This conference features a series of engaging presentations across diverse fields of technology and open source. Key highlights include an exploration of Odac, an open-source structural design software emphasizing detailed engineering calculations and its role in academia and industry. A compelling case study details the challenges and innovative solutions behind orchestrating runtime security for over 50,000 low-powered Point-of-Sale (POS) devices, demonstrating lessons in horizontal scaling and message queue optimization. The legal landscape of open source is examined through the lens of Developer Certificates of Origin (DCOs) and Contributor License Agreements (CLAs), illuminated by historical legal battles and licensing shifts. Mercedes-Benz India presents its comprehensive FOSS strategy, detailing compliance with Open Chain ISO 5230 and active community engagement. A unique personal journey delves into the practicalities and development opportunities on "dumb phones" running KaiOS. Additionally, the conference introduces Plane's "Open Continuum" business model for building sustainable open-source products, offers a hands-on workshop on algorithmic music creation with Strudel, and explores the Indian legal intricacies of AI-generated code and FOSS compliance. Finally, a forward-looking talk unveils the WebCodecs API, showcasing its potential to revolutionize high-performance, client-side media creation and editing in web browsers.
Summary:
Odac - Open-Source Structural Design Software
0:00:06 Odac is presented as an open-source structural design tool that provides detailed calculations aligned with Indian standard codes, suitable for teaching and municipal design submissions.
0:00:55 It features dependencies on Python, Pycute, OCC, and SQLite, generating comprehensive PDF reports and offering design suggestions for failed elements (e.g., recommending larger bolt diameters).
0:02:07 The software supports CAD generation and export to tools like FreeCAD or AutoCAD for detailing.
0:02:44 Odac aims to boost confidence in the steel and construction industry, serve as an alternative to costly proprietary software in design labs, and be integrated into undergraduate curricula.
0:03:46 Future plans include migrating to PyQT6, launching a web version by year-end, updating to the IS-800 draft standard (April 2025), a refreshed UI, and developing a plugin system for diverse design philosophies and international codes.
0:06:13 The project actively seeks student interns and external contributors, offering recognition for their efforts.
0:08:06 Early industry adoption faced friction due to its initial academic focus, but with all undergraduate modules now complete, a broader educational push is underway.
Edge for Security at Scale: Orchestrating Security Across 35,000+ POS Devices
0:14:41 Barun and Swarit discuss the challenge of deploying runtime sandboxing security on 30,000-50,000 low-powered Point-of-Sale (POS) devices, which have limited resources and intermittent network connectivity.
0:18:47 The solution involved using Cube Armor for on-device security, leveraging its low resource consumption (<40MB RAM) and kernel-level decision-making to avoid impacting CPU performance.
0:19:38 Offline functionality was critical, with telemetry data stored locally (up to 10MB) and synced when devices reconnected.
0:20:48 The system successfully blocked real-world attacks, such as unauthorized access to sales data and internal network port scanning.
0:21:40 A major engineering hurdle was orchestrating policies and collecting terabytes of data daily across a dynamically connected fleet without traditional orchestration tools.
0:23:30 Initial attempts with gRPC for data transfer proved inefficient and costly due to manual connection management and lack of decoupling.
0:26:08 Switching to Rabbit MQ introduced new scaling problems, specifically high memory usage from multiple TCP connections per device (80GB for 35,000 devices).
0:29:41Key Breakthroughs: Horizontal scaling of Rabbit MQ nodes by separating connections from queues, and multiplexing connections using Rabbit MQ channels. This reduced memory requirements from 80GB to 30GB and peak node count from 20 to 5, cutting infrastructure costs from ~$2000 to ~$400 per month.
0:34:57 Learnings included the viability of offline security at scale, the power of horizontal architectures, and the importance of continuous experimentation and thorough documentation review.
Open Source Software & Legal Compliance: DCOs, CLAs, and the SCO Lawsuit
0:41:00 Ram discusses the evolving legal landscape of open source, emphasizing the complexities that arise as projects grow and are adopted by enterprises.
0:47:50 The Developer Certificate of Origin (DCO) is introduced as a mechanism for contributors to affirm their code's origin and ownership, providing a traceable layer of accountability.
0:50:3 The Contributor License Agreement (CLA) is explained through the Elastic case study, where the company re-licensed its popular software despite community objections, a move enabled by the broad rights granted in their CLA.
0:53:50 Different CLAs have varying implications: some, like CNCF's, ensure perpetual open-source status, while others, such as Google's (for Golang) and SQLite's, allow for potential re-licensing by the corporate entity.
1:01:03 The DCO's origin is tied to the SCO lawsuit (2003-2011), where SCO claimed copyright infringement of Unix code in Linux. Linus Torvalds introduced the DCO to protect Linux maintainers from such legal challenges.
1:05:08 The SCO lawsuit ultimately failed, reaffirming the free use of Linux, but it highlighted the necessity of clear legal frameworks like DCOs and CLAs for project protection.
1:10:09 It is stressed that projects should adopt either a DCO or CLA to safeguard contributors, maintainers, and the project's long-term viability, regardless of developer inconvenience.
Mercedes-Benz India: FOSS Strategy and Compliance
2:28:50 Mercedes-Benz India outlines its commitment to FOSS, integrating it extensively across its automotive products.
2:30:15 Modern Mercedes-Benz vehicles, like the 2024 E-Class (3000+ components) and upcoming CLA (4000+ components), rely heavily on FOSS in areas such as infotainment, telematics, and ADAS.
2:31:15 The company's leadership champions FOSS, emphasizing its role as standard software used throughout their product ecosystem.
2:32:47 Mercedes-Benz adheres to a FOSS Manifesto, guiding both corporate principles (prefer FOSS, act as good citizens, actively participate) and employee principles (prefer FOSS solutions, good citizenship). This manifesto has inspired other major organizations.
2:35:01 The company aligns its FOSS practices with the Open Chain ISO 5230 standard, achieving ISO conformance in 2023. This involved a multi-step process for compliance audits, defining roles, and managing FOSS artifacts.
2:38:25 FOSS compliance spans development (in-house scanning in CI/CD, license policy enforcement) and supplier management (ensuring third-party software fulfills license obligations).
2:40:10 FOSS information is transparently communicated to vehicle owners via a mini-CD, a dedicated FOSS website (VIN-based PDF reports), and a digital "License Information App" within the infotainment system.
2:41:25 Mercedes-Benz actively supports FOSS communities through memberships (Eclipse, Linux Foundations), sponsorships (33 GitHub projects), and direct contributions/creations (175 repositories on their FOSS GitHub platform).
The Power of the Dumb Phone: Developing for KaiOS
2:47:53 Badri shares his personal journey and advocacy for "dumb phones" powered by KaiOS, emphasizing a preference for technology that serves specific needs and graceful degradation.
2:50:57 He highlights common public reactions to his flip phone, from nostalgic requests to play "Snake" to practical inquiries about modern functionalities like payments.
2:52:36 A demonstration showcases KaiOS capabilities, including a calendar, email, OpenStreetMap for navigation, a podcast app, Bluetooth connectivity, and access to an app store, proving its functionality beyond basic communication.
2:58:58Major Pain Points identified include limitations in ride-hailing services, UPI payments (due to proprietary SDKs), music streaming (lack of developer interest/DRM), and social media access.
3:00:40 Despite challenges, he values the device's form factor, durability, and the ability to type on a T9 keypad without visual focus, preventing motion sickness during travel.
3:03:56 As a developer, Badri created "Convo," an XMPP-based messaging app for KaiOS, demonstrating how standards-based technologies enable cross-platform compatibility and stability.
3:06:01 KaiOS apps are web-based (HTML, CSS, JavaScript APIs), allowing for adaptation of existing web apps and enabling developers to address missing features.
3:07:34 "Convo" rapidly gained traction, receiving a grant for further development, underscoring the demand for modern functionality on these devices.
3:09:47 While KaiOS development faces hurdles like an outdated browser engine (Firefox 49) and limited hardware, these can be mitigated through careful development practices (e.g., Babel/polyfills, minimalist design).
3:11:34 He encourages app developers to consider small-screen and button phone compatibility, believing these devices can become highly usable with targeted development efforts.
Plane: The Open Continuum Model for Sustainable Open Source
3:58:34 Vamsi Kurama, CEO of Plane, outlines Plane's "Open Continuum" model, a strategy for building a sustainable company around its open-source project management software.
4:02:05 Plane's journey involved an initial surge of community excitement and star growth, followed by a period of conflict and disappointment when transitioning from a project to a product and then a company.
4:07:0 This transition required Plane to differentiate between an open-source project, product (adding UX, QA, docs, support), and company (adding revenue, go-to-market, legal expertise).
4:11:16 The "Open Continuum Model" was developed as an alternative to traditional "open core," aiming for true open-source sustainability by ensuring the community edition is fully open source, feature-rich, and free of proprietary restrictions or dependencies.
4:13:0Core Rules of Open Continuum:
Continuous Releases: Regular updates (15-30 days) for the community edition.
Pure OSS: No proprietary dependencies (e.g., uses OpenSearch instead of Elastic).
Zero Vendor Setup: Fully self-hostable via Docker/Kubernetes without external vendor lock-in.
Extensible Software: Licensed under MIT, Apache, or AGPL.
4:16:0 A critical practice is "Upstream First Development": all bug fixes and features are first committed to the open-source community edition. An automated GitHub action then propagates these changes to the commercial enterprise edition, preventing the free version from being neglected.
4:18:50 This model fosters trust, provides clarity on Plane's mission, delivers significant value (enabling air-gapped installations for large clients), and drives strong community support, ultimately ensuring a sustainable open-source business.
Making Music Using Strudel (Algorithmic Music Creation)
4:33:13 This workshop introduces Strudel, a browser-based JavaScript tool for algorithmic music creation, inspired by TidalCycles.
4:34:21 Strudel allows users to define musical patterns using "cycles per minute," create chords (e.g., standard Western progressions), and collaborate in real-time.
4:35:19 To make algorithmic music sound more "human," techniques like late and early (adding subtle timing variations) and rand/cut off (for dynamic effects) are used.
4:37:13 An advanced feature, "motion parameterization," enables controlling musical parameters (e.g., high-hat speed) via physical device motion, enhancing live performance and improvisation.
4:39:42 The speaker demonstrates creating "tricio tracks" using Euclidean rhythms, resulting in lopsided, "Cuban" sounding patterns, and explains how to compose tracks using s for sounds and n for notes.
4:45:27 The workshop encourages participants to experiment with Strudel and continues the jamming session outside the formal presentation.
AI Code Generation and FOSS: Legal & Compliance in India
4:48:23 The presentation explores the legal and compliance implications of AI code generation for Free and Open Source Software (FOSS) projects, focusing on the Indian legal framework.
4:50:0 Key concerns for FOSS projects using AI-generated code include ambiguity regarding the original training data's sources and licenses, the legal status of AI-generated output, and the risk of copyleft licenses (e.g., GPL, AGPL) inadvertently impacting otherwise permissive codebases.
4:52:19 Due to these risks, many FOSS projects either ban or require explicit disclosure of AI-assisted contributions.
4:53:0 The Indian legal landscape for AI is fragmented, consisting of existing laws like the Copyright Act, IP laws, Digital Personal Data Protection Act, and IT Act, rather than a singular comprehensive AI law.
4:54:51 Recent regulatory developments in India include an anticipated National AI Governance Framework and CERT-In guidelines that introduce an AI Bill of Materials (AI BoM) for critical sectors.
4:56:44 Under the Copyright Act 1957, Indian law currently does not recognize non-human authorship; therefore, entirely AI-generated works cannot be copyrighted. Partial human authorship remains a legal gray area.
4:58:43 In contrast, patenting is clearer: AI-assisted inventions are patentable, but fully AI-generated inventions are not.
4:59:28 The AI Bill of Materials (AI BoM), mandatory for certain government and essential services, mandates detailed disclosure of AI model information, including unique identifiers and data sources.
5:00:46 A significant ongoing legal case in India involves ANI (news agency) seeking damages for unauthorized use of its data to train ChatGPT, highlighting the legal battles surrounding AI training data.
5:01:59 For FOSS compliance, organizations are advised to establish clear written policies on AI usage, implement real-time scanning and alerts, and conduct regular monitoring and audits of AI-generated code.
WebCodecs for High-Performance Media in the Browser
5:06:02 Sid introduces WebCodecs, a new browser API designed to enable high-performance media creation and editing directly within web browsers.
5:06:46 Historically, rich multimedia applications on the web were challenging due to browser sandboxing and the need for server-side processing, leading to high latency and server costs.
5:10:51WebCodecs shifts the paradigm by granting web developers direct access to hardware-accelerated encoders and decoders built into browsers (e.g., FFmpeg, AV Foundation), thereby moving computationally intensive media tasks from the server to the client.
5:12:20 This API leverages the GPU and abstracts codec complexities, allowing JavaScript to perform operations like decoding media into VideoFrame objects and encoding them back into playable files, all client-side.
5:16:30 The benefits are substantial: significantly reduced server costs (potentially zero for core media operations), zero network latency (instant previews), hardware acceleration without low-level GPU coding, and a user-friendly JavaScript API.
5:17:24 This technology unlocks new possibilities for browser-based applications, including advanced video conferencing (e.g., virtual backgrounds), sophisticated content creation platforms (captions, subtitling), educational tools, and accessibility features (e.g., sign language overlays).
5:18:41 Sid's project, Helmer, an "infinite canvas for video," exemplifies the kind of innovative tools that WebCodecs makes possible.
5:19:01 With growing browser support (including recent iOS 26 updates), WebCodecs is poised for rapid adoption, empowering more people to create and share video content directly from the web.