►
From YouTube: CHAOSS OSPO Working Group March 23 2023
Description
Minutes from this meeting can be found here: https://docs.google.com/document/u/2/d/1Bf6a1Ywi4m0Ywo4vuBBp3Q9_AA_QKbWf99WxAqRbpMw/edit
A
The
strategy
of
goal,
question
metric
and
I
feel
like
some.
It's
it's
often
hard
to
get
get
all
three
of
them.
Sometimes
it's
only
two
and
I
think
that
kind
of
makes
it
then
difficult
to
figure
out
well,
if
only
have,
if
I
can
only
have
two
of
those
items,
what
am
I
just
am
I
am
I,
justifying
my
Hospital
am
I
justifying
open
source
in
general.
I,
don't
know.
B
B
B
I
always
talk
about.
How
do
you
tie
that
back
to
strategy?
Have
you
tied
that
back
to
objectives?
How
do
you
tie
that
back
to
being
successful
for
your
company,
because
I
know
that
once
we
get
permission
to
do
the
stuff,
Within
These,
open
source
projects,
there
will
be
downtime
right
for
these
Upstream
developers
and
then
they
can
work
on
things
like
you
know,
contributing
back
to
the
community
and,
like
you
know,
documentation
or
you
know,
answering
questions,
and
things
like
that.
B
They
can
do
something
else
that
helps
the
community
and
so
I
kind
of
look
at
those
as
to
sort
of
separate
activities,
because
if
you
try
to
justify
the
work
kind
of
the
wet
and
kubernetes
Community,
we
call
the
you
know:
chalkwood
carry
water
activities,
it
sounds
like
charity
to
Executives
and
they
tend
not
to
like
that.
When
it
comes
to,
you
know,
assigning
employees
to
do
things
so
I'm
really
really
careful
not
to
pitch
it
that
way,
but
knowing
that
I'll
still
be
able
to
do
some
of
that.
B
A
Absolutely
I
know
this
was
a
hard
question
to
answer
it.
Thank
you.
Hey
I,
appreciate,
hearing
everyone's
perspective
and
I
feel
like
I
feel
like
this
is
always
on
the
back
of
my
mind
or
on
leadership's
mind
right,
and
so,
as
people
start
to
come
across,
it
feel
free
to
bring
it
back
up
and
let
us
know
if
you
have
any
new
stories
or
anything
else
to
share
because
I
think
yeah.
It's
it's
an
ongoing
topic
for
sure.
E
C
D
D
D
F
D
Just
asking
participants
kind
of
questions
around
this,
like
what
are
things
that
chaos
should
be
working
on.
What
are
challenges
that
you're
facing
with
respect
to
to
metrics,
so
Chan
I
think
the
questions
that
you're
asking
are
really
quite
relevant
to
what
we
were
talking
about
in
chaoscon
and
so
I
was
trying
to.
D
You
can
actually
click
on
that
chaoscon
EU
link
right
there
Don,
and
this
will
take
you
just
to
an
overall
blog
post
that
we're
putting
together
for
a
summary
and
you'll
see
if
you
scroll
down
just
a
little
bit,
none
you'll
just
see
the
two
questions
that
we
asked
so
right
there
at
the
bottom
of
page.
One
I
should
put
page
numbers
on
here.
What
challenges
exist
for
using
metrics
within
your
ospo
community?
D
And
then,
if
you
keep
scrolling
down,
you
can
just
see
what
should
the
chaos
project
be
working
on
in
the
future.
So
what
this
is
is
there's
two
kind
of
two
things
that
were
pulled
out.
Those
are
those
paragraphs
right
there
and
then
the
full
set
of
comments
from
folks
are
down
below
so
channel.
To
your
point,
if
you
go
back
to
the
minutes,
done.
D
These
were
the
these
two
paragraphs
here
were
kind
of
some
of
the
high
level
things
that
were
drawn
out
of
that,
and
so
the
first
one
I,
don't
think
is-
is
really
the
one
that
maybe
is
applicable
here.
It's
really
kind
of
the
second
one,
which
is
how
to
communicate
better
like
how
to
help
tell
the
story
better,
which
I
think
a
lot
of
people
seem
to
be
struggling
with
and
I
think
that
story
can
be
one
even
with
developers.
D
First,
you
know,
let's
start
there
and
talk
about
how
our
engagement
with
open
source
help
strategy,
and
at
least
this
is
what
I
was
hearing
from
you
Don
and
then,
and
then
from
there
the
open
source
work
like
the
community
work
can
can
can
go.
However,
it
needs
to
go
if
the
tie
back
to
strategy
can
be
established
first,
if
that's
what
you
were
saying,
that's
kind
of
what
I
heard
Don
that
like,
however,
the
however,
you
need
to
engage
with
open
source
at
that
point.
B
D
D
D
Having
is
that
within
large
organizations,
the
way
that
metrics
and
metrics
models
are
understood
throughout
an
organization
or
a
big
Community
varies
widely,
and
so
in
one
portion
of
an
organization.
The
way
that
you
would
talk
about
say
value
like
this
case
is
quite
different
than
the
way
somebody
else
would
and
that
variability
is
hard
to
overcome.
Sometimes
so
we
don't
have
a
consistent
way
of
talking
about
metrics
metrics
models
Health.
G
I
feel
like
the
I
always
have
there's
so
many
caveats
to
everything,
but
I
feel
like
one
thing
that
I've
really
struggled
with
with
various
teams
or
perspective
or
stakeholders.
Is
that
there's
sometimes
there's
a
pressure
to
simplify
and
I,
always
really
struggle
with
that,
because
I
like
to
be
hyper
specific
when
I
show
data,
especially
when
it
can
mean
different
things,
if
you
don't
describe
it
appropriately
and
so
I
guess,
this
is
sort
of
a
just
a
general
Challenge,
and
especially
this
need
to
sort
of
tailor
it
to
your
audience.
G
But
I
have
been
found
myself
in
a
position
sometimes
just
like
give
me
one
number
and
I'm
like
well
there's
six
of
them
and
they
need
slightly
different
things.
So
I,
like
have
I,
don't
know
it's
just
like
it's
been
challenging,
sometimes
depending
on
who
you're
working
with
and
I
have
I
don't
know,
I
just
feel
like.
In
some
cases
it
does
lead
to
sort
of
uncomfortable
conversations
around
how
to
simplify
things
that
are
inherently
complex.
G
G
I,
don't
know
if
any
of
you
have
been
involved
in
writing
briefs
for
the
government,
but
I've
been
explicitly
told
they
don't
understand
any
of
these
words
that
you're
saying
so.
How
do
you?
How
do
you
contextualize
this
and
I
was
like?
Well
that's
going
to
make
it
less
accurate
because
I'm
not
going
to
be
as
explicit,
and
that
was
an
incredibly
difficult
thing
for
me
to
be
comfortable
with.
But
again
this
is
like
who
are
you
speaking
with
and
do
they
know
the
words
that
you're
saying
do
they
know
what
they
mean?
G
B
Yeah
but
I
think
what
you
said
kind
of
early
in
that
discussion,
I,
think,
is
really
important,
which
is
helping
people
helping
people
think,
through
the
context
of
what
they're
trying
to
do
and
think
through
the
problem-
and
you
know
we
work
in
a
space
where
there
are
no
right
answers
for
every
situation
right.
All
we
can
do
is
help
people
help
people
think
of
ways
that
they
can
possibly
contextualize
some
of
this
and
and
put
it
into
something
that's
going
to
work
with
our
particular
organization
or
situation.
D
Yeah,
this
is
good
I'm.
Not
gonna.
Me
personally
won't
know
what
that
those
first
helping
steps
could
be
so
I
I
would
need
I
mean
if
we
could
talk
about
it.
Maybe
even
just
a
few
of
those
here.
You
know
I
agree
with
you
that
we're
not
gonna
just
in
a
book
chapter
say
here
are
the
seven
steps
to
make
this
super
simple
and
it'll
guaranteed
work,
but
maybe
if
there
were
even
just
a
few
steps
that
could
help
folks
within
an
organization
do
this
contextualization.
D
C
D
G
G
To
forget
who
said
that,
but
I
feel
like
it's
that
rest
preceded
by
who
are
you
talking
to
and
what
do
they
care
about
and
so
like
with
both
of
those
things
you
can
probably
get
most
of
what
you
need,
because
then
you
know
who
your
people
are.
Hopefully
you
know
what
their
goals
are
and
the
questions
they
have
answered,
and
then
you
have
numbers
against
those
questions,
so
the
questions
will
give
you
the
context
and
ideally
what
this
is
actually
trying
to
answer
against
their
goals.
G
B
No
I
would
agree
with
that.
I
mean
I.
Think
a
lot
of
it
boils
down
to
the
question.
You
know:
what
are
you,
what
are
you
trying
to
accomplish
if
you're
working,
open
source
and
then,
like
you
said,
I,
think
the
it's
also
important
to
think
about
who
the
stakeholders
are
and
how
they
how
they
interact?
D
Okay,
this
is
helpful.
I
mean
honestly,
if
you
I
can
like
I,
said,
I'll
write
that
up
and
we
can
talk
about
it
in
a
couple
weeks,
but
for
that
first
one
and
then
even
just
scrolling
down
a
little
bit
down
to
that.
Second,
one
I
have
your
comment
about
tying
to
strategy
which
we
talked
about
earlier,
which
these
might
be
good
good
points
of
Entry
to
help
people
in
ospo's
kind
of
Orient
themselves
around
these
two
problems
or
challenges
that
they're
facing.
D
A
D
D
All
right,
so,
okay,
so
just
as
a
quick
recap,
I
think
we've
talked
a
little
bit
about
metrics
models
here.
These
are
kind
of
you
know
we're
down
into
some
of
the
details,
and
so
within
the
cast
project
there
are
maybe
a
collection
of
about
75,
individual
metrics
and
metrics
models
are
ways
to
kind
of
bring
those
metrics
together
in.
D
What
I'd
like
to
talk
through
just
a
little
bit
here,
is
metrics
models
that
you
all
may
find
helpful
within
your
hospital
and
then
the
way
that
it
could
work
is
that
you
all
can
just
brainstorm,
hear
or
kind
of
throw
out
ideas
with
respect
to
metrics
models
like
what
you
would
like
to
see
and
I
have
some
examples
down
below
and
then,
if
there's
an
existing
metric
or
there's
a
metric
that
doesn't
exist
or
a
particular
metric
model,
we
can
develop
them
within
the
chaos
project.
That's
not
the
responsible
group!
D
D
We
have
processes
within
the
chaos
project
that
can
not
only
kind
of
develop
these
metrics
models,
but
the
the
necessary
metrics
behind
them
as
well,
and
so
the
there's
one
here,
which
is
the
the
starter
model,
which
is
one
that
Don
had
put
together,
and
it's
now
published
on
the
chaos
site-
and
these
are
the
four
metrics
just
I-
think
we've
talked
about
this
before.
But
these
are
the
four
metrics
that
help
Define
this
metrics
model
and
so
don.
B
Yeah,
absolutely
so
so
these
are
the
four
metrics
that
that
I
across
all
of
the
projects
within
BMX
VMware
and
updated
to
gather
these
in
a
meaningful
way,
because
what
I
wanted
projects
to
have
was
just
kind
of
a
really
basic
starter
way
of
looking
at
the
help
of
their
project,
and
so
these
these
metrics
are
all
very
different,
because
I
wanted
to
kind
of
capture
what
I
thought
were
key
elements
of
of
project
health.
So
you
know,
are
you
responding
quickly
to
a
full
requests?
B
Are
you
actually
closest,
so
change
request
is
like
a
pull
request
or
a
merge
request
lab.
So
the
are
you
actually
closing
about
as
many
as
you
get
in
any
given
month,
so
you're
not
getting
this
gigantic
backlog
of
pull
requests
because
you're
not
merging
or
closing
things.
Do
you
have
enough
people
on
the
project
for
it
to
be
healthy
and
then
are
you
actually.
A
B
Know
making
enough
releases
that
you
know
people
are
getting
security
fixes
and
features
and
Bug
fixes
in
that
type
of
manner.
So
these,
like
I,
said
these
are
all
four
very
different
metrics,
but
my
my
idea
is
even
even
within
VMware.
The
idea
is
that
they
can
use
this
as
a
starting
point
and
then
what
I
encourage
projects
to
do,
especially
if
they're
bigger
projects
you
know
if
they
have
Community
managers,
maybe
they
gather
lots
of
other
metrics.
B
You
know,
maybe
they
look
at
some
other
things
because
they're
a
project,
but
my
hope
behind
doing
this
as
a
metrics
model,
was
that
other
osbos
can
learn
from
it
and
they
can
take.
You
know
these
four
as
a
starting
point,
because
we
get
a
lot
of
questions
about.
You
know
where
do
I
start
measuring
project
health
because
it's
overwhelming
right
there,
like
I,
have
a
million
metrics
you
could
pick,
which
ones
which
ones
do
you
pick
so
I
I
picked
four
to
help.
D
D
One
of
the
things
that
came
from
chaoscon
as
well
was
a
collection
of
five
metrics
models
that
could
be
brought
together
to
do
five
different
things.
So
perhaps
one
of
those
metrics
models
is
what
Don
had
pointed
out
right,
just
kind
of
getting
people
located
to
to
really
start
asking
questions
about
health
of
the
projects
they
care
about.
D
So
then,
the
question
that
I
would
pose
to
all
of
you
is:
are
there
other
metrics
models
that
might
be
valuable
to
you
within
your
osbo?
That
could
maybe
help
and
part
of
that
communicating
with
others
party.
You
know
part
of
creating
consistency
even
across
ospo's
and
I
put
a
couple
samples
in
here,
so
I'll,
I'll
and
I
don't
mean
to
to
like
you.
You
don't
need
to
just
pick
one
of
these,
but
if
there's
one
that
you
would
like,
that's
not
on
this
list
feel
free.
F
D
F
F
G
I
think
what,
by
being
not
to
like
think
about
the
model
itself,
but
I
always
feel
like
something
like
participation,
is
also
not
really
well
defined,
and
so
in
a
metrics
model
like
that,
I
would
love
to
see
it
explore
different
modes
of
participation
in
terms
of
how
that
can
go
into
a
discussion
of
value
or
impact.
So
in
the
comment
of
philanthropy,
but
there's
also
like
so
many
ways
that
you
can
interact
with
a
project.
G
I
really
like
Don's
example
of
looking
at
working
on
specific
technical
issues
that
are
directly
in
line
with,
say
what
your
product
does
versus
working
on
sort
of
the
broader
issues
in
the
project
that
keep
the
project
functioning
and
healthy,
and
that
potentially
could
even
be
a
subset
of
like
not
just
like
technical
participation.
There's
multiple
ways
that
you
can
participate
that
way
or
if
you're,
doing
more
Community,
Management
pieces
or
event
Logistics,
and
the
other
number
of
things
that
you
could
do.
G
D
C
F
H
H
C
B
B
Because
if
we're
thinking
about
this
from
a
metrics
model
perspective,
I
have
some
starter
project,
Health
metrics,
you
could
kind
of
lump
that
into
sort
of
a
general
General
Health,
and
then
you
can
look
at
participation,
the
other,
the
other
one.
That
I
think
is
particularly
important
and
something
I
think
a
lot
about.
Is
the
business
risk
so.
E
G
G
Talking
about
this
in
the
risk
working
group
just
because,
as
a
number
of
different
risk,
metrics
that
we've
discussed
we're
now
thinking,
how
would
we
surface
this
into
a
metrics
model
in
a
way?
That's
executable
and
not
overly
comprehensive,
because
what
we've
struggled
with
is
sort
of?
How
do
you
deal
with
sort
of
you
can
think
about
all
these
various
metrics
and
how
they
apply
to
risk?
And
then
how
do
you
factor
in
the
dependency
chain?
Because
all
that
can
be
applied?
G
And
so
we've
been
thinking
about
ways
to
sort
of
narrow
that
into
I,
really
like
Don's
approach
to
just
keep
it
simple,
because
I
feel
like
if
you
give
someone
20
metrics,
like
that's,
not
actually
helpful,
so
I
think
that's
sort
of
what
we've
been
thinking
about
on
the
risk
working
group
is
one
of
the
most
important
things
and
there's
always
like
the
extra
stuff
you
can
do.
But
if
we
were
trying
to
narrow
that,
but
I
I
agree
with
that
Pursuit,
as
we
have
already
been
thinking
about
it.
C
G
It
is
difficult
piece
but
I
feel
like
that
is
always
part
of
a
risk.
Conversation
I
would
agree
with
that.
I
think
we
and
I
just
anecdotes.
We've
always
thought
about
the.
What
would
happen
if
we
didn't
do
this
scenario,
which
is
sort
of
like
well?
If
we
use
the
wrong
license,
then
we're
sued
like
that's
pretty
bad,
and
but
you
can't
necessarily
even
quantify
what
that
amount
would
be.
It
can
just
you'll
know
it's
bad,
but
how
much
bad
I
don't
know
which
is
not
correct,
English,
but
real.
B
So
you
know
the
idea
that
you
know
a
project
is
governed
by
a
little
tiny
startup
and
they
go
out
of
business
and
what
happens
to
the
project,
or
you
know
the
the
project,
even
like
big
projects
that
all
of
the
contributors
work
for
one
big
company
and
they
decide
to
de-emphasize
that
that
project
and
now,
all
of
a
sudden
there's
nobody
left
to
to
work
on
it.
And
so
how
do
you
think
of
those
types
of
like
governance
and
Community
things
as
a
part
of
risk
as
well?
B
G
It's
like
it's
worth
mentioning
just
not
to
make
this
a
risk
meeting,
but
we've
also
somewhat
opted
to
not
address
security
in
the
sense
that
there
are
many
ways
that
you
can
sort
of
approach
the
security
posture
and
and
acknowledging
that
that
is
a
risk
component.
But
we've
there's
sort
of
the
conversation.
G
The
risk
working
group
that
sometimes
the
focus
on
security
kind
of
can
overcome
the
other
issues
that
Don
say
brought
up
around
say:
could
the
community
aspects
and
the
government
aspects
governance
aspects
of
things
that
are
also
valid
to
consider
as
part
of
risk?
So
knowing
that
there's
now
a
risk
working
group
also
somewhat
happening
in
the
open
ssf
group
that
is
heavily
focused
on
security
as
a
way
to
be
more
collaborative
with
our
approaches.
G
We've
been
focusing
on
the
non-security
aspects,
so
I
just
want
to
mention
that,
just
because
it's
you
can
always
kind
of
expand
the
risk
conversation.
So
that's
one
way:
we've
tried
to
to
focus
on
what
we
what
we
want
to
measure
in
this
context,
but
for
this
group
I
feel
like
we
probably
would
also
have
to
include
security
but
or
maybe
a
point
or
two.
These
are
the
things
you
should
consider
for
security
as
as
sort
of
a
like
follow-on.
B
B
You
know
because
it
gives
me
a
list
of
the
vulnerabilities
they
have
attached.
I
I
can
see.
You
know,
like
I,
don't
know
lots
of
stuff
about
about
a
project,
so
there
are
definitely
some
security
metrics
that
we
could
do.
That
might
be
that
aren't
related
to
risk,
but
I
feel,
like
security
is
important
enough
that
maybe
it's
a
separate
model.
C
D
Okay,
well,
this
is
a
really
helpful
conversation,
I
think
there's
perhaps
three
metrics
models
that
are
starting
to
be
identified
here,
which
again
I
think
we
can
bring
these
back
to
the
group
here
in
a
couple
weeks,
one
is
already
developed
and
published,
but
at
least
a
couple
bring
them
back.
So
so
thanks
thanks
for
that.
B
Oops
I'm
talking
on
me.
Yes,
this
is
a
really
interesting
conversation.
We
have
four
more
minutes
so
Matt.
Maybe
you
can
just
keep
sharing
and
scroll
down
a
little
bit
because
I
think
there's
only
one
more
thing
on
the
agenda
which
I'm
gonna.
Guess
you
probably
added
anyways.
So
maybe
we
can
talk
about
chaoscon.
It.
D
Did
I
just
wanted
to
point
out
to
folks
on
this
call
that
there
is
chaoscon
it
opens
for
Summit
North
America
I
should
have
put
the
date
in
here,
but
I
can
just
click
this
and
tell
you
the
date,
May
9th
I
believe
and
it's
in
the
afternoon,
and
we
will
and
that's
not
correct.
We
will
actually
be
live
streaming
it
via
the
Linux
Foundation
platform,
but
it's
also
in
person.
D
The
schedule
is
here
so
thanks
to
Sophia
and
to
Emma
who
are
going
to
be
leading
a
couple
discussions.
So
what
we're
going
to
be
doing
at
the
session
is
kind
of
like
what
we
did
in
Brussels,
where
the
Keynotes
one
and
Keynotes
two
will
kind
of
present
around
these
questions
and
leave
folks
kind
of
with
a
task
to
talk
about
these
questions
in
smaller
groups
Sophia.
You
can
obviously
modify
your
question
a
little
bit
here.
So.
D
And
so
it's
just
it's
great,
because
it
kind
of
helps
us
capture,
ideas
and
things
to
kind
of
focus
on
over
the
course
of
the
next
year
and
then
there's
going
to
be
a
keynote
also
by
Sean
and
either
Daniel
or
Georg,
from
beturgia
about
software,
auger
and
grimoir.
Lab
updates
as
well.
So
I
just
wanted
to
put
that
in
front
of
people.
F
B
F
D
F
G
G
Sense
I
was
gonna,
say
it.
I
love
it
as
a
forum
to
say.
Are
these
the
most
like
feedback
on
the
questions
that
we
focus
on
like
I?
Think
we
generally
have
an
idea
of
what
we
could
probably
do,
which
I
say
that
having
we
haven't
actually
had
any
conversations
about
it,
but
I
would
love
to
bring
that
back
to
this
group.
Yeah.
B
Be
good
yeah
for
sure,
okay,
well,
I
wanted
to
just
thank
everybody
for
for
coming
to
the
meeting.
I
would
like
to
stress
that
you
know
the
agenda
is
not
necessarily
driven
by
me
and
Matt.
Anyone
can
add
items
to
the
agenda.
So
if
there's
anything
you
want
to
talk
to
this
group
about
related
to
hospitals,
metrics,
you
know
kind
of
the
health
of
your
Urban
Source
efforts
in
general.