This webinar provided a practical case-study of a GPLv3 enforcement case in Italy, allowing viewers to understand how such situations unfold, and what they mean for open source governance and management.
Check Out The Rest Of Our Webinars
This is OpenChain Webinar #35, released on 2022-01-26.
Today Kakao Corporation announces an OpenChain ISO/IEC 5230 conformant program. Kakao Corporation is South Korea’s mobile life platform company that provides innovative services in global mobile and internet markets.
“More industries are increasing their use of open source, which importance is increasing day after day” says Charles Chung, CTO of Kakao. “Kakao will proactively share the open source competency we have accumulated to spearhead advancements in the development ecosystem. By acquiring certification for the International Standard for open source compliance, OpenChain ISO 5230, Kakao has been recognized for our ability to use open source. The OpenChain ISO 5230 certification will also help strengthen the reputation of ‘Olive Platform’, Kakao’s open source license identification and verification service.”
“The Korean community has been instrumental in building and supporting OpenChain ISO/IEC 5230, the International standard for open source license compliance,” says Shane Coughlan, OpenChain General Manager. “We are delighted to celebrate today’s conformance announcements by Kakao and KakaoBank, underlining the leadership and energy in the local market. Our shared supply chain is becoming clearer, more trusted and more efficient thanks to these efforts.”
About Kakao
Kakao Corporation is a mobile life platform company that provides innovative services in global mobile and internet markets, building on its employees with profound knowledge and experience, technological capabilities, quality contents and highly competitive mobile traffic. Under the corporate vision, “Making a better world with people and technology”, we connect everything in our everyday lives, enabling anyone to experience innovations on a daily basis. The Kakao Corporation headquarters can be found on Jeju Island, with an integrated metropolitan office in Pangyo, where over 2,300 employees in total are working today. Daum Communications, established in 1995, and Kakao, founded in 2006, merged on October 1, 2014 to become Daum Kakao. The name of the company was changed to Kakao on September 23, 2015 to become a company that stands at the forefront of the mobile era.
Today Kakaobank announces an OpenChain ISO/IEC 5230 conformant program. It is the first financial company in Korea and the second worldwide to formally adopt the International Standard for open source compliance.
“The use of open source is a trend and essential for all IT industries,” says Shin Jae-Hong, Chief Information Officer(CIO) of Kakaobank. “As Kakaobank is the first Korean financial company to be a part of OpenChain, We will accelerate innovative financial business possibilities through Ai, Big data, and Cloud based on our open source ability”
“The Korean community has been instrumental in building and supporting OpenChain ISO/IEC 5230, the International standard for open source license compliance,” says Shane Coughlan, OpenChain General Manager. “We are delighted to celebrate today’s conformance announcements by Kakao and KakaoBank, underlining the leadership and energy in the local market. Our shared supply chain is becoming clearer, more trusted and more efficient thanks to these efforts.”
About Kakaobank
Kakaobank is the biggest mobile-first bank in South Korea. Established in January 2016, the bank launched its public service in July 2017 after obtaining a final full banking license in April 2017. The bank attracted 240,000 customers within the first 24 hours of starting service. At the end of December 2021, Kakaobank holds 17.9 million users and 15.7 million account holders, around 60% of economically-active population in South Korea.
Kakaobank provides full-banking products via its mobile application, enabling customers to enjoy our services easier and faster. Kakaobank is looking to become a customer-centric bank under our slogan of “Helping you use banking services easier in your daily life” by providing a variety of essential financial products.
Over the last 12 months there have been several noteworthy concerns around open source and security. The exposure of vulnerability in software has exposed underlying issues with process management and ultimately with sustainability. The OpenChain Project, steward of ISO/IEC 5230:2020, the International Standard for open source compliance, has been at the forefront of addressing these matters.
In August 2021 we responded to market demand by releasing a Security Assurance Reference Guide. The first version of this document explained how ISO/IEC 5230 could be used through the optics of security. Like all our documentation, it was developed and released in the public arena, and subject to review and contributions from a wide array of stakeholders.
We are now working on the second iteration of this document. It does for security what ISO/IEC 5230 did for compliance: it provides a minimal, broadly applicable list of key requirements to institute a quality assurance program to address the domain space.
We do not intend to replace existing security standards. We do not intend to bloat ISO/IEC 5230. Instead, we are pursuing our proven approach of developing a real-world solution for a real-world problem that can be immediately deployed, and over time fits together with adjacent activities as neatly as a jigsaw puzzle.
For those new to this topic and wondering what OpenChain’s engagement means in practice, a summary of our Specification Work Group discussions throughout 2020-2021 is in order.
We are considering three paths for the security domain. One sees the Security Assurance Reference Guide maintaining its stance solely as a guide. Another sees the Security Assurance Reference Guide evolve into a Reference Specification that may become a de facto industry standard over time. Lastly, there is the option to have the Security Assurance Reference Guide evolve into an optional component for a future iteration of ISO/IEC 5230.
You can contribute to this activity by joining our bi-weekly global work team calls [1], our specification mailing list [2], and opening issues on the relevant repository in GitHub [3].
- https://www.openchainproject.org/community
- https://lists.openchainproject.org/g/specification
- https://github.com/OpenChain-Project/SecurityAssuranceGuide/tree/main/Guide/2.0
The OpenChain Project is far from alone in helping to address concerns around open source and security. The Open Source Security Foundation (OpenSSF) is a sister project at the Linux Foundation dedicated to securing the open source ecosystem. The Software Package Data Exchange Project (SPDX) maintains ISO/IEC 5962:2021, an International Standard for Software Bill of Materials. The Linux Foundation also hosts tools to help with automation in the space. We are collaborating to ensure the future of open source is secure.
You can expect a continuation of these activities throughout 2022. There will be an excellent opportunity for you to get involved during this quarter, as the OpenChain Project hosts a security summit to enable our extensive global community to share notes. To learn more about this, as well as our other activities, join one of our calls or one of our mailing lists. Everyone is welcome.
Get Started With Our Community
Attend The OpenChain Security Summit On February 17th and 18th
The Security Summit will take place on February 17th 2022 at 18:00 PST / February 18th 2022 02:00 UTC / 10:00 CST / 11:00 JST. It will be hosted on Zoom and it will be free to attend. It will also be recorded. You can expect to come away with a clear understanding of market conditions, how the Linux Foundation is addressing them, and where OpenChain fits into the picture.
The OpenChain Project will host three summits throughout 2022. Each summit will be virtual though our positioning and agenda will reflect a different geography for each topic covered. Here is what you can expect:
- Security (North America) on the 17th and 18th of February depending on your location
- Intellectual Property (China/Japan) – on the 17th and 18th of March depending on your location
- Automation (Germany) – Schedule Announced Soon
The Security Summit will take place on February 17th 2022 at 18:00 PST / February 18th 2022 02:00 UTC / 10:00 CST / 11:00 JST. It will be hosted on Zoom and it will be free to attend. It will also be recorded. You can expect to come away with a clear understanding of market conditions, how the Linux Foundation is addressing them, and where OpenChain fits into the picture.
The Intellectual Property Summit will take place on March 17th 2022 at 18:00 PST / February 18th 2022 02:00 UTC / 10:00 CST / 11:00 JST. It will be hosted on Zoom and it will be free to attend. It will also be recorded. You can expect it to provide a snapshot of current thinking around copyright, trademarks and patents in our domain
The date and times of the Automation Summit will be announced shortly. You can expect it to brief you on the state-of-the-art around automation for compliance, security and project health.
The goal – as always – is to ensure you have the information necessary to make informed, effective decisions around the open source supply chain. We seek to build trust in the quality of programs used by you, your customers and your suppliers. We are proud to have taken significant strides in our field throughout 2021. We expect to push the boundaries of what is possible once again in 2022.
The OpenChain Japan Work Group will hold their 22nd meeting on the 21st of January. This meeting will take place between 15:00 and 16:00 with a case study covering Mercari’s Open Source Program Office (OSPO). Big thank you, as usual, to SocioNext for hosting us.
開催案内】【第22回全体会合（第9回オンライン会合）】
次回のOpenChain Japan Workgroup全体会合の開催案内です。第22回全体会合（第9回オンライン会合）を
2022年1月21日(金)15:00-16:00に開催します。
本講演は録画無しとなりますので、是非当日ご参加ください。場所(Venue)：Zoom
https://socionext.zoom.us/j/99975267803?pwd=ekhxaHA3bVZUSVU5M0dVMkF2Z0pkQT09
Meeting ID: 99975267803 / パスワード: ]>guXS~6アジェンダ：
15:00 – 15:02 Opening
15:02 – 15:10 Keynote by ShaneCoughlan
15:10 – 15:20 OpenChain Japan WGについて
15:20 – 16:00 事例紹介: 「メルカリのOSPO立ち上げ事例」
株式会社メルカリ
Intellectual Property マネージャ弁理士
上野英和
16:00 Closing今回は、事例紹介ということで、メルカリにおけるOSPO立ち上げ
を紹介して頂く予定です。
Learn More About The Japan Work Group
