►
From YouTube: OpenSSF Diagrammers Society (January 26, 2022)
Description
Meeting minutes: https://docs.google.com/document/d/14i9v7WuQcLzWpvLe9B0sl-kf90JLwxNwrZkRXLWmEdQ/edit#heading=h.9m0zi4b0wnne
A
A
B
A
A
B
A
A
A
A
All
right
folks,
if
you
have
any
opens
you'd
like
to
discuss
today,
please
add
that
in
the
open
section
primarily
today,
I
would
like
to
talk
about
a
presentation.
I
just
gave
a
sneak
peek
to
the
governance
committee.
They
got
promoted,
they're
no
longer
a
subcommittee
I
just
shared
with
the
governance
committee,
get
your
all's
feedback.
If
we
need
to
adjust
anything
before
that
goes
more
broadly
and
then
I'll
shoot
it
out
to
assorted
mailing
lists.
A
All
right,
can
you
see
the
goose?
Yes,
all
right,
so
I
had
shot
this
out.
There's
an
issue
and
I
had
sent
it
out
to
slack
and
whatnot,
but
I
put
together
this
brief,
some
presentation
kind
of
summarizing
who
we
are
and
what
we're
doing
and
kind
of
summarizing
our
our
past
work
with
the
assorted,
diagrams
and
kind
of
views
we've
been
toiling
away
at
so
I
was
curious.
A
A
And,
ideally
the
final
work
product
would
be
like
a
dynamic
interaction
that
a
viewer
could
look
at
and
click
on
and
be
able
to
go
straight
to
resources.
If
I
wanted
to
learn
more
about
salsa
I
could
hover
over
the
supply
chain
group
and
be
able
to
go
right
to
Salsa's
repo
or
webpage.
For
example,
oops.
Sorry,
hey
wait.
So
our
first
view
is
the
hierarchy
view
that
Mr
Wheeler
helped
provide.
This
should
be
very
familiar
to
most
people
that
have
worked
in
a
large
corporation.
A
B
A
I
put
the
cap
again
the
caveat
that
all
of
these
are
kind
of
first
draft,
and
if
there
was
somebody
had
a
perspective,
they
they
wanted
the
end
users
to
be
purple
and
not
pink.
We
certainly
could
make
adjustments
like
that
or
if
we
wanted
to
move
the
end
users
closer
to
the
supply
chain
group,
for
example,
because
they're
really
good
friends,
we
have
that
ability
to
kind
of
show
relationships
between
the
different
components.
A
Believe
me
I
guarantee
that
will
be
a
long
and
aggressive
debate,
and
then
you
have
the
whole
accessibility
and
usability
lens.
We
also
would
look
at
this
with
being
sensitive
to
like
people
with
neurodiversity
your
color
blindness,
so
yeah
there's
a
lot
of
talk
about
the
color
that'll
happen
someday.
A
The
next
view
is
the
CI
CD
overview,
another
diagram
that
David
had
shared
with
us
and
this
one
appealed
to
a
couple
of
the
GB
members
that
had
come
up
through
development
where
they
like
I,
understand
cicd.
This
is
a
pro.
This
problem
speaks
to
me,
so
they
found
this
very
appealing.
But
you
know
this.
The
power
of
this
diagram
is
you
have
a
process
and
you
can
showcase
all
the
different
activities
that
relate
to
a
particular
piece
of
the
process.
A
Another
process
is
sdl
sdlc,
where
you
can
have
the
sdlc
urberos
snake,
eating
itself
arrow
and
then,
as
you
hover
over
a
particular
area
working
group,
you
could
explode
that
out
and
show
details
therein
and
each
one
of
these
whether
it's
you
know
the
cicd
sdlc
I
have
a
devsecops
proposal.
All
of
these
will
need
to
have
a
considerable
conversations,
probably
with
the
working
groups
and
initiative
owners,
to
make
sure
we
get
things
placed
appropriately
or
show
that
they
span
multiple
areas
appropriately.
But
again,
this
is
first
draft.
A
I
personally
feel
touches
upon
all
seven
of
the
devsecops
activities,
whereas
something
like
the
securing
critical
projects
might
only
touch
on
release,
configure
monitor
all
open
for
debate
but
again
to
kind
of
give
people
an
idea
of
how
this
might
be
laid
out.
The
the
theater
of
the
possible
in
your
minds
here.
A
The
next
diagram
was
Matt
and
our
nose
mind
map,
which
I
think
probably
will
not
be
our
end.
Deliverable
but
I
personally
feel
this
will
be
very
useful
in
working
with
the
tack
as
we
realign
to
a
new
vision,
and
we
start
to
work
on
things
like
the
Sterling
tool
chain.
I
feel
this
diagram
offers
a
significant
amount
of
value
in
showing
this
is
the
state
of
things.
You
know
these
groups
are
missing
readme's
or
Charters.
These
projects
that
say
they're
part
of
the
open,
ssf
actually
jump
out
to
external
websites.
A
A
I
have
these
problems
that
I
want
to
solve,
so
as
an
open
source,
developer
I
need
to
write
more
secure
code,
so
we
route
those
folks
to
the
best
practices
working
group
yay
or
if
they
want
to
know
how
to
scan
their
code,
we
would
route
them
over
to
the
tooling
group
or
potentially
straight
to
the
scorecards
or
All-Star
projects
directly.
So
you
have
a
lot
of
opportunity
there.
A
A
We
have
the
vision,
mapped
view.
This
is
something
where,
in
the
end
of
last
year,
Bob
had
started
an
effort
to
revise
the
tax
vision
for
the
foundation,
so
I
took
that
and
there
were
four
clear
statements
and
I
just
kind
of
eyeballed
it
and
lined
up
our
groups
and
I.
Think
hey.
You
know
we're
an
influential
advocate
for
efforts
that
are
aligned
with
our
mission,
so
I
think
end.
Users
helps
with
that
and
public
policy
and
governance.
So
we
can
kind
of
debate.
A
If
this
is
an
approach,
we
want
to
go
kind
of
lining
things
up
to
a
strategic,
Vision
or
Mission.
We
can
line
people
up
like
this
and
ultimately
that
all
needs
to
be
finished
before
we
can
start
to
debate
about
what
goes
where
and
one
thing
we've
talked
about
several
times,
but
never
have
had
the
energy
to
get
around
to
is
the
trail
map.
The
cncf
trail
map
I,
think,
is
a
very
powerful
graphic.
A
A
Maybe
our
metaphor
is
where
the
geese
that
lay
the
golden
eggs
and
we'd
have
a
bunch
of
eggs
laying
around
and
you
could
click
on
the
egg
and
maybe
a
little
Goose
hatches
out,
and
that
tells
you
what
the
hell
that
thing
is
all
about,
but
we
would
need
to
agree
upon
what
the
theme
is
and
what
the
waypoints
are.
So
this
would
be
a
very
opinionated
view
of
the
foundation
and
would
not
necessarily
seek
to
Encompass
everything
but
again
ran
out
of
time
and
didn't
do
it
yet.
A
So,
yes,
some
of
some
of
them
were
very
interesting
to
the
group
and
they
ultimately
agreed
that.
Yes,
there
will
be
no
one
diagram
that
solves
everybody's
needs,
so
we'll
need
to
have
several
and
yeah.
That
was
great.
We
didn't
have
I
I,
didn't
get
a
marching
orders
about
what
they
would
like
to
see.
Next,
like
what
specific
outcomes
they
wanted
to
solve,
so
I
think
we'll
probably
go
back.
A
I
think
I
got
drafted
into
talking
to
the
actual
full
governing
board
on
this,
hopefully
not
next
week,
we'll
see,
but
if
so
I'll
make
do
and
then
ultimately
I
think
at
the
end
of
this
process,
once
we
have
our
hand
full
of
diagrams,
we
would
probably
want
to
engage
professional
graphic
designer
to
embellish
it,
to
do
the
colors
to
make
sure
it
matches
our
desired
palette
and
had
our
iconography
that
we
wanted
and
all
you
know,
helped
with
like
animations
and
whatever
else.
So
this
goes
into
a
web
page
or.
A
Ends
up
being
and
then,
finally,
all
the
designs
would
need
to
be
vetted
for
accessibility
and
usability
issues.
That
came
across
very
clear
in
the
first
first
time.
I
proposed
this
to
the
TAC
mailing
list.
I
got
a
lot
of
statements
around.
We
need
to
make
sure
we
address
the
people
that
have
colorblindness
or
are
neurodiverse,
so
we
make
sure
we
take
those
perspectives
into
account
before
we
finish
our
final
products,
and
that
is
that
what
do
you
think.
B
Aggressive
grub,
I
I,
you
know,
congratulations,
I
mean
lots
of
credit
for
you
to
for
putting
all
these
together.
I
think
collection
that
you
put
together-
and
you
know,
I-
think
it's
great
to
to
try
and
get
feedback
from
a
broader.
You
know
population
than
the
university
call
in
every
other
week
or
so
so
I
think
that's
great
I
I
agree
normally
with
the
fact
that
you
know
there
are
types
of
diagrams
that
I
think
are
more
like
useful
for
us
as
true
right.
B
I
I
was
very
interested
in
the
the
one
you
put
together
but,
like
you
know,
based
on
bugs,
like
Mission,
so
the
goals
for
the
you
know
the
the
week
and
how
all
these
different
activities
relate
to
those
goals.
This
is
the
kind
of
stuff
I.
Don't
think
you
know
the
larger
population
really
care.
Much
about
that
point
of
view,
but
I
think
porous
is
a
very
useful
thing
to
have.
C
Yeah,
that's,
it
sounds
like
a
you
know
when
I
say
that
what
what
comes
next
sounds
like
something
it
takes.
It
doesn't
take
a
lot
of
work
to
maintain
these,
but
as
new
initiative
spin
up
across
the
working
groups,
as
you
know,
more
work
in
groups
start
collaborating
on
other
initiatives
and
they
start
these
diagrams,
not
all
of
them,
but
but
at
least
the
ones
that
are,
you
know
more
detail,
they're
going
to
have
to
be
freshened
up
in
real
time
in
order
for
them
to
maintain
relevance.
C
So
I
agree,
maybe
that's
something
that
we
need
to
think
about
how
how
how
are
we
gonna?
Oh,
are
we
gonna
hold
each
working
group,
but
once
they
get
into
a
workable
state
that
we're
going
to
have
the
worker
groups
update
them,
or
are
we
going
to
have
Liaisons
from
this
group
reaching
out
or
in
each
working
group
meeting
I
mean
we,
we
all
know
outside
of
Jennifer.
C
A
A
A
A
Is
it
the
working
group's
responsibility
to
provide
the
feedback
and
how
do
we
get
that
feedback?
Because
I
think
you
know
even
you
know,
I
know
our
from
the
time
that
Matt
started
the
Mind
map.
Things
changed
immediately
like
the
next
week
and
the
weekend
and
then
our
node
jumped
in
and
it
was
a
little
different
and
when
I
did
a
bunch
of
my
diagrams,
like
the
whole
end
user
working
group
came
into
being,
then
wasn't
in
my
initial
diagram.
So
it's
we
need
to
figure
out
that'll,
be
a
problem.
D
D
You
know
and
I'm
pretty
flexible
in
How,
We,
Do,
It
I
think
there
are
some
advantages
if
we
can
make
it
easy
to
manage
via
GitHub
but
whatever
it
is.
Please,
let's
just
make
it
easy
enough,
because
things
are
going
to
change
and
as
long
as
you
know
and
I
don't
mind,
it
has
to
be
changed
here
and
there
like.
D
If
we
did
both
the
hierarchy
and
the
the
salsa
mapping
I'm,
not
sure
a
tool
can
easily
so
do
that
and
you
know
what
hand
hand
doing
it
here
and
there
is
okay,
I,
don't
think
that's
a
crisis,
it's
just.
It
needs
to
be
clear.
This
is
what
you
need
to
do
and
you
can
do
it
in
a
couple
minutes
as
long
as
it's
not
a
radical
change
and
off
you
go
because
we
obviously
have
jobs
other
than
maintaining
diagrams.
A
Yeah
and
that'll
be
a
chance
like
if
we
select
one
or
two
to
go
out
to
a
a
graphic
designer,
there's
cost
involved
and
there's
latency
in
that
request.
It's
not
can't
be
immediately
updated
whereas
like
if
it's
a
Vizio
diagram
or
a
paint
doodle
I
can
that
up
or
Vizio
at
a
fairly
short
period
of
time.
D
Yeah
I
mean
you
can
see
what
I've
done
and
you
know
I
guess
in
some
sense
there's
the
risk
of
sunk
cost.
I've
I
did
this
or
I
like
it.
This
way,
obviously,
but
you
know
having
a
couple
simple
diagrams
that
you
can
edit
within
Google's
a
presentation,
format
means
grab,
move,
go,
you
can
make
other
people
edit
it
and
probably
yeah,
and
the
reason
those
were
developed
were
in
part,
because
we
have
to
explain
to
other
folks
what
the
heck
open
ssf
is.
D
So
having
a
generic
hey
every
time
you
need
to
describe
open,
ssf,
here's,
the
here's,
the
current
version
of
the
of
the
diagrams
to
explain
it.
That's
kind
of
been
helpful,
so
so
I
I
do
think.
That's
a
use
case
is
explaining
to
others,
and
you
know
if
I
can
describe
it
and
go.
That
would
be
helpful
for
somebody
who
tries
to
pitch
to
others.
Hey
come
join
this
awesome
group
and
everyone's
all
people
listen
to
me
so
yeah
well,.
A
A
D
E
I
am
really
looking
forward
to
using
these
diagrams
or
diagram
in
different
marketing
materials.
Communications
I
think,
are
you
know
our
slides
that
we
can
share,
and
you
know
have
others
share
as
well
to
get
involved.
Definitely
for
the
website
as
well.
I
think
a
couple
of
those
versions
could
work.
Well,
maybe
even
something
interactive
where
someone
can
kind
of
drill
down,
so
you
want
to
do
X
and
then
kind
of
it
takes
a
path
of
where
they
can
get
involved.
A
D
Actually
Jennifer
just
mentioned
something:
I
think
we
ought
to
make
more
explicit,
which
is
the
format
of
the
results.
I
can
see
at
least
two
res
places.
These
diagrams
need
to
end
up.
One
is
open,
ssf
website,
you
know,
I
would
love
to
be
able
to
see
the
diagrams
click
on
it.
You
know,
click
on
you
know
a
working
group
image
and
show
up
there.
Click
on
a
project
show
up
there
and
the
other
is
presentations.
D
E
Yeah,
you
want
to
hand
out
and
I
think
like
something
more
high
level
and
I
think
that's
why,
having
like,
maybe
two
at
least
two
different
kind
of
views
like
a
very
high
level
View
and
then
something
a
little
more
detailed
as
well
for
different
uses,
and
then
you
know
at
whatever
Point
this
Society
is
ready
to
move
on
to
design
there.
We
have
a
creative
Services
team
I've,
given
them
a
heads
up
that
something
might
be
coming
down
with
the
the
road.
B
B
B
A
That's
it.
There
are
a
multitude,
we
talk
about
tools
in
the
beginning,
you
know
lucidchart
and
Vizio
and
graphic
programs
there's
a
lot
of
different
choices.
We
can
make
and
that's
another
thing
is
we
all?
Hopefully
we
all
are
in
the
open
ssf
forever,
but
we
probably
might
not
be,
and
it
would
be
tragic
to
have
an
artifact
created
that
the
next
people
that
are
carrying
on
the
work
didn't
have
access
to
between
the
cognitive
of
that.
D
Right,
which,
which
actually
creates
a
tension,
so
Jennifer
I,
realize
you've
offered
up
the
the
graphic
Services
folks,
who
can
do
awesome
stuff,
but
they
can
use
a
variety
of
tools.
Maybe
we
should
talk
about
not
just
hey,
wouldn't
it
be
cool
if
it
looked
pretty,
but
it
would
be
cool
if
it
looked
pretty
and
we
could
oh
edit
it
easily
without
further
issues,
downloading
a
special
tool
that
sort
of
thing
I
mean
it
could
just
be
as
simple
as
please
put
the
result
in
Google,
Docs
spreadsheets,
not
spreadsheets.
D
D
A
D
B
Days,
I
think
that's
a
good
points.
I
I
thought
along
the
same
line
before
when
I
was
thinking
about
this
license.
When
I
looked
into
the
license
to
fix
mind
my
app
that
we
used
and
I
thought
the
same
as
like.
Well,
if
we
really
want
it
I
suppose
we
could
buy
a
few
licenses
and-
and
you
know
at
the
end
of
the
day
you
can,
if
you
have
licensed
version,
you
can
export
in
all
sorts
of
different
formats
that
free
you
from
the
tool.
C
D
B
D
C
Well
to
that
right,
so
yeah,
it's
expensive
right,
but
so
so
is
silver,
gold
and
platinum
level
sponsorships
right.
So
if
we
reached
out
to
them
and
said
hey,
why
you
know
you
guys
make
a
tool
right,
you
have
to
build
it.
You
need
developers
to
do
that.
This
is
a.
This
is
a
place
where
we're
talking
about
open
source
security.
I'm
sure
you
use
open
source
in
your
development
practices.
So
why?
Wouldn't
you
want
to
be
a
part
of
this
organization?
Oh
guess!
What?
C
Not
only
can
you
become
a
a
member
one
of
the
105
106
members,
but
to
pay
for
that
membership?
You
could
throw
in
a
couple
of
licenses
to
this
tool
that
we'll
use
and
die
like
once
once
I
mean
but
I'm
just
I'm.
Just
saying
that
you
know
what
do
they
call
it
bartering
right.
The
barter,
the
barter
is
real
right:
murder.
B
D
A
So
for
next
steps,
I'll
follow
up
with
Bob
and
see
if
there
is
a
mandate
that
I
am
summoned
before
the
governing
board
to
share
this
with
the
full
board.
But
I
expect
at
some
point
we
will
start
doing
dog
and
pony
show
around
the
presentation
around
our
example
diagrams.
So
if
you
have
any
feedback
or
comments
in
the
interim,
please
feel
free
to
make
changes.
A
Additions,
requests
for
subtractions
go
ahead
and
do
that
and
then
at
some
point,
I
I
know
we
will
have
a
call
between
us
and
the
TAC.
So
I
would
appreciate
your
flexibility
in
trying
to
participate
in
that
call,
as
we
potentially
go
through
like
be
laid.
The
Mind
map
out
and
kind
of
start
walking
through
things
as
an
example.
So
I
know
that
we'll
have
some
requests
of
our
time.
So
just
as
you
are
available,
please
be
flexible
and
consider
helping
assisting.
A
B
A
So
if
you
have
some
personas,
you
feel
these
diagrams
will
want
to
address
whether
user
stories
user
Journey.
However,
you
want
to
phrase
it.
We
need
to
figure
out
some
perspectives
that
we
want
to
address
some
of
these
diagrams
for
probably
as
a
a
future
step,
but
I'd
like
to
have
that
in
our
back
pocket
and
then
I'll.
Let
you
know
when
we
will
be
asked
to
talk
about
this
again
with
other
groups.
D
A
And
some
things
like
the
hierarchy
diagram,
for
example.
That's
super
easy,
there's,
no
aside
from
maybe
prettiering
it
up.
There
probably
is
like
zero
additional
work.
We
have
to
do
on
that
particular
View,
but
you
know,
as
we
get
into
like
the
CI
CD
view.
We
probably
all
will
need
to
go,
have
conversations
with
each
of
the
working
groups.
Do
you
agree
with
how
we've
laid
this
out?
D
Okay:
okay,
since
you
can
blame
me
for
that,
salsa
mapping
diagram,
you
know,
I
had
to
create
some
new
categories
for
some
of
those,
because
some
projects
were
cool
but
didn't
obviously
fit,
and
that's
okay,
I
think
it's.
It
would
be
unsurprising
if
we
end
up
creating
one
or
two
more
categories
and
I
think
that's
just
fine.
D
The
goal
is
to
try
to
make
it
clear
adequately
enough,
and
one
thing
that
I
think
is
helpful,
especially
in
the
webview,
probably
obviously
not
so
much
on
the
printed
version,
but
you
know
for
at
least
a
a
web
view.
All
of
those
links
are
clickable
in
the
original
one,
and
I
really
would
like
that
capability
to
continue,
because
I
can
easily
see
that
showing
up
on
the
website
of
here's
our
hierarchy,
you
can
click
on
any
part.
Here's
more
detail
with
all
the
various
projects.
B
I
totally
agree,
obviously
I'm
a
web
guy.
So
I
wouldn't
disagree
on
that,
but
the
challenge
is
to
sometimes
it's
not
always
obvious
to
know
what
is
the
primary
link
for
a
group.
Is
it
that
there
are
some
of
the
GitHub
repo,
but
there's
also
websites
like
salsa.dev
right
six
stores
it's
on
website,
so
do
you
link
to
the
style.
A
A
D
A
Want
to
make
sure
that's
consistent
and
if
one
thing
has
a
website,
maybe
other
things
need
websites.
So
again,
you
just
want
to
make
sure
kind
of
see
figure
out
figure
out
what
the
standards
are.
We
want
to
the
output
to
look
at
so
the
three
three
parts
of
homework
comments
on
the
slide:
deck
collect
any
Persona
ideas,
a
few
points
we
have
to
address
and
then
start
to
think
about
requirements
for
the
final
diagrams
like
it
must
be
clickable.
A
C
A
a
working
group
or
Sig
maturity,
maturity,
Matrix,
meaning
is,
is
there
readme
file
updated?
Do
they
have
a
scope?
Is
there
you
know
what
I
mean
stuff
like
that
for
us
to
create
that
if,
if
ever
asked
they
we
have
a
place
to
be
pointed
to
say,
hey,
these
groups
are
still
outstanding
with
these
items
per
whatever
policy
is
in
place.
A
The
author
of
the
piece,
Services
maturity
framework,
I,
agree
with
that
item
and
I
think
we
could
eventually,
once
we
get
the
criteria
put
together.
We
could
offload
that
to
the
working
group
leads
that
this
is
your
checklist
and
they
report
in
quarterly
to
the
TAC.
So
this
will
be
part
of
those
materials.
Working
groups
will
have
to
deliver
to
the
tax
so.