CHAOSS Risk Working Group, 22 May 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: CHAOSS.Risk.May.22.2020

Description

CHAOSS.Risk.May.22.2020

A

Okay, so this is the risk working group meeting for may 22nd, um and this is uh the agenda that we have, which I'm sharing and right now we we want to discuss just spdx changes right now. We have a there's a scanner um in augur that follows the three is, which spec does it follow? Matt snell.

B

um The it was the latest spdx once we built it. So let me look at that up.

C

2.1, probably.

A

C

Likely 2.1 because we just released 2.2 at the start of the month, yeah.

A

I'll lose the sp expect 2.1.

A

And then there's going to be major changes to it and that's going to be actually a jump to three point. Something right.

C

Actually, it's right now, it's 2.2 and it's going to go up to 3.0 and the 3.0 is where the security, as well as the pedigree providence, are going into.

D

A

And then, if we look at the open open chain, I'm just getting my head around a little bit and is that where should we be thinking about risk metrics um when it comes to open chain, you know what what kinds of things are? Are they like? I listened to one call, but I didn't make a connection yet so.

C

What, where they're looking at it is, you know, is it trust or, like you know, is the partner in your supply chain trusted enough, and that does does the person in this blind chain know how to handle open source?

C

And it's not and it's asking for an s bomb, but that's about it. It's a binary, and so I think, there's a questionnaire, a self-assessment and I think the I think just basically the same way with ci we trigger off of the questionnaire there. I think just triggering off that has, you know, has the um has the participant self-certified, but it's at a company level, not at a project level.

A

C

Right, so that's where it's sort of a different.

A

C

You know it's company to company, and so you know, what's your risk of working with the company who may be developed.

A

Yes, okay, so would it be like similar to what we've done with cii, where we have a cii, badging metric that we show if a project is badged.

C

Yeah, the challenge here is that we're seeing we're doing at a project level, okay and that and that lines up fairly well with risk for projects. This is this metric is for companies.

A

C

Okay- and you know, are they in the same way as you know, are these, like you know, does a company have an open source project program office?

C

You know, does it have a supplier infrastructure that knows how to work with open source? These.

E

C

Elements at a company risk level, and you know if you're working with a company, can you trust that it's respected. Certain things, like you know, knows how to deal with open source knows not to strip out the headers things like that.

A

Yeah, if I crosswalk open source projects with companies, there are obviously some companies like red hat software, have a lot of projects that they oversee yeah, but in in many cases they are not the principal contributor.

A

You know people. So how does a yes do you? Does anyone have a thought, I'm trying in my head, I'm like wrestling with? How do we crosswalk company? Is there a way or is it useful from a metric perspective to crosswalk uh company, certifications with open chain and particular projects.

C

I'm not quite sure it does at this point yeah. I think it's it's more like the elephant factors and the participant stuff. It's elements in that area.

C

You know, we've got metrics in other areas which are talking about you know, is it dominated by one big company or not, and things like that, and you know, maybe a nuance in that area might be. Is the company? Does a company have a history of knowing what to do about open source? I.E an open chain might be a way of assessing that.

C

So eventually it could come in, but I think it's a second order after we get to go matt.

F

Yep, so on that question, um one of the things we do in the chaos project is, we simply try to articulate work. That is already being done like capture that so, um for example, you had mentioned like determining whether or not an upstream vendor has maybe an ospo. I don't know if that's actually what's looked at, but something along those lines, and I mean we do develop metrics that already exist, but haven't been articulated yep.

F

That can be an option as well, so, basically just trying to document the work, that's already being done in open chain, mm-hmm.

C

Looking at is, you know, a very limited set of criteria of. Has there been training done on open source, you know um is for the products? Are they able to produce a software build of materials.

F

C

Yeah- and so you know, is the right level of discipline in place that they can generate that and for large companies. It takes a lot amount of effort to finally get to the stage where they can generate that and we're going to be seeing more um push coming in that we're going to want to be seeing these software build materials you're going to be seeing.

C

So the one of the things is like in the healthcare sector. There's a strong push towards making sure that medical device manufacturers can generate a software, build materials and hospitals can take and query it.

F

C

Okay um and there's proof of concepts going on exchanging s-bombs right now in that area, so uh we're gonna see, I think an automotive needs it as well and and it's coming in from the security side, but it's valid in a bunch of other spaces too.

F

So we do in the chaos project we we do have the metric around the spdx document is an important thing to look for which I know it's kind of related. I think it is um every yeah. Okay, it's an s-bomb, yes, um and then I mean, maybe you had mentioned training as well. Is there a formal way that within open chain that training is understood, yeah.

C

Open chain makes available a set of reference training materials for companies to use inside their own internal training programs. They harmonized open source training from about four or five companies. Okay,.

A

C

A unified deck that sees you know cc available and you know, and people can take and modify and use internally to have explain certain concepts.

A

C

And so there's an uh one of the criteria is that a certain portion of a company you know of the developers that are working with the software have taken this training.

F

Okay in open chain, is there uh a determination of whether or not that has happened, or is it kind of done in good faith.

C

It there's actually a criteria that people self-assess, however, there's the ability to do third party assessment, too. Okay,.

F

But that could be a much I'm looking under the categories. The different focus areas and transparency could be one sure this could be part of the transparency focus area.

E

F

There's a representation of adhering to the open chain, training, materials or adherence whatever the best word is.

C

Yeah, like you say, I don't know if they measure that they just ask for, has their training to happen and they provide a path for doing it.

F

C

Don't have it on their own. I.

A

Mean so would it be useful matt? Do you think to provide some? I guess I would call it an orthogonal metric, that's not looking at repos at all, but is just providing a directory of companies that.

F

Are certified? um No, it was so like, for example, with in in risk one of the things that one of the metrics that we have is osi approved licenses right right. So a measure of osi approved licenses right- um and I mean osi- obviously, is a organization that that sets kind of these um standards or sets this approval process is kind of a gold standard as to what licenses are right um and we have a metric that measures that like do.

F

You refer to the osi light, or do you, um how are the osi licenses represented and with training I mean. One of the things we could do is basically saying. Listen. Open chain is the the place to go when it comes to internally training, your developers and your managers around open source. I see so we could direct people towards open chain when it comes to yeah. The metric would be have you a determination of engagement with the open chain, training, material.

A

And would we rep so that's, I guess, does that get to a metric and is the metric tied to a company, or is it tied to an affiliation for an individual developer or a percentage of developers from companies that have had the training yep? I'm just trying to I'm trying, I'm just you know, trying to figure out okay. What is the metric we operationalize here.

F

Yeah, the metric could be the number of upstream vendors who have essentially adhered to the training or and here's a bad word, but have taken part in the open chain training.

F

um So that could be the metric. But I care about my upstream and I care how many so, if you scroll down the transparency right now, we have the s bond down there, sbx to spdx document yep.

D

A

B

I've got a question about this, just clarification, so we have this kind of metric. That kind of measures are you participating kind of? uh Are you doing this right? um So are we looking to validate that in any way, or are we just saying this is a good way to something to look at.

F

I think it's just the the latter, it's kind of like the cii yeah, not quite um I think, as badged as cii, but yeah.

C

Like open chain doesn't really map into ci maps to project, so we're good that way, this is a different dimension. I think, which is you know something. We've we're looking at a company level as opposed to a project level.

F

Yeah, so would it be okay to say the metric is something like the number of upstream. You know the number of upstream companies that have adhered to the training, it's not at the project level, but it's.

C

Well, the number of so I would say, be the number of um participant companies in the project that have adhered to the.

B

C

Training would be a way of weaving it in.

F

C

And so what you do, what you're sort of doing is using this as a proxy for are these you know: are the people participating in this project fairly, knowledgeable, who are working open source in general? Yes, so.

A

Because I embrace it in the share, I phrase it as percentage of contributors from open chain certified companies, but it sounds like it's a slightly different name.

A

So give me something to tell me what you just said that we should call it. She said the.

F

Percentage of participants, I think it's the worst big companies participating companies.

C

Who you know have a certain element? Have a certain amount of sophistication around us working with open source.

A

Would I call that open chain certified or you.

C

Could say open change like say we're using open chain certified as a proxy for that for.

F

Yes. Yes, yes, knowledge, because if because if the answer is zero, that might be a something that you care about from a risk perspective that none of them.

C

Well, yeah the example is you've got you know, you've got a bunch of um okay. uh You've got some domain I'll, give specifics if you're not recording, but right now you have some.

F

People that are.

C

We can pause, we can. We can pause, recording, okay, specific and I yeah that's.

A

Fair illustrate.

C

C

Yeah, so you know, depending on you know, new market segments that are moving into using open source, there's different levels of expertise.

F

Yep, no, that's that's fair.

C

A

What is spdx approved licenses, in contrast to osi approved licenses.

C

Well, they're, not real, um so spdx approved licenses just means they've been added. The spdx list. Okay and.

A

C

uh We have things like we have licenses on that list that are part of the free soft. uh The fsf approved list that are not osi, approved. Okay, there's also licenses that are commonly found that are not osi approved.

C

You know, for instance, the cc the creative commons licenses are not osi approved, you see, so it's sort of what can you find in the so we're sort of like uh this is what we usually. This is what gets found in the wild and a summary of that.

A

So we show we're showing like osi approved licenses and I suppose.

A

Matt snell is it by implication when we list the licenses on the risk page that it's a spdx approved license. In other words, are we already kind of doing.

B

That, well all the due socks licenses and all the licenses we show are our kind of the ideas are pulled from the spdx list. So I figure that's how we um we don't have any ones that aren't on that list. I should say.

C

So the osi licenses are a subset of spdx list. All osi are on the spdx list, but spdx list has more than just osi right.

A

This seems like one that we could knock out, maybe not today, but fairly quickly.

A

Okay, why man, google, is good, I don't think it's you kate. I think it's google.

C

I'm looking at things in the dark, I'm not seeing your screen share at all, I'm not quite sure. What's going on or really yeah, so I don't know.

F

The upper left corner do you have switch to screen sharing? I uh I do, but I believe, because I see his screen.

C

Okay, so maybe.

C

C

I was looking at all the people's faces. That's the thing as opposed to that, and so I seem to have the ability to go back and forth between the tags or not. I may rejoin um it's a bit, weird, okay, I'm thinking the other thing. I was wondering if we could squeeze into the agenda for today by the way yeah.

E

C

Did spend some time um going through and doing a classification exercise on the tags.

A

C

I want to get a feedback if you think I'm heading in the right direction, or I should do it and I figured what I do is so I wanted so I'm sort of looking at the top 200.

C

and I wanted to surf uh see if what I was doing made some sense.

A

I I would love to why don't we when we jump to that right now and then we can come back to my question about the illicit project and how do I get to see what's happening inside of it because it's like it seems like I have to get 5 000 and join the.

C

It's linux foundation. All the lists are open, everything's, open, okay. Obviously, so we obviously need to work on our website. That's what you just told me: that's fine, we'll deal with that later, I'm happy to. If you want to stop sharing I'll, go into share mode.

A

I stopped sharing.

C

Okay, ah now I can see weird okay, uh you've, disabled host attendee screen sharing. Oh.

A

I think uh matt has to make you or I can make you co-host, maybe okay, I cannot make cake co-host, but matt can you.

F

C

Thanks matt, so what I was doing here is working to serve the top 200, having a look and seeing if I could figure out patterns, which is something I kind of like doing and the other one that's in here I shouldn't forgot to put his negation.

A

So these are, these are two: these are the 200 most used labels across 13, 000 repositories, right.

C

And I was sort of seeing the patterns I was seeing are? Is this a problem? That's a process check. Are you reporting on something requirement being met, but it's not really in the workflow?

C

Is it a solicitation where someone is looking for an action to be taken in the workflow? Is it a classification for grouping in black binning effectively things so that work workflow could be prioritized?

C

Is it an affirmation which is basically signaling a task is done and can proceed to the next action or is it negation um like a knack? You know, you know we'll not won't fix things like that. Those.

A

Those seem like I mean when I think of the comments and the tags that I see those sound relevant.

C

A

C

So you know I did a first pass of just starting to assign that type of you know the type to it to see. If I could get some sort of insight um and there's certain ones that I just don't quite understand uh like you know what css here and you know life cycle rotten that one I thought was pretty interesting from many perspectives um and then I didn't understand the sig slash and whether that it's likely a classification.

C

But there was a lot of sig slashes and I really didn't understand because special interest group, you know it sort of, is I'm not sure if it's a direction to someone to look at it or not all right. It's a subset of classification, probably, but I couldn't really figure that one out.

A

What I can do is find out what repositories are using those particular ones, and it may it may be.

A

You know, there's there's been no there's been no attempt in what I sent you to sort of uh identify a number of repositories using each of these right, so it could be that a very active repository is using lifecycle, rotten like that, could be the linux kernel or or some something else. That's very large.

E

No, it's not the loose yeah play that one cncf, maybe but not linux, kernel.

A

And and v4 is quite popular.

C

Yeah, that was, that was sort of like not quite sure. What's going on there yeah me.

A

Neither but those are those are ones that I'm making notes. So I can look those up for you and find out where they're used.

C

Yeah but, like you know, help wanted okay to test. That's basically saying there's an action to be taken and we want someone to take an action and then the classifications are effectively okay. How do we prioritize what we're working on and then you know, an affirmation in some sense could be a solicitation. Well, it's it's. It's usually signaling the state. I think it's test and it's simply no further actions done for the negation like won't fix and so forth. um I mean serve the end of the workflow. In my mind,.

B

Could it be a special interest group.

C

Yeah sig usually means special interest group. I just understand how related to this label yeah, you know, um there's also like you know, teams team, slash, plug-ins team, slash. You know che qe, that type of one.

A

These are, these are the pull request, labels right, kate,.

C

Well, these are yes.

A

C

Labels across repos.

A

C

Yep, that was what you put into the label count across reposes, where I was looking at it. Okay. The first thing I gave you.

A

I definitely gave you pull requests first, so I think we're okay.

C

Okay, um you know this thing's like update bot, which I sort of said: that's a process check and cla is being signed and then sometimes this is a process check kind of how I it sort of looked to me. um But, like you know pr action merged. Well, yeah. Someone wanted something to do and kind question that one you know is I'm not quite sure where it goes now. I think about it, but like kind flake, you know um there could be classifications, it's hard to say rgw.

C

I had no clue, um you know and then the teams and kinds like say likely their classifications but wasn't feeling ack. You know affirmations so forth, so I figured taking a looking at the top 200. I haven't finished them all, obviously, but that gives us a reasonable because there's a long tail here.

C

So the question is: where does one sort of drop it? You know, stop it off, but I want to see you know. Can we get some degree of coverage for some basic typing um as a way of starting to build up a metric on the labels? The label usage in the project.

A

And I think I think we can like um one one way to one way to proceed is is to suggest in the metric that that tag I mean, I think I think uh I think I think the list you're working with is the issues t issue tag list. Okay,.

E

A

C

A

But that's that's actually, there's a lot more tagging in issues actually than there is in pull requests in terms of like the like the number of different tags added to an issue they tend to be I mean the numbers are significantly higher. If you look at the there should be another spreadsheet, that's called polar crosstags and that folder I shared um and.

C

Those, I would say could mostly be, would probably have more of the solicitation of classification as opposed to issues, and I find it interesting that the top ones are looks good to me and yes, which are effectively affirmations right right. You know, um uh you know, are approved and the two to me and then the other one is a cla check that came here. Okay, this is you know, because that's not going to be showing up in a workflow generally, but it's something that's necessary on the process side.

A

I wonder if it's a bot that puts those tags in.

C

It likely is there likely is a bot, that's basically looking for it and doing the cross. Referencing.

C

You know um you know, I guess that, so I guess that's an open question is how many of these were generated by bots.

A

I think there's a way that we can determine that because the person, the the bot has an identity when they add the tag, um and I think I think, there's there's some kind of practice around labeling bots.

A

So and then do you want to call it negation or do you want to call it something else.

C

I couldn't think of another feel free to suggest better terms for the all of these. This was just something I wanted that was reasonably neutral.

A

I don't I don't have it, I don't have a suggestion, other than negation, I'm sure. As we go through the process, um we can possibly think of something. It sounds negative. I guess because the word the neg is in it, but I don't know if that's a bad thing.

C

Well, it's basically signaling no further tasks, kind of how I, how I viewed it.

A

Yeah have we have we created in the this? Looking I'm looking at our list of metrics that are under review. If we have started a document for tag classification, I don't see that we have taxonomy of and types of tags bags of words. Yes, we have.

C

No, that's why I was sort of I made a stab at it and you know we might want to subdivide it. But I was just trying to paint the picture of what I was seeing and I was trying to figure out a flow for it. How they might relate to workflows.

A

Yeah, I I think.

A

So I'm gonna look into the ones that have a lot of counts, but we don't really know what they mean right um and also. I can also look for look for bots.

C

Okay, like you say, I'll, save I'll, save I'll like say I'll, send this to you. This is this spreadsheet to you I'll, just mail it to you. Okay, then you can have it.

A

But I think I don't know what it what others think. I think the I think the categories.

A

Work, um at least as a starting point.

A

And then I don't know if we want to, we could what we could do with those categories is we can get fancy and and try to train a.

A

Machine learning algorithm of some kind.

C

Well, I'd say put another for anything else: we can't put into the categories and see how much portion of the others there and then start studying them. But you know yeah.

E

C

Have a different angle to look at these other than the workflow angle.

A

I think work I mean, I think it's about workflow um it could. Some tags are about uh newcomer um interests like this there's some repositories that have things like good issue for for newcomers or good first issue. Obviously, that's not showing up as a highly used tag, but.

C

So you know it is showing like good first issue and that sort of thing I did see that I wasn't sure to put that classification or a solicitation.

A

Yeah and I'm just wondering if so, there's the what are the tags that are used a lot, but then maybe there's our subjective, um because what I think we're gonna see is like some of these tags are just gonna end up in a cluster of the the highest tags like they'll. Be will end up classif, you know ultimately classifying them. Some ways in in the like, looks good to me as an affirmation, there's probably a bunch of different ways that that's essentially said right, yeah in a tag, and so we can.

A

We can map similar tags at some point so that they fall into the same micro category. Maybe we would call that and we can be. You know we can begin with just this list of the top 200 and how they're classified um I'm really curious about things like life cycle, rotten and like v4 and css. Are I'm really curious? What that all means? um And if there's just like one giant repository that uses it all the time or if it's actually spread across.

C

Yeah in these areas, so I've still got a.

A

C

Yeah, I still have a few more to um make a full pass at, but I wanted to sort of do a cross check that I was sort of aiming in a reasonable direction with you guys before I, and we can take it down more if you think it's useful, but I figure.

A

Making a comment uh just in the I put your I put your category, including I added other, under implementation in the doc that has started, and I also made a comment: how many different repos are using each of the tags in the top 200? In other words, are they are they are? This? Is the top 200 skewed heavily towards extremely active repos, and is there another cut that we want to make it popular words.

C

A

C

But anyhow, this is, this was fun. Thank you.

A

Yeah no and um I made.

A

Yeah no- and uh this is- I think this is super helpful like I, I think it's it's. I think it'll be useful for people to see what kinds of tags are being used and that reduced that that somebody's done this work, uh and I think we can you know, there's there's ways that we could have.

A

I miss someone's thinking out loud there's, also, maybe an interest in co-occurring.

C

Tanks, like I said you see, co-occurring, are you thinking like patterns like okay, uh cla, there cla, not things like that related or.

A

Well, like like many-ish many issues and pull requests have more than one tag.

C

Oh so multiple classifications or solicitation classification.

A

Yeah so like tag co-occurrence could be an indication of some kind of pattern.

A

Maybe it's a question. I have to also just put into the document as a question sure.

C

So yeah it's also interesting literally how quickly it tails down to about two thousand. So by the time you get to about 100 like I say that that long tail sort of starts, ten thousand twenty thousand.

A

C

You know in the top twenty you probably got the bulk of them yeah, but where our reasonable cut points would be another question too yeah. If you could equally well just say, take the top 50 and say: hmm okay, you know, but I I am curious as to of those top 200 how many which projects are doing it. Are we having a dominant.

A

Thing: yeah, yeah, that's that's my first. You know it's like. I think. As I look at these, I should have thought of that. Actually, when we gen when I generated the list, I could have run that query to show how many different repos are using them, um but I'm curious about that I'll. Throw that into the same share. Do you.

C

Want me to just up: do you want me to just upload this actually to a google doc.

A

C

I'll just put in inside the same doc, then okay, that.

A

Would be great and then I could actually add tabs for like how many different repositories use have used each of these tags as well sure.

C

Sure I'll do I'll do that after this call.

A

C

Awesome, I might just do it right now, while we're doing it, so it doesn't forget and I'll stop sharing I'll just upload. I'm sorry, because if.

A

C

They don't happen sometimes.

A

I am the same way, so I'm just gonna go we're trying to close these meetings. 10 minutes to the hour, so we've got about seven minutes of time. Left.

C

A

Or lisa we're just gonna you're gonna figure out or look into. Maybe I followed the wrong um path. When I tried.

E

A

Things out, um but I looked at membership and I looked at join alyssa and maybe that wasn't.

C

Yeah, that's sort of more for the membership and you know: do people want to formally join and there's usually an info that we can then that sometimes people click on and we can redirect them when you launch is looking at mail lists. Yeah, let's see community is where you go.

A

Okay, this is good yeah. I don't. Obviously I didn't find the right place to log in.

C

You don't really need to log in and then just set up an email account potentially subtract things, but you can look at the the repos and histories yeah. If you go to community, you go to develop release the tech and all our minutes are visible online and we've just finished um having a workshop on monday through wednesday, and the um sessions from that are all gonna have been were all recorded. Everyone agreed to let them be recorded, so we've got them recorded, and so you can you'll be able to get a pretty good overview.

C

If you go to that website and you look under the news, you'll see a blog that lists all the sessions we had.

C

Let people sign up.

A

Is it am I on the right page.

C

I'm not seeing screen share again, I'm afraid.

A

Oh, I wonder I wonder if it's uh so when I change tabs, I wonder if it's not showing the tab, change.

F

C

I think it's just nice. I think I think quite frankly, it's just uh now, I'm seeing it again. Okay, I think it's my thing so yeah lisa. So if you scroll down on this one, you scroll down this page, uh which one oh you're in maine. No, you don't want the main one. You want the davell one. The community takes you right to.

A

If I go oops a list and if I I ended up clicking lists from somewhere.

C

Wow go to elisa.tech.

A

C

And if you scroll to the bottom.

C

There's the news sitting there yeah move over to may 13th one.

A

C

Which one yeah, so we just had a session about the newcomers intro, what we're going after? What we're doing for strategy this was was going to be. We would have had a workshop in person. We've had workshops in person. This was our first virtual one right.

E

C

Other side is, we could tape it all that was the upside yeah um and so in the next time, yep the next couple days. The links will be available, so people can figure out what's going on, but I'd say watch the newcomers. If you want to understand what we're doing with elisa once the lens is posted and I just go to release um yeah. I don't think we'll update that blog, we'll just put a new blog out with the links and everything and, in fact.

C

Which is our notes? um We did all our notes publicly as well, and they they'll be having the links to everything. Okay, lisa.

C

I need to hit reboot on my machine. It's painful.

A

Oh, we've only got three and a half minutes left so.

C

Yeah um see if I can get if I can call it up fast enough or not it's just being a bit slow.

C

There it is, I did it, how wonderful, okay, there yeah if people want to see how that workshop went.

C

So we took notes, as we went along then went to the chat yep.

A

Okay, when I'm sharing, I get weird I could get. I have to do a weird navigation to get back to the chat.

C

So, if you're curious about what we're doing with the safety, this is where we're starting to you know, get thoughts, organized and things like that.

A

I'll add that link to the chaos risk, okay,.

A

A

It's okay to share that in these notes. Yeah.

C

uh Yeah, it's open to everyone like I say we try to keep this project as transparent as we can um there's nothing new, there's not too much. That's other than the board minutes. They're confidential.

A

Yeah uh matt snell. Do you want to say anything about the change? uh The updates that you made to the auger spx.

B

um Sure project um so for the past, while when we needed to add repository scans um through to nomos, we were um basically someone would say something about it to me and then I would spend like a day getting the scans done because it was very manual.

B

So what we did was we took a lot of time to um well. I took I took about most of yesterday to automate the process, and um now it doesn't work so monolithically it can it's like kind of search for repositories and all the stuff that should have been automated before it is now automated. So we should be getting it put it as a worker and august soon, um so that people can do it themselves without doing all the work.

B

I did because I realized john asked me to type up a guide to how to run it, and I put up like a 20-point bullet point guide and I realized I realized at that point that yeah. I should probably get this running in a way that I don't have to spend the whole day every time.

C

That's that's great matt awesome.

A

Yeah, no I'm very, very, very happy. I haven't tested it yet, but I'm really excited about it. um Well then, don't be excited yet yeah I mean so. Is it? Is it it's it's in the? Is it in the worker directory of an auger branch or is it in the auger spdx project.

B

um It is under, um I think it's called auger jenkins, spdx, matte or auger jenkins, matt spdx. I just tested it with the jenkins stuff that you that you copied for me. Okay, so that's.

A

The that's the branch that I would we would work on merging.

B

Yeah, okay and also the updates to the config, because I added a couple things that you can customize yeah and I um I messaged carter this morning actually well david reached out to me and said I can help you make that a worker. So I'm talking to him probably next week too.

A

B

That's awesome.

A

I'm trying to find the risk notes again: okay,.

C

Second, I'm going to see if I can do the upload right now too, and then put the link in the chat.

A

Oh all, right, we are at time yep I'll point out.

A

It's the tag classification length that you were gonna put in.

C

Yeah, I'm gonna, I'm just doing the upload right now.

C

Yeah, it's issue tags. It's the folder they're in.

A

Did you send a chat message or.

C

I'm trying I'm trying.

A

To it's still uploading.

C

I'm trying to get it to upload yeah there we go showing you the right.

A

A

I've never done annotation in zoom before.

C

That was the source of um that was the source of the zoom bombing. I saw recently, oh really annotations, yeah someone didn't lock it down and had an open call. Oh.

A

Someone started.

C

Drawing um obscene well there's like my body parts and actions on it. Let's put it that way,.

A

Things that should not be drawn yeah.

C

Yeah and the fun thing was, it was a search posted call too.

C

Yeah, it was pretty ouch, so it was definitely a oh you're. An interesting target, I'm gonna go, have fun with you type of thing. I think. What's happening.

C

Let me see if it's come in yet anyhow, if not I'll, try to put it in, send you an email or put it in the notes from today.

A

All right I'll send you an email. With that note, you got it.

C

Maybe yes, just a sec: let's just make it open with the right thing.

C

That conversion, please.

C

Yep we've got it: okay, good I'll, fix the perms in a minute, but you've got the link now.

A

A

Since I'm screen sharing all the chat stuff is.

C

Not showing up yeah I've got to fix the axis and it's still trying to load everything into it. So I'll fix the axis in a minute. Okay,.

A

Yep no problem yeah, I'm going to copy the link and put it in the notes. If you.

C

Can find the right.

A

Link for the notes.

C

I'll just make it such that anyone.

A

Can edit it perfect.

C

I'll just make it so anyone can get it okay, I don't think we need to lock it down.

A

Yeah; okay, thanks for thanks for doing that, kate! um Thank you I'll! Let everyone go as one of my children is crying about something if you probably hear that take.

C

Care sorry bye, guys.

A

All right talk.

B

A

B

By the way, um matt.

F

Do you think you can hang around for just a moment? um Yeah you got to be really quick. I have a 10 o'clock that I have to prepare for. What's up, okay,.

A

I just wanted to ask me for this at all. I'm.