►
From YouTube: OpenSSF Diagrammers Society (March 9, 2023)
Description
Meeting minutes: https://docs.google.com/document/d/14i9v7WuQcLzWpvLe9B0sl-kf90JLwxNwrZkRXLWmEdQ/edit#heading=h.9m0zi4b0wnne
A
A
A
B
B
Alrighty
so
now
I
know
that
crop
had
presented
to
the
attack
on
the
governing
board.
So
I'm
not
sure
what
this
this
group
is
going
to
do
right
now,
I
can
tell
you
what
I'm
hoping
to
do,
which
is
pitch
for
I,
need
a
deck,
so
I
actually
have
a
very
specific
need,
but
I
don't
think
I'm
alone,
which
is
I,
need
a
couple
slides
in
Google
Docs.
A
D
B
It
and
you
know
now
granted
there
are
many
needs
for
explaining
things,
but
one
is
to
be
able
to
present
to
others.
In
fact,
I'm
I
have
to
create
a
presentation
soon
for
well
Boeing.
Oh,
not
not
terrible.
It's
not
a
big
secret
so
anyway,
occasionally
I
have
to
give
presentations.
So
having
slides
that
are
maintained
is
a
good
thing.
Hi.
D
B
B
E
B
Wow
all
right
so,
but
that's
all
right,
I
I'm
feeling
the
guilt
I'm
already
going
to
fly
down
to
the
floor,
so
I
have
a
request
really
for
that.
You
know
and
I
guess
it's
somewhat
selfish,
but
I
don't
think
it
is
I.
Think
other
people
are
in
the
same
boat.
I
am,
which
is
I,
occasionally
need
to
go
talk
about
the
open,
ssf
and
generally.
What
they
want
is
slides.
Okay.
B
We
have
some
you've
already
done.
You
know
at
least
like
the
hierarchy
and
the
CI,
CD
and
I
think
we
can
do
several
I'm
happy
to
to
create
a
Google
doc
of
the
versions
that
I
have.
If
people
want
to
replace
that
with
better
versions,
that's
great
but
I,
I
think
for
at
least
now
I
realize
that
some
of
them,
like
the
one,
the
Mind
map,
one
that
is
probably
not
practical
to
put
in
a
slide
deck.
That's.
B
Well,
I
I
I'm
not
trying
to
exclude
anything
it's
much
more
of
the
having
a
common
Google
deck
of
hey.
You
need
to
present
about
the
open
ssf.
Here
you
go
that
basically
Builds
on
the
ideas.
I
have
a
couple
slides
I
can
artists
provide
if
you'd
like
me,
mine,
if
you've
got
better
ones
great
and
if
other
people
have
slides
for
some
of
these
other
views?
B
E
B
B
At
least
you
know,
heck
I
don't
think
it's
a
crazy
idea
to
have
a
general
elevator
pitch
deck.
Jennifer
I
know:
we've
we've
done
some
things
for
new
members,
but
you
know
I'm
thinking
specifically
of
diagrams.
If
we
want
to
have
just
a
more
General
here's,
the
open,
ssf
I
mean
that
would
be.
That
would
be
quite
reasonable.
I
was
just
thinking
of
the
diagrams,
but
if
we
want
to
have
a
general
open,
ssf
pitch
deck-
and
this
has
is
part
of
it-
well,
that's
awesome
too
yeah.
A
A
E
B
E
E
A
B
B
B
D
E
A
E
B
B
C
C
B
B
B
Come
here,
I'm
gonna,
add
CI,
CD
View,
oh
and
I
have
a
separate
copy
of
it.
I'm,
not
sure
why
I
know
it
needs
some
updates,
but
this
at
least
it
will
give
you
something
to
now.
Why
do
I?
Have
it
twice,
I,
don't
know
why
I
have
it
twice
that
will
confuse
everybody.
Let's
remove
that
now.
It's
only
there
once.
A
E
B
E
The
subcommittee
idea
was
Arun,
called
it
33
30
that
you
have
basically
a
one
pager.
That
kind
of
is
more
like
an
infographic
of
what
the
foundation
is.
You
have
a
short
little
deck
that
you
could
do
in
three
minutes.
It
gives
a
kind
of
a
higher
level
overview,
and
then
you
have
a
more
in-depth
version
that
would
be
like
30
minutes
long
to
kind
of
tell
more
more
richly
develop
the
story,
but
yeah
this.
B
B
B
E
Cool
cool
so
to
Circle
back.
Does
anyone
have
any
other
opens?
Please
add
those
into
the
meeting
agenda.
I'll
dump
that
into
the
Zoom
chat.
There
I
have
a
couple
things
I'd
like
to
chat
about
the
cicd
diagram
and
then,
if
we
have
time
we
could
talk
about
the
continuation
that
Jay
started
about
working
group
and
sigma
charity
review.
E
There
were
different
opinions
on
which
of
the
diagrams
they
liked
better
than
another,
but
at
the
the
one
that
received
the
most
accolades
and
desire
for
continued
refinement
was
the
cicd
diagram
that
David
did
the
initial
draft
of
and
then
based
off
of
kind
of
current
state
of
things
in
the
foundation.
I
did
an
update.
E
There
is
a
link
there
to
the
the
Ping
file
if
you're
curious,
to
see
the
embellishments
I've
added
to
the
initial
diagram,
so
I'd
like
to
see
if
we
would
like
to
invest
some
time
to
you
know
double
check
are
all
the
boxes
in
the
right
place?
Are
we
happy
with
the
colors?
Do
we
have
many
kind
of
objections
or
criticisms,
or
anything
we'd
like
to
change
about
it,
so
I'll
open
it
up
to
the
floor
here?
What
are
your
thoughts
on
the
cicd
diagram.
E
A
E
So
this
is
the
update
and
kind
of
the
my
suggested
placement.
Do
we
want
to
spend
some
time
to
you
know
shuffle
the
boxes
around?
Are
we
happy?
Is
this
good
enough?
Do
we
want
to
actually
start
to
go
out
and
maybe
talk
to
some
of
the
working
groups
to
get
their
agreement
and
buy-in
and
adjustments,
or
is
this
good
enough?
We
send
it
to
the
artist.
E
D
I
was
going
to
say:
I
do
the
same,
I
mean
I
actually
lead
so
one
of
the
things
under
there
the
risk.
Well,
here's
security
Matrix
is
risk
dashboard.
So
you
can
actually
lead
that
thing.
So
so
I
can
that's
one
that
could
be
that
could
be
looked
at
there,
but
I'm
not
sure
if
Alpha
Omega
sits
under
the
working
group.
I
want
to
say
that
that's
a
project
that
sits
outside
of
the
working
group
now
I
know
it
used
to
sit
there
but
I,
know
I,
believe
it's
a
project.
D
We
have
no
deep
emotional
investment,
that's
you
know
like
but
like
where
six
stories,
but
one
of
the
projects,
so
one
of
the
sifts
I've
seen
that
I
know
it
used
to
be
there,
but
if
it's
still,
there
I
think
that
needs
to
be
changed,
or
it
needs
to
be
clear,
clarified
that
that's
where
it
is,
but
everywhere
else
I've
seen
it
is
like
the
alpha
omega
and
six
store.
I
was
surprised.
D
E
D
E
It
so
that
is,
we've
and
part
of
like
Matt's
Journey.
Through
the
Mind
map
recognized
we
have
a
ton
of
inconsistencies
and
duplication
missing
elements.
So
that's
why
I
think
it'd
be
great.
If
we
actually
went
to
that
working
group
officially
and
saying
here's,
here's
what
we
think
the
picture
is,
can
you
please
adjust
it
for
us,
so
it
accurately
reflects
your
work
and
your
ideas.
Yeah.
D
E
E
C
D
D
That
we're
also
thinking
about
the
creation
of
a
supply
chain
security
framework,
a
a
governing
one
I
know
that
that's
been
talked
about.
I,
don't
think
that
we've
put
a
proposal
together
just
yet
for
it
like
that,
but
right
now
those
are
the
three
items
that
are
in
play
and
I
want
to
say
that
I
mean
Fresca's
there,
but
I
still
think
Fresca
is
in
Community
and
communities,
status,
I'm,
not
sure
and
full
disclosure.
The
last
meeting
was
a
little.
D
What
the
last
meeting
was
a
little
touch
and
go
for
me,
I
I,
you
know
the
discussion
in
the
last
meeting
was
like
almost
to
the
effect
of
you
know,
we'd
like
to
continue
this
is
there
you
know:
do
we
have
somebody
that
can
help
with
XYZ
and
I
was
like
Wow
you'd
like
to
continue?
That's
where
we're
at.
So
that's
that's
a
shrug
to
show
the
moment
like
I.
D
D
C
D
Their
work
to
have
a
source
track,
that's
being
talked
about
as
well,
so
that'll
go
off
into
the
source
portion,
Source,
Integrity,
okay,
so
that
part's,
fine,
the
the
Fret
the
Fresco
one,
though
the
Fresco
one
is
kind
of
a
a
bridge
from
if
you
go
from
The
Source,
all
the
way
to
the
consumer
right
so
build.
It's
like
that.
Build
pipeline,
so
that
that
might
span
across
S2
c2f
is
is
is
good
where
it's
at
you
know
good,
where
it's.
E
Get
them
represented
correctly
and
then
for
Alpha
and
Omega
All-Star
is
not
included
they.
Basically
it's
a
lot
of
the
same
people
doing
the
development
and
they
hold
a
conjoined
working.
Sig
call,
but
officially
All-Stars
sits
underneath
another
group
in
the
git
repo,
where
it
all
starts
sitting
under
securing
critical
projects
and
again
maybe
that
needs
to
change.
Maybe
we
do
need
to
officially
put
them
together.
E
F
E
F
No
I
have
to
see
I
I'm
impressed
I
mean
I've,
always
liked
David's
diagram
I
was
always
worried
about
it
being
imbalanced
in
terms
of
where
things
would
fall,
but
it
looks
like
you,
you
know
it
the
way
it's
presented
here.
It
looks
like
there's
a.
It
appears,
there's
a
good
balance.
Let
me
put
it
that
way:
I.
E
F
C
E
F
Yeah
I,
the
only
thing
that
you
know
if
this
is
captured,
I
mean
now
Graphics
designers
can
do
miracles
in
these
things,
but
the
I,
the
one
thing
I
tried
to
factor
out
was
which
things
are.
If
there
was
some
way
in
the
the
bull
ties
list
or
some
indicator
or
something
to
indicate
a
code
project
distinguish
a
code
project,
something
had
a
GitHub
repo.
Somehow.
E
And
the
the
foundation
came
down
pretty
clearly
on
that.
If
it's
code,
it's
labeled
a
project.
If
it's
like
a
white
paper
or
a
guide,
that
is
a
Sig,
so
we
can
go
through
and
again,
that'll
require
working
with
those
working
groups
to
make
sure
that
they
get
the
names
adjusted
correctly
and
maybe
we
change.
Maybe
the
projects
are
diamond
and
yeah.
F
E
E
D
We
have
any
coverage
from
all
the
working
groups.
I
mean
these
working
groups
are
all
here,
I
think
securing
critical
projects,
I
mean
I,
have
to
go
back
and
attend
some
of
those
meetings
in
the
secure
software.
Repos
I
gotta
go
into
some
of
the
means
too,
because
I
haven't
been
to
been
to
many
of
those,
but
all
the
other
ones.
I've
or
security.
F
E
E
E
D
Let's
deferred
for
today,
I
think,
there's
a
few
other
things
that
a
few
other
things
that
we
I
would
like
to
tease
out
on
on
the
proposal
in
general,
like
I,
think
there's
a
there's
a
lot
of
stuff
that
we
need
to
I
want
to
I
want
to
get
done
with
the
bulk
of
that
document,
we're
working
on
yeah
and
then
because
I
don't
want
to
talk
about
it
separately.
I
think
I.
Think
I
don't
want
to
talk
about
separately.
E
Yeah
I
I
think
that's
fair,
so
Jay
and
I
are
working
on
a
a
proposal
to
help
try
to
maybe
get
the
foundation
a
little
more
structure
and
rigor
around
things
like
the
gaps.
The
Mind
map
exercise
highlighted.
So
we'll
definitely
come
back
to
this
group.
Once
we
have
a
more
fully
formed
idea
more
than
like
three
words
on
a
blank
document
and
kind
of
get
your
feedback
on
that,
and
then
this
actually
ties
in
with
something
that
the
governance
subcommittee
is
looking
into.