A globally unified governance framework for Open Source
CC Attribution 2.0 Belgium:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Klooz, Christopher
Differentiating between architectural flaws and bugs in socio-technical systems: Open Source is no legal term or a political institution in dominant sovereign state systems, making it vague and interpretable in different contexts. However, it is a fundamental institution in security provisions in today's socio-technical societies. But it remains impossible to harmonize the transnational Open Source system with sovereign systems: both cannot be clearly mapped to each other. Yet, international arbitration provides a type of remedy that already exists in software development, illustrating how a shift from just fighting bugs to mitigating architectural flaws can look like. Initially, the Internet imitated the institutions of the social world despite their limited eligibility (such as "emails" with their complex and vulnerable architecture). Today, societies are socio-technical without delimitable transitions between technology/Internet and society. Societies have started to adapt to and integrate the possibilities the code provides, no longer vice versa. Sovereign state systems early found their limitations in tackling the resulting challenges. However, software development had already to manage comparable issues. The Java Virtual Machine and Ceph are two of many examples: another abstraction layer can create flexibility, simplification and unification on top of different systems. International arbitration could offer Open Source a transnational and globally-unified framework, enshrined in an arbitration agreement: embedded in a dedicated organization in an eligible legal system to facilitate the conduct of organizations and communities on which code and the Internet depend. Open source and its related institutions are already the core element of a transnational separation of powers, which is based upon competition: public processes & public code in conjunction with distribution (of development, code, review & testing) enable forking (to avoid monopolies and irrevocable consolidation of powers at one place). Reflecting the software engineering concept "secure by design", Open Source has created a "socio-technical system secure by design" because it avoids single points of failure both in social and technical realms: it does not relate governance to centralization but to distribution. Indeed, if issues like the 2020 Solarwinds Hack would spread in deployed Linux kernels, this could have unprecedented consequences far beyond the technical realms. However, Open Source and its institutions remain capable of providing sufficient security and deterrence. There is much more behind Open Source than just open/public code. The increasing use and consolidation of IT in governments may break the traditional separations of powers and does not provide the "security by design" of Open Source institutions if applied to socio-technical systems. Indeed, if one administrator and his password in one consolidated IT department can manipulate the databases used in executive, legislative and judiciary operations, new risks can arise. The system around Open Source already contributes to the security provision of and on the Internet and thus, indirectly to the overall security provision of people and entities that depend on the Internet: it facilitates security in socio-technical societies. If it proves eligible, enshrining the relevant (and legally implementable) Open Source institutions in an arbitration agreement may result in an compatible abstraction layer on top of the traditional state systems. Complementary, this abstraction layer may facilitate to release traditional systems from tackling issues they simply cannot tackle without softening and blurring their own institutional architecture. It may turn antagonism into symbiosis. However, Facebook's Libra indicates the complexity (but also the possibility) of creating such "implicit legal" ventures (in Switzerland). It also indicates that Switzerland could possibly enable the fusion of an international arbitration body (through its "international private law") with an open/public/distributed but regulable cryptocurrency to facilitate not just the (Open) Source but also (open) exchange within one globally unified system. Although they will be critical and challenging for any international arbitration approach, legal patent- and license-related questions are not considered in this lecture. This lecture is derived from the perspective of the field of international relations. It illustrates the role of Open Source in contemporary security provisions (next to and in interaction with sovereign states' security provisions for citizens) and it aims to put alternative (types of) approaches with and around Open Source into discussion.
 Welcome to my lecture, globally unified governance framework for open source. My name is Christopher Clautz and I have studied and worked both in the realms of computer and social sciences and so I have maybe a bit different perspective on several of the current developments. And today I want to give you an alternative perspective and also a potential approach that can help us to tackle several issues. We will begin with the problems we have in the international society, so the society of sovereign states as of today. Then we will have a look on the open source system, what is it and in the end we will come to the abstraction, the international arbitration and how it can give us possibilities we have not yet used. So the security providers of today are of course the sovereign states, they are determined by geography, their sovereignty and obviously they are designed for purely social systems. And this leads to the question, what if the social environment is replaced by a socio-technical one? What does socio-technical mean? It means blood borders among the technical systems like the internet and the social system. There are no longer clear or distinct points of transition, there are persistent reciprocal interactions, influences and impacts and so it is no longer possible to separate or split these two systems, they are persistently interdependent and interacting. So our sovereign states and their traditional separations of powers secure by design in this new environment, what does secure by design mean? It is a concept from software engineering and it shifts the focus from the bugs, the errors, the mistakes we have to the architecture and ask whether these are just symptoms of an architectural flaw and so fighting the bugs does not make a difference. The first issue for us here is we have to avoid single points of failure, abuse and manipulation by architecture. So in purely social systems we have already the separations of powers that can fulfill this purpose. On the other hand we need a predictable behavior of the system, so we need to ensure intended input to have predictable output. I need to know what I am allowed to do to not get punished, otherwise a system cannot offer me security. And so this is a common approach where we have already two single points of failure, the IT operations and the development of the IT systems affecting the whole social system at once. So a very well example is the SolarWindows hack of 2020 where many public agencies, private customers and people were affected because there was a hack in the build processes, in the build environment which is the part where the software we can use is created, where finally something usable. And we can have a comparable issue in the IT operations for example if there is one week password from one admin which is also was the origin of the SolarWindows hack in IT development environment. And another issue here is of course the consolidated Federal IT agencies. And another issue or manifest could be the blockchain approach as it is currently used or implemented in Estonia for example where we have many different blockchains to create no single point of failure, of course affecting one does make a difference for the remaining, but if we have one company that properly without external review develops the technology, the software for all blockchains and if there is one IT agency that does the administration of all, we have still the same two points of failure and then anticipating these blockchains offer me security can be very dangerous. If I then use them to verify everything, legislative, judiciary, court systems, police files, healthcare and such which is planned and given the public papers we have cannot be excluded that this will be possible. And the absence of full information to everything there also makes it hard to determine whether they have considered everything because of the absence of external review. So what you see here is just an illustration, one manifest of an institutional problem because the system, the traditional system is focusing on responsibility and liability and so it needs one entity that has to take over the responsibility and thus this entity also needs to have the means to full access to possess this responsibility. And so also the public review is something that is still partly seen as a vulnerability on itself and so there remains a focus on security through obscurity which consolidates review because external review is also a type of distribution even if I have just one agency for example and the system also anticipates that flaws imply bad work. So good work means we won't have flaws and so everything will be fine and we don't need to consider it. So this can have many manifests and if I have multiple agencies that distribute this does not necessarily make a difference if every agency can create full harm. So this is just one example how I can manifest a much deeper institutional problem and we have also to see that security is much more than not getting hacked but also offer the services people need. For example currently we have big issues in Germany with the COVID apps that don't are able to really implement the new regulations in an accessible amount of time. So this approach is generally no integral part of the international society, no formal thing. Nothing that means getting rid of these problems implies getting rid of the international society or a sovereign state. It's an informal thing and it's architectural yes it's an architectural flaw but of a subsystem not of the system as a whole. It's an informal problem of the society and the society develops over time. It has integrated passive development where the society adjusts its behavior and its interpretations of the norms and its interpretations of laws when they are their traditional interpretations are no longer competitive. So this is something that can happen within the system and where the society can learn and interact with open source. Public drafts public standardization which leads to distribution and also an ongoing public review. We have already examples like the advanced encryption standard, the security in the Linux, where public agencies or publicly strongly influence agencies like the engineering task force or in terms of IS and Char3, the national institute of standardization and technology strongly interact with open source and possess open source institutions. They have adopted public drafts public standardization. So we see open source and international society we cannot just say these are two entities. It's the institutions that make up what we are up against and so it's also a blurred thing and you can only see is it open source by institutions and so it's also a blurred thing and there are public agencies and publicly strongly influenced entities that are already part of the open source system. And so we have also many implementations already, systems are using open source, supporting it and using publicly reviewed systems, for example Linux and have also distributed types of operations or previews. So once again the graphics is just an illustration, multiple possibilities how I can create distribution but also within an agency, not just among different ones. So the architecture, I see in a subsystem it's not a general issue and so we can mitigate it by alternative subsystems but it's more than just fighting the bugs and something that means replaceable norms from within. How the system tackles approaches, it's approaches but it's a bigger issue when we come to here. We have in terms of predictable behavior, state one a customer, he's the customer of company in state two and this company processes its data in state three but storage is done in state four and this leads us in directly to problems to bugs like how to enforce European institutions on telegram which is in UAE, a current problem in the European Union but also a very old issue how to enforce European privacy institutions when data is stored in the United States which also wants to protect its territorial integrity and its own laws. So we can tackle each one of these on its own but finally there is an architectural flaw and it's comparable when we have the GPL version two which ever can be different and interpreted in different states and also within a state that can have different interpretations because these are not legal terms and they are so very ambitious and can be interpreted in different ways by a judge and they are not integral in neither state and they are interpreted and derived from the legal constants of the traditional system, they are not prepared for the transnational dynamic socio-technical system because this new system has much more dynamics is persistently developing and it has not this integrated development of this society which is passive and so as it's also asynchronous developing if we have a well precedent or a well law on day one, on day two everything can have changed and so the system needs to start again by zero and also in a different case things can be differently interpreted so in Germany I can own something, I can possess something and I can use something but if I use a library what's the difference to forking code and what's the difference between a static link or a dynamic link of a library so this is heavily probabilistic in terms of a traditional system and so I cannot have security here and so a question for the lawyers how stare is the agency of a stare diseases which is representative for what our current system wants to achieve, how stare is it in the socio-technical dynamics of code so only dynamics can balance dynamics and so if I try to seek or to get a static link on one side I cannot foresee how it will act when there is a change on the other side so it will be even worse in the situation possibly so in the current social system we have the interpretation of laws that develops with the society and this gives us a static feel it's a passive process of the society but the code does not develop with these informal dynamics it's a completely different thing but that's not an issue because the code itself is unbiased, its math is physics and it has a static dynamics because the dynamics can be anticipated how it will develop above we know what we are up against and so this is not an issue we have the static dynamics of code in this other system that have to be considered as such and that offer us a constant security and so from the perspective of socio-technical open source system the traditional system contains inconsistency among interpretations and thus among cases and so a judge can anticipate we can anticipate that he knows its law but what is the difference the relationship between library and executable for him he doesn't really know much about it and his law doesn't help him really so it's very probabilistic again and so we have no reliable consistency or predictable behavior here and thus a lack of security so and if you input data into a system which it does not intend it I have the same thing on our leo's it wouldn't behave different it's unpredictable behavior it will be a kernel panic and so we are talking here about architectural flaws that have to be considered that way and this leads us to the open source system first as in comparison we have the geographical separations in the dominant sovereign states and we have functional separations in open source so geography is really a secondary thing it's more about are you a current developer are you a tester of a distribution are you one of the management guys so it's a functional thing and everything else is secondary and instead of separations of powers which is a type of command economy in itself we have a distribution of powers which is competition and it captures the dynamics of code the static dynamics of code within this distribution of powers capturing the development so just the interpretation of laws is changing with the society for example so it's a balancing itself balancing thing on the other hand we have also responsibility and liability focus in a traditional system we had initially already talked about it and we have an individual focus chain of trust in open source in many cases which is also a very different thing so the major institutions for open source are forking redundancy and transparency which also link already to lino's law and flaw anticipation so forking means that I can use any code if I disagree with how it develops how things are done and create something else just by forking using it and create something new and we have a lot of redundancy so build processes we have many different build processes where the the Linux kernel is tested there is much redundancy in review codes are tested review and such and this also needs transparency otherwise it doesn't work and so these are the major institutions where flaws are anticipated and just one problem that has resolved us any other problem it's nothing where you talk about fault it's something new in the system because it's actively developing itself and not passively and so we have also within the communities are rough consensus that is driven by merit-based persons so for example the linus torwals was more or less deriving the consensus of the linux kernel community and so this gives a one person a lot of theoretical power where we can have a very efficient development but it's still a very good balanced power because if someone disagrees we have still the possibility of forking through redundancy and transparency and so these people like linus torwals are still affected by competition with others and the constant obviously remains the code and because of these asynchronous development we are we have a rolling release model in this technical open source system in the social technical open source system it's no anticipation of a static environment because we are doing the development actively and so we are anticipating the development and not seeking something static just we are seeking the static behavior of the development of code we can we know its dynamics how they will develop so this already captures the dynamics of the code creating competition based distribution of powers with many different communities within with our mouse cases rough consensus driven some different ways and if you disagree with it you can always create forks which happens from time to time this does not have to have hostile reasons and forking is usually caused by redundancy and transparency also in terms of standardization not just in new protocols and such it's not just software development so is this security critical the majority of websites are linux driven given the fact that just 3.0.3% are not linux of those we know you can anticipate that a majority of the unknown sites are also linux when it comes to company who spent money to get security that they can rely on their operating systems 34% rely on redhead linux just one of many different linux distribution so the linux market in general will be much more and Cisco and junipon themselves have 44% in the market of the service providers so the providers of the internet that run the infrastructure where all the traffic of the internet goes pass through and their current then your systems are all based on linux and there are many more providers that are maybe also using linux but where I couldn't get reliable information and also 70% of the phones people use are linux driven by a modified kernel and so this is also not just about hex but about services it's for me today an important part of security to be reachable to have access to signal what said to be able to buy something on Amazon to rely that my system is able to manage the output of the Amazon website so this is all belonging to security as of today and despite opportunities when I can get malware into the linux kernel there is no exploitation untill today so there's a reason for that which does also include a chain of trust of course which is also related institution and despite its dominance the linux community still has not behaved like a dominant market player this is something we have to consider it has stable competition within and around and there's much more protocol standardization and software we are using and also libraries and things like webkit are also part of proprietary system for example safari uses webkit in its chorus engine and much software proprietary uses open source libraries so we cannot really foresee how much this is and because of the development which is active unlike the social system where society develops passive the development and maintenance have to have to be considered on themselves in the development in security aspects because it's done actively so this is also something the traditional system is not prepared for this is how it looks we have the development like for the linux kernel where the open source system is more or less on itself next to anarchy and doing the work on itself but in most cases of course it's still subordinated to the international society in some cases it even gives security to its communities by managing unseatable precedents or laws of the system so what can they what does technology do in such cases it creates obstruction layers we have running systems we cannot simply replace windows linux whatever we can create an obstruction layer on top that gives us the possibility to have an application that can be run on everything comparable with with saf where we needed simplification where it was no longer possible that one file system could seed any need we have especially in terms of distribution and so everything out we had an output was too complicated and so we now just use the systems we already have which we are used to that are running everywhere we cannot get replaced everywhere just within our so and so we can still use them for what we are doing traditionally and just we added another obstruction layer like another application to add the distribution so obstruction is can make a big difference and they can also help us to give the judge something his system is intended for but we have to consider the institutions that are important for us and not just in this case at another court as we know it so the big issue here is the convention of new york 58 59 this does not introduce international arbitration but just gives an international foundation to enforce arbitration awards more or less globally and so the relevant implementation of the arbitration law is always the national one so the law of the arbitration body and it's irrelevant where the parties are placed so we have also much security here and an award can be enforced globally by by the state system itself but to give the judge something he knows he's intended for he has just to verify the compliance of the arbitration case to the arbitration agreement and of the arbitration agreement to its national law and in the case of an arbitration body always the national implementation of the law so this is something he's intended for and we can use it more or less globally because you see in blue the majority of states of the world are member states of this convention to enforce an arbitration award two examples you can get in to to have some illustration what we are what this is all about and so some what can we do with the system here what can it be enhanced and how to add this attraction layer this is what we will have an international arbitration abstraction layer for the open source system for create security for both sides and it will be also complementary for the society international society because through the international arbitration we help international society through open source system to also fill the remaining gap with this arbitration concept it is used to it knows how to handle it and so it's a symbiosis more or less we are talking about and in terms of Swiss arbitration just one example we can also many other states that have suitable laws like UK or such it has two laws but it's we are free to choose which one we want to apply and so only the highest card of Switzerland this one card treats cases against arbitration issues other cards are not allowed to do so and so we have much specialization experience and knowledge which gives us security and also the public and politics in Switzerland tend to facilitate such implementations so taking things and so you can already pay public agencies with cryptocurrencies we have the Facebook driven DM association so the regulated Libra currency and we have just was just passed a new law to further facilitate international arbitration and just a little additional incentive partly related to here can such a regulated cryptocurrency which is all the possible in Switzerland be complementary because it can give us the possibility for a global stable type of transnational currency which is backed by a stable transnational legal framework which gives us the possibility for linking the source and its exchange which is today of course in most cases a service thing which can also drive development because a legal frame stable framework and our currency and a stable one so it's a big issue that can give us access to even more contributors worldwide and some incentives for this arbitration thing what could improve competitive what we have to maybe consider instead of just adding a new occurred it has to be tailored of course for the rolling needs of this new system which also differs strongly because it is based on community and not on deterrence because you can anticipate in this system that people were engaging in the social technique open source system have a very high human development and so it's more competitive to anticipate community rather than crime because the system in its dynamics its efficiency the flexibility already we know that it automatically gets rid of behavior that is not competitive for the system so it's already very efficient and so here it makes sense to go more towards also within our current towards collaboration because it's just problems we are up against it have to be solved to have to create security for the future and not punishment which is done by the system already and also by the criminal law which is also something that is not part of the arbitration but whether arbitration can also which can be complemented by it and another issue that is already widespread in arbitration open source self-certification for example for code coverage of implementing best practices where you can have rules that just have a show which means you don't must but where the self-certification means a company says hey we are implementing this we are making the show to a must and so an arbitration would also treat this entity that way when it comes to arbitration and so there's also something that gives us security flexibility for future and so constructs like the Linux development or the ITF are maybe more suitable indication than traditional curts here and we have also to consider the back parts so if we make a global rule we have also to think of what will be the different differences in local implementations so how does local systems behave to it how to make local entities aware of what are the differences for you with this new rule so this is something important that have to be considered on itself in terms of intention property we already know it becomes more and more services rather than products because it's hard to implement such a system so it makes sense in such an arbitration to simply assume everything is open and the intention property protection is not our business but has to be done separately in another traditional court it's important to keep the system transparent redundant and also forkable by statutes and this links also to the question has a lawsuit to be in advance or can it be done just like the development in the system where we have debates for example among arbitrators how they will treat a case if it will happen based upon the rules done possibly by maintainers or so because the bureaucracy we want to avoid an enormous system is here not necessary this avoidance because the system already competes towards efficiency in the realms of code anyway we know this so here we can also create more add further security if we keep for sure that there is the distribution given the forkability in such and implement the standards the system the open source system and distribution of pauses used to and of course we have to carefully identify stakeholders maintainers of the rules arbitrators the users developers and whatever and of course the question remains how much of this can be really implemented in a real arbitration law which also has rules and so what I'm talking here about my incentives are really just implicitly legal and nothing explicit and so a lawyer can come to the conclusion that maybe much is not possible and of course we have to consider that and the transition of the existing licenses is also a bit problematic which has to be considered on itself and so always consider architectural flaws and bugs are different things and have to be considered respectively and so now I'm looking forward to your questions and give them the very short Q&A period we have now feel free to do some background investigation and add further questions on the GitHub site I've set up for this or other comments so looking forward to your comments
 Welcome to my lecture, globally unified governance framework for open source.  My name is Christopher Clautz and I have studied and worked both in the realms of computer  and social sciences and so I have maybe a bit different perspective on several of the  current developments.  And today I want to give you an alternative perspective and also a potential approach  that can help us to tackle several issues.  We will begin with the problems we have in the international society, so the society  of sovereign states as of today.  Then we will have a look on the open source system, what is it and in the end we will  come to the abstraction, the international arbitration and how it can give us possibilities  we have not yet used.  So the security providers of today are of course the sovereign states, they are determined  by geography, their sovereignty and obviously they are designed for purely social systems.  And this leads to the question, what if the social environment is replaced by a socio-technical  one?  What does socio-technical mean?  It means blood borders among the technical systems like the internet and the social system.  There are no longer clear or distinct points of transition, there are persistent reciprocal  interactions, influences and impacts and so it is no longer possible to separate or split  these two systems, they are persistently interdependent and interacting.  So our sovereign states and their traditional separations of powers secure by design in this  new environment, what does secure by design mean?  It is a concept from software engineering and it shifts the focus from the bugs, the  errors, the mistakes we have to the architecture and ask whether these are just symptoms of  an architectural flaw and so fighting the bugs does not make a difference.  The first issue for us here is we have to avoid single points of failure, abuse and  manipulation by architecture.  So in purely social systems we have already the separations of powers that can fulfill  this purpose.  On the other hand we need a predictable behavior of the system, so we need to ensure intended  input to have predictable output.  I need to know what I am allowed to do to not get punished, otherwise a system cannot  offer me security.  And so this is a common approach where we have already two single points of failure,  the IT operations and the development of the IT systems affecting the whole social system  at once.  So a very well example is the SolarWindows hack of 2020 where many public agencies, private  customers and people were affected because there was a hack in the build processes, in  the build environment which is the part where the software we can use is created, where  finally something usable.  And we can have a comparable issue in the IT operations for example if there is one  week password from one admin which is also was the origin of the SolarWindows hack in  IT development environment.  And another issue here is of course the consolidated Federal IT agencies.  And another issue or manifest could be the blockchain approach as it is currently used  or implemented in Estonia for example where we have many different blockchains to create  no single point of failure, of course affecting one does make a difference for the remaining,  but if we have one company that properly without external review develops the technology, the  software for all blockchains and if there is one IT agency that does the administration  of all, we have still the same two points of failure and then anticipating these blockchains  offer me security can be very dangerous.  If I then use them to verify everything, legislative, judiciary, court systems, police files, healthcare  and such which is planned and given the public papers we have cannot be excluded that this  will be possible.  And the absence of full information to everything there also makes it hard to determine whether  they have considered everything because of the absence of external review.  So what you see here is just an illustration, one manifest of an institutional problem because  the system, the traditional system is focusing on responsibility and liability and so it  needs one entity that has to take over the responsibility and thus this entity also needs  to have the means to full access to possess this responsibility.  And so also the public review is something that is still partly seen as a vulnerability  on itself and so there remains a focus on security through obscurity which consolidates  review because external review is also a type of distribution even if I have just one agency  for example and the system also anticipates that flaws imply bad work.  So good work means we won't have flaws and so everything will be fine and we don't need  to consider it.  So this can have many manifests and if I have multiple agencies that distribute this does  not necessarily make a difference if every agency can create full harm.  So this is just one example how I can manifest a much deeper institutional problem and we  have also to see that security is much more than not getting hacked but also offer the  services people need.  For example currently we have big issues in Germany with the COVID apps that don't are  able to really implement the new regulations in an accessible amount of time.  So this approach is generally no integral part of the international society, no formal  thing.  Nothing that means getting rid of these problems implies getting rid of the international society  or a sovereign state.  It's an informal thing and it's architectural yes it's an architectural flaw but of a subsystem  not of the system as a whole.  It's an informal problem of the society and the society develops over time.  It has integrated passive development where the society adjusts its behavior and its interpretations  of the norms and its interpretations of laws when they are their traditional interpretations  are no longer competitive.  So this is something that can happen within the system and where the society can learn  and interact with open source.  Public drafts public standardization which leads to distribution and also an ongoing  public review.  We have already examples like the advanced encryption standard, the security in the  Linux, where public agencies or publicly strongly influence agencies like the engineering  task force or in terms of IS and Char3, the national institute of standardization and  technology strongly interact with open source and possess open source institutions.  They have adopted public drafts public standardization.  So we see open source and international society we cannot just say these are two entities.  It's the institutions that make up what we are up against and so it's also a blurred  thing and you can only see is it open source by institutions and so it's also a blurred  thing and there are public agencies and publicly strongly influenced entities that are already  part of the open source system.  And so we have also many implementations already, systems are using open source, supporting  it and using publicly reviewed systems, for example Linux and have also distributed types  of operations or previews.  So once again the graphics is just an illustration, multiple possibilities how I can create distribution  but also within an agency, not just among different ones.  So the architecture, I see in a subsystem it's not a general issue and so we can mitigate  it by alternative subsystems but it's more than just fighting the bugs and something  that means replaceable norms from within.  How the system tackles approaches, it's approaches but it's a bigger issue when we come to here.  We have in terms of predictable behavior, state one a customer, he's the customer of  company in state two and this company processes its data in state three but storage is done  in state four and this leads us in directly to problems to bugs like how to enforce European  institutions on telegram which is in UAE, a current problem in the European Union but  also a very old issue how to enforce European privacy institutions when data is stored in  the United States which also wants to protect its territorial integrity and its own laws.  So we can tackle each one of these on its own but finally there is an architectural  flaw and it's comparable when we have the GPL version two which ever can be different  and interpreted in different states and also within a state that can have different interpretations  because these are not legal terms and they are so very ambitious and can be interpreted  in different ways by a judge and they are not integral in neither state and they are  interpreted and derived from the legal constants of the traditional system, they are not prepared  for the transnational dynamic socio-technical system because this new system has much more  dynamics is persistently developing and it has not this integrated development of this  society which is passive and so as it's also asynchronous developing if we have a well  precedent or a well law on day one, on day two everything can have changed and so the  system needs to start again by zero and also in a different case things can be differently  interpreted so in Germany I can own something, I can possess something and I can use something  but if I use a library what's the difference to forking code and what's the difference  between a static link or a dynamic link of a library so this is heavily probabilistic  in terms of a traditional system and so I cannot have security here and so a question  for the lawyers how stare is the agency of a stare diseases which is representative for  what our current system wants to achieve, how stare is it in the socio-technical dynamics  of code so only dynamics can balance dynamics and so if I try to seek or to get a static  link on one side I cannot foresee how it will act when there is a change on the other side  so it will be even worse in the situation possibly so in the current social system we  have the interpretation of laws that develops with the society and this gives us a static  feel it's a passive process of the society but the code does not develop with these informal  dynamics it's a completely different thing but that's not an issue because the code  itself is unbiased, its math is physics and it has a static dynamics because the dynamics  can be anticipated how it will develop above we know what we are up against and so this  is not an issue we have the static dynamics of code in this other system that have to  be considered as such and that offer us a constant security and so from the perspective  of socio-technical open source system the traditional system contains inconsistency  among interpretations and thus among cases and so a judge can anticipate we can anticipate  that he knows its law but what is the difference the relationship between library and executable  for him he doesn't really know much about it and his law doesn't help him really so  it's very probabilistic again and so we have no reliable consistency or predictable behavior  here and thus a lack of security so and if you input data into a system which it does  not intend it I have the same thing on our leo's it wouldn't behave different it's unpredictable  behavior it will be a kernel panic and so we are talking here about architectural flaws  that have to be considered that way and this leads us to the open source system first as  in comparison we have the geographical separations in the dominant sovereign states and we have  functional separations in open source so geography is really a secondary thing it's more about  are you a current developer are you a tester of a distribution are you one of the management  guys so it's a functional thing and everything else is secondary and instead of separations  of powers which is a type of command economy in itself we have a distribution of powers  which is competition and it captures the dynamics of code the static dynamics of code within  this distribution of powers capturing the development so just the interpretation of laws is changing  with the society for example so it's a balancing itself balancing thing on the other hand we  have also responsibility and liability focus in a traditional system we had initially already  talked about it and we have an individual focus chain of trust in open source in many cases  which is also a very different thing so the major institutions for open source are forking  redundancy and transparency which also link already to lino's law and flaw anticipation  so forking means that I can use any code if I disagree with how it develops how things  are done and create something else just by forking using it and create something new  and we have a lot of redundancy so build processes we have many different build processes where  the the Linux kernel is tested there is much redundancy in review codes are tested review  and such and this also needs transparency otherwise it doesn't work and so these are  the major institutions where flaws are anticipated and just one problem that has resolved us any  other problem it's nothing where you talk about fault it's something new in the system  because it's actively developing itself and not passively and so we have also within the  communities are rough consensus that is driven by merit-based persons so for example the  linus torwals was more or less deriving the consensus of the linux kernel community and  so this gives a one person a lot of theoretical power where we can have a very efficient development  but it's still a very good balanced power because if someone disagrees we have still  the possibility of forking through redundancy and transparency and so these people like linus  torwals are still affected by competition with others and the constant obviously remains  the code and because of these asynchronous development we are we have a rolling release  model in this technical open source system in the social technical open source system  it's no anticipation of a static environment because we are doing the development actively  and so we are anticipating the development and not seeking something static just we are  seeking the static behavior of the development of code we can we know its dynamics how they  will develop so this already captures the dynamics of the code creating competition  based distribution of powers with many different communities within with our mouse cases rough  consensus driven some different ways and if you disagree with it you can always create  forks which happens from time to time this does not have to have hostile reasons and forking  is usually caused by redundancy and transparency also in terms of standardization not just  in new protocols and such it's not just software development so is this security critical the  majority of websites are linux driven given the fact that just 3.0.3% are not linux of  those we know you can anticipate that a majority of the unknown sites are also linux when it  comes to company who spent money to get security that they can rely on their operating systems  34% rely on redhead linux just one of many different linux distribution so the linux  market in general will be much more and Cisco and junipon themselves have 44% in the market  of the service providers so the providers of the internet that run the infrastructure  where all the traffic of the internet goes pass through and their current then your systems  are all based on linux and there are many more providers that are maybe also using linux  but where I couldn't get reliable information and also 70% of the phones people use are  linux driven by a modified kernel and so this is also not just about hex but about services  it's for me today an important part of security to be reachable to have access to signal what  said to be able to buy something on Amazon to rely that my system is able to manage the  output of the Amazon website so this is all belonging to security as of today and despite  opportunities when I can get malware into the linux kernel there is no exploitation  untill today so there's a reason for that which does also include a chain of trust of  course which is also related institution and despite its dominance the linux community  still has not behaved like a dominant market player this is something we have to consider  it has stable competition within and around and there's much more protocol standardization  and software we are using and also libraries and things like webkit are also part of proprietary  system for example safari uses webkit in its chorus engine and much software proprietary  uses open source libraries so we cannot really foresee how much this is and because of the  development which is active unlike the social system where society develops passive the development  and maintenance have to have to be considered on themselves in the development in security  aspects because it's done actively so this is also something the traditional system is  not prepared for this is how it looks we have the development like for the linux kernel  where the open source system is more or less on itself next to anarchy and doing the work  on itself but in most cases of course it's still subordinated to the international society  in some cases it even gives security to its communities by managing unseatable precedents  or laws of the system so what can they what does technology do in such cases it creates  obstruction layers we have running systems we cannot simply replace windows linux whatever  we can create an obstruction layer on top that gives us the possibility to have an application  that can be run on everything comparable with with saf where we needed simplification where  it was no longer possible that one file system could seed any need we have especially in terms  of distribution and so everything out we had an output was too complicated and so we now  just use the systems we already have which we are used to that are running everywhere  we cannot get replaced everywhere just within our so and so we can still use them for what  we are doing traditionally and just we added another obstruction layer like another application  to add the distribution so obstruction is can make a big difference and they can also  help us to give the judge something his system is intended for but we have to consider the  institutions that are important for us and not just in this case at another court as  we know it so the big issue here is the convention of new york 58 59 this does not introduce international  arbitration but just gives an international foundation to enforce arbitration awards  more or less globally and so the relevant implementation of the arbitration law is always the national  one so the law of the arbitration body and it's irrelevant where the parties are placed  so we have also much security here and an award can be enforced globally by by the state  system itself but to give the judge something he knows he's intended for he has just to  verify the compliance of the arbitration case to the arbitration agreement and of the arbitration  agreement to its national law and in the case of an arbitration body always the national  implementation of the law so this is something he's intended for and we can use it more or  less globally because you see in blue the majority of states of the world are member states of  this convention to enforce an arbitration award two examples you can get in to to have  some illustration what we are what this is all about and so some what can we do with  the system here what can it be enhanced and how to add this attraction layer this is what  we will have an international arbitration abstraction layer for the open source system  for create security for both sides and it will be also complementary for the society  international society because through the international arbitration we help international  society through open source system to also fill the remaining gap with this arbitration  concept it is used to it knows how to handle it and so it's a symbiosis more or less we  are talking about and in terms of Swiss arbitration just one example we can also many other states  that have suitable laws like UK or such it has two laws but it's we are free to choose  which one we want to apply and so only the highest card of Switzerland this one card  treats cases against arbitration issues other cards are not allowed to do so and so we have  much specialization experience and knowledge which gives us security and also the public  and politics in Switzerland tend to facilitate such implementations so taking things and  so you can already pay public agencies with cryptocurrencies we have the Facebook driven  DM association so the regulated Libra currency and we have just was just passed a new law  to further facilitate international arbitration and just a little additional incentive partly  related to here can such a regulated cryptocurrency which is all the possible in Switzerland be  complementary because it can give us the possibility for a global stable type of transnational  currency which is backed by a stable transnational legal framework which gives us the possibility  for linking the source and its exchange which is today of course in most cases a service  thing which can also drive development because a legal frame stable framework and our currency  and a stable one so it's a big issue that can give us access to even more contributors  worldwide and some incentives for this arbitration thing what could improve competitive what we  have to maybe consider instead of just adding a new occurred it has to be tailored of course  for the rolling needs of this new system which also differs strongly because it is based on  community and not on deterrence because you can anticipate in this system that people were  engaging in the social technique open source system have a very high human development and so it's  more competitive to anticipate community rather than crime because the system in its dynamics  its efficiency the flexibility already we know that it automatically gets rid of behavior that is  not competitive for the system so it's already very efficient and so here it makes sense to go  more towards also within our current towards collaboration because it's just problems we are  up against it have to be solved to have to create security for the future and not punishment which  is done by the system already and also by the criminal law which is also something that is not  part of the arbitration but whether arbitration can also which can be complemented by it and another  issue that is already widespread in arbitration open source self-certification for example for  code coverage of implementing best practices where you can have rules that just have a show which  means you don't must but where the self-certification means a company says hey we are implementing  this we are making the show to a must and so an arbitration would also treat this entity that way  when it comes to arbitration and so there's also something that gives us security flexibility for  future and so constructs like the Linux development or the ITF are maybe more suitable indication  than traditional curts here and we have also to consider the back parts so if we make a global  rule we have also to think of what will be the different differences in local implementations  so how does local systems behave to it how to make local entities aware of what are the differences  for you with this new rule so this is something important that have to be considered on itself  in terms of intention property we already know it becomes more and more services rather than  products because it's hard to implement such a system so it makes sense in such an arbitration  to simply assume everything is open and the intention property protection is not our business  but has to be done separately in another traditional court it's important to keep the system  transparent redundant and also forkable by statutes and this links also to the question  has a lawsuit to be in advance or can it be done just like the development in the system where  we have debates for example among arbitrators how they will treat a case if it will happen based  upon the rules done possibly by maintainers or so because the bureaucracy we want to avoid  an enormous system is here not necessary this avoidance because the system already competes  towards efficiency in the realms of code anyway we know this so here we can also create more  add further security if we keep for sure that there is the distribution given the forkability  in such and implement the standards the system the open source system and distribution of  pauses used to and of course we have to carefully identify stakeholders maintainers of the rules  arbitrators the users developers and whatever and of course the question remains how much of this  can be really implemented in a real arbitration law which also has rules and so what I'm talking  here about my incentives are really just implicitly legal and nothing explicit and so a lawyer can  come to the conclusion that maybe much is not possible and of course we have to consider that  and the transition of the existing licenses is also a bit problematic which has to be considered  on itself and so always consider architectural flaws and bugs are different things and have  to be considered respectively and so now I'm looking forward to your questions and give them  the very short Q&A period we have now feel free to do some background investigation and  add further questions on the GitHub site I've set up for this or other comments so looking  forward to your comments
intlarbitration_0_167.png intlarbitration_168_263.png intlarbitration_264_923.png intlarbitration_924_1403.png intlarbitration_1404_1727.png intlarbitration_1728_2459.png intlarbitration_2460_3815.png intlarbitration_3816_8999.png intlarbitration_9000_12563.png intlarbitration_12564_12611.png intlarbitration_12612_13667.png intlarbitration_13668_15683.png intlarbitration_15684_17423.png intlarbitration_17424_18335.png intlarbitration_18336_18647.png intlarbitration_18648_18731.png intlarbitration_18732_18815.png intlarbitration_18816_20363.png intlarbitration_20364_24203.png intlarbitration_24204_24995.png intlarbitration_24996_26879.png intlarbitration_26880_27851.png intlarbitration_27852_28463.png intlarbitration_28464_28583.png intlarbitration_28584_28871.png intlarbitration_28872_29735.png intlarbitration_29736_29975.png intlarbitration_29976_30491.png intlarbitration_30492_31403.png intlarbitration_31404_31607.png intlarbitration_31608_31835.png intlarbitration_31836_31967.png intlarbitration_31968_32627.png intlarbitration_32628_34019.png intlarbitration_34020_34835.png intlarbitration_34836_35195.png intlarbitration_35196_38303.png intlarbitration_38304_41159.png intlarbitration_41160_41699.png intlarbitration_41700_41840.png