OpenSSF Securing Critical Projects WG, 13 Jul 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Securing Critical Projects WG Bi-Weekly (July 13 2023)

Description

Agenda: https://docs.google.com/document/d/1MIXxadtWsaROpFcJnBtYnQPoyzTCIDhd0IGV8PIV0mQ/edit?usp=sharing

A

B

A

Going I'm here, hey Josh, hi everyone! What's what's the cabal planning for today.

C

That is a great question.

B

D

This meeting is happening: cool, hey, Josh, hey Jeff,.

B

Yeah I feel, like I've, been out of the lupus I caught a cold last last time and I was like right before I went on vacation. Fortunately, I got better before I went on vacation and then I just got back last night, so I'm trying to catch up on email and stuff.

C

No worries well, the I'd say the tldr from the last meeting was that um overall, I I think folks were happy with what we produced. um You know we, obviously we did our best with what we had.

C

um You know we're all volunteers here, um open ssf in terms of like promotion and marketing the results of our set um thought that it just didn't make sense. So um we said okay, um I, think the plan now is to get what we have to some kind of a finished state and then um I think we need some open discussion, um but also very focused discussion on um essentially how to move forward and how to do this in a more I.

C

Think, I think the main feedback was doing it in a more structured way in a way that engages the community more, um but that's kind of a double-edged sword right. You know if everyone's feedback is well, other people didn't participate in this. It's like! Well, you know you can you know we can participate.

C

You know but um I think that's the goal is you know, we'll wrap up everything, all the work, all the Blood, Sweat and Tears, that that went into this effort, get it to a good final date and then I, don't want to say start from scratch, but really start to to do it in a way that um incorporates all the feedback that we've received and um hopefully do this in a more um in a way that that gets more um um I I can't engagement there you go engagement from across the openness, success and think about, and the greater open source community so um and part of that discussion might be in a way that we can get people um excited and engaged in this working group again, because I do think you know that arduous process of you know, let's do our best to vote on all these projects and talk about them and you know, vote on them and um you know a couple.

C

Folks definitely stepped up uh David, you being one of them, but it seemed like it in some ways it might have disengaged other folks too and might have, um and that coupled I think with um you know, I think we had good intentions with trying our best to accommodate different time zones, um but I think an unattended intended consequence of that was um potentially hurting our attendance numbers a little bit.

C

um So um with that, and of course you know everything I'd like to think is driven by the group and not just myself or Jeff or any one person. So, um of course anything is up to um to discussion here um and you know I would um whatever the group. However, the group would like to move forward.

C

David, does that sound about right with the kind of um I know you were in the attack meetings as well, um and um you you gave us a lot of good uh feedback and things to think about for moving forward. So does that sound like a pretty good plan.

A

Yeah I mean General is part of the plan. um Again it's you know, I I completely agree. I mean great great summary that we need to be more engaged, so it was definitely feedback with the openness is happening, the community in general and again it's part of the engagement in the dopen ssf. As you said it, or is you know who both who's producing the information? What's what are these recommendations from and who are the consumers I think we sort of you know.

A

Essentially, where do we fit into the open ssf pipeline of the rest of the sigs and working groups of attack? I. Think that that to me is the um the the real you know: root cause. You know.

E

C

One thing that made me got me thinking a lot when we were talking about uh Jeff. You brought up the idea of like the road show um which um conceptually I really like and um but I wonder, like part of me, starts to wonder like is it starting to look like it's like? Is this turning into a survey like I?

C

Don't I I'm curious like what the balance is of what we're trying to do with basically serving the open, ssf or the open source community and surveying them on what they, you know think are the most um yeah.

C

You know critical set of projects and I think this ties into what you said earlier, David I think is I. Think we have to just be painfully crystal clear about. You know the the main, um the main act, the the main aspects or data points of what to say. I.

B

Think the first, the first survey we would want to do is not. What do you think is critical, but what do you think is a useful list with what parameters like uh what would you use it for and what are what would? What would you want to see as points of consideration for the list right, uh so we could say like. Is this something that it is a set of critical projects, something that your working group can use and if so, um what are the?

B

What are the restrictions needed on that to make it useful for you.

B

So I think I think the Roadshow should be um here's. What we did. You know, here's the list, here's uh how we made the list. Can you use it as is? Do you have any feedback on our process?

B

uh What would you like to see in the next version that kind of stuff or like like with you, know uh like what considerations did you like taking in? How does that sound.

C

Excuse me um conceptually I think it certainly makes sense um and I suppose I suppose we can. We might be getting um I, think it's a good idea. Yeah um now going back to kind of wrapping up the current version um and getting what we currently have to a finished State.

C

um How do we feel where we're? How do we feel we're at progress wise with um with that? Do we feel like we're very close? um Do we feel like there's more work that needs to be done? uh I see there was a lot of feedback from the last meeting about the set of uh about our current set of projects, so I'm curious as to where we're currently at.

B

Did we ever find the missing packages like I, think I, think David started like the document he copied? The first tab, I didn't even include any of the second tab. I like I, don't know that we actually finished cleaning up the spreadsheet before we started the document.

B

I can't remember.

C

Yeah I'm, looking at so I, think one of the key documents is that critical, open source software projects 2023, which I believe was going to be the article or the blog post, and that has the set um in there I think it was just copied right out of yeah.

B

But that's the set, that's the version. 1.0 set. Oh okay,.

C

Right, so that's probably not what we want to use well,.

B

Because we haven't actually merged, we haven't taken the second tab. That's got the yeses and no's and taking all the yeses and merged it with the 1.0 list.

C

ah Okay, um so is.

B

That some sorry go ahead yeah. The second thing I thought was something we should think about is like. Is this selection reasoning, justification and still useful, I think when we did 1.0, we made sure to capture that, but on this last iteration uh we didn't we, we have some notes, but they're, all more like for ourselves. I think so.

B

Just just kind of calling out like like Docker download counts isn't really a um a reasoning it's it was. It was a reason why it was put on our plate, but not a reason why we decided it was critical. So if we like conclude that that's going to be very um misleading to the reader to how we like how he did the the list- and you know saying that- oh we put this on here because it's highly downloaded or something um I, don't know what we could put.

B

If you know, if we, if we needed to go for the notes or for the column there uh instead or if we need to have something at all.

C

Okay, um real quick though I'm so sorry um Josh did you want to get a chance to um introduce yourself or um um we usually do like a round of new faces, so I yeah I realized that we jumped over that sorry.

D

Yeah, sorry, no, no worries yeah. So um thank you by the way I appreciate that um I, um so yeah Josh I am a a coordinator in the ospo at uh ADI. um Chiaspo is relatively new. It's about a year year and a half old at this point, but they've been they've been doing open source for a long time.

D

um I was hired about six months ago. This is my first open source job and I'm, loving it. uh I got to go to the open source Summit in uh in Vancouver recently and I uh I signed I, signed up for the open ssf day and made the mistake of telling my boss that and now he's like cool you're, the open ssf guy now I'm like oh okay, cool, but no it's cool, so I'm, still kind of like getting my feet. Underneath me uh trying to figure out.

D

You know you know where, where I can help out where, um where I just need to get plugged in and stuff, so, um but so far, everybody's everybody's, very nice, and um it's it. This is really important work, so so I'm I'm totally on board. This is cool stuff.

C

Awesome, thank you Josh and welcome. Yeah I'd say as far as communities go to open source. Community is one of the one of the best, so you're you're in good company.

E

C

To have you um I think your feedback or Insight would be really good, because you know Jeff, David and I we're so we've been doing this for for quite some time now um so I think having a a uh a unique uh point of view um will be very helpful, so please feel free to jump in at any time or provide uh feedback or your thoughts and they're very welcome. So awesome awesome thanks! Well, yeah, of course, so.

C

So we're talking about basically getting to a final V 1.1, essentially and looks like to do that. We need to combine, combine V 1.1 with 1.0 and remove the duplicate. Is that what you're saying to.

B

Yeah I think we were like focusing on writing the text and we didn't actually finish the list for the announcement. So uh I think it's a little bit premature to get all that review or comments. But that's what happened.

C

Okay, um well, let's do it I'm gonna share my screen, um I'm gonna say at least we can dedicate 15 minutes to um to getting this to a finalized state. So I might need a little bit of help and guidance from the group but um yeah. Let's do it I'm trying to see here.

E

I'll, do it okay,.

C

There are some comments, I think right.

F

E

E

B

We can uh take that into account next time. I guess.

C

Yeah I would say our justification for now is probably still reasonable and and then we have V 1.1.

F

B

E

That should be called framework. It should be called laravel. That's.

C

Right, okay, so maybe if laravel is already on here, maybe we could even just take this out yeah.

A

I, don't think you mean duplicitous.

C

E

What does duplicitous mean.

C

A

D

Yeah, like two-faced.

C

Oh, oh, okay, yeah thank you for correcting me, David, all right, so we're getting another framework there. Okay,.

E

C

I mean I'm glad to see we have people discussing, I mean I, think that was the intention here yeah. um We wanted it to be something that people could curate, um but we're yeah. That's for later. Okay,.

B

So is this: Apache is.

F

B

Should be Apache httpd.

C

This one here, yeah.

B

Yeah and we should update that link too.

E

C

Don't know actual like yeah I want to just make stuff up here all right.

F

B

Thank you yeah, so I think stats comment is addressed. Six, the six star I think, is fine to say it's the whole tool.

B

Makes sense so he's so he's saying it makes sense that we just say six star.

E

C

So now we're gonna basically combine the 1.0 with the 1.1 uh and what V 1.1 and remove any duplicate.

B

Yeah, so we should just copy all the yeses from the second tab onto the first tab.

C

C

These are all of the yeses from.

E

Thank you, gosh darn, it okay.

C

I need to get a mouse trackpad.

C

C

That's how we have a reluctant yes here, okay, so I did that correctly, which I probably didn't.

C

C

Okay and then there's probably I would have met I'd. Probably imagine there are some duplicates here. Is there a relatively simple way to.

E

E

Maybe I should.

C

Or potentially, destroy this.

F

F

F

Maybe it's just yes.

E

C

But now subscribe all right.

B

Maybe you need to delete the first row: yeah, okay,.

E

C

Anyway, since this is my copy I'll, just clean.

E

F

F

See if this works now.

E

C

All right, this is taking so long. Y'all no worries.

B

I, don't know how to do this. Yeah.

B

Yeah, all of these have DNA emerged or what that's weird.

C

Oh, my goodness, okay, maybe then.

F

Okay, no! No! Okay! We got this.

C

I think some yeah, D and E are merged. Maybe.

F

C

C

Oh, my goodness, I swear I'm better with um it's the pressure. Okay, let's see if that makes it.

B

I think you need to only select.

A

B

Mean everything's select.

A

4 to 160 you're, all split.

C

It looks like there's, probably 13, duplicates.

B

Yeah I think you need to select all the cells, but then only check a when it has all those check boxes. Oh okay, that's my guess.

F

I'm gonna try.

C

Oh yeah yeah nice job I'm glad you noticed that because I I would have just kept clicking stuff all day.

B

Okay, but wait I, think Colin e had some stuff in it for the ones at the bottom.

B

Those are gonna, be misaligned. Now.

E

B

uh Just uh undoing redo it okay to eat as well.

F

C

F

B

We'll probably have to look through it again because there's like there might be like kernel and Linux kernel.

C

Yeah, that's a good point, but.

B

Maybe maybe we should alphabetize it and just scroll through real, quick, okay.

C

um Okay, so that was on that kind of test. um Oh.

B

C

But I wonder: okay.

E

E

There are numbers so.

F

E

E

F

E

E

I'm sorry y'all I needed a mouse today of all day unearned.

E

E

C

C

I can just copy and paste this yeah to um I guess we could go through it. Real quick see if there are any duplicates.

B

I'm gonna sort it by name a.

E

E

All right, let's do this.

C

Pardon my ignorance, our go and going the same thing. Yeah.

E

Okay, so let's go and going.

E

And then there's Linux and Linux kernel.

C

But are those are different, I believe correct. No.

E

C

I believe these two are different as well: correct, yeah, yeah, okay,.

F

E

C

E

I had Linux and Linux kernel.

E

E

We have Linux and Linux kernel: okay, yeah.

B

I think you missed the rest of the columns there in the sort.

E

Yeah I shouldn't have done that. Okay.

B

E

B

The whole sheet and then sort it.

E

F

F

F

E

E

So we can remove this second Linux kernel, yeah.

E

And then the other one that we had, that was a duplicate, was.

B

C

Ah That's right going going.

E

Because we have different urls.

B

Probably I'll go to the same place. Oh, it's a mirror: okay! Well, there's GitHub Google source and go Dev. Okay,.

C

um Is there one that's more succinct than you is go laying more to think than go? It.

B

I think we should call it go. Okay,.

E

C

So got rid of golang, uh which I believe was.

E

C

Those were the only two that were not duplicitous but duplicates because PHP and PHP Symphony are different. Yeah I think everything else.

C

Okay, so I'm gonna. Now, although no I did get rid of the name. Okay,.

B

Yeah, so we've got the different columns now for like the old list and the new list. Oh okay, some of them we wrote like little I mean I. Actually, most of them, we wrote little descriptions on like what our thoughts are.

B

I, don't know which ones what we want to publish in officially, if.

F

B

Have any column, that's a like a justification.

F

C

Honestly, I think.

C

I mean if I, if this is kind of like the the just the display of what we came up with I, think you might even be right that we probably just need.

C

I mean the name of the project, a URL, maybe that's it.

C

I mean we could keep like just the justification and notes just to show that you know we didn't just pull this out of our behind, but.

B

I mean we definitely need to keep that in our spreadsheet but like if you like, a document or a little or if you do that, little website publishing thing: GitHub pages, uh that's what we're going to point! People at and.

B

You know I just see I see over and over people commenting like Docker, unlike if it says, Docker pull account that that's like a bad way to decide things or.

F

If it says criticality.

B

Score they're like criticality, scores, bad, you know, or or whatever it says you.

C

Know right yeah seriously.

E

B

Yeah we do have two columns like we do have two URLs where we try to like have canonical Source repository and the project website homepage I like that like. If we can keep that I, don't know, or we just have one.

C

Yeah I mean I guess at the end of the day, all people want to see is what we came up with right. So maybe just these two and maybe yeah just the URL.

B

Yeah I mean I feel like went and did it went through every project and came up with a really well-worded justification. Then we could have it. You know, um that'd, be like a whole nother few weeks, a few weeks of work.

C

um Not to put you on spot I'm curious Josh, do you have any initial thoughts or Gata.

D

Oh I'm, totally on the spot, um you know um I actually have, as you were kind of flipping through the list. I was like this is a this is a really good list. These are all really important things like like I've heard of basically all of them, so it's pretty cool I'm glad to see things like that Warden on the list as well.

D

um So, even though there's like a commercial company behind that, it's still making the list, um but yeah I think this is. uh It just seems like it's a good idea. um All of this stuff and yeah the the whole having to go through everything a little like it has to be cleaned up. I think that's just all there is to it and yeah I agree like being clear by using saying golang instead of go is a good idea um and also making sure that yeah Linux versus Linux kernel like yeah.

D

Those are obviously the same thing, even though they support things like like Android and other, but yeah all the components of a Linux distro to be considered separately, I think because they are put together based on the needs of the the person using it so yeah. No. This is this is uh good stuff.

C

Oh, thank you Josh and I'm. Sorry, to put you on the uh please feel free to keep coming to our meetings.

D

Nope not anymore I'm out no just kidding I'm gonna put a big label on it, not friendly to introverts.

C

C

Just kidding okay.

C

So I mean for a final, more or less to close this out. We just have you know the name of the project. A URL- and you know this I'd say- is a good set of projects, at least for.

C

A final product of all of our efforts, people can use this I would say: I mean I, know it's already being used to some degree by project Alpha.

C

um We did something with it earlier with that great MFA project. um You know.

E

C

Can use this as a as a as a data point justification point for um facilitating security audits for these, for these projects, um so I'd say I mean if the objective was to kind of close out the set and have something.

C

I'd say this: if it's a bill.

E

Yeah I agree: okay, all right nine, so I'll just do here out.

D

Of curiosity, what was the, what was the tasking like what we're, what we're set out to to do.

C

Well, the goal essentially was to come up with a set of of critical projects in the open source ecosystem.

C

um It was kind of. It was meant to be pretty vague in that sense, because um that was kind of where our starting point was, and then we for the last year we've done two iterations or basically a year and a half we've done two iterations here um and then it was basically presented to open up the stuff and open ssf attack and they provided some feedback on it. Some good feedback on kind of where to go next um and we are kind of incorporating.

F

C

So what we're doing is um finishing out, basically the the the sets we've been calling it a set also because list all folks, a lot of folks got caught up on lists and you know and and implied prioritization upset list. You know, you know they see a number one and they see a project and they think that's the number one thing you know um so we've been calling it a set to kind of just diffuse that um and then yeah I would say. Probably the next step would be.

C

Let's take everything we learned from the feedback. We got from doing this and kind of to a better another iteration, um but really I. Think being more mindful of of some of the things that maybe we rushed through the first time um and then you know incorporating all of that feedback that we got.

D

Nice, okay, yeah.

F

D

Saw that all the previous meetings are up on YouTube, um do you think those are worth worth watching.

C

So some of them through this.

C

Might feel repetitive, but it might be a good way to see kind of how we discuss things, how we talked about things um and then um so yeah I would say so.

F

E

A

It's looking very good, so I need to get to another event.

C

um Okay, thank you. David, we'll see in two weeks.

E

B

C

B

So, what's the next so now you know, we've got this polished up, I'll, take a look at it and see if I can find any other problems um then make everything. Clear Solutions clarify inputs, outputs! Oh that's what we already said, or was that last one? That's this one um yeah! What do you think we should work on next? Do we need to work on the text more?

B

F

B

Are you gonna still go with that, or would you want to start over.

C

No I I think that's a great place to start. We should start I think maybe by capturing you know all of the basically the metadata. You know the context that people you know one way or another didn't get, um and maybe just start by literally listing them out and start writing them out um so I mean we kind of did something like this, as you know like when we started this yeah when we started this last year, but I think really.

C

um What we need to do is um essentially something like this, but that captures things like you know. You know who is this for?

C

um What is this.

F

C

Those high-level questions that I think when we go about showing this again, you know, ideally it should be. You know listed along with this stuff.

E

C

Know so we could have a couple bits of information at the top, almost even like a little bit like, um even though I know we're not using this but David um the thing that David started working on here, where you know have like an introduction. You know what this is, what it is and um kind of setting out the those things that people didn't just didn't get from from this.

C

But also in a way where, because I feel like no matter what we do, um you know we're always going to get people saying you know oh well poking holes in it essentially and that's fine um but I think if we can cover as much as many of the bases as we can.

C

So, do you do you think, should we create like a a new document, then.

B

I don't know uh I I can't decide what I uh I'm not I'm, not clear on like what we wish. What our, what we want to do with this iteration.

C

B

C

Meaning the one we just finished, yeah.

B

I, publish it on a GitHub page. Are we doing anything? Are we just saying, okay, the spreadsheet? Is there we're done and we're gonna like? Maybe do the road show like uh what do and what is like, so open, ssf marketing is saying: they're not gonna. Do they're not going to do a blog post, but we should just publish it. I I, don't know I kind of like. Is it up to us what we want to.

A

B

As like, our GitHub pages is goes.

E

C

These are all excellent questions, um I think you're, absolutely right, I mean just because we're not marketing this per se like publishing it I think we could definitely still do.

C

Something like the concept you mentioned with the road show, um because that will help I think I think get engagement. It'll help ideally get people who are going to show up and help us with this. uh Instead of just wait for something, and then say you know not enough, people participated um so, hopefully we'll get more participation.

C

um Okay, so I think it would be I mean for a current D 1.1, um because another thing we could do too, that might I know it might circumvent like instead of going to all these different working groups. If we.

C

Because I feel, like the attack, has a good representation of people in all the different working groups.

C

um So if we could potentially kill you know, I, don't like this expression, get a bunch of things done with one stroke or whatever um you know we can maybe just go to tack and and for the Road show and have like a very specific ask, um or we really. We literally could do like more of a road show and just.

B

Go we actually need to go, I mean go to the working groups, uh you know if we want, if we have something that we think we want to get out of it like again like are we asking for participation? That's I think where that would be premature, because we don't really have an updated process to like do another list with more participation.

B

um Okay, how are we asking for ideas? Are we asking like? Are we trying to just promote our current list and say: hey? Would you like to use this?

B

um Are we asking, for uh you know ways to make our list more relevant? If that's needs to be, are we asking yeah I, don't know what we should. We should have some we should. We should have an idea what we want totally.

E

C

um um I I mean you saying that got me thinking that maybe we could basically do internal promotion yeah, basically, but I think we could potentially do it asynchronously in that. If we, you know, I, think every working group has an email list and a slack Channel. So we went to every single work group and said hey. This is um the 1.1 of our set of critical projects.

C

Here's a survey of a couple of questions, so I liked what you said about like how can you you know? How do you see this being used? Can you can you use this and how could you use it um and then we could also use it as a mechanism for getting feedback in terms of like how can we automate or not automate this? But how can we do this in a way that maybe more sustainable and more efficient, um so we could potentially do with that. We could do two things.

C

We could share the results of our work and show people that we actually produced something. You know we weren't just talking about some. We weren't just talking ourselves in circles. We came up with something at least yeah um and then get basically feedback and I put. Ideally, it could give us both feedback and get people. You know at least aware of what we're doing that could potentially drive more participation.

C

So maybe yeah just like share that, along with survey to all working groups.

B

Yes, I mean: if we're gonna go. Look you know I'd be happy to to try to do do more of the you know, presentations to the working groups as many as I can do, but I think we get a little bit more engagement that way than slack or email. Email, I think is pretty dead. Slack I think if we Post in Maine, like people will see it but I don't know how many people will respond.

B

um Yeah to the point, people like to go to the meetings- and you know, discuss yeah.

B

But it definitely slack, will you know we can do slack um I, I I? Think we, if we're gonna, say like here, is the list? uh Can you use it? We need to have the um not just the the spreadsheet but the the description of what it is and how we made it so that they can look at it or you know we can show it and they and people can come back and see like um they can answer the question. Can you use this because they the way that they can answer that is based?

B

Is you know knowing how what what decisions and where were made going into it, foreign.

C

So like providing that further context.

B

Not so much that, but the the way that basically like these things, were our process, like the description of our process, um I, think it's important to cover. So I mentioned this. One I put this in the notes for the last meeting that wasn't there, but, like I, think it's important to cover the fact that, like we haven't considered every project in existence, you know like.

E

B

We don't this, isn't the top 100, because there are things we haven't considered yet um there. You know that thing projects were proposed to us in a variety of manners, as well as some automated uh scraping that we did and then the way that they were proposed didn't dictate the way they were approved. You know like if.

F

It was proposed.

B

Due to criticality score, that wasn't the reasoning why we said yes to it.

B

um That was just how it got on our plate. So all that stuff I think we need to put like I. Think David's document like tried to capture some of that I. Don't I think it still needs work or you know, but we need to have if we're going to do. If we're gonna do something with this list.

B

I think we need to to have that published somewhere either. In the you know, a completed word doc or or on GitHub pages.

E

C

Right, um okay, so that's a good idea too then um clean up and put on GitHub.

C

So we would clean and clean it up a little bit, maybe um provide that contextual information so that actually kind of ties into well. It does two things because, like we want to I, think you're right, we want to capture the process and what we did in some way. So.

E

C

If it's a very high level, like the list of you, know what the process was like, that would certainly help.

C

Give people the context they would need to give us the feedback and the engagement that we would that we would want, because you're right I mean we don't want people to just yeah okay, um but that that brings up a great point about um basically capturing.

C

um Capturing basically the The Meta, the metadata, more or less so like you were talking about.

C

Process to you, limitations um intended use, I, guess um and and and and this came up a number of times too and I think maybe we should if we could make at least come no consensus on it about like what is what? Basically, what is the unit we're using? Because you know we have some sure that our open source projects but they're, like they're repositories and the way I.

E

C

Thought about it for a long time was that, like the minimum unit is like a software package, basically an open source software package, um but you know I, think other people have different opinions on that. So I don't know if we can come to an agreement on that. Like saying you know what exactly it is that we are showing you like, we are showing you open source packages, not necessarily like collections of packages or repositories of packages or I.

B

Think what goes beyond that I think we're showing projects, so a project might consist in multiple packages like Apache, isn't a project. It's a foundation. It's got. You can't call every Apache software piece a single project, but you know you might call six store a project right or kubernetes is probably stretching the limit of what a project is yeah, it's probably beyond that, but we still have kubernetes on there, but you know, like even entire distributions, are pretty much.

B

We maybe that wasn't why we stayed away from maybe there's another reason why we stayed away from those but um um yeah I. Think package is too small, but some I agree with you that, like some description of what we're trying to identify here is good and I think it would be like some attempt at describing what is a project and what is greater than a project. You know right.

C

Exactly so even having some of that, because I.

F

Know yeah, yeah and.

C

I think that was some a lot of the feedback that we got here like from other folks, like um you know, who's the consumer. What do they want clear about the input and output? All that stuff? You know, um so this is I. Think really good I think we've made some good progress. We at least have you know a cleaned up.

C

You know very straightforward set of projects that we said we would produce and I think we're at around 150, which is pretty good um there's more than enough in terms of needs for resources out of these 150 projects, um and then yeah we'll continue talking about how will um How we'll leverage what we already have and and get and promote it internally, and also how we will um how we will iterate and do a more kind of sustainable, ideally um yeah, more sustainable, less manual, um more Community, curated driven process, um but I think to do that.

C

We have to be very clear about. You know what it is we're doing and and all that stuff so we'll we'll definitely incorporate all of the feedback.

C

I'll feedback from.

C

um So with that um actually come to think of it, uh Jeff real, quick I think, oh sorry, um I think in two weeks I might I will likely be out of commission um I'm, just letting you know that now in case I am not available in two weeks. Yeah.

B

So no problem, yeah I'll, be I'll, be there um I'll try to make sense of both what David has in his talk and what we have in our process docs and see if I can start coming up with something new that we can use as an opener for the list for when we presented it just so that people know what it is.

E

E

C

um Well, with that, I think we're at time um thanks everyone for the discussion participation. Thank you, Josh for for participating and.

E

Absolutely all.

C

D

E

You have a good weekend. Everyone.

D

Yeah you too Jeff take care bye.

E

C

I, don't know what I did but I'm like sharing my screen on zoom and I'm like minimized everything. So I can't see.

F

I can't see what I'm doing like.

F