Philippe Ombredanne

My mission: make it easy to reuse #FOSS #licensed & #secured #FOSS-on-FOSS SCA with ScanCode, & Package URL CTO @nexB @DejaCode

[Philippe Ombredanne @pombr]

@sbarnea @JulianWasTaken @codewithanthony @pajlada ^

[Philippe Ombredanne @pombr]

@sbarnea @JulianWasTaken @codewithanthony pajlada https://t.co/eWInRxNr8B

[Philippe Ombredanne @pombr]

@Sh1bumi @stevespringett @lorenc_dan @Sh1bumi Hey! ... that's awesome. Let me review the PR and discuss there
@stevespringett thanks for the ping!
@ashcrow ^

[Google Developer Groups on Campus HIT @gdg_hitk]

Hola Everyone!!!
@gdscheritageit had an amazing session "Guild to GSoC and Opensource" by @MrHritik.
If you are interested about @gsoc and #OpenSource make sure to Check it Out!!!😇
Special Thanks to @pombr and @rachejazz .
Event - https://t.co/VULqV6ylCu
#GrowWithGDSCHIT #GSOC

[Philippe Ombredanne @pombr]

@OpenSourcePilot on looking first for #FOSS license evidence matters most https://t.co/YET4rQcoF5 (with a decent #FOSS tool ;) )

[Gijs Hillenius @Sjig]

Switzerland plans to anchor public services’ contribution to open source in law

https://t.co/FR4CJn3uYt | OSOR

[Philippe Ombredanne @pombr]

@gpooc @dirkriehle @scancode @fossology @osrgroup @anulman @bitandbang gpooc See https://t.co/nkgn56JrMX and https://t.co/M7Vadt9ii2 that ran some benchmark on license detection that included Ninka for evidence .. this in particular https://t.co/MnyKPuJRci

[Philippe Ombredanne @pombr]

@gpooc @dirkriehle @scancode @fossology @osrgroup @anulman @bitandbang I have some evidence, but there have been no license updates in Ninka for about 4 years. I discover or get report of new FOSS or proprietary license notices or new licenses at least once a week or more on average. 4 years is like a century is this domain.

[Philippe Ombredanne @pombr]

@gpooc @dirkriehle @scancode @fossology @osrgroup @anulman @bitandbang There are (possibly unfortunately) new licenses often enough and even more so many new way to state existing licenses that pop up that Ninka is mostly out of date for any practical use today.

[Philippe Ombredanne @pombr]

@stevespringett that's awesome! ... Tell me how I can help 😍

[Philippe Ombredanne @pombr]

@gpooc @dirkriehle @scancode @fossology @osrgroup @anulman @bitandbang Ninka is not maintained and mostly out of date

[Philippe Ombredanne @pombr]

@dirkriehle @scancode @fossology @osrgroup @anulman @bitandbang As a maintainer for scancode this is a fascinating read!
I may not agree on some of the conclusions, in particular random sampling, but what is missing is reproducibility. Which tools versions and scanned code version? Where are the scripts to redo this?

[Philippe Ombredanne @pombr]

#ScanCode and #AboutCode FOSS projects are a #GSoC mentoring org for the @gsoc 2019 ... Students can sign up until April 9th with their proposals https://t.co/1ab25fs4nO 😎Help us scan #code better for origin, #license, #packages and deps and more!

[CamilleM @Camille_OS]

When it comes to licence identification, @pombr 's Scancode accuracy is hard to beat. Thanks for https://t.co/ssfbkrNGu3 #Compliance

[Philippe Ombredanne @pombr]

See also https://t.co/TFEkHmSQ9W for the talk video. I had the privilege to chat with @edward_j_kearns and this was great: from satellites to nuclear power plant cooling to solar system climate to submarine drones to the everglades and more: #fascinating person, mission and job! https://t.co/EWa5hPHGww

[Jeffrey Borek 🇺🇦 @jeffborek]

Now Edward Kearns, Chief Data Officer @NOAA talking #opensource use and data sharing for public good. Industry and government balance. Modern data licensing. #cloud #policy #CDLA @linuxfoundation @mdolan @NOAAResearch @oceanexplorer

[Philippe Ombredanne @pombr]

@lsaiz BTW, there are now #packageurl (aka. purl https://t.co/xmWhJpEPzj ) #FLOSS implementations that have been contributed in #golang @golang, #java and #python .... Help wanted for #javascript #ruby and others. 😇

[Philippe Ombredanne @pombr]

that's great. I wished CPE would do it, but there is somewhat of a gap between CPEs and the actual reality of packages as used today IMHO... I tried to capture this in this FAQ entry https://t.co/AXOgkxlpei

https://t.co/xmWhJpWqXT https://t.co/97iARGJByw

[Philippe Ombredanne @pombr]

@lsaiz I still think CPEs are essential, and #packageurl (aka. purl https://t.co/xmWhJpEPzj ) are a way to bridge the gap between software packages as we know of it and use and officially tracked vulnerable packages in the national vulnerability database #NVD and at @MITREcorp

[Philippe Ombredanne @pombr]

I modestly help there! We are embarking on an idealistic open #FLOSS data journey to help each and every #FLOSS project provide #OpenSource license clarity and more. Join us if you care about this @OpenSourceOrg https://t.co/mgL6Kp5Ogo https://t.co/72qlL1Hsjg

[ClearlyDefined @clearlydefd]

Well, its official. ClearlyDefined (@clearlydefd) is a thing! @opensourceorg just announced (https://t.co/cW54JeUjyx) our status as an Incubator project. Congrats to everyone from across the community for getting to this important milestone. Check out https://t.co/8IZklQrIUJ.

[Daniel Lopez @vomkriege]

Interesting approach to provide a universal reference mechanism for packages by @pombr at #lfosls

[Daniel Lopez @vomkriege]

“If your software does not have easily detected license information, it is a bug” @pombr #lfosls