Open Source Summit + AI_dev Japan 2024

Love developing AI/ML systems, but don’t want to become the next front-page cyberattack? We got you! In this fast-paced, meme-a-liscious, hands-on workshop, we’ll take a deep dive into the murky waters of the AI/ML supply chain, explore its many threats and terrors, and then – with our trusty box of supply chain security tools – build an island of safety for our AI/ML systems! Participants will come away with the skills and knowledge to significantly improve AI/ML supply chain security at their organization, as well as the unpleasant awareness about what might happen if the industry doesn’t do the same. Sorry! Hands-on activities will include vulnerability scanning, creating/consuming SBOMs/AIBOMs, digital signing using Sigstore tools, and provenance tracking. We will also provide a conceptual background on AI/ML supply chain components, attack categories, and global regulation and standards related to AI/ML security. Led by software supply chain and AI deployment experts at Chainguard, this workshop will enable participants to harden their AI/ML systems and evangelize others to do the same.

When a project is abandoned by its inventors, core contributors, and the most prolific community members, it often spells the end. Yet, Meteor.js managed to rebound from the brink of oblivion. This talk explores the critical factors that led to Meteor's fall from being one of the hottest new projects to its near-demise and the remarkable turnaround. We'll delve into the issues that created the crisis, and more importantly, the strategies and actions that enabled a successful comeback. The discussion will cover the pivotal errors that contributed to the project's initial decline and the challenges faced by the community in reviving Meteor, including the lack of comprehensive internal documentation. We will examine the solutions that facilitated the recovery, while also addressing the ongoing challenges and unresolved issues within the Meteor community. Finally, we will explore practical steps and tools you can employ to safeguard your own open-source projects from similar pitfalls.

we would like to share with audience about volvo cars' open source journey, and how we drive open source maturity within Volvo Cars.

The migration of data-intensive analytics applications to cloud-native environments promises enhanced scalability and flexibility but introduces complex cost models that pose new challenges to traditional optimization strategies. While on-premises setups focused on speed, cloud deployments require a more nuanced approach, factoring in cloud storage operations costs, which can escalate rapidly in real-world scenarios. In this presentation, Bin will analyze these challenges through a case study on Uber's large deployment analytics SQL platform on HDFS and GCS. They will show their findings of unexpected cost implications with standard I/O optimizations like table scans, filters, and broadcast joins when implemented in cloud environments. He will also highlight the need for a paradigm shift in optimizing data-intensive applications for the cloud and advocate for developing new I/O strategies, balancing performance and costs while tailored to cloud ecosystems' unique demands.

Ever feel like contributing to groundbreaking AI projects but unsure where to start? Have a cool project that you are looking to find a neutral entity for? Through the session learn how the LF AI & Data foundation empowers open-source projects. Discover the framework to support for open development, governance models, and resources like legal assistance, marketing, and events. Gain exclusive updates from the LF AI and Data Technical Advisory Council (TAC). Learn about their vision, technical roadmap, success stories and how you can contribute. The session will cover practical tips and tricks to dive into project contributions, navigate the initiation process, and ultimately guide you towards project graduation. Also discover the diverse work streams within LF AI and Data foundation and how you can leverage your skills to make a real difference in the open-source AI community.

Are you struggling to scale your open-source product? You're not alone. Traditional business models don't always fit the community-driven world of open source. Join me in this talk as we explore the essential components of a community-driven roadmap for open-source companies. We will discuss the importance of inclusivity, clear communication, and creating a welcoming environment for contributors through engaging initiatives and effective use of platforms. We will evaluate different options for community platforms and explore how community appreciation initiatives like awards and giveaways can be more than just token gestures, serving as powerful tools to incentivise participation and foster a sense of appreciation among community members. Moreover, we'll discuss the art of incorporating valuable feedback from the community into the development process, leading to more robust projects and a shared sense of ownership. Drawing on real-world examples and experiences, this talk will equip you with actionable insights to chart a course for your open-source company's success through a community-driven approach.

Imagine a world where the hassles of configuring dependencies disappear, replaced by a streamlined and automated process. Buildpacks enable developers to focus on writing code instead of dealing with complex configurations. This session will unveil the secrets of Buildpacks, highlighting their capacity to seamlessly manage various languages, frameworks, and runtime environments. Discover how Buildpacks revolutionize your development pipeline, fostering consistency and efficiency. A sneak peek to our session: *Core principles & benefits of Buildpacks *Application packaging/deployment *Using Buildpacks to enhance collab across development teams Whether you're a seasoned CI/CD practitioner or a DevOps enthusiast, this session equips you with the knowledge to transform software development with Buildpacks. Join us to explore the exciting future and the impact of Buildpacks on the CI/CD landscape.

MCUboot enables secure booting of Zephyr RTOS using asymmetric cryptographic signature verification with a public key. Typically, the hash of the public key is embedded within the MCUboot binary, ensuring its integrity. For enhanced tamper protection, this hash can also be securely stored and retrieved using hardware keys. Embedded SoCs, such as the i.MX RT, offer advanced security features like High Assurance Boot (HAB), Data Co-Processor (DCP), and Trusted Firmware-M (TF-M) for implementing TrustZone in SoCs like the nRF91. These features enable secure storage with hardware crypto acceleration or external security modules (e.g., TPM, EdgeLock) to store keys in a hardware vault. This presentation will explore MCUboot secure booting with hardware keys, using the NXP i.MX RT as an example. We'll delve into HAB for booting signed and encrypted MCUboot, establishing a hardware root of trust, and booting Zephyr RTOS using keys from OTP for verification. Additionally, we'll discuss using the TF-M backend and OTP for securely booting TrustZone-enabled SoCs.

If you're seeking visibility and recognition for your merits, there's no better place than open source to invest your time and energy. As the saying goes, 99% of bright minds are outside of your organization. Thus, by engaging with the right open source community, you increase your chances of collaborating with them. In this session, we'll discuss how you can leverage the visibility and relationships you cultivate in open source to secure your next job or achieve your career goals, whether it's transitioning into new technology, advancing in your current field, or refining your leadership skills.

What are the advantages of using OSS? - Is it because it is free to use? - Is it because you can start using the latest features? - Is it because everyone else is using it? I believe all of these reasons are correct, but the value becomes even greater by not only using OSS but also engaging more deeply with the OSS community. How should you handle bug fixes and feature additions when using OSS? - Should you maintain patches internally within the company? - Should you modify the source code to implement unique features internally since it is open source? The best practice in the OSS world is to participate in the OSS community and address these issues within the community. In this session, I will share the value of using the OSS community and talk about easy ways to get started with community activities. I will also share tips for engaging with the community. Additionally, I will introduce the CNCJ(Cloud Native Community Japan), which was established to be more active to the cloud-native community in Japan, and training for participating the Kubernetes community which is subchapter of CNCJ.

Explore the dark side of powerful AI tools and the burning question: Are they truly secure? Join me as we unravel the construction of AI models, focusing on their weak spots. Through multiple demos, witness how AI models can be manipulated to become malicious. This session offers a deep dive into a case study on the "Malicious Copilot" IDE plugin will showcase how a code-completion model can be trained to target specific victims, embedding malicious code within models, and more. Additionally, we'll tackle practical takeaways for companies utilizing generative AI and LLMs.