►
Description
Speaker: Matt Snell
Organization: University of Nebraska Omaha
This presentation is to explain the process of implementing the CII Best Practices API as a risk metric and a brief discussion of its implications. I will start with a program that performs a basic API call to CII. Next, I will examine the API call and explain some important parameters. Then, I will ask for some feedback on other parameters that may be useful. A combination of the predetermined metrics and audience suggestions will be used to create a CII dashboard. If we are short on time, example code will be ready to be used in the place of written code. I will end the presentation with a brief discussion with the audience, exploring potential use cases and implications of the CII Best Practices metric.
A
Yeah,
okay,
hi
guys
I'm
here
to
talk
about
implementing
CI,
a
best
practices,
metrics
and
your
own.
Your
own
work,
your
own
life
and
I'm
gonna
talk
a
little
bit
about
what
it
really
means
to
at.
First
I
wanted
to
talk
about
chaos,
and
just
just
a
short
thing:
I
really
appreciate
the
chaos
community
and
what
everyone's
done
with
it
and
what
it's
done
for
me
too.
A
These
are
these
guys
are
my
faculty
advisors,
but
I'd
put
them
before
my
name,
because
they're
above
me
in
the
chain,
I
know
yeah.
So
so
I'm
gonna
talk
about
badging
first,
because
everybody
might
not
know
what
the
software
badging
means.
So
what
do
people
think
about
software
badging?
What
does
it
mean
to
you?
A
Takers,
yeah,
that's
true,
yeah
yeah
I
was
just
gonna,
get
some
opinions,
but
yeah
yeah
I
have
some
examples
of
some
software
about
is
here.
This
is
a
project
that
I
just
pulled
up
called
GG
stats
plot.
They
have
a
lot
of
different
badges
that
you
can
use
from
on
their
on
their
website
to
see
more
about
their
project.
It's
it's
kind
of
an
idea
of
where
their
project
is
in
lots
of
different
lots
of
different
angles.
I
guess
is
a
good
way
to
put
it,
but
this
is
just
an
examples
of
software
badging.
A
It's
something
you
put
up
on
you
with
repository
and
get
more
information
to
people
about
it.
So
this
also
takes
us
to
core
infrastructure
initiative.
It's
a
Linux
Foundation
project
and
something
interesting
about
it
is
that
it
started
after
heartbleed
happened,
so
it
was
announced
pretty
soon
after
that
and
their
goal
is
to
fund
and
support
for
repositories
and
software
and
core
infrastructure
for
the
Internet
and
information
systems.
So
this
is
the
core
infrastructure
initiative
like
basic.
A
You
know,
idea
inventory,
but
they
have
something
called
the
best
practices
badging
program,
it's
something
that
I
like
to
call
a
thousand
foot
view
of
the
project.
It's
a
very
broad,
very
open,
like
it's
a
number
that
tells
you
are
they
following
best
practices?
And
we
absolutely
absolutely
know
like
we
just
talked
about
ethics.
A
Best
practices
is
kind
of
a
part
of
that
and
we
we
work
on
best
practices,
because
we
want
to
follow
a
certain
guideline
and
missing
on
I
talked
about
that
a
little
bit
too,
and
we
want
to
also
know
why
it's
helpful
to
explore
these
best
practices,
and
this
picture
on
the
right
is
just
an
example
of
projects
that
are
associated
with
core
infrastructure
initiatives.
Badging
program.
They
have
badges
themselves,
so
I'm
going
to
pull
up
a
picture
of,
and
this
is
an
example
of
the
CIA
badging
context.
A
This
is
one
of
the
cast
projects
and
they've
got
their
own
CI
eyebags
show
is
that
showing
that
they're
83%
to
being
at
a
passing
level
there's
also
silver
and
gold
that
can
indicate
different
levels
of
compliance
with
CIA
best
practices.
So
I
actually
took
some
work
and
put
this
into
augur
in
that
box
in
the
bottom
right
there,
and
this
is
just
an
example
of
an
implementation
of
the
CIA
best
practices
metric.
So
this
is
I,
don't
know
how
to
pronounce
it.
A
It's
Apache
sync
up
a
sync
up,
but
it's
something
that
is
at
a
passing
level
with
CIA
best
practices.
It
shows
when
it
happened,
and
what
the
user
ID
is.
That's
a
very
simple
implementation.
The
API
actually
returns,
there's
an
API
that
I
get
this
information
from.
It
actually
returns
a
lot
of
information,
so
we
can
work
with
that
at
any
time
and
let's
talk
a
little
bit
about
why
this
box
is
incredibly
important
to
the
implementation
of
specifically
risk
metrics
and
in
any
software
package
that
is
looking
at
those
metrics
in
in
detail.
A
So
I
have
I
have
kind
of
some
information
here
about
why
this
is
important.
So
yeah
it
has
their
badging
program
site
and
we
can
explore
that
too
later.
But
you
can
go
there.
But
if
you
want
to
have
all
your
data
in
one
place,
which
is
very
nice
and
efficient,
then
you
have
to
that.
You
pretty
much
have
to
put
it
with
all
your
other
metrics.
A
You
can
take
our
badging
data
and
put
it
on
a
dashboards
so
that
we
have
that
we
have
this
available,
because
if
you
really
honestly,
if
I
was
looking
at
metrics
for
a
project,
I
wouldn't
go
and
look
at
go
to
CIA's
website,
look
them
up
and
buy
an
ID
and
then
find
them
every
time.
I
needed
that.
So
the
big
sentence
I
have
here
is
integration
is
crucial
to
the
efficient
consumption
of
best
practices.
Metrics
and
I.
A
A
A
I
can
show
you
something
real,
quick
that
shows
the
best
practices
so
I
have
it
pulled
up
here,
and
this
is
the
CIA
kind
of
website
that
I
was
talking
about
earlier.
We
can
look
things
up
by
eye
DNA,
and
things
like
that
and
I
am
on
the
page
that
we
can
find
augur
right
here.
So
this
is
their
badge.
A
You
can
embed
that
onto
your
repository
from
any
area
and
basically
they
use
a
lot
of
checking
you
put
in
some
information
yourself
and
they
use
a
lot
of
checking
to
to
find
out
like
if
it
follows
licensing
best
practices.
If
it
has,
if
it
has
information,
I
could
read
me
and
install
document
things
like
that.
B
A
C
A
A
A
Can
tell
you
how
many
repos
there
are.
There
are
currently
about
a
little
over
three
thousand,
and
a
lot
of
them
are
small
repos.
A
lot
of
them
are
based,
their
URL
is
just
get
hub,
didn't
have
their
own
website
or
anything,
but
a
lot
of
times.
People
will
just
use
it
to
check
their
own
project,
but,
like
you
said
for
your
private
repos,
to
be
able
to
see
how,
while
they're
following
best
practices
and
then
the
majority
of
them
I,
maybe
12
or
19
percent
between
that
range.
A
C
A
That's
a
good
thing
to
ask
questions
of
the
community
about,
but
I
am
not
sure
who
exactly
is
consuming
it,
the
most
it's
kind
of
like
if
you
look
at
a
black
duck
badge
or
CI
badge,
or
something
like
that,
it's
just
a
good
indicator
of
the
health
of
the
project
or
the
risk
of
the
project.
For
that
matter.