OpenSSF Education SIG, 10 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Education SIG – Collect & Curate Section 1 (November 10, 2022)

Description

Meeting minutes: https://docs.google.com/document/d/1Lt8uGpiMFfgws8VF36xtTMaJAeHufha-7Dqz1tjrPGY/edit#heading=h.naeeah7jeanr

A

A

Welcome in welcome in.

B

Waiting to see if Dave's able to join us, he is currently in Florida and they are an imminent danger of getting very wet. Oh there, he is, that is the current situation. I can concur also.

C

B

C

Also Glenn was supposed to join, but Glenn needs a moment because he's picking up the kids.

C

B

D

Your raincoat, it's sitting over there on the chair, drying off.

D

All right link.

D

All right there's a link to the agenda. If you have not done so already, please mark your presence and we'll get started. Let's get started right now, it's three! After all, right, um first and foremost, is there anyone new who would like to introduce themselves.

D

It's like familiar faces, that's cool! um If anyone, as always, would like to help take notes, I'll do the best that I can take the information here, but please feel free to change your Abby thing, I put in if I uh mishear, something or you'd like to put some additional context in there.

D

If anyone has any additional agenda items, they would like to talk about. Please add them to the bottom of the list. First thing: we're going to start off with today um is follow-ups from action items from the last meeting, so first one uh in Randall Randy. You wanted to wait for the graphdb schema before we proceeded with this whatever. This was sorry about that. This is the section one goal uh about creating a curriculum framework and you hope to have more information available by today. Do you have anything to share.

C

Yes, uh I've put a lot of it into the section 2 plan um when we had kind of a long talk about it in the previous call, with Saul um and yeah I'm, not at a computer right now, but I will be in a few moments um if I can send a link somewhere, but it's it's in the pr.

C

A lot of it is in the pr that's in there for section two.

C

The main thing that we discussed, though, was about the need for uh or open data which might be another line item in there. I'm not 100 sure.

B

It is Glenn and I talk about that. Briefly, that's the reusable column.

C

Yes, we also talked about that moments ago. um Saul, do you want to fill everyone in on our conversation about that yeah.

A

So on the call right before this we're running into the issue of yeah, a lot of these are Great, Courses and they're, openly available to use and yet right the Google IBM things we still have not confirmed those Partnerships. So all I've done is go in and stated which ones are fully open, right, lfos and then, unfortunately, as we already knew, nothing else is um so the next steps with that that I think would be essential. Is um let's well some of the actions that we came out of this last call.

A

It turned into a bit of a discussion about genuinely just how do we get all this coming together?

A

um So we are going to get a sort of basic uh architecture diagram of what the SK ostrich platform is going to look like on the back end and also get a data structure requirement put together a very basic base.

A

It's a draft of that and then use that as we're on boarding the LF certification course and take that document.

A

We need that document before we can start really strategically reaching out to those Partnerships, um but those are going to be the next steps as soon as we have that document in a way that we're comfortable with I think then we should reach out, but as we're submitting this plan, I think it would be just fine in the gaps analysis to include those resources and include it as partnership pending right, cool.

C

D

You all right uh yeah! Thank you very much for that. I try to grab a little bit of it, but again, if interested in this, please feel free to add it uh so I is. Is it fair for me to say that, based on all that information that this is something that's going to be covered in section two, we do not need to worry about it in section one.

C

This is kind of that whole discussion about where the librarian goes, because it kind of depends, but um kind of because, like yeah.

B

Like where the Librarians is, the plan is irrelevant, Randall it yeah I could shove it in section five, if I wanted to it's just, we need to make sure that we thought this group felt it was important to hire someone to help manage the content going forward and we just need to make sure that's documented yeah.

D

So let me justify, let me adjust my statement a bit. Is it fair to say that you've got this stuff covered in section two and this group in section one doesn't need to worry about it right now. Yes,.

C

Yes, okay, okay, fair.

D

Thank you. uh The second thing that we had was writing up a primer for how to use the categories in The, Matrix materials, spreadsheet and Sal Randall and Eric. We're going to take a look at that. Any uh updates you'd like to share with the group.

A

Yeah, so ultimately, we fixed up the spreadsheet I think enough to not need to have the onboarding document, and it's halfway done now, so call it done. Work is getting done. um What is not done, though, we still need um so I will go through and finish up.

A

Judy you've done so much work on that spreadsheet and now someone else needs to take it over um so uh yeah I'm gonna go through and try to catch, uh at least as much of those last ones as I can over the next couple of days with my lovely vacation time, what a fun way to spend it actually I am going to enjoy it, because some of those courses are cool and I've been looking into them.

A

um So I will go through and finish that up and then what we really need to get done. I think in this group is finish up. The written Gap analysis is our highest priority. Following that.

A

B

We want to give you a milestone for the actual conducting the Gap analysis. Dave. Thank you. Yes, yeah.

A

What's our deadline for that again, I was going to say it was mid-november correct. Let.

D

Me see I just opened the plan and see what's magical Secrets. It will share with us.

D

D

uh We had quarter one 2023.

D

For the survey pardon me my my bad I misspoke um reviews cure development. Materials from following sources is Q4 2022.

D

uh The Gap analysis is part of Milestone number four, so the mouse number four was q1 of 2023.

A

Youtube 2023.

D

Yeah q1 2023.

D

., so we had this quarter uh quarter four of 22 to get the materials into the spreadsheet, including specifically looking at areas like Linux, Foundation, o wasps, some other member organizations, and then we once we had all that information we were gonna. You know figure out the whole, what's missing through the Gap analysis and just figure out what uh what the next steps were.

D

Yeah. Obviously we can't start that now as soon as materials are in. If you know the materials are as good as they're going to get for now. We can certainly move this up. That would just a high level deadline.

A

Yeah I mean we might be able to move this up because I was I mean I was overly optimistic that there would be more available than there is, and now I'm just sad, but it's a good opportunity to make new content. um So I think M1 here is almost.

B

And- and we also have the opportunity, if we can see the content, we potentially could develop our own if we feel the topic was useful, but that is much more labor intensive than yeah open sourcing.

A

It but again I said this on the last call: if there's a wheel, do your best to get that wheel, don't recreate it right right.

E

um Also one thing I wanted to point out that David also created an uh GitHub issue, because um he was also concerned that uh he didn't see any uh education for like.

A

E

Or K-12 um yeah, so that would be easy, I guess, because I also didn't found it uh only Trend Micro, but again it's free, but it's not open data yeah.

E

So that's should I think or can already be added to the Gap analysis as well. That currently is- and it seems like.

A

D

Thank you, Crow. Oh right. There.

A

Yeah all right, there's only six things that need to be reviewed left in this. So yeah I'll go again that finished up this week um and then, um where do we want the do? We want the Gap analysis to live as a Google doc or as a GitHub thing. I think this one makes sense as Google doc, um so I will put that together and Link it back in um as soon as it exists. Fine, with Google doc,.

D

Yeah I think it's a good place as far as collaborating and stuff I think Google Doc's a good place to start yeah.

A

D

Any other questions comments, follow-ups on either of the action items, all right next bullet. Here, of course, we just talked about that any and all information anyone can find. um You know, steal, dig up, discover on another planet, please add spreadsheet and uh that that's gonna be the foundation for all the activities we just talked about. So I will move on uh the.

B

Question on that, are we it's? The format is locked ish right so.

A

B

Can send a note out to the TAC and solicit additional external contributions.

A

Yes, pending the data structure requirement templator.

B

Well, that's the approximate ETA on that.

A

E

Yeah exactly we wanted to start working on that when we actually finalized the section two uh we're almost there. So hopefully, when we finalize it, we can uh yeah start with that document, because it's quite crucial also for the quality that we will uh then get in right, that we have a good quality gate as well.

B

Yeah, so make a task for me that when you are ready, I will send a note to both the tack and the end user working group, which is right directly after this call that I got roped into helping. They would be very interested in uh content. They may have additional resources that you might could share.

D

And I I missed the. uh When is that data structure supposed to be due.

E

uh In a week.

D

In a week so I mean the 17th.

E

uh I think yeah.

C

Yeah so yeah yeah yeah yeah I can do I can I can have it out by then.

D

All right, I got all that noted down so crab. You have an action item one week from now. Congratulations and.

C

And all, and also probe I did reach out to Jennifer before about this, so she's also prepared on that front.

B

Well, yeah I want to see if there's like an all Foundation male but a lot of people lurk on the tack list uh and then, like the end user group, I, think, would be extremely motivated to learn more about what we're doing so I'd like to rope them in like they rode me.

C

B

Did add that as an action.

C

By the way, Crow yesterday, okay.

E

D

All right so moving on I want to talk about the plan, the section one plan, which is due by December 1st fun fact. We have no further meetings between now and December 1st for this section group, since uh the next one scheduled for Thanksgiving in the U.S, and it's going to be canceled.

D

So um I wanted to talk about issue 32 very briefly and then talk about um where the plan is at and what we're going to do for the next couple weeks and of course, maybe has anything else they'd like to add. We can certainly discuss that as well, so issue 32 was created uh as far as the duplication of goals in stream, 1.5 and 2.4.

C

D

C

Of reached the conclusion.

D

C

That, in the last call.

D

Okay and what was that conclusion.

C

That uh we will only index English terms inside of SKF or skg, and we're going to have a GitHub repo with the translations for lexicon or for the glossary terms, and those will just be linked. We won't actually index those. Those will just basically be uh separate, GitHub repo that we're going to have and I was going to add that to the issue and close it later, yeah.

A

C

A

State that it's going to be styled after the cncf glossary, so we already know what the template is. We already know what that looks like.

D

Okay, so Randall you're going to update and close the issue correct all right. Do we need to do anything with the section one subjective 1.5 in our in our um that are part of the plan, foreign.

A

Prioritize training content to be localized, um so yeah I mean this. This doesn't change because this isn't natural language. We know it's like the application and the LF security are the two ones that we're putting in first.

D

uh But the the duplication of so so I read: I, read 2.4 the the pr that has 2.4 in it. You have localization in that section two. We need to only have it in one area personally, I, don't care which one it's in as long as we've got it covered, uh so I'm going to switch together at the end yeah.

A

Let's remove it from 1.5, because it's an implementation um now. This is something that I mean from the way that 1.5 is written. It's very clear that someone intended I don't know for like hiring someone to literally go in and translate full Pages. My argument against that is that all technical documentation is pretty much written in English um cannot be maintained. That.

B

There are Cerner certain learner constituencies that not only prefer their natural language, but will demand that so we're trying to give an option. Yeah.

A

So what works so well? The reason why they're, just two different approaches to solving the same problem- one is going in and using a single human body in mind to go in and translate a bunch of pages with their own natural bias towards their own experiences of a language or we do this open source and we allow for specific languages to self-identify, what's important for them to be translated right, they'll be having active conversations on the glossary.

A

So it's really easy for us to know what needs more attention or translation based on the conversations that are being had by the community.

A

um But I would I would maybe loop back in with Dave on this 1.5 goal to see. If we can, we understand what languages we've prioritized I think that's good.

B

I'd, like you to make an issue and.

A

B

A note to this full Sig asking their consideration because someone felt very strongly about.

A

This exactly, let's.

B

Get their vote and have them vote in the issue and we'll Knack that or augment it, and if it goes to section two, that's irrelevant the placement is, you know it lands where it lands.

D

So Glenn I'm, going to ask um I, will remove it from section one I'm going to ask that if you could please ensure that all the information we've got in section one is able to get into section two in the right side in the right areas. I would appreciate that. Is that something you can do on your side.

E

Yeah we can yep.

D

Thank you very much.

A

All right, so it sounds like it's going to be wrapped up. That issue is wrapped up and it'll be anything. Do you actually need me to put anything out there.

B

Well, we should vote, have the have the full Sig provide their opinion? Do they want a person typing, or do they want to do it? Ad hoc or programmatically.

B

Again, thank you. I didn't put it in there, but someone felt important enough that it has lived on for the last five months in this artifact right. I, don't want to make somebody sad.

A

So functionally.

D

A

Do we I mean I'm just a new moment? How do we go about ensuring that there's a clear vote? Where do we raise that.

B

People to vote on the issue for the comment in the issue saying I would.

A

Like this year, okay, so we're not creating a new issue and I got it. Okay,.

B

Well, is there an issue on it right now.

A

There is yeah, so it's this I would State that's this issue, 32 right, I,.

D

Yeah I would suggest we create a new issue, so people don't get confused uh question about issue. 32 was: where is it's going to live, but the question at hand that we're looking for the votes on is not that one. So.

E

B

What's that you could link to 32 if you want yeah got.

A

It now now I understand why we're creating new issue we'll do thanks.

D

So I appreciate it all right anything else about that one. We have a plan for that one. It was usually feel good. All right, if you saw there, were some changes made to our section of the plan. Some milestones and some details were put in there uh by our friendly neighborhood Crow, uh and so what I'm gonna say is uh after talking with crow about this, and in fact we have no more meetings with this group.

D

Any additional contributions that anybody has I will go and I'll get rid of the stuff we talked about earlier about any contributions. Anyone has please submit them as a PR no later than November 23rd after that, crobe and I are going to go through we're going to start trying to fill in the blanks that still exist as best we can.

D

Everyone is welcome to review those things, but at that point it's pretty much going to be a done deal while Crow takes all three sections of the plan and tries to mesh them together into a coherent document which is not going to be fun, we're going to help do it, but it's not going to be fun anyway.

D

We just have to you know some things we need to get from as far as formatting and content make sure we don't duplications, all that good stuff, but again anything anybody has about any stuck in section one put in a PR. We will review it if you have questions we'll cover that in in slack or email as needed,.

B

And I'll say this: I would like that similar uh goal for both of the other plans, sections yeah I'm in active conversations with Brian bellendorf, the director of the open ssf right now about how he would like this to be presented up to the attack and GB. So we may not have to Mush it back into one like PDF, but uh we'll definitely have to make sure that the formatting is consistent. So, like we say year, one or y1 Y2 year, two, so we make sure we're consistent throughout so that'll be fun.

C

That markdown linter also works. Now too.

B

Does it I saw it had a big big fat error, yeah.

C

It did, it was emailing.

B

Me maybe sad I had to make a new email.

C

I created that air too anytime.

D

Chrome has to make an email will. He gets sad yeah.

D

Are any other questions or comments about the plan for our section through the end of the month?.

D

Cool Crow you've had an update. You wanted to give.

B

D

Yeah, just for 1.6.

B

I there is a group of people within Intel called sarc that they do uh open source, secure development, training and education they're like a center of excellence within our company. They were super excited to talk to me and I was super excited to talk to them, uh so they are looking at what um they have developed a lot of content that potentially we can leverage like um C and C, plus plus uh secure coding, guides these types of things that potentially could be either resources or maybe actual training, so they are looking through.

B

uh We have to talk to our legal department about what we could give away, um but they are also even better, very excited about contributing to this and the best practices working group. So hopefully, in the coming weeks and months we will see some new faces from Intel, because again they've have been working with open source software for over 20 years, so they have a lot of maturity in this space and they're very excited that this these groups exist and they want to collaborate with us. So yay contributions.

B

That's awesome and then the the next one, let's um whatever the issue, ends up being. Let's please uh express your opinion, so we get that adjudicated quickly. Yes,.

D

All right that is the end of the agenda as it stands right now uh before everyone goes and starts, adding some some content to the spreadsheet and or the plan I will ask if anybody has any additional topics that they'd like to discuss today at with the group.

A

Yeah um my last thing, I know section three has been falling behind because you.

D

Have any idea how.

A

Many conferences there have been in the last three weeks, but I have one whole week off, and this is my like dedicated I'm like get our girl to get through cncf get this done. um So I will be welcoming any comments, sort of discussions and be a lot more active on the slack this week.

B

And and I went through and staged the format you did.

A

Thank you, I love the check boxes, yeah.

B

So feel free to modify whatever and if you need to add more details but event, the idea is: when the plan is done and it's approved, we will make issues for each one of these things to help with tracking and we could kind of pull this into a kanban board and I'll do all kinds of fun, stuff, cool.

C

uh Chrome I'll also make like I'll loosen up those uh rules for the markdown like there's like the line length and stuff like that. I'll loosen all that up.

D

Don't try and put Chrome in a box it. It doesn't work.

B

If it had more useful errors too, that would be nice, it just says linter air I'm like what the but what what's wrong.

B

C

D

Scroll into this stupid thing.

B

It doesn't even like flag the line, that's bad it just.

E

D

Think meaningful error text is a is a good, secure development practice. Isn't it Crow.

B

It is, it is useful error messages well,.

C

I'll I'll I'll I'll look into it but yeah. That's the GitHub super linter. If I may add.

B

Github sub-optimal winter.

C

Yeah but and then we also had a question Chrome in section two um Glenn and I have been calculating Ops hours. Is that useful or should? Is that not useful? Because the Ops people were proposing being full-time employees, um because.

B

Because let me say this is a big swag saying this will be 300 hours from the Ops Team or whatever.

C

Does it matter that we're really lopsided because we have way more hours than we really have people.

B

No okay, we'll find volunteers, um but the the main goal is I want to express to the governing board sponsors that these efforts, while we may not be hiring someone, are not free and we think we require this many volunteer hours to assist. Make this successful, gee I wish the governing board could help us find some more volunteers. Please.

C

Okay, so should we maybe add volunteer hours there too, because we don't have volunteer hours in our PR if.

B

It's relevant okay, if you feel that you know this is task for this Ops Team and you want to say this is kind of how many hours they're going to be. You know doing this great, but that's a less important detail than you know: I need to hire a body. I need to buy a server. I need to I need.

C

Something no, the main reason. Why is because, like when you go into the labs like we were calculating the first set of labs and it's like for 4 200 hours and something and like we're only asking for three developers in our Ops Team, which is only 6 000 hours? Oh so like yeah like it. So so that's why we were like these hours could vary.

C

So we were kind of wondering if it was useful or if it's too distracting, because if you do start adding up all the hours we have for Ops Team, it's very lopsided I.

B

Mean put put it in there and if we don't like it, I'll knock it before the final proposal. You know it.

E

Sounds like if it is distracting it'd, be nice.

B

To see- and you know, I guess- for the Ops Team, it would be useful metrics to track that if we get funded- and we start doing this so that they can understand how much uh new work they can take on in the future. Or you know how many you know Labs per engineer. However, you want to measure your sales.

C

Right, Fair, okay, cool yeah, we'll have it in there, data.

D

Oh, it's good to have more day at the beginning. We can trim out stuff, if you don't want to. You know, raise it to the next level.

C

Well, I was just thinking that if somebody were to actually add up all the Ops hours it just, it would be like you guys are what like yeah. It doesn't make sense, but yeah.

B

Leave it as it is, um and again, if it's not useful, we'll trim it out in the edit sounds good, get it in post.

C

Sounds good sounds good. We should have that finished up here uh today and through tomorrow tomorrow. So yeah and I'm sorry about the entanglement but I try. We had a little bit of a hiccup there, but I tried to do my best to not untangle it.

B

Cool yeah I was okay with it. uh Whenever you're ready go ahead and push the button to update section two, whatever you guys.

C

B

C

D

Good all right anything else.

A

huh There's a nice little issue for everyone to go vote on now.

A

I thought about it: a little bit more and I've offered the porque no Los Dos option, which I think might be the best option, so um so yeah I think we're good um so for tomorrow, I don't know who's gonna be on that call entirely. I know Glenmont, because Glenn's gonna actually enjoy a vacation day, um but uh we.

B

Have an all-day meeting with the governing board yeah.

A

I was thinking that it was going to be really like, because everyone's traveling back from Tahoe anyway, so um I think what we'll plan to do. I got the whole morning to go and sit and look over that and I'll just let people know that we're doing that async all provide any of my updates and just be like all right. Everyone give me your feedback on this first draft, so we're like stamped and ready to go for Monday.

A

C

Thank you, so do you need to be there Saul or no for tomorrow? Will you have my updates.

A

If you're, on slack um as long as I can just like reach out to you I'm always on slack ooh but you're in America time, aren't you.

C

Yeah but I sleep three hours a day, so yeah.

A

Okay, cool well yeah I'll reach out to you, because you might still be asleep in my my morning in the UK but yeah, let's just async for that and I'll. Let everyone know on the stream, uh so I'll put it in the in the channel. So everyone knows not to show up tomorrow sounds good but use those hours wisely and tell me what you think on GitHub, we'll.

C

D

All right, thank you very much. Everybody appreciate it and have a good rest of the day sounds.

A

D

E

All right, bye, everybody.