OpenSSF Security Tooling WG, 20 Dec 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Security Tooling Working Group (December 20, 2022)

Description

Github: https://github.com/ossf/wg-security-tooling
Notes: https://docs.google.com/document/d/1DoB7zgtLsP-JGF77ASkHV7UMofTE2wseniexaa6Q4M8/edit#

A

B

C

Mr Josh's children's that the meeting was not canceled. What's that well, I thought. Maybe the meeting was canceled.

B

No I don't expect a lot of people, but I want to work on this document anyway. So I figured even if no one shows up I'd do it. So it's all good.

B

It's uh it's just that time of year, it's hard to get anything done.

C

Yeah this week next week and the first week of January yeah.

B

Well then, I'm out next week we just shut the company down, which makes sense, because everyone takes off anyway. So then, but this week, like the last two weeks, had just been brutal. For my.

C

B

C

I think yesterday I was on the call one after the other one from Seven a.m to 4 P.M. There was one hour of Gap in there and 4 P.M I just shot my PC and just ran out of the house seriously.

B

Yeah yeah I mean that's exactly what it's been like for the last two weeks for me, I've got like so much work to do and none of it's getting done because I think the problem is Christmas lands on the weekend, so all of the people are like they've got like that. Last put, you know they get the whole week like. Let's use it and it's like, oh, my goodness, no stop.

C

Yeah so uh yeah the last week and then also the first week, a lot of folks that I talked to in Europe for some reason. Europeans outside of U.S take that week off, because even uh they have folks in South America.

B

B

So I'm I'm hopeful it'll be quiet at the end of this week, although I live in Wisconsin and we're supposed to get like a huge freaking snow storm tomorrow, night yeah. So that's going to be great.

C

Yeah they're talking about snow in Philadelphia on Friday yeah, not snowing. It's like ice and sleet and polish stuff and.

A

C

Have my son is coming from Arizona he's arriving in the morning on Friday and then sister-in-law arriving by train uh in the afternoon, so I don't know which one is going to get here. First, wow.

B

That's going to be quite the change from Arizona to Philadelphia right now, like.

C

B

Should have gone the other way.

C

Well, actually, you know he used to live there and he moved to Arizona to be closer to his work because he was doing a remote. He prefer to be at work and he says he likes the cold now you know because he misses that cold weather in Arizona. So.

B

I don't know about that. I feel like when my kids are off and out of the house like I, hope, I never see snow again. That's.

C

The dream: yeah the choice between Minnesota or Phoenix, it's pretty easy choice, I think I. Think so too.

B

C

B

Like Minnesota, but the weather is, is Right, their weather is even worse than my weather, because I live in Green Bay, which we get the the lake kind of tempers. The climate, a bit and I have some family that lives in Minneapolis and they just get like feet and feet of snow and horrible cold. And just uh it's terrible.

C

Yeah I lived for many years in Buffalo, New York, and it was the same thing you get up in the morning. You say: oh, my goodness, there are two feet of snow by your door right now. You have to shovel yourself.

B

Up I know, I know, I've got a co-worker, that's there and they just can't what was it like? 40, some inches of snow I'm, just I, don't even know what to do with I can't imagine that I mean and I live in freaking, Green, Bay, I, think I think we got 24 inches once and it nearly ended me because it was just like what do you even do with it? At that point, there's it's awful and man.

D

B

All right, let's, let's get this this show on the road I, don't expect a lot of people which is good, so I guess thank you, everyone who, who made it you're the dedicated few. So uh let me share my screen. I'm very slow. Today, I apologize, it's been in a week all right, so I will paste this in the chat which I find so sign in. Do me, a favor um people who are here there's the introduce yourself in the chat. Do that quick.

B

And then the s-bum everywhere agenda exists: I, don't I, don't unless someone has something else to do. I want to hammer this document out and get it close and I think having a fewer people here is much better because then we get a lot of this bike. Shutting on this stuff, um I'll.

E

B

It oh crap, what have I done? I clicked the wrong thing.

F

B

Going to paste the link to this in the chat is that I think I added a slash, I'll paste it again all right, and so basically what this boils down to is just hammering out what this group is going to do for for I.

B

Think most of you have been here in the past, um so basically hammering hammering this out getting it in order, and then we can start using this group to kind of move the s-bomb everywhere project forward the the intent and purpose is we don't want the group to do anything for anyone who doesn't remember.

B

um That sounds silly, but one of the challenges the openssf has is getting working groups to actually do work and they they don't because we're busy people, and so what we really want to do is use the purse of the openssf to accomplish tasks not try to acquire help from people who are too busy to do it. So so, anyway, uh let's just go through this and and see what we're missing and we have all right. We got the overview. I'm gonna ignore that for now, because I think this is easy enough.

B

So we have scope, secure the software and also I want to add, if any of you, oh hi, Kate. uh If any of you have anything to say, just jump in and talk, don't worry about, raising hands or anything like that. I'm, not watching the chat. So if someone could speak up, if anyone makes a comment, that's relevant, um otherwise we'll just kind of keep going all right. So secure software ecosystem require making production distribution. That's one easy in consumption, so this part is.

B

We talk about consumption, a lot in this group and when we started the group there was going to be a focus on creation and then the group basically said all we care about is consumption, and so I think this one is important and we need to do more with it. But I don't know what yet. So if anyone has thoughts or comments, I would value those, because just saying consumption I think is meaningless in many instances. But.

F

So I think consumption what it means basically be able to ingest them, and um you know, use the information. What we're trying to do is use it. Let me be able to use the information augment the information incorporate in their systems and do risk management right.

B

Right hold on Kate, you just said a lot of stuff and I'm really slow right. Now. All.

A

B

um They want to use the information, like would you say, ingested into Risk, Management, Systems yeah.

F

It will adjust it into their own internal risk management systems or into any or into their own systems. Realistically, it could be more than just Risk Management Systems. Quite frankly,.

B

Yeah, that seems fair, yeah, um okay, um now I guess so here's so here's where I think we need to be clear is are we is our intent to just explain what to do with them or do we want to like be involved in tooling that can ingest this stuff, I I? That's where I think the line gets. Fuzzy is like how well.

F

We want to make sure that the blockers are removed so that people have Solutions out there that they can use themselves to do so. Like you know, there's some open source projects out there. There's some commercial offerings out there, making that visible, um that these options are there I think it's something that I thought we had agreed was in scope for this group already. Hence the landscape approach, yeah.

B

Right and that's still like the Big Goal, we want to do and in fact you and I need to talk at some point, but probably not this week. Well,.

F

Later this afternoon's quiet, yeah.

B

uh I do have I do have a little time this afternoon.

F

B

Talk about it uh no I, agree, I think the landscape is, is the key, so.

F

So we've I think we've got some degree of consensus on the the terms. I think they've pretty much I'm, not seeing any major changes happening since the last couple weeks on the cesa side. So I think we've got that piece of that taxonomy now in play, and so.

B

F

Some of these things, starting to categorize and getting people giving us feedback on that I think, is probably a good Next Step. Well.

B

The Cesar defined consumption in that document.

F

um Does not know they describe the type of s-bombs and the consumption of the s-bombs. Is you know what you do with? It is different, depending where you get the information. What's in the those s-bombs right, um you know, we've got examples of Open Source projects out there that are consuming them.

F

um Specifically, daggerboard is out there in open source yeah and it consumes it, and then it basically does a match up to um you know the vulnerabilities. It gives you a dashboard, so you can track them for yourself and so getting more of these things which are taking the s-bomb and ingesting the s-bombs, um and then you know, transforming or communicating them like I think you know, the d-bomb project will be ingesting them in the sense of bringing them in and encapsulating them and passing them on. What.

B

F

Well, digital build materials.

C

Open source project by which enables producer and consumers to share s-bombs and the related artifacts right who's.

B

Doing that great.

C

Policies and that's what I was going to bring up so the consumption I think it needs to be agreed. Consumption rules, because something that also came came up yesterday during the season call was as an integrator I might consume an s-bomb produced by the producer, and then what can I consumption? Does it mean that now I can share it with my Downstream customer, which might the producer may not want me to share? So it's a little bit grayish area about this consumption and the rules around it.

C

So I, don't know whether we want to touch on say, I based on agreed consumption or that's going too far.

B

I feel, like that's a rat hole right, I think we should Define it later.

B

F

Just saying that one of the use cases of consumption I think that's what Mandy's point was is to take and pass it on further. So, if you're asking for a definition of what consumption is to me, it's either you're using it or you're, passing it on further and that's some sort of structured fashion.

C

And you may want to just make a note on it. For now that cons is exactly what uh K set the consumption could mean either, which needs to be touched on later. Yeah.

B

I'm going to write it down, but I'm terrified.

B

F

Yeah no, but you know for for the for it to be everywhere. You know the whole part of the thing is you know the information can pass through the supply chain, yeah right and that's the goal. Well,.

B

And I think one of the points that I always bring up when when this conversation happens, is there's a ton of tooling now to build these things. So you can either give someone an accurate, s-bomb or they're going to build their own and who knows what is going to end up in that thing,.

F

C

Right tell that to our legal team.

F

We have, we have a quality that has to be worked into the scope, yeah.

B

I think that's true.

F

That um you know we don't we don't come up with all sorts of variants out there. We have. You know we're lining up with what is being defined as a couple of references bombs that have some degree of blessing associated with them. At this point,.

B

Is sisa defining quality in any meaningful way? It.

F

Shall defer that one to uh Justin who's on the call since I haven't been able to be on the calls for the last couple weeks with my travel.

A

uh It's something that comes up I mean pretty often but there's, but there's no task right now. uh That's that's working on specifically defining it. It's it's something! That's reflected in our notes that uh whether the term would be you know, like completeness of the term, that's been thrown around.

A

um You know uh it's something that that needs to be discussed, but uh we're gonna have a clear definition set right now,.

F

Right so I think both cyclone and spdx have validation tools out there, I think. Maybe if at least we can take a practical bottom line, that it must go be able to any s-bomb produced must be able to go through a validation tool and be valid. It's very valid, quick.

D

Quick clarification, though, those validations are syntactic, not hey, it got the right.

F

Answer: yeah; no, but let's at least at least have to be syntactic and they're, not right. Okay, okay, we've got to crawl.

D

But I think the I I do think that's important because we are going to have a problem with really inaccurate s-bombs. A lot of folks are doing analysis they're, you know throwing bits in and you know flipping the random the digital coins to see what they can figure out, which is I mean if that's what you got to do, that's what you got to do, but uh I I fear that people are going to look at that and say: oh, that's, all a sponsor could be so I I think we.

F

Need to keep that clear, yeah.

F

B

E

B

The the verifying is, don't fall off the floor right.

F

Like verifying at this point, I'd say: don't fall off the floor is something that someone is a little imprecise, a thing. I'd say it's in that uh you know some syntactic at least gate yeah make sure the syntax is correct and you're following the actual written down. Syntax, yep, okay, the um so I'd be explicit here that it's a syntactic check.

F

If anything, yeah.

B

Yeah yeah I'm I'm comfortable with that.

F

Uh-Huh say maybe just say: pass a syntactic validation tool. I just want to separate the semantics from the syntax.

E

B

All right, I'm, gonna I'll, just bold, that as the quality gate for the moment um and then I'm gonna rewrite all this. So don't worry, I'm just taking notes, basically in the document. um Okay, so I think the other piece and I don't know I, don't know how much we want to focus on this, but there's the angle of how do we get open source or not? Even how do we get? um We know one of the goals is we want to see all of Open Source producing s-bombs for everything they do right.

B

So what does that mean like? Do? We want to provide some level of guidance? I mean like the example is the Apache Foundation asked us for guidance and we haven't really given them any because we don't have any like do we do we want to create that kind of guidance? Do we just want to tell open source projects you should do this? Do we want to like give them the tool? I I, don't know, I, don't know where to draw this line.

F

Well, I think what we need to do is understand. What's missing so I think guidance in the set like I say everyone's going to want to do things differently in each open source project, they're, all special okay, everyone has their own Community.

F

Everyone thinks they know everything in their own space, um so I think figuring out what Min we already have, a definition of what minimum is and helping them figure out how they can achieve minimum in one of the recognized formats as opposed to creating their own, because they're all seeming to want to create their own um is I. Think what we need to help do and make it easy for them. So um reference tooling examples- and um you know.

F

And exam reference tooling and examples to show them a lot of them will not want to use the reference tooling. So it's reference tooling libraries and examples.

F

E

F

E

F

And then show them how it's being used and if they don't want to use that point them to examples, so they can look and see what's valid or not. Now,.

B

One challenge we're going to have is I mentioned this on a call. It's been a couple months now, I think, but uh Brian Fox was there from sonotype and like the Java ecosystem kind of, does it their own way, and there was.

B

This came up where there's different ecosystems are kind of trying to do different things, and so I think this is one of the challenges we get in trying to create reference Tooling in libraries because, like they're already doing their own thing and then, if we create guidance that is in opposition to what they're doing they.

F

B

Right well, I mean obviously, but it also I think it weakens us and them right. So how do we? How do we square that Circle.

F

um Well, I think finding uh people who are have connections into these communities who also understand this space. In effect, if you create you, know, get a set of ambassadors who actually understand the format and who can you know talk to these people um and help put pull requests in and discuss things in their own spaces is probably what's going to be needed.

F

And I think you know having a I think: we've already come up with a variety, a variant set of lists.

B

Well, I I guess the the.

F

I want to prioritize the.

B

Landscape should help with this also right, if we, if we understand which ecosystems are already doing something.

C

I'm going to go back to reference tooling yeah, um so that's isn't that like a live reference tooling or something that can continuously be updated because otherwise it's a snapshot and this whole area is growing so fast. You know every morning you get up there, there's a new tool, there's a new way to this, or should it be.

F

Having tools out having tools that do things in the open is what I meant by reference. I saw that people can see and copy and paste effectively.

F

um You know that's what the open source project sphere looked like they're, not going I it'll, be pretty rare. I think that the open source projects will take and use some of the commercial tooling that's freely.

C

Available, okay, so.

F

It's only referencing.

C

Open source to him.

F

Yeah, like I, say we're talking about the open source problem. That's what I thought what I was hearing right now.

B

Yes, we should be completely clear about that.

C

C

Just to put open source well.

F

It does sort of say that there, how do we get open source projects to build high quality, ass bombs.

D

Yeah, but that doesn't necessarily mean using High open source tools, although many won't use anything else. So probably some.

F

Clarity would be good yeah, you know, um and quite frankly, as the specs change the the tool, you know, the reference tooling needs to change, as do the reference examples. Definitely.

B

Now now David I, I'm gonna, ask you on this. One is, is I, think Brian said at some point long ago that the open ssf is comfortable being a king maker when it comes to like these tools, because, obviously, if we create a reference architecture, that's it right. That's that those are the tools that win are. Is that still true I.

D

I think that is still true, I I would say, with a caveat that King maker, but wise King maker. In other words, we shouldn't just roll the dice I'm, hoping that we like and you actually Josh. You actually started down this road and I. Think you had the right Road, you know sit down what's close um and even if something, even if nothing is perfect today, what's a good basis.

F

um People around and build critical mass, because everyone's doing anything in fragmented way right.

D

Right I mean there's, there are advantages to doing 100 different things, but if we want to focus resources on one thing, it's helpful to know what the one thing is by the way. I, don't think we'll actually have one thing, I think there'll be a thing for a particular ecosystem and it might not be the same thing for every ecosystem. I.

B

Agree well this this hearkens back to the assistant documents on like the different types of s-bombs right I expect there will not be one tool that generates all of them all.

F

The no there will definitely not. There are different parts of the life cycle and different.

B

F

And actually that's one question I've got for Justin since I've got him on. The call is that document now published. um Is that document considered final now because I couldn't like say, I was traveling still last week, so I don't know. If Justin was on the um tooling call.

A

Let me do some checking on that. I know that that was the goal, um and so it's not um it's not final from the sense of that it still has to go through. This is a chain of approvals, but uh let me just double check the notes, because I was in uh uh North, Carolina and Idaho last week.

F

So you were traveling too okay, but.

A

Let me I can double check the notes.

F

Real quick to see yeah, if you could double check that right now, because I'd like to start putting this landscape into that context and the tools context. If it feels like it's pretty unlikely to change right now. But.

A

I'm checking I'm checking right now, I'll I'll, let you know sure so.

F

We've got, you know, I think the build one is the one that you know everyone's sort of focusing on the industry in the in the industry right now, but um certainly the uh deployed one is ones I think will be moving to next but I. Maybe we should sort of choose an order of what we think is most important from.

B

A security perspective.

F

And start tackling them from that side in.

B

The open source perspective right because most open source projects aren't going to care a little even a little about deploy because they're, developing and distributing right.

F

Mm-Hmm exactly, although they deploy other projects in their own context, that's.

B

F

E

F

You know they basically are they actions that you know they've got dependencies that they have to get installed, so they can do their own build their own projects. That's.

B

True, oh my goodness, you know every time I have conversation like this I feel like it just gets more complicated and we're like seven.

F

Thousand dollars, let's just let's just choose escort, you know, you know a part thread by thread at this point in.

D

Time yeah, you know, but before you get overwhelmed really it's just you know it's Turtles all the way down. It's just it recur it. Recurses I.

B

Mean that's alternative. It's a it's! A it's a Mobius strip of turtles. That's what we have.

F

um You should keep it amusing, yes, um but you know we can get things better a bit by.

B

Bit exactly 100, and- and this is the other reason- I want to start better, just documenting and tracking a lot of this, because it feels like there's so many projects and it's so fragmented and no one knows what anyone else is doing, and it's just no one wins in an environment like that. We all just suffer well.

F

Then, like I say getting the landscape up there and then getting many people discuss things. I think is yeah.

B

100 all right so I I feel like there's enough notes in this scope that I can take this and and spin it into spin the straw into gold and put together something passable, probably uh let's jump to the mission, because we're also running ourselves out of time. um Mission of this work stream encourage collaboration between esperan producers, Distributors between all the s-bomb people, identify barriers, usage of s-bomb.

E

B

Bone ecosystem Kate: do you have thoughts.

F

Yeah, um well, let's say: rather it falls to the yes, but I think you want to put something in here about the software supply chain and basically fostering s-bomb usage through all points in the software supply chain, or something like that.

F

Like I said: we've got you know, mission statements should be crispr and I. Think the software supply chain catches a lot of what you've got here.

B

F

You know the mission of the workstream is to encourage collaboration.

B

So we really well.

F

Basically, I think the mission of this work stream is to have high quality to have um high quality, s-bomb or.

F

uh Okay, my turn to go into verbal mode here um is basically having high quality s-bombs um being automatically like being on established part of the software supply chain.

F

Something like that.

B

Sorry I want to put myself into suggesting mode. So I don't completely travel this all right, what'd! You say you want high quality, s-bombs high.

F

Quality s-bombs be an established part of the software supply chain. Oh my God.

F

We put software supply chain in there, yeah.

B

F

B

Okay, so we've got high quality, s-bombs software supply chain, and we also I think deferring to other groups is an important part of this and connecting others is an important part of this. So I feel like these three things are the real goal. We want.

F

I would also say: high quality stint. um You know I'm tempted to put the word standardized in front of s-bombs but um or like I said. How do we refer so, let's just leave it as pumps, never mind I.

B

I for now I think so I think we can add standardized in the future, but I feel like that's going to create annoying hassles at the moment. Okay,.

F

um Maybe shareable, what I'm trying to do is you know if someone's creating something someone else has to be able to ingest it, which is why the support software supply chain is I'm, going to be looking for that right um and I guess we established. That means it happens. Okay, fine, yeah, okay, I'm, not gonna, word Smith any further there. Let other people Wordsmith a bit better.

D

Yeah, the one thing that's worrying me a little bit and maybe maybe it doesn't belong here, but um in the end we've got to have you know- and this is American thing- the king maker comment earlier from Josh. um We need to get good high quality, s-bomb generators for the various ecosystems. Ideally, there be at least an obvious OS open source software tool for it uh and I would be more specific for at least the bill dust bombs for an ecosystem uh in.

D

In some sense, you can argue that that's hidden underneath the uh uh getting more open source software projects generating s-bombs, because they're not going to do it unless it's easy right.

F

D

Yeah, basically in support of them, so you could say in support of that. You need to make sure that there's an easy obvious way to do it for common ecosystems,.

F

F

Ecosystems is what I'm sure I'm raising my voice a little in the sense that um what defines common, I think it's a rat hole. We can go down, I, just thinking to say, open source ecosystems.

F

We should be trying to classify.

D

Them, okay, all right, oh I, see I, see I, see, yes, all right, fair enough. You know uh for uh for for each Eco, for each um for each ecosystem, there'd be at least one obvious way to do it easy one easy obvious way to do it. I I.

B

D

Care, if there's more than one.

B

But I think we catch that in the scope.

B

Where we, where were the tooling so I, don't want to specifically say that I think for the mission to be crisp like high quality, s-bombs I think captures that.

F

Established part means that the open source roots of all the software supply chain are doing it to.

E

B

F

B

B

Let's not argue this yet let me turn this into a mission statement and then and then we can bike shut it. Okay,.

F

E

B

Like the like this document's also out of order, the mission statement needs to be first and then we Define the scope and the scope should hopefully clear up any questions that arise upon reading the mission statement, so I'm comfortable with that very.

D

Nice I also don't want to get too bogged down into the words, but it's just in the end. What I want to make sure is that we are, we are ensuring we have generator tools that are you push the button off? It goes super easy, I think we're all in agreement. We just got to put that down because when people join I want them to come in and oh that's what you're doing and not have to re-explain it.

F

B

Yeah I agree: I.

E

B

100. and even then oh man, it's gonna, be it's gonna, be a treat, but that's right. uh uh Okay, so the requirements is old, so I don't want to put too much focus on that. But the approach is not so to to reiterate what I've said at the beginning. We don't want to do any work right. We want to fund work and encourage others to maybe do work, and we could potentially create like a special group or a project beneath this group to do the work.

B

But this group should not do work, which is weird every time.

F

I say well, there's there's work done to create the funding to do anyhow, not.

B

Not I, don't okay,.

A

D

Yeah don't say that yeah don't.

A

D

Don't do work I, I'm, not interested, don't.

B

Do technical work, we'll say the technical work should be done by others. We should Shepherd the technique. We want to Shepherd money to to people doing work. Does that make sense.

D

Okay, we I would call that oversight management, something like that. um So basically we're not going to write code in this meeting.

F

Right, that's right, but we are going to basically write specs well.

D

I'm hoping that there's going to be code and I I do think as an output of this activity, there better be a lot of code written because if there's no tools on the other end, it.

F

Doesn't matter I've already, we've already started that with the python tools we've got, I know we're trying to get a release out right now.

D

Upstream problems but anyhow I'm glad of it I'm glad I, just I don't want our clarification subvert the whole point. Thank you.

E

B

All right, so, okay, we got the approach, remove friction. S-Bomb, adoption, uh open, tooling, makes it easy for anyone. I don't want to just say open, tooling, I want to say open source because that's well defined yep.

D

Sounds like a better plan and oh.

B

Man, open, don't get me started uh that I feel like that, so that's kind of covered in the scope, but the approach should be more clarified. I think this is where I guess we we create so.

F

I think I think the approach is yeah I think the approach is basically having using the landscape to have the survey and understand where the gaps are to focus ourselves on.

B

Okay, um do we have.

F

Because I've written about in the last two years, I've written about four different variants of you know here's what we need to talk tackle it things like that.

E

F

And so I think you know getting a a agreed upon list of here's where we've got coverage: here's where we don't and here are the gaps that we need to get. We need that we think are worth. You know, recruiting um someone to fill with funding.

B

So one of the oh, let me let me write this down first and then I have a I have something to ask you Kate um sure, whatever that's gonna, so you talk about the gaps and there's I think there's two important gaps, but we don't talk about them correctly. So there's the angle of there's just tooling missing, be it. You know uh some sort of blind spot like we can't generate s-bombs for like Cobalt or something we'll say, but then there's also I think the angle of like.

B

If we look at the Go python library, that was a gap in maintainership right like the the tooling existed, but we didn't have anyone actually taking care of it and I feel like we. A landscape can help identify gaps of like a tool, not existing or a feature not existing, but a landscape isn't going to tell us which projects have funding or you know.

F

They don't have a stable path, for example,.

D

You know what I'll, although Landscapes, typically don't. um If that's one of our primary concerns, there's no reason we can't uh the landscape tool. We could add data about, you know number of contribute. Has it been contributed to or released in the last we can grab the data straight from scorecards and just extract that out. If we think that's a high enough risk for these kinds of projects and I think that's plausible, uh we can do.

F

That one of the things might be quite frankly, is once we've identified. The projects we know about is to actually take a look at using some of the other um openssf initiatives like scorecards and do an assessment yeah.

B

E

Like that, and.

F

Then use that too put some structure around the Gap um discussions other than you know. Until some extent, I'll probably come down to tribal knowledge.

F

A framework to start talking about and then that's useful data for the other projects too. If the tribal knowledge is disagreeing with what they're saying.

D

Yeah so Josh I know that you had already started down that path. um I I think that basically some acceleration and you know people to work alongside you know. Here's here, here's some sample code I mean we can just there's a whole lot of Open Source projects we can use, you know, go grab, uh you know, grab some tools.

D

What if we? What can we learn? Where are the gaps which ones are most likely going to be plausible bases um and your recommendations so.

B

That's another interesting problem, I think so there is tooling right. There's cooling that needs help and I. Think again, like your comment: scorecard's fine, but then there's also the I guess architecting. Is that the right term, maybe of like all this tooling exists, there's a need to use it and someone needs to glue it all together, and that is not really so we we say that we want this group to do that right up in the um we're up in the scope. We talk about tooling.

B

We say we want to do that, but who?

B

How do we do that and I think that's part of the approach here is like here. This is actually a number three you know start with tool sets that will be fastest to release economically efficient to build. But who is going to do that right, like we can't pay an upstream project to do this? Necessarily we can't pay I, don't know we.

D

B

Mean there's no there's.

D

No law, there's no law about that. I. Don't remember.

B

You didn't say we could do it, but we need like some sort of structure to say, like this person is going to architect this and then the their work will live in this project and I. Also, the most important thing I do not want to see us like fund something get it done, and then it rots because no one is responsible for it. Absolutely.

D

True I think we're.

F

All in agreement on that and that's part of you know, as we structure any type of funding contract, there needs to be a provable. Like say there needs to be the effort, at least even if they don't quite achieve it, towards going to building the community and recruiting other people into it.

F

So they can't just sort of Define it as a fight for themselves and continue yeah, and you know that was one of the conditions that we've tried to set up, and you know we're going to be continuing to work on it for the python side. I think. But um you know we're seeing people start to help us out the ghost libraries and things like that. So.

D

Yeah and the good news is that you know. Certainly the US government is really interested in this I think there's some other folks. Europe is also the European commissioned is floating uh requiring us bombs in certain cases as well. So I I think that there's a even though this is a huge kind of radical change on the industry. uh There is uh some stomach in trying to make it happen and therefore, uh at least some folks willing to put some money in there if there's a plausible path for it. Well,.

F

The cell is still on those ones um David, it's a posit. They're willing to use are like the small business initiative paths which the open source Community doesn't have access to.

D

um Well, we actually do there's ways to uh okay, you're now, you're talking about U.S government.

F

I was getting all excited when you know the s-bomb initiatives were, and there was the small uh small. Was it Silicon Valley program, and you know, but when you start going into the details of that program, there's no way that sort of an open source project could easily take advantage of that funding. You had to be a commercial entity right.

D

F

There's new mechanisms I think needed here to Vector funds beyond what we can do. As from the open ssf side.

D

Right um I I think for some of these things you need. We need to talk to some of the government folks, because I mean the question here is: is your goal to be a small business um uh funding mechanism and you know what? If, if that's your goal, then be honest about it?

D

If the goal is to produce results, then that's a different mechanism, uh but the US government and Europeans governments both have funded quite a bit of Open Source software development and sustainment in the past, uh you're, absolutely right, Kate that it can be a struggle and particular projects uh shoot themselves in the foot, um but I think that there's there's a hope for at least some of these cases the particular project you're talking about that they may be too far down the road, I think they're more interested in being a small business funding than solving the problem, but I could be wrong.

D

I would like to be wrong, in which case you know. Let's, uh let's talk about that.

B

All right, I'm gonna, pull us out of this hole because.

D

How's this we can engage with other folks who have who have funding and want to solve this problem and see. If we can't do be the Matchmaker how's this we can at least drive. We.

B

Don't know we'll succeed, but we can try and and part of that challenge is still going to be. We can fund something, but we can't like money, can't build community as much as we want it to yeah. We can money, can write code, money can't build community and we need both of those things.

F

B

Don't know can we can people, we pay people to be our friends like that works right like.

F

We can say a little bit: Community managers.

B

Oh, that's true right.

F

So we can basically pay. We could hire someone. You know to basically be a community manager here right.

D

You money doesn't create people who didn't exist, but it does enable people who already were interested to do that as opposed to something else. So.

B

That's true, that's true, and anyone who's ever stood up like a proper open source project understands that, like just dealing with the Community Management stuff is all you end up doing after like two months, and you don't want us to do that so you're like well screw this I'm done and then your project dies.

D

I also think that there's a there there is a stage where I have you know it works sort of, but not quite quite enough for a large enough Community to be willing to use it. And there is always the challenge of getting the software for enough use cases so that people will just grab it and use it. And then, and then you you pick up the rest as it gets better and better.

F

Yeah, one of the other things that's possibly at a top level going up a level here back, is be able to celebrate the celebrate and make visible the wins effectively.

F

So when things are there and have been accomplished and are available, make that more visible because a lot of people don't know about all the stuff that is out there today. But you know you know.

F

B

Yeah I I like that I think that's a really good point. Kate and I think we suck at that.

F

I know I suck at it.

B

Yeah I mean I'm: okay,.

F

We all are, we need to basically have more people doing marketing. So some of these elements are, you know, um evangelist type of roles. You know community and evangelist type roles.

B

Yeah and like that's a great example of where I think the open ssf can add a ton of value because.

C

B

Has some of that um so I I want to jump to four here it says incentivize and educate blah blah blah maintainers. It includes helping open source maintainers implement this, which I think is the obvious second step after the first step. So if we have the tool sets, if we have the guidance, if we have money to give people to implement this stuff like how do we, how do we actually start turning that crank and is there something we can do to incentivize? That.

F

um So I think part of it is um sponsoring meetups at the some of the shoulder events, so maybe having a hackathon type of deal where all the tool vendors can come. You know people are doing tooling, can come and collaborate together, um and you know so those who are sort of, like maybe using sort of the open source events.

F

Quite frankly, you know the open source Summit to Hoover. Something was fought in the spring. You know let's have a day or two of a hack event, the same way: the automotive grade.

F

Linux people always have sort of like the meet up and make it make progress on things for any tool vendor to show up um the open source or otherwise, and you know it makes explicit Outreach to invite some of the ones when we know this problems, possibly even help support funding getting some of the remote people in from the their communities into some of this, too.

B

Yeah definitely and.

F

B

The government loves their plug, fests and I think that's kind of the same idea.

D

And ITF loves them. Also, it's a good thing would.

B

You just say: David I didn't.

D

Hear that ietf also.

B

F

And spdx loves them as well. That's the only way we've been making progress, yeah.

E

F

Me you know, is we've been making progress this way for the last five or six years we.

B

Could argue the semantics? It is a plug Fest, a hackathon. Well, no we're not talking about.

D

We can talk about that, but let's.

F

Not oh, no rather than say rather than say, plug for, say, interrupt testing.

F

D

Which is really what you want. A plug. Fest is one way to do interrupt testing but I agree. The real issue is: if you want something to be true, you test it.

B

F

And you know we're getting close to having the 3-0 spec come out, lspdx side that might be a way of you know. Gathering people and you know, sort of getting things talking together. Yeah.

B

100 um so like what else is there, though, like sponsor I, don't think I feel like sponsoring meetups is the boring default answer we might not have when we maybe can't.

F

B

All today, but like I, feel like so let's say: we've got random open source project, it's mildly successful, like they're not going to come to an open, SSM.

F

Meetup yeah, why don't we just basically so I think part of it is the magic of having people talking to each other in the same room.

B

F

Okay, I'm calling that meetups for whatever reason, but you know in-person get-togethers whatever. However, what we might want to do is have uh sponsor a seminar series of you know: people have a tool and they can talk about how to use their tool um in a lightweight fashion and have a q a session. So, as you know, projects have tools visible and available and they want to show people how to use them.

F

Give them a forum for coming and presenting you know throughout the year, like you know, once type of Deal or something like that, and you know see if we get someone to schedule them and they can come and show how to use their tool as a part of the ecosystem. Okay,.

B

Let me I I do like that. That's a cool idea, I think we should definitely have some sort of forum, but uh actually I, think the CNC app does stuff like this, where they have regular show me webinars and stuff yeah, where people like to show off their cool stuff, I'm, seeing even even higher level than this. So let's say I'm gonna pick.

F

On open, Office.

B

Just because I was running their tools this morning and I was getting grumpy about it, but so open office right, let's say open office needs an s-bomb. How do we incentivize a project like that? That is already running thin to dedicate resources or something into making and maintaining esperan content are.

D

We talking openness, open office or LibreOffice.

B

Well, LibreOffice sorry yeah yeah, because because.

D

If your question was about open Office, the answer is give up, they don't maintain it.

C

B

Know what I mean for LibreOffice? Stop it stop it. It's irrelevant pick, add any Project's name. It doesn't matter because, like literally thousands and thousands of projects, they aren't all coming to meetups, they aren't all going to conferences and we need to incentivize all of them.

D

I I, I, I, I I, think there's multiple answers to the question.

D

um I think we should identify a few and literally work with hand and Glo I would call what we call White Glove work with a few projects to help them over the starting line, because when nobody, how else does it everybody's gonna say nobody else? Does it and you get keep repeating that and Kate's going to point out that some projects already do, which is true um but um I, think there's some other kinds of products that are widely used.

D

That don't LibreOffice might make a very good case because there's a wide variety of folks who bring that in as a desktop application, I, don't know what the right list is. Doesn't matter right, you pick a few help them get going once you've got a few as examples now you can point to them and say: look do X and they're doing it already, and you can do it too, following exactly what they did and so.

F

The earlier comment about reference examples: yes,.

D

uh Now I won't guarantee you that everybody will do that once that happens: okay, but I I, don't if I think we have to help things start and then once things have started more will come or at least it's way more likely. That more will come.

F

D

We'll never get 100 I think we're going to have to acknowledge that yeah.

F

Another I'm sorry go ahead. Okay, another thing like this is and then sort of the meetups type of equations, but rather than taking meetups like basically just say you know sponsoring in-person get-togethers, so we've gotten a s-bomb Dev room now in fosdem for this year, yeah.

B

That's really cool.

F

um We basically um Alexis Adolfo and myself are you know, sponsors we got so many submissions in. They took us from a half day up to a full day, nice, okay, so we're we were scrambling to get everything agreed to right now, but yeah. So we have a full day worth of content already.

F

um There is a pent up place. So this is what I'm sort of saying we need places where people can talk about their stuff and explore issues on these types of areas. There is a pent-up demand, there is opt.

F

You know there are people wanting to talk about what they've got or explore or say what, like you know, we had to turn about a third of the proposals away: okay because of space wow, um so like I, say so: sponsoring in-person, get-togethers of some form and, quite frankly, collaboration forums where people can talk to each other, and you know explore these things. I think is um a way to advance this and get adoption in a lot of these other projects.

F

um What we might also want to do is in the notion of celebrate. You know celebrate when people achieve things is. You know as projects make things visible or have done things you know it should we have some sort of way of badging equivalent I don't want to use the term I didn't want to use such a badging, but nonetheless, badging is kind of what I'm talking about as hey. We speak s-bomb.

D

And you know, and that's my badge- yeah I've been trying to be careful. You're referring the best openness is a best practices. Badge I use that old phrase, because obviously, projects have many badges budget.

F

That many badges have many ways of signaling it, but having it an easy way for projects to basically um you know, let people know they can generate out s-bombs I'd.

E

F

To dig into it too far um level, it.

D

You know as Mom available or something.

B

Yeah I mean that's true, you can just jump in you. Don't need to raise your hand this. This.

F

Where we're pretty flexible yeah, please go ahead.

E

Sorry haven't been in one of these in a while, uh so um you know it's got me thinking about something along the lines of the blackhead Arsenal. So having something you know, if you already have a conference around these issues, whether it's sisa or the Linux, Foundation or whatever, and then simply opening up a track for tools uh for guys to be able to show presents and people can ask questions similar to what they do in the bracket.

E

Arsenal um I think that could be nice to to to raise awareness and get people talking and sharing knowledge.

B

So the uh kukan had this when I in Detroit, they had like a whole Community section where people were showing off their tools and stuff like this, which is really cool yeah, but.

F

Yes, I love that having a focus on um so there's I think a couple of events that the allele f is already. You know sponsoring, there's also and I. Think openssf is likely to have a role in some of them.

F

um I would encourage possibly.

F

um Oh, the open source summons, but I also encourage the embedded open source Summit as a place.

B

I was I talked to some embedded people a couple weeks ago, and their s-bomb needs are very different from the say, more traditional s-bomb needs and there's like an enormous amount of overlap. But it's still like there's some weird things. Well,.

F

Yeah I mean you've, been, you know like I say this is why we've been working with the Octo so see earlier point about the white glove treatment. Like you know, we've been working with the Octo and that's a good inflection point. I'd say like any of build chain, like you know, compiler tool chain with a Linker step as the information necessary here. Yeah.

D

F

Reach into those guys is all good, but um getting it so that we've got ways in the embedded side, so maybe openness like maybe we should use this funding here to sponsor a track at these places and So like um I, you know I, think Angela's uh for the embedded, open source, Summit I think is like you know we can sponsor a track for 20K and then we basically go forward.

F

We say we want to have a track on tooling for s-bombs, um and we say that our you know whatever we want to call it here. S-Bomb everywhere track yeah yeah, and we do that at EOS and we can do it. Maybe Angela Matthew to doing it for some of the other ones too. I know she'll. Do it for Eos.

B

Yeah yeah I, like that. That's a good idea, um okay, so we're out of time, but this has been a phenomenal hour. I I want to thank you all for everything. I'm I'm, incredibly grateful.

B

So what I'm going to do now is take everything we have and I'm going to turn this into like a a proper draft document that we can then like, like nitpick words and Wordsmith and do whatever we need to do and kind of get this under sort it out and and and like get moving after that, like I, think I think we have all the pieces we need now. We just need to put it together and then like get moving so awesome.

F

Just curious to Justin managed to hear back before we break off. Can we make the Assumption those six types of the ones are going to stick or not yeah.

B

I'm I'm going to get 100 deferred to Sasa and whatever they say, I.

F

Just wanted I just wanted to see if I can do something, I can work on it.

F

A

F

And utterly enlightened self-interest here.

A

It's my quiet time.

A

um I uh have messaged both Alan's on a plane to Texas, but he is technically working so when he gets off that plane, I'll check in with him and I'll shoot you an email when, when I find out status, yeah thanks.

F

Justin, sorry for me: yeah no problem.

A

B

Right crack that lip.

F

Kate new project management world, what can I say, I.

A

F

It um anyhow, if you've got some Cycles this afternoon and want to talk further yeah.

B

Yeah I'll hit you up on slack Kate, um because I want to get that proposal for the landscape kind of sorted out. So.

F

Yeah we've also like I, said, there's also, there's. uh There's was a lot of um that's bomb interest in Japan and there we we had some other sort of stuff there. That I can do a bit of a recap on.

B

Too nice yeah, that's awesome. I would love to hear all right all right. Everyone have a lovely holiday, I hope I, don't see most of you again. So all right take care. Bye-Bye.

E

I think so happy.

D

Holidays, thank you.