Recent content in Updates and Thoughts on Max Mehl
Ich wurde mal wieder von Ralf Hersel zum “Captain it’s Wednesday” Podcast von GNU/Linux.ch eingeladen, um über Software-Lieferketten bei der Deutschen Bahn zu sprechen. Anlass waren meine jüngsten Vorträge auf der FOSS Backstage und der FOSDEM, in denen ich über die Herausforderungen und Chancen von Software-Lieferketten bei der DB gesprochen habe.
At DB, we handle 100,000+ SBOMs per day. For our small, virtual Open Source Program Office (OSPO), the challenge is not to get lost in the data, but to cut through the jungle and identify real risks. Together with my OSPO colleague Cornelius Schumacher, I presented this challenge at the FOSS Backstage conference in Berlin. We explained how we gather data, generate insights, and take action.
At FOSDEM 2026, I presented Deutsche Bahn’s journey from operational need to concrete implementation of large-scale SBOM collection and use. The scale is staggering: approximately 500,000 SBOMs across our software supply chain expected, covering 7,000+ IT applications, 100,000+ Open Source components, and diverse sourcing streams from software we build ourselves to what we buy and operate.…
At FOSDEM 2026, I presented Deutsche Bahn’s software supply chain strategy in the context of the EU Cyber Resilience Act (CRA), but made clear from the start that CRA was the context, not the trigger. We didn’t adopt SBOMs because of regulation – regulation validated the direction we were already taking based on operational needs. The presentation positioned our work at the…
At the EU Open Source Policy Summit 2026, I participated in a panel discussion on how Open Source Programme Offices (OSPOs) can serve as engines of digital sovereignty for large organizations. Alongside experts from the European Commission, RTE, IKEA Group, and Research Institutes of Sweden, we explored how OSPOs can build institutional capability for open collaboration and governance, and how EU…
In the 45th episode of the FSFE Software Freedom Podcast, I joined Alexander Sander and Bonnie Mehring to discuss what is hopefully the final chapter of the EU Radio Equipment Directive (RED). This was a fitting conversation on the way to FOSDEM 2026, reflecting on nearly a decade of work to protect Free Software on radio devices. The discussion traced the complete arc of this campaign, from my…
I had the pleasure to moderate the OpenRail Day 2025 in Paris, organised by the OpenRail Association to share knowledge and experiences about Open Source software in the railway industry. This event brought together railway operators, digital experts, and Open Source communities from across Europe for a day dedicated to showcasing concrete Open Source projects already at work in the railway…
At FOSS Backstage 2025 in Berlin, I explored a critical challenge facing OSPOs and development teams: as we increase analysis of our software supply chains, tools and scorecards reveal potential risks in Open Source projects like low maintenance, lack of community, or poor security practices. But this data alone doesn’t help if it merely points out potential problems without offering…
My talk at FOSS Backstage (see earlier update) was covered by LWN.net, in an article by Joe Brockmeier. It’s an extensive summary of the talk, so if the video recording isn’t your thing, you can read the article instead.
I own and manage 30+ domains at INWX , a large and professional domain registrar. Although INWX has a somewhat decent web interface, it became a burden for me to keep an overview of each domain’s sometimes dozens of records. Especially when e.g. changing an IP address for more than one domain, it caused multiple error-prone clicks and copy/pastes that couldn’t be reverted in the worst…
In this article, I explain why DB Systel relies on Open Source for strategic collaboration and how we approach Open Source at Deutsche Bahn. An essential tool for that is the OpenRail Association, a neutral platform for the railway industry to share and collaborate on Open Source software. The article also highlights the importance of community involvement and how DB Systel fosters a culture of…
At Siemens Open Source 2024, I presented a narrative journey through the life of an Open Source maintainer, structured as a five-act drama with a happy ending. Through the story of “Alex”, a fictional developer, I explored what really drives maintainers, what they actually do beyond writing code, and the challenges they face when interacting with corporate structures. The talk moved from the…
I have been invited to talk about Software Bills of Materials (SBOM) in SAP’s Open Source Way Podcast, hosted by Karsten Hohage and with SAP’s Sebastian Wolf as co-guest. We had an interesting conversation about the growing importance of SBOMs in the software industry and their role within Deutsche Bahn. We also discussed the limits of SBOMs and how they can be complemented with other…
Im “Captain it’s Wednesday” Podcast von GNU/Linux.ch sprach ich mit Ralf Hersel über Freie Software bei der Deutschen Bahn. Das Gespräch fand rund ein Jahr nach meinem Wechsel von der FSFE zur DB Systel statt und bot eine gute Gelegenheit, über meine neue Rolle zu sprechen und zu reflektieren, wie ein großer Konzern wie die Deutsche Bahn mit Open Source umgeht. Der CIW-Podcast richtet sich…
At OSPOlogy Live Frankfurt in October 2023, I gave an introduction to Software Bills of Materials (SBOMs) for the OSPO community. Everyone had heard of SBOMs by then – they seemed ubiquitous, with shiny tools sprouting up everywhere. But what were they actually all about? What were the real use cases? And what often caused practical applications to fail? This talk aimed to provide a common…
Auf dem 9. Bitkom Forum Open Source in Erfurt präsentierten Cornelius Schumacher und ich eine Erzählung über das Leben von Open-Source-Maintainern, strukturiert als Drama mit Happy End. Durch die Geschichte von “Alex”, einer fiktiven Entwicklerin, beleuchteten wir, was Maintainer wirklich antreibt, was sie jenseits des Programmierens tun und welchen Herausforderungen sie sich stellen müssen. Der…
I have been using Seafile for years to host and
synchronise files on my own server. It’s fast and reliable, especially when
dealing with a large number and size of files. But making reliable backups of
all its files isn’t so trivial. This is because the files are stored in a layout
similar to bare Git repositories, and Seafile’s headless tool,…
At Upstream 2023, I participated in a fireside chat with Luis Villa (Tidelift) and my colleague Erik Schaufuss exploring the fascinating intersection between Software Bills of Materials (SBOMs) and Hardware Bills of Materials (HBOMs) within Deutsche Bahn’s complex supply chain. As Germany’s national railway company with hundreds of federated subsidiaries, we face unique challenges in…
So you have a number of Docker containers running web services which you would
like to expose to the outside? Well, you probably will at least have considered
a reverse proxy already. Doing this manually for one, two or even five
containers may be feasible, but everything above that will be a PITA for sure.
At the FSFE we ran into the same issue with our own
distributed…
At FOSDEM 2022, I again joined my fellow organizers of the Legal & Policy DevRoom for a panel discussion on the hot topics we observed over the past year in Free and Open Source Software. Together with Bradley Kuhn, Karen Sandler and Alexander Sander, we reflected on the presentations from the day’s track and looked forward to the future of FOSS policy. This panel provided an opportunity to…
I was invited to join the Digital Impact Alliance’s “Pulse on the Principles” podcast for a conversation about the intersection of Open Source software and Digital Public Goods. Alongside Lucy Harris from the Digital Public Goods Alliance and Bernhard Kowatsch from the World Food Program Innovation Accelerator, we explored how Open Source principles can unlock digital cooperation and help…
At SFScon 2021 in Bolzano (Italy), I presented REUSE as a gold standard approach for Free and Open Source Software licensing. The REUSE initiative, launched by the Free Software Foundation Europe, provides best practices and tools that make licensing Free Software projects straightforward and unambiguous. By following three simple steps – providing license and copyright information in every file,…
At EuroBSDCon 2021, I introduced the REUSE initiative to the OpenBSD community, demonstrating how this approach can simplify licensing practices for Free and Open Source Software communities like theirs. The talk focused on the practical challenges developers face when trying to properly license their code and how REUSE’s three simple rules can solve these problems. This presentation was…
In the scope of my work with the FSFE regarding Cell Broadcast, I have been interviewed by The Local about the disaster warning system in Germany and whether a more open and resilient system could have prevented some damage during the Ahrtal floods in July 2021. The article discusses the known deficiencies of the existing system and explores why improvements were not made in time.
Nach der verheerenden Flutkatastrophe in Deutschland im Juli 2021 veröffentlichte BILD einen Artikel, der das Versagen der NINA-Warn-App kritisierte. Ich wurde zu den technischen Grenzen des zentralisierten Warnsystems und zu resilienteren Alternativen wie Cell Broadcast befragt, die alle Menschen erreichen können, ohne dass eine App installiert werden muss.
Heise/c’t magazin berichtete über die Pläne der EU-Kommission, die Funkanlagenrichtlinie (RED) mit Vorschriften umzusetzen, die effektiv alle Funkgeräte sperren könnten. Als Programm-Manager der FSFE wurde ich zitiert und warnte vor der Bedrohung für Open-Source-Projekte wie Freifunk, OpenWrt und das gesamte Internet-der-Dinge-Ökosystem, da die Anforderungen es nahezu unmöglich machen…
In the 11th episode of the FSFE Software Freedom Podcast, I joined my colleague Bonnie Mehring to discuss the REUSE initiative and the newly launched REUSE Booster programme. This marked the first time that an FSFE staff member appeared on the podcast, and it was a great opportunity to provide an accessible introduction to REUSE for listeners who might find software licensing complex and…
At OW2con 2021, I presented REUSE to an audience deeply involved in Open Source infrastructure projects and close to public authorities and French businesses. The talk emphasized how REUSE makes Free Software licensing accessible and manageable for everyone – from individual developers to large organizations managing complex codebases. This was particularly relevant for the OW2 community, where…
Bei Europe Direct Dortmund hielt ich einen Vortrag über digitale Souveränität in Europa und die zentrale Rolle, die Freie und Open Source Software dabei spielt. Der Vortrag beleuchtete, wie abhängig Europa von proprietären Softwarelösungen geworden ist und welche Risiken diese Abhängigkeit für demokratische Institutionen, wirtschaftliche Wettbewerbsfähigkeit und technologische Selbstbestimmung mit…
At LibrePlanet 2021, I presented the REUSE initiative as a set of best practices for declaring copyright and licenses in Free Software projects. LibrePlanet is the Free Software Foundation’s annual conference celebrating software freedom, making it an ideal venue to discuss how REUSE helps uphold the principles that the community values most. The talk focused on how clear licensing and…
At FOSDEM 2021, I participated in the annual panel of Legal & Policy DevRoom organizers where we discussed the hot topics from the track’s presentations that year. This panel tradition brings together the organizers to reflect on the most pressing legal and policy issues facing Free and Open Source Software, based on the talks and discussions throughout the day. It provided an opportunity to…
Ich war als Gast bei der sechsten Ausgabe des GnuLinuxNews-Podcasts zu Gast, wo wir über verschiedene Themen aus der Welt von Free and Open Source Software sprachen. Der GnuLinuxNews-Podcast richtet sich an die deutschsprachige Linux- und Freie-Software-Community und behandelt aktuelle Entwicklungen, Projekte und politische Themen rund um Freie Software. In dieser Ausgabe diskutierten wir…
Ich wurde von Netzpolitik.org zum aggressiven Vorgehen der Musikindustrie gegen youtube-dl befragt. Als FSFE-Programm-Manager erklärte ich, dass Multifunktionswerkzeuge wie youtube-dl für zahlreiche legale Zwecke genutzt werden – von Journalist:innen über Wissenschaftler:innen bis zu Menschenrechtsorganisationen wie Amnesty International. Das Problem ist, dass Freie-Software-Projekte sich teure…
In the recent weeks and months, the FSFE Web Team has been doing some heavy work on the FSFE website . We moved and replaced thousands of files and their respective links to improve the structure of a historically grown website (19+ years, 23243 files, almost 39k commits). But how to do that most efficiently in a version controlled system like Git?
Im Librezoom-Podcast LZ20 mit dem Host Ralf Hersel gab ich ein Interview zur Frage, ob mehr Freiheit zu mehr Sicherheit führt – ein scheinbares Paradoxon in der IT-Sicherheitsdebatte. Viele Menschen assoziieren Sicherheit mit Kontrolle und Einschränkungen, während Freie und Open Source Software auf Offenheit setzt. In diesem Gespräch ging ich der Frage nach, warum diese scheinbare Dichotomie in…
For the 4th time, and less than 5 months after the last meeting, the
FSFE System Hackers met in person to coordinate their activities, work
on complex issues, and exchange know-how. This time, we chose yet
another town familiar to one of our team members as venue – Lyon in
France. What follows is a report of this gathering that happened
shortly before #stayhome became the order…
Beim Winterkongress der Digitalen Gesellschaft Schweiz hielt ich einen Vortrag über den fundamentalen Zusammenhang zwischen IT-Sicherheit und Freier Software/Open Source. Die Kernthese war provokant formuliert, aber technisch begründet: Echte IT-Sicherheit ist ohne Freie Software nicht möglich. In einer Zeit, in der Cybersecurity zunehmend als kritisches Thema für Gesellschaft, Wirtschaft und…
A few days ago I’ve sent an announcement email for today’s I Love Free Software Day to a large bunch of people. Most of the remarkably many replies have been positive and a pure joy to read, but some were a bit sceptical and critical. These came from Free Software contributors who are maintaining and helping projects that they think nobody knows and sees – not because these software…
At FOSDEM 2020, I presented “Go REUSE to license your code” in the Legal and Policy Issues Devroom. This talk marked an important milestone in the REUSE initiative’s evolution, as we were seeing increasing adoption across diverse projects and growing recognition of licensing clarity as a critical aspect of software quality. The presentation encouraged developers to adopt REUSE practices for…
At the Open Source Summit Europe 2019 in Lyon, I presented REUSE to an audience of enterprise Open Source professionals, developers, and decision-makers. The Open Source Summit, organized by the Linux Foundation, brings together the commercial and community sides of Open Source, making it an ideal venue to discuss how REUSE addresses licensing challenges that affect both worlds. The talk…
On 10 and 11 October, the FSFE System Hackers met in person to tackle
problems and new features regarding the servers and services the FSFE
is running. The team consists of dedicated volunteers who ensure that
the community and staff can work effectively. The recent meeting built
on the great work of the past 2 years which have been shaped by large
personal and technical…
At BalCCon 2019 in Novi Sad, Serbia, I delivered a talk arguing that real IT security is fundamentally impossible without Free and Open Source Software. BalCCon (Balkan Computer Congress) brings together security researchers, hackers, and technology enthusiasts from across the Balkans and beyond, making it a perfect audience for examining the deep connections between software freedom and security.…
Bei den Grazer Linuxtagen 2019 hielt ich die Keynote über den Zusammenhang zwischen IT-Sicherheit und Freier Software. Die Grazer Linuxtage sind eine der wichtigsten deutschsprachigen Veranstaltungen für GNU/Linux und Freie Software, und die Keynote bot die Möglichkeit, dem gesamten Publikum – von Einsteigern bis zu erfahrenen Entwicklern – zu erläutern, warum Freie und Open Source…
The Register reported on the controversy surrounding the EU Radio Equipment Directive (RED) that could ban installing alternative firmware on routers and other radio devices. I was quoted alongside my FSFE colleague Hauke Mehrtens, highlighting how the FSFE was excluded from the implementation working group despite our attempts to participate.
We are facing a EU regulation which may make it impossible to install a custom piece of software on most radio decives like WiFi routers, smartphones and embedded devices. You can now give feedback on the most problematic part by Monday, 4 March. Please participate – it’s not hard!
If you are reading these lines, you are already accessing the brand-new planet of the FSFE. While Björn, Coordinator of Team Germany, has largely improved the design in late 2017, we tackled many underlying issues this time. 
 So what has changed under the hood?
LinuxInsider published an article about 20+ years of innovation in the Open Source movement, featuring my perspectives on how collaborative development has transformed the technology landscape and the continuing influence of Open Source across industries – from operating systems to enterprise software and cloud infrastructure.
At BalCCon 2018 in Novi Sad (Serbia), I presented the FSFE’s “Public Money, Public Code” campaign and its vision for modernising public digital infrastructure through Free Software. This was during the early, energetic phase of the campaign when we were building momentum across Europe for the principle that software developed with taxpayer money should be made available as Free Software.…
At DrupalEurope 2018 in Darmstadt, I presented the “Public Money, Public Code” initiative to an audience of Drupal developers, site builders, and digital agencies. This was a particularly relevant venue because Drupal itself is Free Software, and many in the audience work on public sector projects where the principles of Public Code directly apply. The talk connected the FSFE’s campaign to…
WELT veröffentlichte einen Ratgeber, wie Android-Nutzer:innen Google-Dienste von ihren Smartphones zurückdrängen oder entfernen können. Der Artikel richtet sich an Menschen, die mehr Kontrolle über ihre Daten haben möchten, und behandelt alternative App Stores wie F-Droid, freie Android-Distributionen wie LineageOS sowie datenschutzfreundliche Alternativen zu Google-Apps.