Stephanie Domas, Canonical's Chief Security Officer, returns to What's in the SOSS to discuss critical open source challenges. She addresses the issues of third-party security patch versioning, the rise of software sovereignty, and how custom patches break SBOMs. Domas also explains why geographic code restrictions contradict open source principles and what the EU's Cyber Resilience Act (CRA) means for enterprises. She highlights Canonical's work integrating memory-safe components like sudo-rs into the next Ubuntu LTS. This episode challenges assumptions about supply chain security, software trust, and the future of collaborative development in a regulated world.

Chapters:
00:00 - Welcome
01:49 - Memory safety revolution
02:00 - Black Hat reflections
03:48 - The SBOM versioning crisis
06:23 - Semantic versioning falls apart
10:06 - Software sovereignty exposed
12:33 - Trust through transparency
14:02 - The insider threat parallel
17:04 - EU CRA impact
18:50 - The manufacturer gray area
21:08 - The one-maintainer problem
22:51 - Will regulations kill open source adoption?
24:43 - Call to action

Episode links:

• Stephanie Domas LinkedIn page
• Canonical
• Ubuntu
• OpenSSF Global Cyber Policy Working Group (CRA & policy/standards resources)
• WiTS Podcast #18 - Canonical’s Stephanie Domas and Security Insight from a Self-Described “Tinkerer”
• Get involved with the OpenSSF
• Subscribe to the OpenSSF newsletter
• Follow the OpenSSF on LinkedIn