►
From YouTube: OppenSSF TAC Meeting (November 30, 2021)
Description
No description was provided for this meeting.
If this is YOUR meeting, an easy way to fix this is to add a description to your video, wherever mtngs.io found it (probably YouTube).
A
B
A
Okay,
I'll
go
ahead
and
get
started.
I
think
we
have
most
folks
here
and
I'm
just
going
to
apologize
ahead.
I
may
go
on
mute
every
once
in
a
while,
because
my
throat
is
bothering
me
this
morning
and
so
I'm
constantly
having
a
clear
unfortunately,
so
today
the
main
agenda
topic
is
the
wrapping
up
this
election
process.
So
we
had
some
good
feedback
on
the
github
issues,
so
I
tried
to
go
ahead
and
summarize
sort
of
the
discussion
that
was
happening
there.
A
There
weren't
too
many
changes
based
on
the
content
from
our
last
meeting.
So
I
think
that
this
may
go
quickly
if
we're
all
still
pretty
much
in
agreement
unless
something
new
pops
up
so
I'll,
just
kind
of
run
through
these
and
then,
if
folks
have
comments,
questions
you
know
just
please
bring
them
up
as
we
go
through
each
item.
So
the
first
one
was
the
the
seats
that
are
up
for
election
during
this
process
and
who
the
candidates
should
be.
We
agreed
that
all
seven
were
up
for
election
in
this
table.
A
You'll
see,
I
have
current
support.
I
kind
of
looked
at
what
was
happening
on
the
github
issues
and
sort
of
defined,
whether
that
was
a
show
of
support
or
not
not
that
we
acted
like
officially
voted
or
anything.
So
all
seven
seats
folks
are
able
to
self-nominate
by
sending
an
email
to
the
attack
mailing
list.
A
A
E
E
To
say
all
seven
are
up
for
change,
but
but
for
at
least
by
default,
and
this
may
change,
because
there's
actually
a
conversation
we'll
have
at
the
governing
board
on
thursday
about
whether
the
governing
board
wants
to
continue
to
appoint,
attack
members
and
and
if
so,
when
you
know
before
the
election
after
election.
That
kind
of
thing,
but
one
prospect
is
that
it
might
be
that
all
seven
are
elected
by
the
governing
board.
A
Oh
okay,
yeah!
So
that's
something
to
talk
about.
That's
actually
the
last
item
on
here
because
we
had
discussed
that
months
ago
about
what
the
composition
of
it
should
be.
The
4-3
split.
And
so
I
just
want
to
confirm
that
everybody's
still
in
agreement
with
that
or
if
we
want
to
make
a
change,
but
that's
good
to
know
that
the
governing
board
will
be
discussing
it
as
well.
A
E
I
think
what
we'll
be
able
to
do
is
get
a
list
of
contributors
from
the
last
year
out
of
lfx
insights
and
proactively,
email
them
and
say:
we've
determined,
you're
eligible
and
just
just
either
confirm
here
or
or
look
watch
for
a
ballot.
And
then
we
could
say
anybody
who
hasn't
received
that
ballot
but
believes
they
should
be
eligible
because
they've
contributed
in
some
other
way
that
we
haven't
automatically
detected
can
submit
to
this
form.
It's
that.
E
E
A
G
Yeah,
sorry,
I
was
a
bit
late,
but
just
on
that
very
point
you
just
talked
about,
I
mean
brian,
you
may
remember
in
hyperledger
we
have
this
system
with
insight.
One
key
aspect,
though,
is
you
need
to
determine
a
time
range
that
is
taken
into
account
for
insights
yeah.
That's
something
you're
gonna
have
to
set
a
period
so
we're
just
we're.
Spinning.
G
Yeah
exactly
when
do
you
end,
you
know
and
stuff
like
this,
I
mean
we
have
the
case
in
hyperledger,
where
people
you
know
contributed
like
two
days
before
the
election
and
say:
hey,
I'm
not
on
the
list
and
we're
like
sorry,
we
cut
you
know
two
weeks
ago,
that
was
the
the
deadline,
and
so
it
doesn't
really
matter
what
it
is.
But
you
need
to
be
clear
about
what
it
is,
so
that
you
can.
You
know,
explain
to
people,
I
mean
you
could
say
it's
the
final
day.
G
E
To
tell
you
what,
since
none
of
the
since
there
isn't
a
schedule,
that's
part
of
this
decision
matrix
today
and
I'd
ask
let
us
come
back
to
you
with
a
specific
set
of
dates
for
when
certain
things
happen,
and
what
we'll
do
in
that
schedule
is
propose.
You
know.
As
of
this
date,
you
know
any
contributions
within
the
prior
year
will
count
towards
eligibility.
Yeah
sounds
good.
A
A
A
There's
the
announcement
mailing
list,
there's
the
tac
mailing
list,
probably
all
the
working
group
mailing
list
as
well,
just
to
make
sure
that
it's
seen
by
everyone
so
we'll
go
ahead
and
spam
that
out
to
everybody
and
then
at
the
conclusion
of
the
nomination
period,
the
election
officials
will
go
ahead
and
publish
that
list
of
the
candidates
most
likely
on
the
attack
repo.
That
will
then
again
get
sent
out
to
everyone
for
folks
to
go
ahead
and
look
at
and
then,
as
mentioned
already,
the
officials
will
validate
the
eligibility
voters
before
the
election.
A
A
The
eligibility
is
that
an
election
official
has
to
also
be
eligible
to
vote
in
the
elections,
so
basically
have
participated
in
open
ssf
in
the
past
year,
and
then
the
the
general
clause
that
we
kind
of
have
across
openssf
is
max
representation.
You
can't
have
more
than
one
person
from
the
same
organization
that
includes
subsidiaries
and
affiliates.
A
So,
for
example,
you
know
microsoft
and
github
that
type
thing
so,
given
that
this
one's
a
little
bit
more
loose,
there
wasn't
a
ton
of
obvious
approval
for
it
as
well
to
make
sure
that
we're
all
kind
of
on
the
same
page
here.
What
do
folks
think
about
this
proposal?
Any
other
comments
or
suggestions.
H
A
Yeah,
I'm
certainly
open
to
that.
You
know.
Ava
had
mentioned
that
this
is
how
another
group
did
it
so
we're
kind
of
modeling
after
that.
Just
given
that
there's
other
communities
following
this
sort
of
mechanism,
I
think
that
did
make
sense,
but
I
I
don't
have
a
you
know
any
opposition
to
that,
but
definitely
it
seems.
D
Part
of
the
context
there
is
kubernetes
versus
cncf.
There
are
different
levels
of
the
organization,
kubernetes
being
a
specific
project,
and
so
the
the
link
that
I
had
shared
as
a
reference
for
how
kubernetes
does
it?
It's
not
a
direct
one-to-one
mapping.
It's
like
saying
well,
this
is
how
the
cncf
does
their
election
to
how
the
openssdf
could
do
theirs,
which
is
not
the
reference
I
shared.
As
far
as
why
yeah
I
could
go
either
way
as
well.
D
E
Jory,
david,
sorry,
certainly
by
certainly
by
default,
will
do
everything
necessary
to
ensure
a
smooth
election.
I
think
the
point
of
an
election
official
is
to
look
over
our
shoulder
and
make
sure
you
know
what
we're
doing
never
can
be
criticized
as
not
having
you
know
had
the
involvement
of
somebody
trusted
by
the
community.
So
yeah
I
mean
it.
I
think
the
one
thing
that
isn't
here
that
you
would
normally
have
is
that
an
election
official
must
be
somebody
not
running
in
the
election
but
yeah.
E
J
E
G
So
that's
the
thing
I
wanted
to
share,
I
mean
in
hyperledger
we
started
with
nothing
and
basically
the
staff
was
running
it
and
then
the
chair
then
volunteered
to
help
them
and
it
created
some
controversy
because
it
was
also
running
and
some
people
say
well
where's
the
transparency
when,
in
fact,
I
think
it
was
all
very
you
know
well
intended,
but
anyway,
so
in
the
end
I
mean
the
last
election.
We
actually
have
a
mailing
list,
which
is
public
where
people
can
make
their
case.
G
This
is
the
so
the
staff
runs
the
election
to
be
clear
and
they
have
a
process
with
all
the
dates
and
everything
that
is
presented
to
the
to
the
to
the
attack.
I
guess
in
this
case
beforehand
to
for
approval,
so
everybody
knows
what
the
process
is
going
to
be
and
then
they
are
in
charge
of
implementing
executing
the
plan.
Then
the
only
really
problem
that
can
surface
is
what
brian
was
just
touching
on
his
eligibility.
G
Somebody
who
says
hey,
I'm
not
at
least,
but
I
think
I
should
be
for
this
and
that
reason
and
then
the
staff
has
to
do
some.
You
know
due
diligence
to
figure
out
whether
this
is
a
valid
claim
or
not,
and
that
can
be
a
bit
touchy.
I
mean
in
hyperledger.
In
the
end,
we
have
a
mailing
list
where
this
is
being
discussed
openly.
F
I
will
say
that
this
each
apache
project
has
its
own.
Each
project
management
committee
has
its
own
process
and
most
there
is
not
a
rotating
board,
basically
you're
becoming
a
project
committee
member
for
life,
unless
you're
voted
out
under
extreme
circumstance,
because
knowledge
of
the
code
or
knowledge
of
the
process
and
procedures
never
goes
away.
So
they
don't
like
removing
people
right.
A.
J
D
J
D
I
do
see
your
point
that
we
are
putting
a
recruitment
requirement
in
here
that
the
election
officials
not
be
running
for
a
seat.
I
don't
think
that
would
pose
an
issue.
I
would
hope
that
we
can
find
three
people
who
are.
You
know
well
respected
members
of
the
community
who
are
not
running
but
would
want
to
be
involved
in
this
process.
J
J
D
A
A
A
C
C
J
E
You
can
tell
this
is
a
security,
conscious,
zero
trust
community,
we're
trying
all
different
angles
on
this.
I
think
in
practice,
because
you
know
the
the
person
cannot
run
for
the
attack
themselves.
You
know
if
they're,
an
election
official
and
the
attack
approves
the
the
person
who's.
You
know
volunteered
to
be
in
this
role,
because
it's
a
volunteer
thing,
there's
not
any
reward
for
this.
Really
it's
it's
not!
I.
D
A
D
A
Okay,
the
next
one
is
the
tax
size.
There
was
some
discussion
last
time
around
increasing
the
tax
size
for
various
reasons,
including
diversity,
and
you
know
growing
opinions
and
things
like
that.
It
seemed
like
the
consensus
on
github
was
to
keep
it
at
seven
for
now,
but
certainly
folks
were
open
to
the
idea
of
increasing
it.
A
And
then
this
is
this
last
one
here
is
the
discussion
we
had
some
months
ago,
but
just
to
revisit
it.
So
we
had
this
idea
of
splitting
the
seven
between
the
community
and
the
governing
board
where
four
seats
would
come
from
the
community
or
the
technical
initiative
side.
You
know
basically
the
org,
the
community
around
the
attack
and
the
three
seats
would
actually
come
from
the
governing
board.
A
But
then,
as
brian
mentioned
earlier,
they're
having
the
governing
board
is
having
a
discussion
later
this
week
regarding
whether
they
even
want
to
participate
in
that
so
brian
I'm
actually
curious.
Is
there?
Have
there
been
discussions
already
kind
of
indicating
that
they
don't
want
to
do
that
or
they
don't
have
figures
in
it?
Well,.
E
E
You
know
did
play
a
role
in
in
kind
of
arriving
at
a
balancing
act
here,
but
what
I
was
looking
to
do
is
I
just
try
to
align
it
with
things
that
I've
seen
other
lf
projects
do
some
projects
do
continue
to
have
governing
boards,
appoint
members
of
the
attack
and
that's
part
of
the
value
of
being
on
the
governing
board.
I've
I've
seen
it.
E
You
know
the
the
broad
specter
spectrum
of
interest
in
our
community,
so
I
am
I'm
not
making
a
firm
proposal
or
a
recommendation
to
the
governing
board.
I'm
saying
one
option
is
simply
for
the
sake
of
streamlining
things
and
because
I
worry
about
trying
to
get
22
people
to
agree
on
three
people
to
a
point.
E
That's
that's
also
in
the
back
of
my
head.
Is
I'm
just
trying
to
reduce
the
amount
of
machinery
and
amount
of
bureaucracy
to
to
an
absolute
minimum?
So
that
was
one
reason
I
was
interested
in
kind
of
detangling
these,
but
the
only
reason
that
I
could
see
them
keeping
it
or
that
I
think,
would
be
a
valid
reason
to
keep.
E
It
would
be
to
come
in
after
after
the
the
public
election,
the
contributor
election
and
go
here's,
here's
three
more,
that
we
think
help
flesh
everyone
out
and
flush
out
the
attack.
So
so
I'm
not
it's
not
a
foregone
conclusion,
one
or
the
other
and
I'm
not
even
sure
which
way
the
learning
board's
likely
to
vote.
But
I
just
wanted
them
to
be
conscious
about
that
decision.
A
Okay,
now
that
makes
sense,
so
it
sounds
like
for
now,
unless
folks
here
want
to
change
their
minds
on
this
one
which
is
okay,
we'll
keep
it,
as
is
four
and
three
three
from
the
governing
board
and
then
pending
the
outcome
of
that
discussion,
we
may
need
to
amend
this
yeah.
So
you
have
your
hand
raised.
D
Yeah
I've
I've
seen
what
brian's
referring
to,
and
I
think
it
has
worked
well
in
some
groups-
and
I
might
just
put
this
I
plant
the
seed
if
the
governing
board
doesn't
want
to
have
like,
wants
to
reserve
the
right
to
go
down
that
path.
What
about
a
seven
community
elected
and
then
an
optional
two
from
the
governing
board?
If
they
feel
that
those
seven
didn't
cover
some
important
areas,
we've
seen
some
organizations
also
go
that
path,
I'm
comfortable
with
four
and
three
as
here
I
just
wanted
to
plant
that
seed.
K
A
Yeah,
I
totally
agree
that
we
did
discuss
that
at
the
previous
meeting
too,
that
that
was
one
of
the
ideas
that
as
open
ssf
grows,
we
may
need
to
grow
the
tax
to
cover
everything,
and
so
I
know
there's
some
new
working
groups
that
have
come
up
lately.
I
think
folks
are
still
good
with
seven
but
yeah.
I
could
definitely
see
the
potential
in
in
this
expanding
for
sure.
K
I
think
another
option
to
brian
with
respect
to
the:
how
do
you
with
a
larger
governing
board?
How
do
you
try
and
manage
the
function
of
you
know
how
that
gets
appointed?
It
could
be
done
by
just
you
know,
drawing
straws
at
that
level,
possibly
because
I
do
think
there's
some
benefit
to
having
attack
that's
populated
with
some
different
methodologies
that
provide
a
comprehensive
point
of
view.
A
Yeah-
and
I
think
ava's
suggestion
was-
was
interesting
as
far
as
if
the
governing
board
did
decide
that,
oh
generally
speaking,
we're
not
interested
in
appointing
having
seven
community
seats
that
then
the
governing
board
could
say
well,
we
actually
think
you
need
two
more
perspectives.
You
know
in
this
way.
I
could
definitely
see
that
happening
and
being
useful,
but
again
this
is
all
kind
of
at
the
the
behest
of
whether
the
government
board
wants
to
do
this
or
not
that's
what
we
kind
of
need
to
wait
and
see
what
their
their
comments
are.
E
We're
also
in
a
spot
where
you
know
most
of
the
governing
board
participants,
you
know
have
employees
from
their
staff
who
are
following.
What's
going
on
in
the
technology
community,
you
don't
have
you
know
a
wide.
You
know
division
between
the
two,
so
you
know
I
that's
that's
part
of
my.
Why
I
bring
it
up.
Is
it
just
might
not
be
necessary
for
the
governing
board
to
have
to
appoint,
but,
but
I
think
ava
was
referring
to.
E
You-
know
kind
of
the
point
I
made
earlier
about.
Sometimes
it
can
help
to
have
a
second
look
on
here's,
here's,
some
voices
that
might
be
missing
from
the
conversation.
But
of
course
these
are
public
meetings
so
and
and
everyone's
free
to
talk,
you
know
and
the
votes
when
they
happen
tend
to
be
fairly
unanimous
or
consensus
driven.
So
I'm
just
trying
to
avoid
you
know
too
much
bureaucracy
or
too
much
process,
because
that
that
can
that
can
kind
of
bog
down
conversations
when
they
happen
yeah.
I
think
it's.
A
A
good
point
and
then
kind
of
the
other
sort
of
elephant
in
the
room
that
that's
in
the
back
of
my
mind,
is
that
not
only
is
the
new
the
governing
board
new
a
lot
of
the
governing
board.
Members
are
now
also
very
high-level
executives
and
may
not
be
as
involved
in
the
day-to-day
technical
aspects,
and
so
therefore,
may
not,
I
guess,
for
lack
of
a
better
term.
I
apologize
be
qualified
to
appoint
somebody
or
just
have
the
knowledge
qualified.
It's
totally
the
wrong
word,
but.
L
A
I
D
A
G
So
I
just
wanted
to
add
that
you
know
regarding
the
size
issue.
I
think
you
might
want
to
you
know,
give
yourself
the
possibility
of
reopening
the
the
size
issue
based
on
what
the
governing
board
decides
to
do.
You
know
just
as
a
possibility,
because
if
you
really
down
to
only
three
seats
elected
by
the
community,
the
technical
community
at
large
might
be
a
bit
small,
so
you
might
want
to.
I
think
you
know,
for
now
you
can
wait,
see
what
they
decide,
but
yeah.
M
A
H
E
E
E
A
A
H
E
A
A
A
A
A
Well,
we
do
seem
to
have
a
communal
memory
on
it.
So
if
we're
all
wrong,
then
we'll
see
but
okay,
so
in
general,
I
think
we're
in
agreement
here
we
seem
to
go
lock
down
the
details
and
make
sure
that
we're
in
the
right
place
here
and
then
brian,
that
the
governing
board
meetings
on
thursday
is
that
correct.
A
J
A
A
D
There
are,
there
are
three
different
decision
points
though
one
is
who
are
the
election
officials?
The
next
is,
who
are
the
first
one
is
who
are
eligible
for
voting,
that
pool
from
that
pool
then
are
drawn,
who
are
your
election
officials
and
who
are
the
candidates
who
run
four
seats,
but
you
first
have
to
have
that
list
of
who's
eligible
to
there's
a
bit
of
interplay
between
these,
because.
J
J
G
D
G
D
E
Here's
the
bigger
point
is
yeah
two
and
a
half
weeks.
We
can
do
things
expeditiously,
it
might,
I
don't
say
violate,
but
it
might
require.
You
know
a
fair
degree
of
trust
between
all
of
us
as
a
community
to
overlap
some
things
that
otherwise
might
be
strictly
sequential,
but
you
know
working
backwards
ava.
I
appreciate
you
working
forwards
working
backwards.
E
If
we
said
we
want
to
have
an
election
the
week
of
december
12th,
which
would
be
one
week
to
conduct
the
election,
which
is
probably
fair
and
standard,
some
communities
do
too,
but
let's
say
one
and
then
the
week
before
the
week
of
the
sixth
to
have
people
self-nominate,
which
is
also
compressed
but
fair,
and
that
means
you
know,
through
the
end
of
this
week,
getting
closure
on
the
governing
board
question,
which
I
think
we
can
and
you
know
any
other
prep
work.
So
it's
it's
tight.
E
I
think
we
can
do
it
and
you
know
I'd
be
glancing
over
at
jory
if
we
were
in
a
room
just
to
make
sure
she
was
running
election
that
quickly,
because
that's
I
yeah
there
might
be
dependencies,
I'm
not
aware
of,
but
I
just
want
us
to
all
realize:
we'd
have
to
work
asynchronously
be
a
bit
perhaps
quicker
and
parallelized
than
we
might
otherwise
be.
If
we
wanted
to
do
it
by
the
end
of
this
year,
if
not,
we
should
just
punt
it
to
january.
G
A
A
D
J
D
My
my
suggestion
would
be-
and
I
like
brian's
framing
of
it
working
backwards,
get
as
much
of
the
groundwork
in
place
as
possible
before
the
end
of
the
calendar
year,
so
the
election
can
actually
be
held
right.
You
have
like
the
candidate
pools
are
in
place,
the
all
of
all
the
things
in
place
to
actually
hold
an
election.
We're
not.
A
D
I've
seen
large
communities
do
two
weeks.
I've
also
seen
them
do
one
week,
but
I
will
say
that
in
in
communities
where
I've
seen,
elections
get
rushed
or
overlap
a
holiday,
there
have
often
been
a
blowback
afterwards
that
things
weren't
communicated
well,
and
this
was
raised
on
some
of
the
github
issues
that
were
concerned
about
getting
the
right
information
out
to
all
the
constituents
so
that
ballots
aren't
missed
things,
don't
get.
D
I
would
I
would,
I
would
say,
let
it
let
it
run
a
little
bit
longer
like
make
sure
we
got
our
eyes
and
cross
our
teams.
That's
a
whole
lot
better
for
this
to
take
an
extra
week
or
two
or
three
than
have
to
re-run
an
election,
because
there's
considerable
doubt
having
seen
organizations
have
to
rerun
elections
in
the
past.
So.
J
A
A
C
A
Yeah,
so
my
default,
like
I
mentioned
earlier,
is
to
talk
to
some
of
the
working
group,
leads
and
see
if
any
any
of
them
are
interested
in
being
elected
officials
and
also
not
running
for
the
attack,
and
I
can
reach
out
to
them
and
then
the
folks
have
other
recommendations
as
well.
You
know
we
can
kind
of
go
from
there.
A
B
A
D
So
I'd
like
to
suggest
slightly
different
dates
here
and
I'll
explain
why
there's
another
the
election
official
soft
nomination
by
1210
and
then
selection
on
1214
makes
sense
that
runs
right
up
into
the
holiday
window
for
a
lot
of
people.
I
think
candidate
nomination,
a
candidate
self
nomination
and
validation
by
election
officials
needs
a
minimum
of
one
business
week.
That
is
not
overlapping
common
holidays,
which
puts
that
at
the
week
of
the
fourth
to
the
seventh
at
the
earliest,
possibly
even
the
14th,
the
end
of
that
period.
D
The
election
officials
validate
the
final
list
of
candidates
and
their
position
statements
all
that
that
could
get
emailed
out
then
aggressively
on
the
10th
optimistically
on
the
17th
that
being
a
monday
or
the
sunday
beforehand,
and
then,
if
one
week
of
elections,
that
means
the
election
closes
on,
probably
the
21st
or
28th.
If
it
closed
on
the
fight,
it
doesn't
happen
on
the
friday,
but,
like
that's
kind
of
the
window,
is
this
all
runs
through
january
to
the
end
of
january,
but
there's
no
reasonable
way.