Open Source in Finance Forum New York 2022
2022-12-08
New York City, United States
as the organisers put it
REGISTER NOW View THE 2023 SITE Post Event Report That’s a wrap on Open Source in Finance Forum 2022! Thank you to all the attendees and speakers that joined us this year! We will migrate all session…
who it's for
platform engineers, security engineers, compliance engineers, data engineers, cloud architects, backend developers (financial services), open source program managers, quantitative engineers
topics
NIST OSCAL compliance as code; SBOM generation (SPDX/CycloneDX); Spark per-row enrichment pipelines; PostgreSQL CI security and encryption; Apache Pulsar streaming platform; WebAssembly in trusted execution environments; open source supply chain security; Terraform infrastructure practices; Backstage developer portals for fintech; ORT policy automation and scanning; Fineract core banking platform; matrix profile anomaly detection
| title | author | length |
|---|---|---|
| Trestle Compliance Collab Platform OS Project + NIST Compliance as Code OSCAL Standard | Anca Sailer | 08m |
Trestle is an open source tool that implements NIST OSCAL and automates continuous compliance: Excel CIS benchmarks convert to OSCAL JSON and human-editable… | ||
| Open-Source Maturity in a 160-year-old organization: Technical and Legal hurdles | Ravi Devineni | 33m |
A 160‑year‑old financial firm uses concrete practices: inventory every repo, generate an SBOM (SPDX) per application, run dependency scanners in CI/CD (OWASP… | ||
| Loans, Accounts, and Transactions on top of Open Source Software | Javier Borkenztain | 15m |
Open source core Fineract powers loans, accounts and transactions for ~2,000 institutions in ~60 countries, exposes REST APIs and ships cloud‑ready and… | ||
| Confidential Transactions with Zero Knowledge Proof in Trusted Execution Environments | Shraddha Vijay Inamdar | 13m |
An open-source runtime compiles code to WebAssembly runtime and loads it into a CPU-backed enclave so only CPU vendor firmware must be trusted; attestation… | ||
| Enriching the Data vs Filtering in Spark | Gokul Prabagaren | 16m |
Compares two Spark patterns and shows a concrete replacement: swapping expensive in-memory inner join filtering for a per-row enrichment pipeline using left… | ||
| Building FinTech Streaming Applications with Pulsar | Timothy J Spann | 22m |
Apache Pulsar promises one unified streaming/messaging plane that handles petabytes and millions of topics with per-tenant isolation and built-in… | ||
| PostgreSQL and DevSecOps: Ensuring database security | Tim Steward | 38m |
Argues that database security must be embedded continuously into CI/CD and gives concrete tooling and controls: Jenkins automation deploys agents, runs PSQL… | ||
| An Open Source Architecture for Modernizing Market Risk Management | Aric Rosenbaum, Marius Bogoevici | 23m |
Proposes an open-source, real-time event-driven backbone that moves risk from overnight batch to sub-minute evaluation using VAR and Monte Carlo (10k–100k… | ||
| An Inside Look at Why Litigation from Patent Assertion Entities is at an All-Time High | Jaime Siegel, Keith Bergelt | 09m |
Open source attracts most of the current surge in patent assertion because it is now pervasive across industries, and investors buy patents and use litigation… | ||
| Real-Time Data-Driven Insights in Finance with OSS Hybrid AI | Hugo Latapie | 24m |
Claims a hybrid OSS system that finds events by detecting simultaneous regime changes across many series using the Matrix Profile and a symbolic layer… | ||
| ORT: Automate your open source policy using Open Source & Inner Source | Thomas Steenbergen | 30m |
An open source compliance pipeline that runs in CI (GitHub/GitLab/Jenkins) using OSS Review Toolkit (ORT) scans code, emits SBOMs (SPDX/CycloneDX), and… | ||
| Superman or Ironman - Can Anyone be a 10x Developer? | Justin Reock | 49m |
Argues that “10x” developers are manufactured by environment not born, citing the 1977 Coding War Games with >600 developers across 92 companies where best vs… | ||
| OSS Documentation: The Cat's Cradle of Information Flows | Elena Treshcheva | 14m |
Describes a documentation strategy for an open source testing platform called CH2 toolkit that splits facts about the generic framework from client-specific… | ||
| The Path to Open Source for the Traditional Enterprise | Raimon Ràfols Montané | 23m |
A traditional insurer describes running hundreds of OSS libraries, running pilots that sometimes succeed and sometimes fail, and staging a global engineering… | ||
| Terraform Practices - The Good, the Bad, and the Ugly | Hila Fish | 41m |
Covers practical, proven Terraform moves: lock provider and Terraform versions and store state in S3 with DynamoDB state locking and S3 versioning so… | ||
| Fireside Chat | Gabriele Columbro, Rohan Deshpande | 19m |
Goldman Sachs runs on open source, claiming 50,000+ open source packages in use and open‑sourced Legend (data modeling suite) in 2020 with internal and… | ||
| How Brex Leverages Backstage for Fintech Engineering Growth | James Russo | 26m |
Brex scales developer onboarding and runtime ops after a 5x engineering growth (from under 100 to ~500 engineers) by adopting Backstage in 2021 and getting a… | ||
| The JavaScript Survival Guide for Financial Services | Robin Bender Ginn, Daniel Cousineau | 26m |
OpenJS Foundation hosts about 40 projects including Node.js, Electron, jQuery, webpack and Jest and provides trademark, infrastructure modernization… | ||
| Securing the npm Ecosystem | Abigail Cabunoc Mayes | 23m |
GitHub describes concrete fixes: after several high‑impact hijacks response time drops from nine hours to 15 minutes, login verification OTPs roll out and 2FA… | ||
| Loosely Coupled - Micro-Frontends And Capital One’s Contact Centers | Steve Husak, Noah Mandelbaum | 35m |
Capital One migrates a 15-year-old ASP.NET monolith into an app-shell micro-frontend platform that runs full-stack JavaScript on AWS, hosts pieces on… | ||
| Debugging Node.js Upgrades | Bethany Griggs | 26m |
Upgrading from Node 14 to 16 breaks a client because a commit (net auto destroy socket) changes socket/stream behavior: Node 14 emits an error when writing to… | ||
| A Conversation with Discover: Career Journey with Open Source | Jane Gavronsky, Angel Diaz | 18m |
Claim: adopting open source practices inside a bank cuts time to deliver and lowers maintenance costs. Describes an internal Discover Technology Academy that… | ||
| ElectronJS from the Source | Jacob Groundwater | 29m |
Electron warns that upgrades drive security and fixes: Chrome ships a new major every six weeks (≈600 engineers), Electron follows and releases about every 12… | ||
| The Life and Times of a Node.js Release | Danielle Adams | 30m |
Node.js maintains four supported release lines and does about 50 releases a year, with routine releases every six months and typical builds of ~100 commits but… | ||
| Getting Energized by the Bureaucracy of Open Source | Sara Chipps | 18m |
Open source projects often start as weekend hacks and scale into production with 100,000 women taught by Girl Develop It as an example of open curriculum… | ||
| Using your Favorite Open Source Database at Enterprise Scale in Financial Services | Julian Moffett | 10m |
EDB positions itself as the largest contributor to Postgres and claims enterprise customers run at scale — one estate reached 15,000 databases. Recommended… | ||
| Looking Backwards and Forwards at CDM:... | Gabriel Callsen, Amy Caruso, Ian Sloyan, David Shone | 19m |
Common Domain Model moves into Finos after six years of industry design, expanding CDM from derivatives to bonds, repo and securities lending and modeling… | ||
| FINOS Project Expo Announcements | Jane Gavronsky, James McLeod | 05m |
Event announces four FDC3 demos and a project expo where teams show working integrations: Connectify, JP Morgan, City Velocity, Ensemble + State Street… | ||
| The State of Open Source in Finance | Hilary Carter, Colin Eberhardt, Cara Delia, Penny Crosman | 20m |
Survey of 250+ respondents finds 87% say OSS is valuable and GitHub commits from finance are up +43%. Finance adopts projects like FDC3, builds an Open Source… | ||
| Awards Ceremony | Gabriele Columbro, James McLeod, Rob Moffatt | 26m |
Desktop agents now pass FDC3 1.2 conformance with three certified providers announced: Cosaic (Finsomble), Tick42 with Glue42 Enterprise and Glue42 Core+… | ||
| Automating Governance - Dear Security, Compliance, & Auditors We’re Sorry. Love DevOps | Bill Bensing | 30m |
Claims an automated pipeline that gets from commit to production with 100% no-human-hands, using CI-collected evidence, signed artifacts and attestations to… | ||
| An Architecture for Universally Interoperable Open Source Wallets | Wenjing Chu | 47m |
Proposes an Internet‑style, four‑layer wallet architecture that puts a minimal authenticity layer (public keys + identifiers) under a trust‑spanning layer so… | ||
| An Open Source Approach to Driving Developer Efficiency | Lee Faus | 45m |
Company open-core instances send heartbeat data to GitLab and the talk shows concrete metrics: onboarding often takes six months to a year (~$50k per hire)… | ||
| Fault Tolerant 24/7 Operations with Aeron Cluster | Todd Montgomery | 34m |
Aeron Cluster (built on Aeron and Aeron Archive) implements a Raft-based replicated log with snapshots and replay, showing region‑wide fault tolerance and… | ||
| What's Community Got to Do with It? Navigating Open Source Contributions in the Financial Industry | Maria Ashby, Matt Gogerly | 21m |
Spinnaker adoption at JP Morgan targets faster, safer releases by addressing scale and approval bottlenecks; Spinnaker is used by over 50 organizations, has… | ||
| Introducing FDC3 Sail, "A Secure Open Source Container for an Open Source Standard" | Nick Kolba, Sebastien M’Barek | 33m |
FDC3 Sail is an open-source Electron-based desktop container that ships a full FDC3 implementation (contributed to FINOS) and proves concrete developer… | ||
| Bridging the Gap - Connecting Multiple Desktop Agents in Your FDC3 Environment | Tiago Pina, Aaron Haines | 29m |
Proposes adding a Desktop Agent Bridge to FDC3 and shows an open‑source implementation called BackPlane that already runs on user machines, connects desktop… | ||
| Open Source at Goldman Sachs | Bella Wiseman, Vicki Chung, Priya Gupta, Kay XiongPachay, Rob Moffatt | 34m |
Open Source Program Office launches August 2021 and grows to about eight staff in a year, standardizing contribution policies and licensing workflows, adding… | ||
| The Benefits and Pitfalls of OSS Project Metrics: Measuring Health and Risk in Open Source Communities | Sophia Vargas | 35m |
Practical rundown of what to expect: concrete metrics and real pitfalls rather than high-level theory, with tools like depths.dev and OSS Insights shown as… | ||
| High-Performance Market Data in a Cloud-Native World | Matt Tait, Salvatore Sferrazza | 42m |
Concrete claim: a schema-driven transcoder called market-data-transcoder (described as ffmpeg for market data) reads binary feeds like SBE/ITCH/FIX, preserves… | ||
| The Path to Amazing Software Through Open Source | Andrew Duckett | 19m |
An inner‑source program codifies a recommended, supported workflow called Golden pass as a repository of step-by-step tutorial guides that list every form… | ||
| How Digital Public Goods Are Bringing the $10 Trillion Informal Economy Into the Digital Payments Loop | Paula Hunter | 43m |
Open source payment plumbing Mojaloop brings interoperable instant payments to 1.4 billion unbanked people and a $10 trillion informal economy by knitting… | ||
| Trends in Enterprise Open Source | Misty Decker, Len Santalucia, Kim Alex, John Mertic | 35m |
Panel claims enterprises treat hybrid stacks as a competitive advantage, not a cost, and offers concrete moves: create a modernization working group with an… | ||
| Real Life Use Cases for FDC3 2.0 | Michael Lynch, Leslie Spiro | 36m |
Shows FDC3 2.0 used live: Symphony, Glue42 and SingleTrack connect via FDC3 2.0 intents and richer data contexts so a market-color message on Symphony launches… | ||
| Bringing Blockchain-Backed Provenance to Financial Services | Csilla Zsigri, Duncan Johnson-Watt | 19m |
A blockchain-backed provenance product called Chronicle records and queries immutable life‑stories of assets using a domain YAML mapped to the W3C PROV‑O… | ||
| Open Source Powered Real-Time Fraud Analysis in a Hybrid Cloud Environment | Yichong Yu, Krishna Ratakonda | 35m |
Demonstrates a pipeline that trains LSTM/Gru models in TensorFlow on Cloud Pak/Watson Studio using open source sample data, converts models with a… | ||
| Musical Charts: Using OSS to Make Data Visualizations Accessible to Visually Impaired Users | Julianna Langston | 21m |
An open source JavaScript library called Chart2Music converts chart data into interactive sonification with four or five lines of code, syncing with existing… | ||
| Building a Secure Open Source Project on GitHub | Philip Holleran | 27m |
Shows concrete steps: enable Dependabot to open PRs that bump to the lowest secure version (users patch 13 days faster), run CodeQL code scanning in GitHub… | ||
| Proactive and Polymorphic Adaptation of Multi-Cloud Deployments | Katarzyna Materka | 23m |
An open-source framework called Melodic models applications in a camel modeling language, computes a flexible utility function, and uses a solver to pick and… | ||
| From Builds & CI to Security Testing in a Single PR | Sarah Khalife | 35m |
Shows how a GitHub Actions pipeline builds containers, runs Trivy image scans, uses CodeQL for data‑flow code analysis, runs tfsec on Terraform, and triggers a… | ||
| Open Source Supply Chain Threat Landscape - A Moving Target | Brian Fox | 31m |
Sonatype runs Maven Central and observes enormous scale — Maven Central (≈700 billion downloads/year) — which exposes three attack phases: longstanding bugs… | ||
| Perspective in 3D | Andrew Stein | 28m |
Perspective’s expression language is repurposed to implement vector math and a ray tracer inside a columnar engine using expertTK and plain table rows. It… | ||
| Broader Adoption of FINOS Projects, Case Studies - Charming Legend and Waltz | Srikrishna Sharma | 27m |
Shows how Juju deploy finos/legend bundle and Charmed Operators cut a real installation from two to three weeks to about 3 minutes, including MongoDB startup… | ||
| The Current State of DEI and Path Forward | Jevon Beckles, Chitra Hota, Nick Fuller, Rita Chaturvedi | 31m |
Panel reports concrete measures and results: recruitment expands beyond alma maters to conferences and high schools, the Taulbee report shows low single‑digit… | ||
| Implementing CDM : How is it Done, Why is it so Beneficial to Financial Markets Infrastructure? | Jon Nance, Dianne O'Boyle, Sunil Challa, Eleonora Acuna | 39m |
CDM is being used as a state‑transition processing standard, not just a message format: implementers serialize the model as JSON/Protobuf, call… | ||
| Looking Backwards and Forwards at CDM:... | Gabriel Callsen, Amy Caruso, Ian Sloyan, David Shone | 28m |
Common Domain Model is now CDM open-sourced at FINOS and already underpins a production project, the Digital Regulatory Reporting (DRR) live in production used… | ||
| Why Open Source Technology Is Critical to Widespread Adoption of CBDCs and Other Digital Currencies | Jennifer Peve, Dominic Paolino | 28m |
DTCC runs a pilot with the Digital Dollar Project using Hyperledger components and Project Hamilton code, involving nine participating banks and two simulated… | ||
| Morphir Integration with Scala | Damian Reeves, Stephen Goldbaum | 33m |
Morphir becomes a portable, strongly typed IR that stores logic-as-data so the same business rules compile to TypeScript, Scala, JSON Schema or run in a JVM… | ||
| Rethinking Risk, Governance, and Compliance Applying Automation | Michael Edenzon | 22m |
Argues that release authorization becomes objective by capturing signed SDLC attestations, using Sigstore, in-toto/SLSA provenance and Open Policy Agent for… | ||
| Modernize Regulatory Reporting: Get Ready for T+1 Settlement | Ephrim Stanley, Ashley Trainor, Antoine Amend, Stephen Goldbaum | 24m |
Regulators set T+1 for September 3, 2024 and DTCC estimates margin calls drop ~40%, so the panel shows a concrete pipeline: Morphir-generated Spark code… | ||
| Delivering an Industry Implementation of the CFTC Rewrite using Rosetta and the CDM: A Production Use-case | Leo Labeis | 29m |
An industry implementation of the CFTC Rewrite uses the CDM and Rosetta DSL to digitize 175 report fields spread across ~230 pages, cutting implementation cost… | ||
| Demonstration of FINRA’s Machine-Readable Rulebook Initiative | Afshin Atabaki, Alex Khachaturian, Anadi Rastogi | 34m |
FINRA launches a prototype machine‑readable rulebook that pairs a manually built regulatory taxonomy with a web search UI and a consumable rulebook API so… | ||
| Exploring Open Reg Tech with the LCR | Stephen Goldbaum | 30m |
FINOS demonstrates the US Liquidity Coverage Ratio implemented as executable business logic using the Morpher data format so the spec, datasets and… | ||
| Keynote: Welcome & Opening Remarks | Gabriele Columbro, Dov B. Katz, Rob Moffatt | 30m |
Conference organizers announce concrete community metrics and tools: 66 members, 50 projects, a public open source maturity model and survey, and a claim that… | ||
| nothing matches | ||