Subject: [Codematch-develop] Open Source Discussion on SAAG

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 22 Dec 2014 09:33:02 -0500

Hello,

There is a discussion on open source software and the IETF happening
on SAAG that may be of interest.  Once CodeMatch is up and running,
we'll be able to help track the connections for folks.

On a call with Dave Ward, he mentioned he would like to see maturity
ratings for open source.  I'm not sure of the liability implications
of this, but it is something to think about and to figure out if there
is a way to apply a ranking without having a way to cause trouble for
the IETF.  I mentioned we plan to have a way to both announce
plugfests as well as provide a report from plugfests to say what
projects (open source or proprietary) have proven interoperability
with the associated drafts or RFCs.

Here is a link to the discussion:
http://www.ietf.org/mail-archive/web/saag/current/msg05874.html

Also, do we want to have a call tomorrow?  Lisandro, have updates to
the data model been completed?

Thanks!

-- 

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Mon, 22 Dec 2014 10:53:41 -0500

Hi,

I thought about the maturity ranking and ways to get around possible
liability issues a bit more.  Since the IETF works by consensus,
perhaps having a reputation scoring ability would get around any
liability to the IETF.  I'll have to vet this approach to see if my
assumptions hold, but would have scores be from individuals rather
than the IETF as a whole, but could show collective rankings from
participants in the scoring of software packages.

We would want to include an overall maturity score as well as one for
security (how do people regard the secure software coding practices
and reality for any package).  Are there other maturity rankings that
should be included?

If anyone thinks of a viable alternate approach to including a
maturity score that should be considered, please post to the list.

Another item - we will be rolling out CodeMatch in phases.  Once
Lisandro posts the next revision of the data model and mock ups, I'd
like to pull together a list of phases to prioritize additions to the
site.  Once pulled together, we can debate the prioritization and see
if anything is missing as well.  It should help.

Thank you,
Kathleen

-- 

Best regards,
Kathleen

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 24 Dec 2014 15:04:01 -0500

This didn't go to the list, so I'm forwarding it with responses.

Thanks, Michael!

Sent from my iPhone

> On Dec 23, 2014, at 10:57 AM, Michael Richardson <[email-masked]> wrote:
> 
> 
> Kathleen Moriarty <[email-masked]> wrote:
>> ratings for open source.  I'm not sure of the liability implications of
>> this, but it is something to think about and to figure out if there is
>> a way to apply a ranking without having a way to cause trouble for the
>> IETF.  I mentioned we plan to have a way to both announce plugfests as
>> well as provide a report from plugfests to say what projects (open
>> source or proprietary) have proven interoperability with the associated
>> drafts or RFCs.
> 
> Add a layer of indirection.
> github, and ohloh, for instance, each list how *active* a project is.
> So link to them.

True and we do have this planned in that any project that implements a draft (CodeRequest), would be a link.  If it's open source, that might be in GitHub where you can see forks, followers, etc.
> 
> That's not the same as maturity; but it is a metric.
> the pppd implementation is very low activity, but rather mature, for
> instance.

Good point.
> 
> An Ottawa company, https://www.securifylabs.com/ is also attempting to do
> something similar, with the idea of (corporate) crowd sourcing verification
> efforts. There are some methodological problems with their first take of
> which the company is aware.
> 

I'll check it out, thanks!

Happy holidays!
Kathleen

> --
> ]               Never tell me the odds!                 | ipv6 mesh networks [
> ]   Michael Richardson, Sandelman Software Works        | network architect  [
> ]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [
>