Stephanie Domas, Canonical's Chief Security Officer, returns to What's in the SOSS to discuss critical open source challenges. She addresses the issues of third-party security patch versioning, the rise of software sovereignty, and how custom patches break SBOMs. Domas also explains why geographic code restrictions contradict open source principles and what the EU's Cyber Resilience Act (CRA) means for enterprises. She highlights Canonical's work integrating memory-safe components like sudo-rs into the next Ubuntu LTS. This episode challenges assumptions about supply chain security, software trust, and the future of collaborative development in a regulated world.Chapters:00:00 - Welcome01:49 - Memory safety revolution02:00 - Black Hat reflections03:48 - The SBOM versioning crisis06:23 - Semantic versioning falls apart10:06 - Software sovereignty exposed12:33 - Trust through transparency14:02 - The insider threat parallel17:04 - EU CRA impact18:50 - The manufacturer gray area21:08 - The one-maintainer problem22:51 - Will regulations kill open source adoption?24:43 - Call to actionEpisode links:Stephanie Domas LinkedIn pageCanonicalUbuntuOpenSSF Global Cyber Policy Working Group (CRA & policy/standards resources)WiTS Podcast #18 - Canonical’s Stephanie Domas and Security Insight from a Self-Described “Tinkerer”Get involved with the OpenSSFSubscribe to the OpenSSF newsletterFollow the OpenSSF on LinkedIn

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related