►
From YouTube: Risk Working Group - June 8, 2023
Description
https://zoom.us/j/4998687533
Github Repository
https://github.com/chaoss/wg-risk
Meeting Agenda and Notes: https://docs.google.com/document/d/1iqIMpLBwuKSnE0BbQTgbsb9Im87IoN7IUzukochClCw/edit?pli=1#
---
CHAOSS Community is inviting you to a scheduled Zoom meeting.
Topic: CHAOSS Community's Personal Meeting Room
Join Zoom Meeting
https://zoom.us/j/4998687533
Meeting ID: 499 868 7533
One tap mobile
+13126266799,,4998687533# US (Chicago)
+19292056099,,4998687533# US (New York)
Dial by your location
+1 312 626 6799 US (Chicago)
+1 929 205 6099 US (New York)
+1 301 715 8592 US (Washington DC)
+1 346 248 7799 US (Houston)
+1 669 900 6833 US (San Jose)
+1 253 215 8782 US (Tacoma)
888 788 0099 US Toll-free
877 853 5247 US Toll-free
Meeting ID: 499 868 7533
Find your local number: https://zoom.us/u/aekLDhxWwF
A
B
The
osbo
working
group
has
also
been
talking
about
a
it's,
not
necessarily
a
risk
model,
but
looking
at
the
consumption
risk.
So
if
you
are
a
company
in
this
case,
it's
been
led
by
an
individual
from
Verizon
who's,
trying
to
build
a
framework
for
assessing
packages
that
they
want
to
ingest
into
their
company,
and
so
it
is
somewhat
of
a
risk
model,
but
he's
looking
at
it
very
comprehensively.
So
maybe
four
or
five
metrics
for
each
category,
yeah.
B
I
was
in
that
meeting
that
one
so
I
feel
like
there's
a
little
bit
of
overlap
there,
at
least
in
terms
of
which,
which
groups
are
talking
about
kinds
of
risks
I'm
just
this
is
mostly
for
for
Victor's
benefit,
who
probably
hasn't
been
in
all
these
different
meetings
in
this
working
group,
I
feel
like
we.
We
try
to
be
a
little
bit
more
General
about
risk
or
various
different
kinds
of
risk,
but
in
other
working
groups,
risk
always
comes
up
because
it's
kind
of
it's
a
popular
topic
everywhere,
so
I
feel
it's.
A
B
A
B
A
That's
I
mean
I,
think
that's
fine
and,
and
some
of
these
questions
like
like
I,
don't
know
like
okay
governance,
s-bomb
and
best
practices
badge
we
have
I
know
we
have
a
best
practices,
badge
metric
and
I.
Think
we
haven't
I,
don't
know
if
we
have
an
s-bot
I
think
we
have
something
like
an
s-bomb
metric,
but
we
didn't
call
it
s-bomb
at
the
time
and
I
don't
know
if
there's
a
governance,
one
off
the
top
of
my
head.
B
C
B
B
We
rely
heavily
on
the
structure
of
the
governance
model
to
ensure
that
there
is
no
pull
from
one
company.
So
when
we
do
want
to
say
bring
something
to
the
project,
there's
a
process
around
proposing
a
some
sort
of
technical
proposal
or
whatever
that
is
or
whatever
that
changes
and
that
gets
brought
to
the
governing
board
and
decision
making
processes
in
the
project.
B
And
so
ideally,
we
like,
if
that's
always
going
to
happen,
I
think
in
terms
of
like,
if
you
have
a
big
team
working
on
a
thing
like
it
makes
sense
for
you
to
discuss
and
get
on
the
same
page
before
you
bring
into
the
community,
but
I
think
maybe
in
terms
of
the
project
going
in
a
direction
closer
to
a
company.
I
feel
like
that.
That's
a
little
bit
more
like
elephant
factor,
I
would
think
existing
metrics,
which
I
would
say,
is
slightly
different
than
transparency,
but
I
I
do
agree.
B
Victor
is
an
issue.
Sean
and
I
have
talked
about
it
from
a
different
perspective
like
what
was
the
risk
of
Licensing
changes
say
is
one
example
of
that's
really
put
puts
all
their
eggs
in
one
project
and
they
want
more
control
over
how
people
are
operating
and
or
using
it
than
changing.
The
license
is
one
way
they
could
do
that,
but
that's
we've
seen
examples
of
that
be
highly
problematic
for
the
project
and
seeing
the
community
fracture
as
a
result.
B
So
we
were
talking
about
that
as
a
potential
metric
as
well,
but
that
was
specifically
looking
at
sort
of
change
in
licensing,
but
I
think
changing
governance
and
change
in
sort
of
company
influence
in
governance
could
also
be
part
of
that.
Like
same
kind
of
conversation,
Sean,
do
you
think?
That's
that's
something
that
like
when
you
think
about
transparency.
Does
your
mind
go
there
or
you
see
that
as
a
separate
topic.
B
C
So
so,
for
example,
that
open
source
to
to
change
the
closed
Source
model,
I
guess
what
Matrix
can
be
used
to
measure
the
risk
beforehand,
it
could
be
that
projects
doing
very
well.
Actually,
that's
and
it's
being
accepted,
you
know,
growing
adoption
is
is
in
all
that
is
regular,
open
source
community
health
indicators
is
all
flashing,
green
and
everything's
doing
well,
that's
one
District's
become
High,
okay,
so
so
I
guess
coming
back
to
the
risk.
What
is
the
highest
risk?
C
C
So
far,
the
other
chaos
Matrix
are:
oh
nice
all
useful.
Those
are
all
primary
for
the
health
of
the
project.
It
might
just
influence
how
the
you
know.
Also
try
to
you
know,
make
the
developer
contribute:
Better,
Or,
Not,
Right
But,
but
in
the
end,
it's
all
for
for
individual
organization,
whether
it's
a
company
or
government
agencies
to
adopt
a
particular
open
source
project
and
decide
and
use
it
and
use
it
for
long
term.
So
so
yeah,
that's
my
thing.
When
I
see
this
title
risk
and
yeah.
This
actually
is
probably
interesting
because.
B
B
Yeah
I
think
in
the
past,
we've
looked
at
it,
at
least
in
chaos,
from
that
perspective
of
participating
company
and
affiliation.
If
you
can
measure
that
and
just
sort
of
looking
at
the
percentage
of
contributions
by
various
companies
and
if
you
can
see
more
enter
the
work
distribution
like,
is
it
who's
who's
actually
reviewing
and
merging?
And
that
is
that
also
from
a
diverse
population?
Or
is
that
less
not
from
this
perspective?
B
B
So
I,
don't
I,
don't
think
that's
come
up
yet
in
in
any
metrics
model,
like
any
metric
itself,
I
think
again,
elephant
factor
is
probably
the
most
direct
one
but
I
at
least
those
are
the
two
things
that
come
to
mind
in
my
view,
but
I'd
be
curious.
If
you
have
any
other
thoughts
on
what
else
you
would
want
to
what
other
indicators
you
could
possibly
look
at.
A
C
C
A
B
B
I'll
give
you
a
quick
search
because
I
feel
like
it
might
have
come
up
in
another
another
space
like
common
words,
so
that
is
not
necessarily
a
risk
metric
again.
Do
you
have
a
governance
framework?
Do
not
is
that
available
to
people
to
see
as
something
that's
it's
harder
to
scan
for
metric
wise,
like
do
governance
files
have
similar
naming
criteria
on
GitHub
like
I?
Don't
I
can't
say
that
comfortably
so.
A
D
so
Dei
has
they
can
share.
This
is
I
downloaded
this
from
the
old
website,
because
I
found
I
I'm,
actually
finding
it
difficult
to
find
our
metrics
on
the
new
website,
comparatively
speaking,
but
there's
so
there's
a
focus
area
for
diversity,
equity
and
inclusion,
and
one
of
their
Focus
areas
is
governance
and
these
get
it
board.
Council
diversity
and
the
presence
of
a
code
of
conduct,
there's
also
I,
think
possibly
some
related
metrics,
inclusive
leadership,
mentorship
sponsorship,
but
board
Council
diversity
I'm
a
little
bit
curious.
B
A
A
B
A
C
Risk
mitigation
right,
so,
even
with
the
best
governance
model
in
place,
it
is
possible
for
a
startup
that
just
got
a
100
million
dollar
plus
funding
and
just
hired
all
the
best
maintainers
in
that
project.
So,
regardless
of
the
governance
model,
effectively
become
a
monopoly
in
that
technical
area.
How
should
company
to
risk
mitigate
that
scenario?.
C
C
It's
decided
they
want
to
dominate
in
that
area
and
then
just
hired
everyone
from
that
community,
and
so
even
if
it's
your
open
source
project
effectively
become
a
kind
of
a
monopoly
Lies
by
one
company
yeah,
so
I
mean
it's
okay.
Actually,
as
long
as
the
product
continues,
it's
just
at
that
point.
What
if
I
come?
If
a
user
adopt
that
project,
what
kind
of
risk
mitigation
would
be?
You
know
you
need
to
be
considered.
B
Is
it
possible
you
to
become
more
involved
or
you
could
have
more
of
an
octave
role
in
the
community
and
eventual
Direction
steering
of
the
project,
as
another
company
like
I,
think
there's
always
an
element
of
how
much
weight
you
put
in,
but
it's
not
oh
you're,
not
always
able
to
grow
into
it.
So
it's
always
like
it's
somewhat
up
to
the
individual
and
up
to
the
community,
whether
or
not
they're
accepted
as
part
of
that
role,
and
the
other
aspect
is
just
like
I.
A
B
I
think
you
like
I,
think
there's
natural
ways
to
sort
of
break
that,
and
you
want
to
keep
track
of
sort
of
your
distance
from
upstream
and
distance
to
the
latest
version
and
whether
or
not
how
easy
it
is
for
you
to
continue
to
upgrade
toward
the
Upstream
version
but
like
having
having
a
version.
That's
working
well
for
you
now
that
you
can
always
torque
and
take
away
from
if
there
is
that
need.
If
there's
some,
because
there
is
natural
Divergence
in
some
community
and
forks
become
their
own
thing.
B
I've
also
seen
the
opposite
case.
Where
projects
come
together,
because
there
was
too
much
overlap,
it's
not
always
a
clean
process,
but
it
is
possible
and
so
I
think
it's
like
a
company
that
that
is
one
way
that
we
mitigate.
That
risk
is
by
ensuring
that
we
always
have
the
current
copy
available
to
us
locally
without
having
to
depend
on
pulling
from
third
party
package
managers
with
every
build.
C
C
B
Your
version
is
sometimes
gets
a
little
hairy,
because
then
you
need
to
know
what
version
you
forked
from
and
how
much
you
diverge
and
whether
or
not
you
can
apply
Upstream
patches
or
whether
or
not
the
vulnerability
even
impacts
you
maybe
you've
changed
enough
that
it
doesn't
so
I.
Think
then,
for
the
ability
to
automatically
detect
whether
or
not
because
you
can
see
vulnerabilities
reported
in
whatever
the
available
packages
externally.
But
if
your
internal
version
looks
different
enough,
then
then
it
gets.
It
mostly
ends
up
being
a
flag,
and
then
you
have
to
go
remediate.
B
B
I
just
told
it
would
react
to
the
sort
of
relationship
to
the
broader
ecosystem.
I
know
like
makes
you
think
of
like
somewhat
like
criticality
score.
Actually,
that's
not
even
in
here,
but
it's
also
it's
a
little
bit.
What
we've
written
is
a
little
bit
more
like
subjective
qualities,
not
necessarily
like
they're
harder
to
measure
so
I'm
curious.
If
there
are
things
that
come
to
mind
when
you
see
this
without
seeing
those
descriptions
that
will
either
be
in
line
with
them
or
diversion
from
them.
A
Yeah
I
mean
I,
think
dependency
chains
are
a
real
thing,
I
mean
I've,
heard
organizations
starting
to
talk
about
limit.
You
know
somewhat
arbitrary
or
at
least
calibrated
limitations
on
the
number
of
metrics
in
a
product
or
the
number
of
dependencies
for
a
project
that
would
be
considered
acceptable.
A
B
That's
interesting,
though
I
haven't
heard,
someone
take
that
stance.
I
mean
I've,
heard
it
from
the
perspective
of
individual
projects
in
terms
of
whether
or
not
they
choose
to
import
something
or
build
it
themselves
and
I
know
these
projects
that,
basically
you
don't
want
any
dependencies.
They
want
to
be
completely
self-sustained
in
their
own
code
base,
and
so
because
of
that
they
are
building
a
lot
of
things
that
they
don't
necessarily
need
to
build.
But
it's
an
active
choice
so
that
there
is
no
like
them,
then
they
don't
have
any
dependencies.
B
A
A
A
A
B
B
Issues
closed
issues,
updated
comments
for
issue
number
of
project
mentions,
oh
here,
there's
a
defense
account
and
then
dependencies.
So
most
of
it
is
just
like.
Is
it
still
being
like
worked
on
by
how
many
people,
by
how
many
orgs
and
then
how
many
dependencies
it
has
so
I?
Don't
I,
don't
love
it
I!
Think
that's!
Actually
what
I
remember
talking
about?
B
Don't
remember
how
many
organizations,
but
they
were
trying
to
characterize
basically
how
many
people
or
how
many
teams
how
many
Orcs
were
using
it,
and
so
it's
a
somewhat
opaque
calculation
because
they
couldn't
share
all
the
data
and
the
exact
methodology,
but
they
were
trying
to
factor
in
more
things
than
just
this
I
think
I,
guess
looking
at
the
criticality
metric.
It's
because
those
are
things
that
are
relatively
available
to
you,
but
I.
Don't
know,
I
feel
like
for
me.
This
sort
of
broader
ecosystem
points
more
at
understanding.
B
B
B
B
A
B
A
Yeah,
like
so
like
I
know,
for
example,
there's
like
six
or
seven
products
in
the
Zephyr
space
and
Amazon
is
the
leading
one
in
terms
of
usage
and
Zephyr
is
the
second
leading
one
and
there's
three
or
four
others
so
they're
part
I,
suppose
they're
part
of
a
a
competition.
You
know
a
competing
project,
product
Community
framework,
but
people
contribute.
A
B
A
B
B
B
Maybe
I
mean
it's
all:
it's
like
it's
clear
that
there
are
many
ways
to
do
this
and
so
I
think,
because
there
is
no
one
single
project
it
is.
It
is
going
to
be
interesting
to
see
how
how
that
space
evolves
like
I
think
we
saw
that
happen
with
kubernetes
early
on,
but
then
kubernetes
became
the
clear
winner
and
then
this
entire
ecosystem
developed
around
it,
where
the
other
ones
didn't
like
mesosphere,
ended
up
adopting
kubernetes
later
on.
So
it's
it's
one
of
those
things
where.
A
B
A
B
It
All,
possibly
but
like
in
the
case
of
like
understanding
its
relationship,
the
broader
ecosystem.
Looking
at
any
of
these
projects,
you
would
look
at
them
and
say:
hey
in
theory,
they're
all
competing
with
each
other
in
both
mindshare
of
user
and
the
central
contributor
someone's
like
I,
want
to
work
on
a
Surface
mesh,
or
they
typically
will
work
on
the
one.
A
B
They
use,
maybe
I,
don't
know
how
people
pick
what
they
want
to
work
on.
They
think
it's
a
little
accommodation
of
both
but
I
think.
Eventually,
there
is
going
to
be
some
consolidation
because
or
like
I,
don't
know,
because
it's
just
like
or
maybe
they'll
go
in
different
directions,
I'm,
not
really
sure,
but
in
terms
of
how
it
relates
to
the
risk
of
that
individual
project.
B
I
would
say
it
is
riskier
for
any
of
these
because
they
have
22
competitors
or
21
competitors
already
in
the
same
space
that
support
service
smash
architectures
on
top
of
kubernetes
container,
based
like
application
design,
so
yeah
like
I
would
say
that
is
inherently
riskier,
because
there
are
more
things
that
are
competing
with
it
versus.
If
there's
only
one
or
two,
then
it
has
a
greater
chance
that
all
of
them
continue
or
one
of
them
or
ends
up
being
the
one
that
is
as
preferred.
A
C
B
B
There
was
a
couple
of
different
researchers
that
were
attempting
to
to
build
more
data,
sets
around
governance
models
just
to
be
able
to
research
them
in
terms
of
the
impact
of
a
governance
model
and
type
of
model
on
the
trajectory
of
a
community
and
projects,
and
whether
or
not
they
could
identify
various
attributes
traits
design
principles
that
led
to
a
more
favorable
or
negative
trajectory
in
a
project.
So
that
is
thank
you
for
sharing
this
because
I
didn't
know
it
had
been
published
and
I
want
to
read
it
now.
Yeah.
C
C
B
A
A
A
C
Yeah,
if
you
search
yeah,
so
they
have
a
lot
of
a
lot,
a
lot
of
phds,
actually
very
theoretical,
sometimes
into
what
is
governance
model
even
like
the?
What
is
democracy,
for
example,
what
is
the
yeah?
All
kind
of
a
research
relate
some
type
of
that
area,
but
yeah.
That's
why
the
reason
I
joined
I
attend
some
of
the
meeting
is,
is
really
to
govern
this
model
like
what
is
the
right?
Is
there
a
real?
C
B
I
would
say
there
isn't,
but
that's
that's.
My
personal
opinion
I
think
that
there's
a
lot
of
people
that
are
thinking
about
this
victory
Victor,
at
least
in
that
meeting
back
in
March.
There's
a
lot
of
people
coming
back
to
the
sort
of
model
of
the
commons
I'm
trying
to
remember
I
need
to
remember
the
exact
name
of
it,
but
there
was
a
researcher
and
there
that
was
proposing
this
like
model
of
the
commons
and
then
people
that
were
applying
those
principles
to
governance
models.
A
A
A
I
mean
the
current.
The
corn
nugget
of
ostrom's
book
is
the
imagine
a
common
grazing
area
that
is
overgrazed
and
that's
her
tragedy
of
the
commons,
where
everybody
shares
the
same
resources.
But
if
there's
an
incentive
to
have
more
goats
because
you
get
more
goat
milk
and
then
a
person's
over
grazed.
B
B
B
Well
are
not
working
well
because
the
sheer
scale
of
the
project
and
it
essentially
confirming
that
I
guess
is
sort
of
my.
It
depends
answer
for
governance
models.
I
think
there
are
key
things
that
all
governance
models
need
to
have,
but
there
does
seem
to
be
some
element
of
reflecting
the
needs
of
the
community
in
your
governance
model
and
acknowledging
that
the
size
structure,
makeup
and
organizing
principles
within
your
community
should
guide
what
your
governance
model
looks
like
like
I,
think
something
we've
been
talking
about
Victor
in
our
chaos.
B
Weekly
calls
is
actually
updating
the
chaos
governance
model.
So
that
might
also
be
interesting
for
you
to
see,
and
just
in
terms
of
how
at
least
Don's
been
working
on,
trying
to
update
it
and
ensure
that
everyone
in
the
community,
as
well
as
the
governing
board,
is
on
board
with
everything
that's
in
there
and
it's
not
just
about
how
rules
are
made
but
also
say,
outlining
how
individuals
are
promoted
up
into
maintain
our
leadership
or
governing
board
positions
in
the
community
and
how
we
think
about
growth,
development
and
expectation
of
those
positions.
It.
A
A
C
B
One
of
the
presentations
that
I
loved
a
couple
years
ago
I
did
a
presentation
with
one
of
the
leads
on
Dora
sort
of
offering
a
view
of
how
to
evolve
Dora
for
open
source,
recognizing
that
that
sort
of
basic
Assumption
of
a
team
and
shared
incentives
as
team
members
working
for
the
same
company.
Those
assumptions
go
away
in
the
community
and
sort
of
thinking
about
how
that
would
impact
the
types
of
things
that
you
want
to
measure
to
achieve.