►
From YouTube: CHAOSS.AsiaPacific.Community.August.26.2020
Description
CHAOSS.AsiaPacific.Community.August.26.2020
B
C
B
B
Okay,
hbo
series,
so
do
we
wanna,
I
mean
the
question
is:
do
we
wanna
spend
time
kind
of
recapping
what's
going
on
in
the
project
right,
like
kind
of
spending
time,
just
keeping
you
up
to
date
with
with
the
things
that
have
been
happening,
or
do
we
kind
of
originate
things
in
this
call
that
we
can
bring
to
the
to
the
chaos
project
as
well?
Does
that
make
sense.
A
B
D
E
D
I
asked
them
to
join
the
meeting,
so
maybe
it's
a
for
you
guys
to
introduce
about
the
kiosk
project
and
maybe
the
metrics
we
could
use
to
monitor
the
health
of
the
open
source
project.
I
think
this
metrics
could
be
very
helpful
if
we
use
this
in
in
the
source,
especially
currently
we
we
just
start
the
the
process
to
have
some
projects.
D
B
D
D
They
we
we
can
get
the
data
detailed
data
of
the
who
is
who
just
the
contribution
come
from
where
the
contributors
come
from,
but
at
first
the
most
challenging
things
is.
We
need
to
encourage
them
to
do
their
contribution,
but
in
a
source
where
they
may
not
have
the
motivations
to
do
that
kind
of
work.
B
B
D
For
I,
I
think
the
metrics
for
the
approach
of
the
development
development
is
good
enough.
Okay,
because
we
can
use
the
agreement
or
or
argos
to
get
the
data
from
the
gear
lab.
We
use
a
gitlab
internally
to
to
host
the
projector.
So
I
think
it's
just
what
cultural
books,
but
first
the
most
interesting
things-
is
bring
bring
more
people
online
on
board.
Okay,.
A
B
D
Yeah
good
good
community,
but
it's
like
we
have
a
bunch
of
projects
and
yes
too,
to
be
take
care
of,
and
so
so
certain
kinds
of
tools
can
help
us.
So
I
I
play
with
the
grameen
app
for
for
a
while.
So
so
I
I
think
that
the
data
I
get
from
the
gear
lab
is
isn't
enough,
but
to
encourage
the
people
to
to
to
to
join
the
the
the
process
is
a
huge
challenge
for
me.
B
So
we
know
that
there's
events
that
can
occur,
that
kind
of
change
the
nature
of
participation
in
the
community,
and
so
we
could
using
the
metrics.
We
can
kind
of
track
what
those
bursts
might
be,
but
then
you,
as
an
organization
would
have
to
try
to
work
to
kind
of
identify
the
events
that
you
did
internally,
because
we
don't
really
have
insight
on
that.
D
Yeah
we
we
have
planned
to
there's
a
program
festival
around
october,
so
we
we.
We
are
planning
a
big
event
to
actually
to
to
to
show
the
projects
our
company,
as
you
know,
we
we
have
a
bunch
of
developers,
so
so
they
have
some
projects
to
share
each
other's
and
we
are
planning
to
do
this
kind
of
events
to
advertising
or
just
little
people
to
know.
There's
a
projects
you
can
join.
So
okay,
we
even
built
a
website
for
that.
D
B
C
B
C
B
D
D
D
Yeah
yeah
and
it's
not
just
about
the
metrics.
I
I
think
mattress
can
bring
the
people
in
the
same
page,
but
the
skills
are.
They
still
need
to
develop
some
skill
set,
especially
working
in
the
open
source
way.
So
it's
like
it
looks
like
I
teach
one
or
two
projects
and
then
this
project,
the
member,
will
have
other
projects,
but
but
this
could
be
a
challenge
for
them
to
devote
their
time
to
to
do
this
kind
of
things.
B
B
B
Sounds
good
all
right
cool.
Are
there
other
things
that
people
so
will
I'm
not?
I
jotted
that
down.
Are
there
other
things
people
would
like
to
to
talk
about
on
this
call?
We
can
definitely
focus
on
on
intersourcing
and
thinking
through
that,
but
are
there
other
things
that
people
would
like
to
talk
about
on
this
call
that
might
be
useful.
B
Kind
of
that
first
agenda
item
just
wanted
to
give
you
an
update
that
we're
still
moving
forward
with
this
we're
probably
going
to
be
paying
to
get
some
of
this
work
done.
But,
as
we
talked
about
in
prior
calls,
we
probably
need
a
few
people
to
double
check
the
work
and
willem
you,
and
I
had
talked
about
that
yeah
yeah
yep.
So
that's
still
kind
of
work
in
progress.
We're
gonna
aim
it
at
translating
the
metrics.
I
think
right
off
the
bat
and
then
perhaps
the
website
would
be
another
candidate.
B
B
B
So
thinking
about
health,
not
just
of
a
particular
open
source
project
and
the
activity
within
the
project,
but
also
thinking
about
health
at
a
dependency
level
or
an
ecosystem
level
is
another
way
to
think
about
it.
So
this
is
something
we
could
that
if
it's
of
interest
to
folks
here,
we
can
always
talk
about
it
here,
but
I
think
this
is
something
that
needs
a
little
needs
a
little
attention,
because
I
think
it's
important.
B
D
C
A
Be
a
difference
in
what
so
what
maven
does?
Is
it's
really
kind
of
a
build
tool
for
java
right
yeah,
and
so
that
will
give
you
a
clear
picture
of
the
dependencies
inside
of
a
project
in
the
context
of
that
project
and
java
doesn't
use
package
managers
to
the
same
degree
that
other
languages
do
so
you're
generally
importing
a
library
and
maven
probably
could
be
used
as
a
as
a
dependency
manager.
A
I
can
see
I
can
see
that
for
java
for
many
other
languages
the
dependencies
are
more
of
a
spider
web,
for
example
with
npm
or
python.
There
are
package,
you
know,
actual
programs
where
you
do
npm,
install
or
pip
install,
and
when
you
install
that
package
that
package
depends
on
other
packages,
so
you
inherit
a
set
of
dependencies
that
are
somewhat
invisible
to
you.
A
I
know
java
libraries
work
somewhat
differently,
it's
been
a
number
of
years,
but
so
I
can't
speak
authoritatively,
but
I
I
don't
know
whether
or
not
maven
will
cover
all
of
the
dependencies
for
a
java
project,
especially
if
it
has
a
web
front
end
at
the
end
of
the
day.
That
is
not
written
in
java,
which
is
usually
the
case,
if
you're
doing
any
kind
of
javascript
on
that
project,
you're
definitely
using
package
managers,
and
you
probably
have
dependencies
you're
not
aware
of.
D
B
A
A
Like
they
could
they're
kind
of
a
logical
step
when
it
comes
to
looking
at
how
a
project
evolves
and
I
think
they
are
they're,
I
mean
they're,
also
a
significant
point
of
risk,
yeah
yeah
projects
as
well.
So
it's
it's!
It
doesn't
matter
to
me
what
work
group
takes
it
on
right,
but
I
think
it's
it's
fair
to
say
that
this
is
a
right.
This
issue
is
becoming
more
and
more
prominent
because
it's
the
dependencies
where
the
security
holes
come
to
play.
C
B
A
B
Yeah
and
yeah-
that's
the
I
think
tied
lift
is
the
commercial
company
or
one
of
the
commercial
companies,
but
I
think,
as
sean
has
pointed
out,
tide
lift
is
built
on
libraries,
dot
io,
which
doesn't
give
you
the
entire
entire
view
of
of
dependency
structures.
Yeah,
there's
a
there's.
The
package
mannered.
A
Manager,
dependency
structure
and
then
there's
also
the
things
that
we
import
directly
that
yeah,
maybe
not
package
managed.
For
example,
in
many
cases
there
are
projects
that
people
download
from
github
and
incorporate
and
those
dependencies
have
to
be
identified
kind
of
in
the
in
the
build
process
for
a
piece
of
repo.
A
B
A
I
think
the
strategy
around
how
to
address
dependencies
is
important
because
it
does
it's
come
up
in
a
lot
of
working
groups,
it's
a
complex
problem
and
it
is,
and
we
both
of
the
software
projects
involve-
and
it
requires
software
to
to
make
understandable,
even
but
both
of
the
software
projects
within
chaos
are
pretty
heavily
committed
right
now.
So
we
may
want
to
consider.
A
There
was
also
I'm
just
gonna
I'll
stop
talking
after
this
there's
also
a
suggestion
from
gosh.
I
think
your
name
is
sophia,
but
I
apologize
to
get
it
wrong.
So
yeah
sophia
vargas
yesterday
in
the
general
call
about
the
dev
stats.
Dashboard
for
kubernetes
is
undergoing
a
major
overhaul,
and
so
there
might
be
opportunity
for
collaboration
between
chaos
and
kubernetes
and
the
devstats
group
specifically,
and
she
is
looking
she's
trying
to
make
that
connection
for
us
between
yesterday
and
next
tuesday.
Oh.
B
A
A
It's,
I
think,
well,
I
think
well,
so
what
I
think
is
the
resources
that
are
engaged
in
dev
stats
certainly
have
an
interest
in
dependencies
and
we
meet.
We
may
be
able
to
join
some
sort
of
forces
to
get
you
know
to
not
have
to
be
responsible
for
the
technical
work
required
to
answer.
Those
really
important
questions
like
there
might
be
a
there
may
be
something
that
we
can
work
with
them
to
build
and
they
already
have
corporate
support
for
developers
yeah.
So
there's
there's
opportunity,
but
it's
undefined.
B
B
C
I'm
king,
hello,
I'm
sorry,
I
I
I'm
not
delay
in
the
airport,
yeah,
I'm
a
bad
network.
So
I
heard
about
you
talk
about
the
condenser.
You
know
at
first
I
jumped
in
the
chaos
project.
I
have
opened
an
issue
on
the
risk
or
group,
and
somebody
told
me
the
kids
case
work
to
talk
about
the
in
stx
project.
A
B
A
Yeah
the
the
law
it's
been
about
a
month
since
I
was
in
in
their
meeting,
but
that's
an
active
part
of
the
next
spec
and
it's
a
as
he
mentioned.
It's
a
critical
aspect
of
the
creation
of
a
software
bill
of
materials
that
it's
rec.
I
think
it's
a
primary
consideration
in
the
next
spdx
released,
if
not
driving,
consideration.
B
Okay,
because
then
again,
because
spdx
doesn't
necessarily
do
tooling
like
right
in
that
regard,
I
mean-
maybe
one
of
the
things
we
could
think
about
is
like
how
augur
or
morelab
could
generate
the
data
that
would
be
beneficial
to
the
spdx
document
it
would.
It
would
just
help
frame
things
right
out
of
the
gate.
That's
all
I
don't
know
what
your
thoughts
are
on
that,
but
yeah.
A
Yeah,
I
think
I
think
the
tooling
is
good,
you
know
so
so
we
have
some
spdx
tooling
for
the
current
spec,
and
I
think
I
think
evolving,
that
tooling
to
this
next
spec
will
be
a
substantial
effort
in
its
own
right,
and
so
perhaps
there's
I
mean
perhaps
there
are.
There
needs
to
be
a
bill
of
materials,
virtual
conference
that
involves
the
dev
stats
chaos
nspdx
projects,
because
all
of
us
have
a
vested
interest
in
in
this
question.
B
B
We
don't
have
the
ex
we'll
have
the
expert
daniel
here
in
two
weeks
to
talk
about
this
a
little
bit,
but
one
of
the
things
that
maybe
we
could
talk
through
and
sean.
I'm
gonna
lean
on
you
a
little
bit
because
you've
done
some
of
this
work
with
other
folks
is
when,
when
you
think
about
this
issue,
metrics
that
kind
of
help
not
monitor,
but
maybe
help
reveal
the
growth
of
of
communities.
A
A
That's
sort
of
a
sign
of
a
project,
ignoring
something
that
they
don't
want
to
talk
about,
because
they're
not
going
to
accept
it
and
it's
off-putting
to
new
contributors,
a
project
with
a
lot
of
long,
where
the
the
slowest
20
of
pull
requests
are
ultimately
merged.
That
just
often
indicates
that
the
pull
request
is
complex
and
requires
more
discussion
before
it's
merged.
B
B
B
A
I
I
rolled
it
into
one
because
of
the
acceptance,
and
it's
also,
I
suppose
another
question
is
speed
of
response
to
new
issues
and
new
prs,
which
is
sort
of
a
time
to
first
response
metric,
because
that
is
also
strongly
indicative
of
you
know.
If
new
prs
and
new
issues
get
a
comment,
that's
not
a
bot
within
a
day
that
that
leads
to
people
engaging
in
a
community
if
their
issue
or
pr
is
ignored
for
a
week
or
a
month.
Then
that
is
that's.
A
B
So
one
of
the
things
I
kind
of
hear
you
talking
about
which
is
you're
treating
growth
as
not
necessarily
just
an
absolute
number
of
people
right
growth
in
the
sense
of
the
people
who
are
there
whether
or
not
it's
more
people.
The
people
who
are
there
have
become
more,
are
becoming
more
committed
right.
Success
of
the
project.
A
And
for
a
first
time
contributor
that
that
result
of
the
pull
request
or
that
response
to
the
question
is
they're
gonna,
it's
an
indicator
of
whether
or
not
they
ultimately
engage
in
the
project
so
from
a
community
management
perspective.
Speed
of
response
helps
you
to
build
your
contributor
base.
Okay,.
D
They
barely
have
purecast
from
outside,
and
today
I
I
I
found
the
the
the
key
issue:
they
they
just
the
other
setting
in
a
git
lab.
Don't
let
the
people
fork
the
project
if,
if
the
user,
if
the,
if
the
apr
contributor
wants
to
do
that,
he
has
to
you,
click
the
fork
button
first,
but
if
the
projector
disable
that
it's
look
like
it's
just
a
shot
down
the
the
door.
D
D
A
Control
this
that
it'll
be
what
we
want
it
to
be,
and
it's
just
like
a
laser
focus
and
whatever
you
people
are
trying
to
contribute.
It's
just
it's
like
the
parent.
I
don't
know
if
you
get
charlie
brown
in
china,
the
cartoon
have
you
heard
of
it:
okay,
well,
the
parents
and
charlie
brown
they're
only
ever
heard
going
or
you
never
know
what
they're
saying,
and
so
I
think
they
hear
them
like
that.
Those
kinds
of
characters.
B
D
D
D
Unlike
the
outsides,
were
it
looked
like
there
was
a
bunch
of
people
waiting
to
do
the
contribution
because
they
are
passionate
about
that
or
they
feel
they
can
can
make
an
impact
on
the
in
the
community,
but
from
the
inside
from
the
inside
company.
A
lot
of
people
feel
they
are
too
busy.
They
don't
have
the
extra
time
to
do
the
contribution
for
the
other
apartment,
because
the
other
other
apartments
don't
pay
for
them,
and
especially
the
project
manager.
B
B
A
Yeah-
and
I
would
even
say
that
these
these
are
things
that
are
in
the
auger
community
reports,
repo
that
reads
the
auger
database
like
we
don't
even
have
the
these
things
in
our
dashboard
yet
because
they
emerged
from
direct
engagement
and
we've.
We
just
found
again
because
javascript
front
ends
just
takes
so
much
time
that
building
jupiter
reports
and
actually
apis
that
generate
these
visualizations
with
captions
is
far
more
efficient
than
dealing
with
javascript.
B
So
sean
how?
How
hard
is
it
I-
and
this
is
a
just-
a
question
because
you're
the
maintainer
of
auger,
so
to
take
to
to
take
these
aggregated
views,
that
kind
of
come
from
these
questions
and
provide
kind
of
a
layer
behind
these
aggregated
views.
That
gives
you
insight
as
to
the
the
names
of
the
contributors,
who
are
say,
new
contributors
or,
as
you
I
know
in
your
reports,
you
have
like
second
time
contributors
right,
yeah,
yeah,.
A
A
So
so
I
would
say
that
we
have
not
we've
not
done
that,
but
it
could
it's
it's
just
an
another
query
and
one
of
the
things
one
of
the
things
that
we
do
is
we
try
to
resolve
all
and
I
say,
try
because
sometimes
it
works
and
sometimes
if
a
person
has
not
used
their
real
email
on
git
hub.
But
if
anyone's
committed
to
github
all
the
emails
they've
committed
with
are
recorded
by
github,
and
we
can
map
them
to
a
single
person.
A
A
A
If
you
can
imagine,
you're
editing
the
contributor
on
issues,
pull
requests
and
commits,
while
we're
gathering
data
on
issues,
pull
requests
and
commits
and
unifying
the
user
ids
at
the
same
time
is
like
just
logically
problematic
gosh.
That's
probably
that's
too
deep
of
an
answer.
I'm
sorry!
But
no
because.
A
A
I
mean
in
the
case
of
get
lab
yeah.
If,
okay,
it
just
it
will
depend
on
actually
their
local
git
configuration.
So
if
they're
committing
to
get
lab
and
a
github
and
to
you
know
other
things
and
your
git
identity
can
be
set
universally
and
usually
is
so
your,
but
their
email
address
would
be
consistent.
Then,
if
they're
using
that
work,
presumably
they'd
be
using
the
same
computer.
A
A
B
A
B
A
I
would
ours
yeah,
and
I
think
I
mean
that's
a
report
like
ethically
we
should
discuss
like.
Is
that
a?
I
think,
that's
a
report
where
we
say
this
is
we
would
build
that
report?
We
have
the
data,
we
would
put
a
disclaimer
at
the
top
and
say
this
is
intended
solely
for
intersourcing
analysis.
Well,
100
for
corporately
approved.
A
You
know
open
source
analysis.
This
is
not
approved
for
like
we
don't
want.
No,
like
I've
avoided
individual
identification,
no,
of
course,
with
gdpr,
stuff
and
yeah,
and
I
think
just
respect
for
the
people
on
github,
because
github
has
exclusions
in
both
of
those
laws,
and
we
don't
want
to
lose
that
exclusion,
because
if
people
stop
providing
their
some
kind
of
identifier
with
a
commit
that
makes
the
whole
thing
a
mess.