I think it's good.
Okay, thank you.
So, yes, it's going to be very quick because it's a 15-minute talk,
so it's kind of like lightning speed.
So if you want to get anything from the slides,
this is your chance, and it won't be a long time,
so just like take a picture, and then we'll move on from there.
Right, three, two, one, go.
Check. Yeah, I love open source.
I am working in open as a self, so please come to our stand and talk to us.
So, yeah, I don't have to copy this, but you come to our stand.
That's what you have to do.
So it's just downstairs at level two.
So, who have read, let's say you open a pack of Crips,
who have read the ingredient list?
Anybody? Yes?
Some of them don't care, some of them don't care what you're eating.
Okay, so this is what you need to know.
So you need to know what you're eating because you may be allergic to some of the ingredients,
or maybe like, you know, it's not very healthy,
I should not eat that much sugar and that kind of thing.
So that's why it's almost like a universal standard that we have to list
what is actually the ingredients of the things that you are buying,
like a pack of Crips, or a cake, or a soda, whatever you're drinking.
So, that consumer group now is like, you know, the scope has been expanding.
It's not just for food or some hardware that you're buying,
but also software that you're using.
We just like, you know, talk about, you know, in Europe we have the CRA and PLD.
You know, PLD is now going to maybe encourage software,
so we have to be careful about those.
So, I know this is the S-bomb death room, so maybe a lot of you are already expert in it,
but just for those maybe people watching online that is new to the concept.
So, a bit of materials is, you know, we have to list all the components in your software,
including those open source, that, you know, all the dependencies that you are actually using.
So, yeah, so you have to list not just what you're using,
but also the detail about what you're using, like for example, the license that, you know,
is part of the component.
And you should know anyway, because, you know, check the license,
maybe you have to be open source if you're using some open source software.
So, you know, for people who don't check, then ooh, alarm.
Also, the versions, because, you know, versions can be very different,
especially like different major versions,
there's very different from each other.
So, if you don't actually know what your dependencies,
which version you're using, that's also a big no-no.
So, these all these things kind of like, you know, your pack of crisps,
that like, you know, you have to list your ingredients
and you have to know what you're eating, what you're consuming.
So, go back to the pack of crisps.
So, do you know that actually you can't just say like, you know, list whatever you like,
you know, because there's actually some standard that you have,
you know, when you look at all the packaging,
they have a certain format that they will have to follow
and they list their ingredients.
So, for example, I use a U.K. of Monaz and example,
because I live there, you know, I do care what I'm eating.
So, if your food or drink has two or more ingredients in it,
then you must list all of the ingredients.
So, basically it means that you can't skip an ingredient,
even though it's like tiny, teeny amount.
Also, it needs to be in order of weight.
So, usually if you see like, oh, how much sugar,
for example, I'm very concerned about that,
like how much sugar you have in the food that you're eating.
So, you see, like, where they are.
So, if they're the first thing in their list,
probably like most of the things you're eating are sugar, right?
So, yeah, because it's list in order of weight from the most, you know,
percent of weight first, so that's mostly what you're eating.
Also, if there's any like allergen,
because in the U.K. there's like a list, I think it's like 12,
but I may be wrong, allergens that need to be clearly, you know, shown.
So, those will be, you need to highlight them with maybe different forms,
different color, or different background color to make sure that, you know,
people are allergic to those, very aware of they should not touch that thing.
So, also for S-bomb, we want to have some format, right?
Because, for example, I'm allergic to, let's say, I'm not really,
but if I'm allergic to nuts, right?
Then the standard format of how to list the ingredients
make me very easy to have a look and see, oh, I should not touch this chocolate
because there's some nuts in it and I would be allergic
and I get really sick or ill or maybe die if I eat it.
So, we need some formats to show, you know,
what the software is actually made of, right?
So, that's why S-B-D-X is coming in to kind of have a standard
that you could, so I have to speed up again, like, running, like,
so it's very good that it's kind of like a standard-sized machine
and human readable, so it's very good to make it very clear
that everybody can just easily consume that information.
So, in X-B-T-S-2.3, it's pretty good for software
because, like, it's, you know, it will show all the, like, common, you know,
CEV advisory, they've all been linked and referenced to it, it's quite clear.
Also, it meets the, yes, executive order of, you know,
the S-Bomb need to be, you know, meeting those standards
and it also needs to, you know, have the ISO standard,
so it's standard, it's very easy, it's very consumable.
So, and also, what with Cosine, you know,
Sixth Door, I love Sixth Door, I work over on SSF-Y,
I come to our stand to get a sticker.
So, S-B-T-S-2.3 is good, so if you are using any, like, software,
like, you know, maybe, apply today, but we can make it better, right?
So, traditional software build material, like, for example,
for concrete or for boats or for cars, the hardware is already covered.
Now, you know, we have software, now we're doing it,
you know, S-B-T-S-2.3 is pretty good for that,
but if you think about what we are having in the future, right,
we have AI, machine learning, these are the, you know,
the words that everybody is talking about.
They have a huge component that we actually traditionally,
like, software we don't have, for example, a lot of data.
We have the AI model and all this stuff,
so we have to cover them as well to hit the target, I would say.
So, there's the new model, you know, S-B-T-S-3.3,
so now is the release candidate, so you can already have a look.
So, it has new model that will cover, you know,
security data and AI, which is great.
It will support database better, so for those like, you know,
machine learning, you know, using a lot of data,
then it's also covered up.
So, domain-specific information as well.
So, yeah, so I think for those, if you are like,
if your software is actually, you know, going to like AI and stuff,
so maybe you should look at model 3.3.
So, that's great, but I have been to a lot of AI and machine learning conferences,
nobody is talking about S-Bomb and S-B-T-S, which is, ah!
So, for them, actually, they really need to care about it
because for AI and machine learning applications,
there's a lot of like risk that make them vulnerable.
For example, data is a big problem.
We have like, you know, data bleach and other stuff that happen all the time.
Every time we heard about it, it's a big yike, so we don't, we won't avoid those.
So, also, the system is very complex, right?
This was a black box.
We always talk about machine learning models.
We don't know what's actually going on, so it's like,
very scary stuff.
So, also AI Bloom, now all the, you know, VC money is going to AI,
and everybody's talking about AI and stuff.
So, they may want to rush to get things done,
so we need to please the, you know, the funding, you know, the funders, right?
So, yeah, so they may be less careful about what they're doing,
just need to get it done, you know?
Also, there are new vulnerabilities that is not like, you know,
there's new technology, there are new vulnerabilities.
Now, there are some people hacking around like, problem injection and having fun,
but it can be very serious if it's not just fun,
if people are using it for malicious thing,
it could be very bad, like, consequences coming up.
So, we need to, we need to make the community adopt it very quickly.
So, I always think about that, like, for any tools,
if you want a very good adoption, you need, you know, good tool, and outreach.
So, those two go hand in hand, you can't just skip one of them.
Very bad tool, going to tell people, people still don't like it.
Very good tool, but nobody know about it, nobody use it.
So, you need both.
First of all, you know, now, you know, for example, we want a very profile for S-bombs,
because, you know, also it needs to be easy to start,
we don't want something very complex, because, you know,
AI machine learning people, they want to, you know, make, you know,
work on their model, but not care about these, like,
compliances and things like that.
Also, we want to make it a universal standard,
instead of shopping around, they have to choose which one to use.
We want to make it universal, so it's like,
no brainer, just go for that one.
Also, satisfy the policies, that's very important,
because at the end of the day, you have to satisfy the government policies,
so you can make it an adoptable production-ready product.
So, outreach, we have to, like, show more examples,
show people that you can use it that way, so it's like,
very easy for them to learn.
You have to have use cases, show that some companies,
they have some, yeah, exactly.
Some companies, you know, if they make a successful case of using that,
make sure everybody knows about it and follow.
Education, tell the machine and AI community that, like,
you should care about security and compliances and all this stuff.
You can't just, like, you know, make it work and voila,
and you know, everybody's happy to get all the VCs money, right?
So, SPDX 3.0 is pretty thorough, it's pretty good,
so this is good, keep on continuing doing the good thing.
Also, communication with policy makers, so I'm sure that, like,
there's, that is ongoing because, you know,
at least foundation, we have some people, you know,
keep talking to policy makers and that's a good thing.
So, how can we make it into, like, a very well-adapted model?
So, outreach is a key, so we need to create universal standards,
so that's why we need to make more outreach,
tell people that, follow this, this is a very good standard,
and go to the, where the community is, right?
Like, go to those, where people, like, go, this AIML people are,
they go to their conference, you know, those machine learning
conferences and stuff, like, go there and tell them
what they should care about.
And also understand their need as well,
it's a bi-directional communication,
we want to see how we can make it easier for them,
or what can cover what they're concerned, maybe, you know,
their consumer, the consumer of their product care about
these kind of things, so we can cover that for them.
So, so at the end of the day, after understanding their needs,
it will go back to a good tool, so it's kind of like
a very good cycle that we can keep doing that.
So, cost action, that's the last thing, adopt,
SPDX 2.3, if you're, like, you know, now ready,
so just adopt it, but you can also help try the release
candidate, you know, try, you know, help contributing to the
new 3.0 model, also engaging in outreach activity,
go and tell people, use it, right?
And also keep communication, like, that's the part I love most.
Communicating with policymaker and the user, we have to get
everybody involved and have a good communication going on.
So, that's the end, I hope I didn't overrun too much,
so, yeah, let's make SPDX in the system, ML, and get the slides,
and talk to me at the stand, thank you.