►
A
A
A
Day
is
20th
of
October
and
I.
Do
send
my
apologies
for
not
being
able
to
attend
the
last
two
meetings
but
excited
to
be
back
here
with
everybody
and
hear
about
what's
been
going
on
with
everyone
and
progress
made
on
some
of
the
things
we've
been
working
on
to
start,
do
we
have
any
new
faces
or
folks
where
who
are
either?
This
is
their
first
meeting
or
one
of
their
first
meetings
and
would
like
to
introduce
themselves
and
what
they
do
and
how
they
work
with
open
source.
A
C
Yeah
and
sorry
I'm,
camera
off
I'm
I've
been
recovering
from
a
cold.
So
thanks
for
taking
this
on
Amir,
of
course
yeah.
So
we
had
our.
We
had
a
hiccup
with
getting
started
on
our
alternating
meeting
time,
so
we
had
like
two
that
were
Amia
friendly
and
then
we
had
to
change
it
kind
of
at
the
last
minute
for
the
last
meeting,
but
we've
got
it
on
for
next.
C
You
know
this
last
meeting
was
APAC
friendly
this
one's
early
and
then
the
next
meeting
on
the
third
will
be
our
standard
Apec
time,
then
the
one
after
that,
our
normal
morning
time
and
then
after
that,
we're
going
to
switch
to
a
new
Apec
time
based
after
the
time
change,
Northern
Hemisphere
goes
backwards.
Southern
hemisphere
goes
forward,
so
it
actually
makes
it
easier
for
us
to
overlap
times
and
we
can
get
a
time.
That's
Can,
more
inclusive
to
all
people.
C
C
C
A
A
So
yeah
wishing
you
a
speedy
recovery
and
yes,
hopefully
yeah
we'll
get
in
the
in
the
get
everything
updated
on
the
calendar
and
ideally
if
we
can
get
them
to
the
openssf
events.
Folks,
who
manage
the
calendars
to
just
update
it
kind
of
indefinitely
going
forward
or
six
months,
or
what
have
you
yeah
and
overall
do
folks
are
folks
liking,
the
the
alternating
timelines?
A
A
Yeah,
that's
a
good
point,
so,
okay,
good
good,
yeah
and
and
of
course
you
know,
the
intention
was-
was
solely
to
to
be
more
inclusive
and
to
to
include
you
know,
folks
from
different
time
zones
as
well,
so
great
I'm
happy
to
hear
that's
going
well
and
yeah
so
for
the
next
meeting,
November
3rd,
that
will
be
on
the
Apec
friendly
time
cool.
So
I
was
looking
at
some
of
our
previous
notes.
Talking
about
the
charter
and
looks
like
maybe
at
the
at
the
last
meeting.
A
We
didn't
have
enough
people
to
feel
good
about
a
quorum
which
I
believe
is
just
a
it's
just
when
you
have
a
large
enough
group
of
people
to
call
a
vote.
I
believe
so.
Is
that
something
that
we
are
ready
for
in
this
in
this
meeting
that
we
have
today,
or
is
that
something
that
maybe
we
should
hold
off
on
I'll
I'll
I?
C
Yeah,
you
haven't
really
missed
anything.
Amir
I
think
we
haven't
made
any
kind
of
changes
or
discussions
on
the
charter
in
the
last
few
meetings.
We've
just
kind
of
I
think
we're
pretty
much
okay
with
it
and
we
just
kind
of
looked
around
and
said:
hey
there's
only
like
you
know
five
or
six
people
here.
Let's
put
this
off.
Okay.
A
A
E
Between
you
and
Jeff,
as
as
the
co-leads
of
the
of
the
working
group
in
absence
of
a
a
a
quorum,
a
charter
really
is
about
what
you
know
what
the
Norms
are
for
the
working
group,
and
then
you
two
dictate
that
so
so,
ultimately,
you
know
an
absence
of
a
quorum
and
to
get
just
to
get
the
charter
ratified.
You
guys
can
between
the
two
of
you
can
both
say:
hey
yeah,
let's.
C
E
This
and
then,
of
course,
should
anyone
who's,
a
a
member
of
the
working
groups,
look
read
the
chart
and
say:
hey,
there's
some
things
we
need
to
change
in
the
charter.
At
that
time,
you
take
a
vote
on
whatever
changes
to
the
Charter
need
to
occur,
but
for
the
purpose
of
ratifying
the
charter,
that's
a
you
and
Jeff
situation.
That's
that
that
doesn't
mean
that
doesn't
need
to
wait.
Oh.
A
A
So
then,
what
we'll
do
then,
is
we'll
take
an
action
item
for
both
Jeff
and
I
to
just
to
to
make
sure
that
the
the
charter,
as
best
as
it
can
accurately
conveys
you
know
what
the
Norms
are
for
the
working
group
and
and
and
how
things
are
to
be
operated.
I
think
most
of
it
should
be
perfectly
fine,
but
I
think
just
for
due
diligence
sake,
we'll
take
a
look
at
it
and
make
sure
it
accurately
reflects.
A
You
know
what
we're
looking
to
do
in
terms
of
activities
for
the
working
group
and
by
the
next
meeting.
We
can
essentially
ratify
or
accept
it
and
that
way
it'll
be
formally
adopted
and
then,
as
you
said,
JM
any
any
updates
to
that
or
or
feedback
are
welcome,
really
anytime
before
or
after.
But
it's
always
welcome.
So
we
can
go
ahead
and
move
forward
with
that.
C
Yeah
I
mean
I,
think
we've
discussed
it.
You
know
if
we,
if
we
add
up
all
the
meetings
that
we've
discussed
it
I,
think
all
the
people
that
we've
wanted
to
make
sure
they've
had
a
chance
to
you
know
raise
any
concerns
have
been
there,
so
maybe
not
all
on
the
same
meeting
but
yeah
again
right
now.
If
anybody
has
any
concerns
we
can.
We
can
discuss
them
too,
but
otherwise
I
think
we
can
say
you
know
we.
A
A
C
Yeah
I
am
I
had
this.
This
was
something
we
were
discussing
last
meeting.
So
if,
if
we
go
to
our
our
repo
under
initiatives
and
then
identifying
critical
projects,
we
kind
of
have
the
the
previous
work
or
and
also
links
to
like
the
Harvard
studies
and
such
but
the
I
believe
you
know
your
process
for
identifying
that
you
wrote.
Amir
is
all
you
know,
kind
of
agreed
upon
that
we're
what
we're
working
on
now.
C
You
know
where,
like
our
current
work,
should
we
should
we
collaborate
more
in
the
working
group,
people
and
say
hey.
This
is
or
this
is
what
we're
currently
doing
and
can
we,
you
know
just
kind
of
cut
and
paste
that
into
a
mark
down
there,
or
should
we
keep
working
in
that
Google
doc
because
I
think
not
everybody
sees
it
at
the
top,
even
though
it's
at
the
top
of
this,
you
know
meeting
notes
here
as
important
documents
key
documents.
We
don't
always
see
that
there.
A
A
I
I,
think
that
makes
sense
yeah,
especially
because,
like
you
said
Jeff,
sometimes
the
things
can
go
unnoticed
or
or
they're,
not
as
easy
to
find,
and
so,
if
we
start
basically
just
using
the
repo
as
our
central
body
for
all
of
this
stuff,
I
think
that
will
make
things
easier
for
everyone.
So
Randall,
you
have
your
hand
up.
D
Yes,
I
also
have
updates
from
Caleb,
because
him
and
I
have
been
working
on
getting
criticality
score
for
use
in
that
context.
So
we
we
don't
have
it
a
hundred
percent,
but
there
is
a
lot
of
work.
That's
already
been
updated
for
this
use
case
in
the
criticality
score,
so
I
just
wanted
to
say
that
awesome.
A
Okay,
okay
yeah,
so
unless
we
have
any
objections
to
moving
the
process
to
markdown
and
putting
it
in
the
repo
yeah,
we
can
certainly
move
forward,
but
I
just
wanted
to
make
sure
we
heard
from
everyone
or
in
case
someone
didn't
get
a
chance
to
provide
any
feedback.
But
are
we
overall
all
good
on
that?
A
A
D
Yes,
so
Caleb
and
I
met
a
couple
times
to
do
a
couple,
modifications
and
yeah.
So
we
have
the
GitHub
enumeration
part
already
like
sorted
so
now
we're
working
on
the
like
how
it
would
actually
work.
So
I
know
that
one
of
the
line
items
was
to
describe
how
the
GitHub
repo
would
work.
I
think
we
can
do
that,
probably
after
next
week,
because
we
should
have
it
finalized
about
how
the
most
Optimum
way
for
us
it
would
work.
D
D
A
D
A
D
But
I
know
that
when
we've
talked
in
the
past
that,
when
you
add
hard
numbers
to
packages
or
to
projects
like
that
that
it
could
start
creating
like
a
ranking
and
like
a
competition
and
I
know
that
we're
much
more
in
sets,
it's
kind
of
what
we're
talking
about
so
yeah
and
I
know
that
we've
talked
about
also
in
the
past
about
how
the
criticality
score.
Some
people
have
problems
with
the
way
that
score
is
generated
as
well
and
I
know
that
we
don't
want
to
really
get
into
that.
So
yeah.
D
A
C
A
D
The
person
that's
going
to
review
it
or
merge
it
has
that
information
there,
because
we've
talked
about,
for
example,
what
happens
if,
for
example,
there's
a
project
that
hasn't
received
a
commit
in
a
really
long
time?
And
yes,
we
also
talked
about
what
happens
if
this
project
happens
to
be
something
like
xorg.
That
has
a
really
strange
commit
history,
because
you
know
it's
been
around
forever,
so
yeah,
so
we're
trying
to
get
all
of
that
stuff
to
paste
that
on
there
nothing
is
like
you
know
like
disqualifies
anything.
D
It's
just
supposed
to
be
like
the
data,
so
people
could
see
how
I
guess
in
a
certain
way,
like
the
health
of
that
project,
not
as
much
as
like,
because
I
know
that
in
the
past
we've
had
like
suggestions
about
rating
security
and
stuff.
Like
that
and
I
know,
we've
talked
also
in
the
past
about
how
now
we
want
to
stay
away
from
that
with
criticality
score,
because
we're
really
just
measuring
how
critical
something
is
to
an
ecosystem
or
to
the
ecosystem.
So.
A
Okay,
wonderful
and
yeah.
It's
definitely
seeming
like
like
we'll
use,
basically
the
GitHub
repo
as
a
way
to
really
kind
of
keep
track
of
this
and
keep
track
of
of
changes
because
yeah
I,
don't
think
I,
don't
think
the
the
Google
sheet
I
think
it's
good
for
maybe
collecting
that
information.
If
we
wanted
to,
let's
say,
share
it
or
display
it,
but
in
terms
of
kind
of
managing
you
know
the
the
the
process.
D
You
can
always
schedule
GitHub
action
so
like
as
I
said,
I
know
that
there
has
been
talk
about
how
we're
going
to
maintain
this
set
of
packages
like,
for
example,
if
there's
something
there,
it
doesn't
get
a
commit
for
a
really
long
time.
Will
it
still
be
eligible
for
being
there?
You
know
and
I
know,
we've
talked
about
so
there's
all
sorts
of
stuff
that
we
could
talk
about
down
the
line
about
how
this
list
would
essentially
get
maintained.
D
A
G
Hey
sorry
to
interject,
this
is
Rob
Underwood
from
Goldman
Sachs
I'm.
The
lead
of
the
open
source
program
office
here
just
wanted
to
quickly.
We've
we've
shared
this
feedback
with
the
Linux
Foundation
a
ton
of
times,
but
for
our
organization
at
least
and
I.
Think
for
others
in
our
industry,
Google
just
Google
Google
Sheets.
What
have
you
is
a
non-starter
like
you?
Just
we
can't
even
access
it,
so
I
just
wanted
to
put
a
plug-in
for
GitHub,
which
we
can
use.
G
So
if,
if
anything
that
we
can
do
to
to
drive
stuff
towards
GitHub
or
email,
and
not
so
much
on
slack
or
Google
or
like
you
know,
Google
Sheets
I
know
they're
super
helpful,
but
for
our
just
speaking
purely
from
our
industry
and
I
I
think
there
might
be
someone
from
City
on
the
phone
as
well,
but
it's
it
slack
and
and
Google
Sheets
are
are
almost
non-starters
for
our
our
industry.
So
if
we
can
just
get
up
great,
thank
you.
A
G
D
That
actually
has
come
up
before
in
glossary,
and
the
solution
we
came
up
with
glossary
was
to
build
a
very
simple
front
end,
which
is
possible
because
we
have
Anthony
on
the
phone
which
is
kind
of
the
moving
Force
there
to
do
that
glossary.
So
if,
if
it
is
necessary
to
build
like
a
front
end,
that's
not
tied
to
anything.
D
F
Yeah
on
the
line
that
Toronto
was
talking,
I
I.
Imagine
if
wouldn't
be
possible
in
the
future,
when
I
have
like
how
the
ingestion
layer
don't
to
provide
some
API
small
API
or
data
fit
that
can
be
consumed,
consumed
by,
let's
say,
to
depart
applications
and
this
kind
of
stuff.
So
we
don't
necessarily
rely
only
on
a
front
end
or
on
GitHub,
like
people
can
consummate
their
our
skin
they
into
their
own
scanning
or
our
own
systems.
D
That
also
came
up
and
we
have
a
solution
for
that
which
is
a
commit
button.
So,
from
the
front
end
you
can
actually
are
going
to
be
you're
going
to
be
able
to
add
glossary
terms
from
the
front
end.
However,
there
is
a,
however,
which
is
we're
using
GitHub
authentication
to
sign
these
commits
because
they
need
to
be
verified,
so
that
is
one
kawinky
dink
to
the
issue
that
yes,
we
can
make
a
dialog
box
where
you
could
like
just
fill
out
what
you
want
to
add.
D
However,
you
still
have
to
be
signed
in
with
GitHub,
so
I
don't
know
if
there's
a
workaround
for
that,
but
I
know
that
that
was
suffice
for
the
glossary
team
because
they
had
a
similar
concern
about
adding
things
to
the
list
and
what
happens
if
you
don't
know
how
to
use
git
or
GitHub,
and
this
was
the
this-
was
something
that
Glenn
from
SKF
actually
contributed.
So
yeah
I.
E
F
Yeah
I
was
thinking
more
only
like
to
consume
the
data,
not
necessarily
to
input
data
like
we
can
can
have
our
front
end
in
the
future
to
input
data
if
people
are
not
use
it
to
really
open
PRS
in
GitHub.
So
we
can
do
that
via
front
end,
but
more
in
terms
of
consuming
ismo
API.
That
can
allow
us
to
retrieve
the
current
set
and
filter
out
and
this
kind
of
stuff.
D
A
You
know
to
be
to
be
on
the
slit
on
the
set
of
of
critical
projects
and
I
I
like
it,
because
it's
a
way
that
you
know
we
can
see
in
a
very
transparent
public
way.
You
know
what
people
are
suggesting,
what
their
reasoning
is
and
whatnot
I.
Just
wonder
if
I
the
thing
that
scares
me
a
bit,
is
you
know
if
this
grows
quite
a
lot?
I
don't
want
to.
F
B
D
F
Yeah
I,
just
just
wonder:
I'm
okay,
with
not
accepting
suggestions
on
issues
as
well.
I
think
that's
the
first
solution
just
to
wonder
if
just
stating
that
to
all
the
block
people
to
do
that
and
what
left
us
we've
had
done
off
open-ended
issues
that
can
kind
of
jeopardize
the
process
of
checking
real
issues
with
detuning
or
documentation.
A
Okay,
yeah,
maybe
until
until
it's
more
or
less
finalized
finalized,
we
can
keep
using
the
the
current
the
current
dock
that
we
have,
which
I
will
share
now,
because
I
also
really
like
the
idea.
Maybe
if
we
used
one
of
our
sessions,
you
know
solely
dedicated
to
to
making
progress
on
this
and
potentially
even
what's
it
called
building
like
a
like
a
proof
of
concept
or
a
very
basic,
a
very
basic
thing
that
we
can
iterate
on.
A
A
This
is
informing
potential
funding
potential
resources,
and
so,
if
folks
are
relying
on
this,
then
I'd
like
to
have
something
that
we
can
provide
for
them
and
that
they
can
that
they
can
derive
value
from
so
I.
Think
then,
for
the
the
next
APAC
friendly
meeting
time,
which
is
looking
like
on
the
on
November
3rd,
we
can
dedicate
I,
would
say
at
least
30
minutes
to
really
focusing
on
this
and
and
seeing
what
we
can
kind
of
start
start
producing.
D
A
D
D
A
B
C
A
That
is
the
intention.
Yes,
I
I
think
the
the
the
idea
is
that
this
is
going
to
be
kind
of
a
living
thing.
That
will
be
that
might
change
over
time
that
you
know
things
might
be
added
over
time.
Things
might
be
removed
over
time,
so
I
think
the
more
Nimble
that
it
can
be
and
and
the
possibility
you
know
again,
adding
new
projects
or
or
for
whatever
reason,
removing
a
project.
A
D
I
know
I
know
that
we
talked
about
like
what
happens
after
a
certain
period
of
time
like
once,
packages
are
in
there.
Do
they
get
to
be
in
there
forever.
I
know
a
lot
of
people
had
things
to
add
about
that
and
ways
they
felt
so
I
I
think
it
would
be
defined
in
the
process
later
on.
I
think
we
would
have
to
have
consensus
about
what
those
types
of
situations
are,
because
it
is
true
like
if
you
take
something
like
the
JavaScript
World.
A
Yeah
yeah
or
something
like
rust,
where
maybe
a
couple
years
ago,
folks
wouldn't
really
think
much
of
it
or
see
it
being.
You
know
a
new
standard
almost
and
then
you
know
things
definitely
do
change
so
I
I
like
the
idea
of
being
able
to
to
to
adapt
to
the
changes
in
the
ecosystem
yeah,
but
yeah
you
bring
up
a
good
point.
You
know,
maybe
if,
if
we
can
be
a
little
prescriptive
about,
you
know
what
that
means.
You
know
if
we
say
you
know
we're
going
to
review
this
every
year.
A
You
know
as
a
work
group
to
make
sure
you
know
everything
is
accurate.
Just
building
in
some
some
kind
of
quality
control
measures
totally
makes
sense
so
and
I
think
that
is
part
of
what
this
work
group
really
is
is
we're.
Setting
out
to
do
you
know
is,
is
helping
identify
these
critical
projects
out
there
to
help
get
more?
You
know,
resources
and
funding
for
them,
so
yeah
definitely
makes
sense
to
be
nimble.
A
Okay
cool,
so
we've
got
about
15
minutes
left.
That
was
everything
that
we
had
on
the
agenda
for
today.
I'd
love
to
open
up
the
floor
to
discussion,
thoughts,
feedback
updates,
really
anything
that
the
the
work
group
would
like
to
talk
about.
I'm
wonderful
looks
like
we
have
Jeff.
That
has
his
hand
up.
C
Yeah
thanks
Samir,
so
I
added
it
in
the
notes
a
little
further
up
actually,
but
a
reminder
that
for
our
working
group
mailing
list,
we
have
an
official
one
through
openssf.
Now
this
is
actually
like
one
of
the
oldest
working
groups
before
a
lot
of
the
open,
ssf
infrastructure
was
set
up
and
it
was
done
on
Google
Groups.
C
So
the
Google
group
is
theoretically
deprecated
and
we
had
some
spam
on
it
recently
and
I
just
asked
Kim
and
Dan
for
ownership
of
the
group
so
that
I
can
kind
of
clean
it
up,
but
theoretically
that
one's
deprecated,
although
we're
still
using
it
for
automatic
access
to
this
node
stock,
because
with
with
Google
Groups
I,
mean
with
Google
Docs.
You
can
share
them
with
the
whole
group
and
you
instead
of
and
that
doesn't
work
with
open
syphilists.
C
C
G
Our
industry,
and
so
the
general
way
that
we
get
around
that
is
email,
is
okay
right.
So
we
can,
we
can,
you
know,
send
emails
to
a
Google
group
and
receive
them.
The
one
part
that
doesn't
work
is
the
Subscribe
piece,
because
when
you
do
subscribe
through
Google
Groups,
it
then
sends
you
a
message
back
with
that
join
button,
and
so
you
click
the
join
button
and
then
you
get
into
the
interactive
web
portion
and
that's
blocked
so
it
when
we
want
to
be
added
to
Google
Groups.
G
We
actually
have
to
have
the
group
administrator
manually.
Add
GS
email
addresses
to
that.
So
I
just
say
that,
because,
if
we're
moving
away
to
you
know
groups.io
or
something
all
some
alternative
to
Google
Groups,
that
would
be
again.
I
I
think
there
may
be
somebody
else
from
city
or
a
couple
other
of
the
financial
services
companies
here
but
again,
Google
that
Google
Group
web
interface
provides
presents
some
some
blockers
for
us
participating
in
the
Google,
Groups
and
Google,
and
we
can't
use
Google
Sheets
anyway.
G
G
You
know
harder
and,
and
the
you
know,
the
policies
for
Morgan,
Stanley
and
JP
and
us
and
the
city
are
all
going
to
vary
from
from
bank
to
bank,
but
in
in
general
you
know
you,
you
know
we're
we're
we're
under
a
lot
of
scrutiny
about
the
way
we
use
electronic
media
and
communication.
So
we
have
to
be
yeah.
C
G
I
guess
one
other
thing,
I
would
add,
is
just
the
we're
we're
trying
to
get
more.
Just
generally
engaged
in
more
of
the
working
groups
and
I
know
I
saw
a
colleague
of
mine
Barbara
is
is
on
the
call
as
well.
So
you
know
we're
just
trying
to
get
more
engaged
and
thank
you
for
all
of
the
hard
work
that
everyone's
putting
into
it.
It's
a
really
important
effort
and
we're,
hopefully
we'll
we'll
get
some
more
folks
attending
this
working
group
and
others.
G
From
our
perspective.
This
is
also
important
because
we're
trying
to
work
to
better
align
our
open
source
contribution.
The
code
contribution
work
that
we
do
with
our
critical
projects.
Right
so
generally
are
generally
right.
Now
contribution
works
at
our
firm
that
people
it's
up
to
Engineers
like
if
you
want
to
contribute
to
a
project,
it's
sort
of
up
to
you,
and
so
it's
a
little
bit
Bottoms
Up
and
that's
great
and
we're
not
going
to
discourage
that.
G
But
we
also
want
to
start
saying
okay,
so
you
know,
let's
look
at
our
kind
of
a
Pareto
perspective.
What
are
our
you
know?
Most
critical
100
or
200
open
source
projects,
and
then
how
do
we
get
more
engaged
in
the
working
groups
and
projects
of
those
and
then
in
turn,
you
know,
be
doing
more
pull,
requests
and
code
contributions
to
those
projects
that
could
that
you
know
that
that
were
so.
This
this
group
and
its
Mission
really
resonates
with
us.
So
thank
you
for
everyone.
Who's
been
working
so
hard
on
this.
A
Of
course
yeah
the
pleasure's
all
ours
we
we
certainly
don't
do
this
for
the
glory.
So
it's
really
nice
to
be
with
with
a
with
a
group
of
folks
who
really
care
about
this
stuff,
and
so
I
really
appreciate
that
and
yeah
we're
looking
forward
to
the
contributions,
the
thoughts,
insights,
I'm,
very
much
looking
forward
to
that.
A
A
B
C
A
A
A
B
A
Yeah
and
we
do
a
lot
of
work
so,
oh
stiff,
we
do
a
lot
of
work
with
Cloud
native
projects,
cncf
projects
we
recently
do
almost
all
of
their
security
audits.
So
it'll
be
really
nice
to
see
a
lot
of
the
folks
you've
only
seen
on
a
screen
for
years
and
then
see
them
in
person.
So
very
much
looking
forward
to
that
and
yeah
and
I'll
be
sure
to
report
back
at
the
next
work
group
meeting
any
interesting
things
that
came
out
of
that
and
yeah
okay.