Evidence Over Certificates: John Ellis on the Eclipse Trustable Software Framework

<p>What does it mean to trust software? For this RedMonk Conversation, Kate Holterhoff sits down with John Ellis, President of Codethink and the contributor to the Eclipse Trustable Software Framework, to pull that question apart. Ellis leans on an old image: the bridge builders who once slept under their own bridges to prove the work was sound. Modern software rarely faces that kind of test, even when it steers a car or flies a plane. He explains where trust tends to break, especially the integration step where hidden dependencies finally show themselves, and points out that a safety certificate almost never uses the word "safe." Rather than pass-or-fail box-ticking, the framework asks teams to state their confidence and back it with evidence that others can inspect and challenge. They also dig into AI-written code, the EU Cyber Resilience Act, and why rising software recalls suggest current habits fall short.<br /><br />This RedMonk video is sponsored by the Eclipse Foundation.<br /><br />Show notes: <a rel="noopener noreferrer nofollow" href="https://redmonk.com/videos/john-ellis/" target="_blank">https://redmonk.com/videos/john-ellis/</a><br /><br />Chapters<br />00:04 Introduction to the Eclipse Trustable Software Framework<br />02:57 Understanding Trust in Software<br />05:59 The Integration Moment of Truth<br />08:54 Challenges in Software Development Lifecycle<br />11:25 The Role of the Eclipse Trustable Software Framework<br />14:39 Managing Change in Software Development<br />17:20 Versioning and Continuous Improvement<br />20:01 Risk Analysis and Trustworthiness in Software<br />24:39 Automating Testing and Confidence in Software<br />25:23 Bridging the Gap with Regulators<br />27:15 The Complexity of Software and Safety Standards<br />29:18 Understanding Certification and Safety Claims<br />31:12 The Need for a Shift in Mindset<br />32:16 The Role of the Eclipse Trustable Software Framework<br />34:18 Navigating the EU Cyber Resilience Act<br />37:41 The Journey of Compliance and Awareness<br />39:16 AI's Impact on Software Provenance<br />43:34 Future Directions for the Eclipse Trustable Software Framework</p>