AsyncAPI Community, 12 Nov 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: AsyncAPI SIG meeting 14 (Nov 12, 2019)

Description

This is the recording for the AsyncAPI Special Interest Group (SIG) meeting #14.

Attendees:
- Fran Méndez
- Jonas Lagoni
- Nishchit Dhanani
- Waleed Ashraf

Moderation:
- Fran Méndez

Agenda:
- Paid collaboration program
- Repositories security
- Q&A

A

Aka, oh yeah. Let me share this with you here. This is the part method on the other parser, and there is a. There are three options. As you can see there. Let me share my screen: I think it's movies.

A

So there are three options here right and these three options are from JSON schema, parsers library and, if I'm not mistaken, that the reference or rizal what let's try to find it.

A

A

Where is it I? Remember it was there? Oh, no, wait! It's not in the options. Isn't it the reference.

A

Yeah, let me try it just to find this.

B

A

Yes, it's not that one is actually the path option, I abstracted it away so yeah, it's here very tired, so you have this option here that we can pass to the parser to tell him to tell the parcel where which one is a current directory right or the path of the current directory tab of the of the document might not be.

A

It makes a bit simple to guess like or impossible to guess, because file guessing the the current path of violence is possible. Guessing their current path of the URL is also possible, but if you're rendering you're doing it not running but you're parsing is a string. There's no fat! No, this this train is leaving nowhere. It's not hosting any file right. So that's why we introduces path option and, as I can see, we are not using it on the generator.

C

A

No I remember that we had this.

B

A

You see it's a metal here in red front string of the generator and it's you know it's using parts with a Mason capacity, no options with no parser options see.

B

A

So yeah we should have SMTP a string and then following this and object with the path option, which will be the path of the file or you know, cattle. But the thing is that when you're rendering a string, you don't have any past, usually using scroll passes. This is pass it here. What's the relative value good to use yeah, you know what I mean, because it's the string you're generating a string, is there's no.

A

B

A

Let me check because so the generate is actually oh.

A

Yeah, this is parsing a string at them calling generate now. What we doing here always is most probably we're going through these doors through these function. This line- and there are there's no context about the the location of this file, which is not a file, is history right. We should probably be able to pass this past year. All right relative path, so we are able to pass it to the parts method, doesn't make sense. Yep.

B

A

C

It should be pretty easy fix. Yeah yeah.

A

Yeah, we can probably just let's open it, so we don't forget.

A

Or maybe maybe you want to open it and you can take a screenshot of your new screen and put it there goodness yeah.

B

A

It's gonna be easier because then I'll have to explain everything and you have a screenshot which.

B

A

A

Let's go to the agenda, maybe.

A

What happened again.

A

Applecare I booked care.

A

So it was same yeah. The the so journalist is gonna create a suit, so we don't forget to fix it. It's we know. Where is it so it will be easy to fix it into the but I. Remember that we discussed this before I, don't know what happened. Maybe we just discuss about it and if we forget to fix it terrible so yeah, two things about the agenda. There are two points in the agenda today, which is a collaboration program and repository security.

A

So there are welcome.

A

Let me try to browse this without offending anyone. Nice sheet.

A

So I think you you were yeah. We were nothing before right, we're working four days. What.

D

Yes, yes and the fire camp project.

A

Yeah, so we were saying there are two points in the agenda which is no penetration program and repository security and I. Don't know what do you think about postponing, maybe one of them, because especially that the repository security? Yes I, would like to counter with more people into no match more than, as probably the four of us about security, and so we can discuss this better right, the wild it will be like it would be a great chat between the four or five but or maybe I mean after you really.

A

Sometimes it's just coming up with a list of things to do like like Jonas proposed or maybe maybe, if you would just explain what was it about robot that you failed with security in there yeah.

C

Sure so, right now, there's no limitations on what a member of especially the core group, what they can do to the repository and they can do pull requests and they can merge manually without even having to pull requests in place.

C

And the main issue about that is that we have full trust that the systems are not compromised in any way. And so, even that none of us directly have any.

C

Wrong intentions: they might not even be a fault, but it could happen that there was some codes in the master branch that was not supposed to be there and.

C

So the proposal was more or less to get to cut restrictions on the master branch to ensure that it has to go through a pull request and that pull requests have to have at least two reviewers before even getting approved. For example,.

A

So, yes, I think that the problem is clear. So, for instance, the as he was saying, the problem is: if anybody inside the organization, who's, a member of the organization can, by default, push to master or merciful, request right. So so the problem is that we have some actions and Froggy's associated with like pushing text, for instance in some Reapers.

A

If you put a new tag, it will publish to NPN, which is cool, but it can also be a problem because, like he was saying that there has been many cases where people gained your trust, you know like they make some contributions for a few time and then, once you give them the access to merge, pull request up to push tags. They do Nessa's tough right, like like putting some lights of code, that religious lines of code in your tool in knowing that this studio is gonna, be running on companies machines.

A

So they can compromise information right.

A

So one of the things that I mean it's true, it's happening, but one of the things that that I have in place a place. Is there.

A

Even even though, if even if I don't the review of a pull request, if you push the master, I'm gonna get a notification myself because I don't know if you know it, but there is a channel on slack which is called github activity. So everything is, it's gonna be logged there and I'm gonna get a notification and then we're gonna see what 17 right but yeah again, it's gonna be polished to a p.m., so you will have to release a new a new version right to write this so I. Think the other.

A

A

Maybe someone can come up with the list of things that or action items that we will have to do to avoid this, like a rolling studying, BOTS or I know there are there BOTS that require at least two approvals or something like this or our required certain rules to be able to make sure to be able to merge, pull request and and I, don't know about pushing tax, maybe about pushing directly how we can limit this is.

C

It's not already in place and github I think you can already do it. I, don't.

A

Know, to be honest, it's like it's me, I'm behind the you know so give.

C

A

C

Think I did it in one of my projects where I limited the push to master completely and it has to go through the pull request and and I'm pretty sure that there's complete control over it and get up. So it does no need for no external yeah.

A

So well, you like to take this this task of coming up with a list of action items or like.

D

A

Do it myself, but you know with actually items not necessarily necessarily do it right, just like hey, take care of this, isn't that right, yeah.

B

A

I think it's gonna be better because myself, I myself, I'm not very unit security. So- and you told me your did.

C

A

No it's, it will be better right. Sorry, my phone is ringing and this is really nice.

A

So yeah cool, so next next the agenda is about collaboration program. So okay I know we are. We are not many people here today, but I'm gonna share it anyway. So I was thinking on some kind of Fanta collaboration programs to to give back to the community who are people who are contributing to it. It's in KPI, because I think it's unfair that I ask for contributions and I'm making a living myself out of icing KPI and then other people are like spending their free time on that.

A

So in the beginning, it's fine because I didn't have any money to give back, but yeah I think the more sponsors we we have. The easier is gonna get, so we can probably dedicate some money to no specific issues or or specific tasks or taking care of a specific tool.

A

Don't know yet so, but before I draft this program, I would like to like to know your feedback on this. So how do you feel about this I? Can? How do you feel about contributing? How do you feel about getting paid about contribution? I guess you'll find well like nobody. It's gonna complain about getting paid right, but but yeah like I, don't know like how much do you think the amounts will be depending on it's also, depending on the complexity of the issue of this.

A

But if you have some thoughts around it, I would like to hear them because yeah before I sit down to draft is this program and so to take into account all the possible feedback right before it's too late. I know there are some programs, like both desserts. There are some.

A

There are services for this.

B

A

There is bountysource calm.

A

And this one is actually is this one yeah it's actually for this, like you can put some issues there meet Elise, is there and assign a value, and so people can work on that I think the first one who completes the issue is a completes that issue and validated is a writer that user gets larger pool of us gets merged. Is the one who's gonna get the money? So probably we can use something like this.

A

If you have another ideas, I'm up to me, to listen.

C

I, don't have any experience with this at all. I have no idea what some allusion is, but I guess this could be something. That's.

C

A

Yeah I'm asking because I have no I, have not experienced myself either so I'll have to explore this. Nobody has experience in this. It's nonsense to keep asking because you'll be in the same positions as I am so so yeah cool. So that was a really quick meeting today. If you have questions and answer, questions, I or suggestions, I mean I, always call it enough questions and answers. But this is over you having troubles with something and- and you want to ask for new feature whatever I think that's the right time.

A

This I think you lost or you could stop your video, but you can. You can still have all your right.

D

Yes, yes, I can follow you guys. Okay,.

A

I want to make sure that that you are included in.

C

One point: I have.

D

Actually at this, this is my first meeting with testing APA and let me introduce myself and just thought and our fat camp right now we are implementing some of the specifications from the s in KPI in fat camp. It's still under a beta version, so I think onward. I will try to attend almost every meeting I'm, so if they work and I'm sure it could be, it has a potential to change the entire industry standards. Combining all of today's specification is protocols within that.

D

So I will try to put as much as value from my side in a single PA, so I for this meeting, I think I, don't have any questions or any doubts from the next meeting. I will I'm sure I will have something something important important forget it for you share it with you guys.

A

Cool so I'm welcome by the way it's your first meeting, so you might not have questions but I have I do have about.

B

A

How you see async API help in farken product.

B

A

Is this, how do you plan to use it or I know that you already is something, but she said its possessor yeah.

D

A

D

There's a great question: let me show how we are using I. Think API to, let me see for sure, would aspire camp so far, can a single platform of a developer or engineer and a stout debug out every protocol and every technologies we are. We are saying this right now: is the protocol agnostic a pH to do so? The logo can test out. Any API is regardless of any portable.

D

For that we have by forget the couple of categories like a px graph QL and the even Message Queuing API is like socket I use web socket SS is our server sent event then after our plan is going forward, m2 DT, then after CRP CRP see these are you know plan so now, let's take an example.

D

If we have created a one project and we have added a multiple requests within that project, like a couple of them, are htps requests couple of our thoughts of it, which one is it, and so, but I/o requests and impurities. Well. So now, if you want to export this project and how we can do it, we have to, we have to have some specifications, because the export is one a file it will share with colleagues with community. We can put it a public file, so anyone can use it import it within the fire camp.

D

So at that point we are thinking like that. If we will give the support of s into P I, so we can export the wall project within the API, so someone can import it within their system and so.

A

I say that they and the reason you want to export it is because you might want to import it in another account or.

A

Enable cooperation.

D

A

D

It may have the use key just like, as you said, if I want to share it with you. I am working on some project and I want to share it with you. How.

B

D

Do it and I can export a one project with a single specification and you can import it likewise suppose, right now, 3d Twilio Emilio is julia, has their on on public API. But how can we Leo can expose the entire click API specification.

D

A

D

Actually, I have seen that right now we are going I. Think API is going absolutely in the future. We would have the couple of extra standard specifications actually at this moment. I am also learning the essence of a so I am not sure how it be, how we can use it with the how we can cover this. Almost every technologies and protocol you, but I will try to put my F values like whenever we will do the amputee anything else, then I would like to add it into the single payer. So.

A

Every event we will or we every messaging protocol is it's really possible to document with async API. But when it comes to documenting things like REST, API or graph, QL or G RPC I mean the spec is not meant for that right, so isn't KBS not meant for documenting any kind of.

B

A

It's possible to do some kind of probably Nessa's tough, because you have to misuse the spec right. You have to use the spec for something that is not built for yeah, but yeah. It's possible, I! Think you it was. You created an issue about the HTTP binding.

A

What you cannot have multiple methods of a single pack. Was it you.

D

Yeah, yes, actually I wasn't ever about that. One of my team member has created the issue. Okay, I think it will be a panel.

A

Yeah but the thing yeah I mean it makes sense, but also that's like a demonstration that we are not thinking about how to document the rest, API or or or an HTTP API with recent API. Just a simple endpoint move. You can probably send the message, so that's it right and you I'm.

B

Also, having most of the cases, you only have.

A

101 method right because it's a this endpoint was actually like, for instance, think about Kafka. When you want to send a message to Kafka, there is also a HTTP Kafka connector and you can send messages to dump by using an HTTP POST request. It's it's just for this. For these cases, right for this case or for simple cases like you have a HTTP streaming AP right, you only have one method, one path and everything and hangs from there right. Yes, yeah we can. We can probably add this to the to the HTTP binding.

A

So we make it possible and we we can explore this. People are interested in that for sure probably exploit, but yeah I want people to keep in mind that this is not like a solution for all the API.

D

A

Know just in case people are thinking about, it is in KP is actually for async, API, spice or Rosie, and rough QL, for instance, is nothing synchronous. G RPC is nothing interest. It's kind of what it's like like like web hooks with in restate the ice right. These kind.

B

A

Right so yeah, it's like asynchronous quadrants. On top of.

B

D

I am completely agree with you, because I have also learned that the fbi's have a lot of standards like open. Api specification is the wash out of dead till now. So it's it's completely fine to use the open, OS open up a specification plus I syncope ice. So if you use we use both specifications, then we can definitely cover the lot more things, but I am not sure about graph QL. If we put beautiful, has only one endpoint yeah yeah, so there might be some possibilities. We can.

A

Write because, yes,.

B

A

Area like event-driven API is recipe as graph queue. Api of them separately are already is so huge that trying.

B

A

Everything into single spec will probably.

B

A

This fact a lot you know in the in the space right, yeah I, think I always tend to imagine days like many many people trying to pull the pull string, everyone in their own direction. You know, and sometimes the things are going to move until they're.

A

Making be a is gonna, be like.

B

A

Be suitable for you, but and it's gonna be a pain in really experience for others right. So that's a thing. The reason we we are trying to converge. For instance, nobody buying we're trying to converge on JSON schema specification. So all the schemas that you have an open, API and async API. They are terrible, they're interchangeable right that you can. You can use whatever you declared for open API.

A

It's also valid for async API and also the other way around right as a way to as I'm going to say that you might have two specifications, but both of them are somehow compatible right with each other, so it doesn't.

D

A

D

This is the reason the FPS has a lot of specifications like open, API, 2, 3, Rd ml blueprint, the Justin D yeah. That's fine! Actually,.

A

Blueprint, you know: rommel open api, they're, all they're, all attacking same product, right, hey.

B

A

It's not, it wouldn't be like a different kind of kind of spec. Is it's more it's more like the same kind, different approach right? Yes,.

D

A

Yeah cool, so thanks for doing today and I hope we can chat again in two weeks and weeks from now. So remember we do this meeting every other week and and yeah I'm available.

D

Here the most active in slave.

A

So yeah, whatever you have pressures, if I cannot reply, maybe someone from the community can replies so yeah feel.

B

B

A

Thanks for your name, see you.