, uh, within our
community that have much more insightinto this than, you know, the average
person or, uh, anybody that's sort ofoutside that maybe relying on it but
don't really know to be able to say,yes, I trust that level of security
so.
Where did we get this or how did,how did we come up with this is
really more of a when question.
Um, so if we go back to, youknow, around 2004, which we talked
about a little bit in, um, inMatt's session, um, this morning.
So back then, software wason central centralized sites.
So you went to two cows.com, or youwent to download.com or uh, whatever,
and that's where you download allyour software and you probably did
it with an FTP client, um, which, uh,which you know, sends your, uh, your.
Password in plain text becausethis was the early two thousands
and people are going, oh, well,probably no one will notice.
And
but times have changed.
So, uh, um, so Subversion was dominant,uh, right up until 2010, uh, as the, uh,
you know, for source code management,um, agile, which, um, most of us in the
dev world are very familiar with, and.
It's just kind of thenormal way to run a project.
It hadn't really gotten traction.
We're still using, uh,waterfall, uh, methodologies.
Uh, and, and those kind of reflect the,uh, um, systems that are designed for
the cathedral rather than the bizarre.
Um, and this, this was, was an issue.
So, uh, what we, what we had therewas the um, uh, you know, oh.
Sorry, I'm getting ahead of myself.
The, uh, broadband use wasjust passing dial up and, uh,
blogging was in the zeitgeist.
Um, so looking to when B two came,or WordPress came out of B two,
um, uh, and this is the part wecovered a little bit this morning.
First release, May,2003, um, plugin support.
Uh.
The official pluginrepository January, 2005.
Um, and theme support in February.
Um, and then the official plugindirectory, so this is, uh, early 2005, um,
was when we, you know, sort of had that.
And, uh, and really this was, thiswas great at the time because,
um, there was really no, like, thecommunity was, you know, a fraction.
A very small fraction of what it is now,and it was hard to find, um, plugins
or themes that you wanted to use.
So, uh, you just had to, and, and youdidn't know which ones were better or
worse or should I trust this one or not.
And so, uh, you know, in thosedays I would, I would be looking
for, if I was looking for a theme,I might, uh, you know, I might
look around and go, oh, okay.
Well, uh.
Oh, here's one by Brian Gardner.
I know who that is and, uh, youknow, I'm just gonna use his themes.
So, and that's basically how Ilearned to write themes is, you know,
dissecting what, how he'd built them.
Um, and, but you had to kind of knowa little bit about the community
and you had to know where to findstuff and it was very difficult.
So, uh, that kind of Wild Westwas, uh, was kind of brought
gradually to a close by.
People, you know, gradually movinginto, uh, dot org as the official
source for all of the, uh, pluginsand themes, and you could trust it.
Um, so, um, so in those days, thatwas something really needed and out
of necessity, it was all centralized.
Um, so the question is, can wedecentralize it without, without
reintroducing the Wild West?
Um.
Spoiler.
Yes we can.
So, um, how do we respond?
So, um, say doingnothing's always an option.
Um, usually not the best one.
Maybe it's fine, you know,um, maybe it's not fine.
Um.
Because doing nothing wouldbe accepting the risk.
Um, and we have a numberof different risks.
The fact that we've got a larger,uh, surface area for attacks.
We've got, um, some opaque, um, youknow, protection or we don't know.
Uh, and the biggest one single vendor,
so as of a year ago, um.
Aspire Press was founded by SarahSavage who, um, had this, uh,
this idea to do, uh, federated,um, independent repositories.
Uh, and just have them, youknow, anybody could, you know.
Set up a mirror or set up their reposand, uh, and list their packages,
uh, you know, to be distributed.
So, started to work on it and that'swhen I found the group and, um,
not founded, but I found the group.
And, uh, what I found was peopleasking the right questions, which is
far more important than people withthe right answers because you're gonna
get more ideas and you're gonna get.
You know, people working out the kinkstogether and you're gonna get a group,
because at the time there were a lot ofpeople saying, and I mean, most of you
remember this, it's not that long ago.
It's, uh, we had a lot of people saying,oh, here's how you run your own mirror.
Here's how you would do this and that.
But nobody was, nobody's reallyoffering to do it for you.
It's just, oh, here'ssome, here's some tools.
It's like, oh, just set up a mirror.
There's 60,000 packages, by the way.
Just, you know, but here's, here's thecode you can, you know, run it yourself.
Well, it's not really, uh,practical for, for most people.
Um, so the difference here was,um, aspire Press was building
a suite of software tools, um,
and standing up infrastructure.
Because the idea was let's not just havea mirror, let's make it a public mirror.
Anybody can use this.
Um, and we worked with Fastly on that.
So, um, they were, they were,uh, they partnered early.
So as I got involved with the AspirePress project, um, I. I don't know.
I opened my mouth one time, too many orsomething, and I ended up managing big,
uh, project managing big parts of it.
Um, but the development has been, uh,done by, uh, mostly other people and,
and we've had a good group there.
But, um, we launched version 1.0 as of,uh, June 6th in, uh, Basel, um, right
around the time of, uh, word Camp Eu.
And, uh.
Uh, yeah,
the same time, um, early, uh, earlythis year, um, talks sort of started
sort of just sort of quietly andonline and different corners about,
um, um, coming up with a new solution.
And it was, it was very much ofthe same vision that, uh, or, or
very similar to what Aspire Press.
His vision was.
And so we kind of naturally, um, gotinvolved with, uh, with those discussions.
Um, and Fair was born out of that,uh, the federated and independent
repositories, um, was formed underthe Lennox Foundation, which has,
uh, a around a thousand projects.
Uh, so they've got a little bitof experience in knowing how to.
Put together a pro, um, uh, aproject with, you know, good
governance and oversight.
And that's, that's what wewanted because we needed to, we
needed, wanted to move quickly.
And, um, the, uh, LinuxFoundation was able to provide,
you know, guidance in that.
So, um.
Uh, coordinated, um, announcement tookplace, uh, in Basel at the same event.
Um, and that launched the, uh, thefair plugin for technical independence,
which used the Aspire Press, um, serverswith their, the mirror so that we,
you could download everything through,uh, through Fair and Aspire Press
that you could from wordpress.org.
Uh, a couple of weeks later, itwas announced at, um, the, uh,
open source summit, uh, in Denver.
Yes.
And, uh, it, response to thatwas overwhelmingly positive.
Um, both, you know, both from withinthe WordPress community and from.
You know, a, a surprising number ofgroups and, and organizations, people
outside, um, what we call our community.
Um, so non WordPress userssaid, Hey, that's great.
This, we love what you're doing.
So working together to, um,decentralize and federate.
Uh, and, uh, and the approach is, um, for.
Uh, for Fair and Aspire press, um,
to essentially, I I'm saying disruptivepotential, uh, because we are looking to
make some significant changes in the waythat we think about distributing software.
Um, and the, the.
The fair, um, approach was creatinga, a general protocol with WordPress
specific application to it.
So the, in the general applicationof the protocol, it could be
used really to distribute anykinds of, uh, digital goods.
And, uh, I keep usingthe example of EPUBs.
Maybe you've got a whole group ofwriters that love to write science
fiction and they just wanna sharetheir, their epub files so that they
can read what each other is writingThat would work, uh, under this sort
of protocol in the general sense.
But because we are.
Primarily, uh, looking at WordPress rightnow, we have some, you know, a lot of
specific WordPress, um, uh, specific, uh,extensions to the protocol that really
address, um, uh, you know, the way thatWordPress, uh, meets things distributed.
So it's, uh, similarly, it's a suiteof tools that are really standard,
uh, uh, MIT and GPL licenses.
Um.
So back on our supply chain,
we, uh, how did I get
Okay.
Supply chain with our three, uh,three areas that we're, we're looking
at, um, you know, three differenttypes of things that we can do
to help secure a supply chain.
Um, but.
Remember the WordPress supplychain's a little bit different.
So when we're going back to this kindof a model, plus doing it in a, in
a distributed fashion, um, we neededto, uh, we needed to move some things
and we needed to add some things inorder to, um, to provide the additional
layers of security that you, uh, couldpotentially lose by decentralizing.
So, uh, the decentralizingis made much safer by.
Uh, adding some types of securitythat we have never had in WordPress.
Um, and some of them are ones thatwe have talked about, um, for,
in some cases years in WordPressabout, oh, we should have this.
Um, but it, it's just kind of nevercome up as the priority with so many
other things that are, uh, that arebeing done in, uh, in WordPress core.
So, um.
What we did then was we said, okay,well we need to make a, a, a, a stronger
connection between the original.
Um, the original softwareand the end user.
So, um, we have, uh, we tightened thatconnection so that, uh, when the, the
end user website installs the software,they know it, that it is a bit for bit
copy of exactly what they requested.
Um, so even if it was cashedor stored somewhere in between,
it, uh, it, it is, um, uh, it isdigitally signed with a, uh, uh.
Crypto signature so that you can,uh, verify that it's, uh, it's
the right thing that you received.
And how does that work?
So decentralized architecture,um, we first, we, um.
We add some stuff to the package.
So, uh, as I said, it's signed.
Um, it uses a decentralized I, uh, IDso that we can, uh, we can always refer,
um, canonically to the same package.
Um, it's got, uh, a Providence documentthat has attestations that the, uh,
the developer could make, uh, aboutthe, um, about the package and.
Many of these can be verified.
So, uh, the, um, uh, the DIDcan be verified if you have
set up a domain alias for it.
Um, and that's already, uh, in, in fair.
So what, as I kind of go into thispart of the talk, I want to be, uh, I
want to be cautious not to overstatewhat is there today versus the things
that we're working on, but, um, butit's important that you, that I sort of
present the, the direction that we're.
We're going with it.
So, um, so a a lot of this is in place,A lot of it is, you know, underway.
Uh, and some of it is,uh, is future plans.
So I, I may not always point out whichone is which, but, uh, but can clarify.
So, uh, so aggregators like,uh, aspire Cloud, um, can, um.
Uh, point users to all available packages.
Uh, and these can appear, uh, rightin your WordPress dashboard, just
the same way that you've alwayslooked for plugins and themes.
Um, and it can do all of the, uh, thechecks to verify that what the um, um.
What, uh, what the publisher hassaid about the package is accurate.
So verify the check sums and allof the different things that, and
say, yeah, this, this looks good.
Um, uh, we can, um.
We do some code scanning.
So, uh, there's a lot of these checksthat are being done on.org now, and Matt
talked about some of them this morning.
But, um, looking at the same approach.
So we've already got, um, a, um, uh,a good, um, list of, of things that,
uh, uh, um, are checked for in the,um, um, uh, in the WordPress repo.
And we can use the sameones, uh, and extend them.
So distributed repositories, everypublisher of a package gets to choose
where they're hosting their code.
Uh, and uh, we feel that's importantand that's the decentralized part.
So you're in control of, you know,this is the canonical version.
This is the only canonical version, and.
This is where I want it hosted.
So if you like, you know, uh, youknow, GitLab over GitHub or you
know, whatever, uh, or if you wannaself-host and run Git or, or you know,
so there's a, there's a list of, ofones that are currently supported, um,
and likely plans to extend those, um,
and.
Again, installation comes directlyfrom the canonical source, uh, and
is the, the signatures are, arevalidated before the install happens.
So whatever else happens.
So we can assign trust, you know, examinethe trust signals and apply a label
and say, yeah, we trust this package.
But after all of that, at the end of theday, if the pa, if the signature doesn't
match, the install gets aborted because.
Uh, you know, you, you can't be sure,uh, like the, there's not a lot of
certainty that you can, like, nobodyreally wants to put down 100% on, uh,
on a lot of these, these assurances.
But, uh, this one, the, uh, thesignature you can, uh, you can validate
so that gets, that gets the right tooverride any of the other trust signals
that we, uh, that we were looking at.
So, um, labeling packages is, um, uh,is something that we looked at, um, uh,
at Blue Sky, and when I say we, a lot ofus refers to Ryan over here who's done
a lot of this work in writing the specs.
And, uh, uh, Mika Epstein, uh,has written a good chunk of
this part of the spec as well.
So, um.
So we looked at the, at, athow Blue Sky does it and said,
well, this is a good model.
Um, and they've got someprotocols for dealing with it.
And uh, so, um, we can just sortof appropriate that for, um,
uh, a version for, uh, for fair.
So for example, we could havea community labeler, which, um.
Provides additional informationbeyond what Fair provides.
So there's a, um, just like with BlueSky, there's a hard coded sort of a,
um, a trust labeler that everybody getsfrom fair and then everything else after
that you could choose to subscribe to.
So if you wanted to subscribe to,uh, a CVE list, um, you could,
you could potentially do that.
Uh, and if that, um, if that provider.
It gave you an any API for, you know, afree version or a paid version, you could
put in your API key and upgrade and geta different level of service perhaps.
So this is the sort of architecturethat we've, uh, we've envisioned.
And, uh, and for that therecould be any number of, of.
Providers.
But, um, in particular, and just ina couple of weeks we'll be doing a
hackathon at, um, uh, at Cloud Fest inMiami, where we're gonna start building
this with Patch Stack who is sponsoring.
Um, so we're gonna start buildingthis piece to, uh, to allow your,
uh, your WordPress dashboard or,you know, some, uh, means of seeing.
Whether, um, whether our, uh, CVEs listed,
um, do third, third party things like,um, we didn't, we didn't collaborate on
this, but, uh, you know, meets WCAG 2.2.
So if you wanted to provide alabel like that, you could do
that as a third party and say.
Um, you know, different ways of, ofcategorizing, uh, all the packages.
So if that was a requirementfor you, you could filter that
or just sort of general curating lists.
Um, so if you have a trusted reviewerof plugins, you could have him, uh,
um, you know, give you a, a, youknow, a thumbs up or thumbs down.
And if, and.
Uh, and the idea there is if, ifyou wanted, you could configure
it to, uh, to not install anythingthat he gave you a thumbs down.
So, uh, it's gotta get at least threestars from Hank or you don't install it.
So, uh, this is how weimplement a, a trust model.
Um.
And yeah, I'm gonna try and starttalking faster, but, uh, they, um,
so digital trust is a big deal.
Um, the, uh, uh, web oftrust map is, come on.
There we go.
Um, globally it's identified thousandsof, uh, of different projects that are
working on this particular problem.
Uh, how do you verify.
Trust or identity online.
Um, and in Canada alone,
I don't know why it's not loading,but the, the picture is right.
So, um, uh, we've got, uh, andthere's even the, uh, digital ID and
authentication Council of Canada, which,you know, as I, until I started digging
in here, I didn't realize we had that.
Um, so.
Uh, I dunno, maybe they need a littlemore marketing, but, um, but it's, uh,
um, it's all of these people being, um,concerned and working the problem of
how to, uh, establish trust digitally.
So here again, we've, uh, we have.
Sort of how I've, I conceptualizeour, uh, uh, our trust model.
So we've got our package, uh, and we'vegot the different, um, uh, attestations
that the um, um, uh, that the publishercould make as well as different
things that we can, we can run checkson and say, well, does it do this?
And does it have that?
And is this secure?
Um, and.
Y So one of the things is the, uh,the SBO m which, uh, the SBO m is
the, um, software bill of materials.
So, um, in a, in a software package,you might have different libraries or
components that, that ship togetherwith it, and that's what this refers to.
Um, in the, uh, the eus, um,cyber Resilience Act, these
SBOs are a requirement that.
Is will be coming into effect soonerthan we probably realize because, uh,
like unless you've been following it,uh, and if you haven't started towards
it, you're, you know, you're behind.
So, uh, so this is something that,that we said, well let, we can, you
know, we can, uh, put in the abilityto verify that those are present.
Uh, and then we do the,the various checks.
So code, scans, uh, all of that.
So then we.
Calculate a trust score, apply a label,uh, using, uh, criteria that are, uh, are
also used on in a number of other places.
So, uh, open SSF scorecardto uh, wordpress.org.
Um, symphony has a program.
There's, uh, the, uh, opencode has a badge program.
A lot of people are doing this kindof, um, uh, scoring assessment.
We look at the same kinds of,of checks they're doing to, to
validate that best practicesare, um, are being, uh, followed.
So over the length of the, thetime that WordPress has been
running, things have changed.
We structure softwareprojects differently.
Um, so we've gone from waterfall to agile.
We organize our developmentteams differently.
Now we are, you know, not in cubicles.
We are online and asynchronousand decentralized.
We do source code management differently.
Um, we've gone from, um, uh, fromCVS to Subversion to now get, um.
And we even use software differently.
So, uh, does anybody have actually aninstalled copy of Microsoft Office?
We don't do that anymore.
Um, so this gives us anopportunity we should do,
distribute software differently,
and we have the opportunity to demo,democratize the publishing of software.
And this is brought aboutthrough decentralization.
So why the future will be federateddistributed is the natural, healthy
state of the internet, has always been
this.
Don't expect you to read it.
It's just there if you wannadownload the slide later.
But, uh, David Weinberger in,uh, uh, 2001, I think, uh,
described this as, uh, you know.
Uh, this is how package routing works.
It's basically like if you wanted to drivefrom New York to San Francisco and you
did it by driving from one gas station toanother and asking directions at everyone,
and each, each gas station will tellyou, well, yeah, I, I don't really know.
But if you go to that gas stationand ask again, you'll be closer.
And it turns out that that actually ismore efficient and it's more robust.
Because if you had a centralizedspot for all of the package routing
of the internet, one hiccup wouldbring down the whole system.
So it's more robust that way.
Um, and that's by design.
Tim Burners Lee, um, talks about thisbeing very decentralized and he says
that feeling of individual control andthat empowerment is something we've lost.
Um, and this is important, uh, becausefor me this is, um, a Web3 thing.
Web3 is just the webrediscovering its roots.
Web two was silos and monolithic Twitterand Facebook and all of these silos.
Web3 is just saying, oh, that'snot how it was supposed to be.
That's, let's get back towhat, what we, what we meant.
Um,
second, third.
Secondly, web has always beena starfish and not a spider.
Um.
With a, a spider, um, a spideris a wizzy wig organism.
What you see is what you get.
You've got a head, you'vegot a body, and some legs you
cut off the head and it dies.
It's very straightforward.
But a starfish is adecentralized organism.
You can cut off its arm, you can cut it inhalf, and you'll end up with two starfish,
and that is the beauty ofa decentralized organism.
Or a decentralized organization.
And the harder that you fighta decentralized organization,
the stronger it gets.
So this is like the Hydraand Greek mythology.
You're cut off ahead andtwo more grown in its place.
Um, and if you don't believe the analogy,um, ask the recording industry about
how they shut down Napster, and thenthere was no more music sharing anymore.
Because that worked out so well.
Can you wrap it up please?
Yes, I can do that.
We're waiting on the main plenaryas well, so if there's a Okay.
A last wrap up that,
uh, alright, so centralizationbrings zero network value.
Um, network value is something that,uh, you may have thought, uh, thought of
this as Moore's Law and stuff, but StromsLaw actually provides a, uh, um, uh.
An economic calculation tothe value of a, a network.
But if it's decentralized,there is no network to value.
Um, network economics says thatwhen everyone supplies part of the
network, the costs are also shared.
So when, when we're saying that it'snot, um, it's not sustainable to have
all these centralized distribution.
Well, if everybody supplies a piece ofa decentralized network, you've solved
a, a huge piece of the cost problem.
So I, I have to quote, uh, Lenis because,um, he was talking about get here.
Uh, and the reason that he refusedto use CVS or SVN was because it
was not distributed and the Linuxkernel development was distributed.
So
he, so he wrote, get for that reason.
Um, and lastly, it's time.
The, um.
Innovation tends to happen whenthe time is right and when you see
a whole bunch of people workingon the same thing from different
angles, you know, it's coming time.
And that's what we see withthe, uh, the digital trust,
uh, work that are being done.
Um, can you
make a final statement, please?
I can, this does have to end now.
Sorry.
The ethos of open web is decentralized.
And final slide.
Alright.
The future will not be centralized, so.