Risk management: best practices for people with legal compliance to ship open source
summary
Distinguishes legal compliance from security risk and shows concrete fixes: check every dependency (including dependencies of dependencies), prefer Docker image vs Dockerfile depending on whether distribution happens, and freeze builds by using private repos to freeze builds. Recommends automation: generate an SBOM and run scanners (turn), add SPDX metadata, and create an Open Source Program Office. Demonstrations include a Mistral LLM running on a MacBook Pro and a cloud demo that billed only ~$4, proving both local and cloud options work.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker background
- 1:04Risk management vs legal compliance
- 8:33Docker use cases for compliance
- 13:59Open source license families
- 23:23AI and LLM licensing challenges
- 34:53Tools and solutions for compliance
- 42:27Q&A session
related talks
19mDocker and Legal Compliance: Navigating the Containerized World
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
32mOpen Source Contributions in Today’s World
15mShifting Open Source Compliance Activities Left
25mOpen Source Compliance
45mOpen Source distributions in a cloud-native world: from a technical to a legal point of view
29mOpen Source and IP Departments: Risk Containment and Portfolio Management
28mFOSS and Security Risk Management