CPAN Security Group

A forum for coordinating and help resolving security issues on CPAN. CVE Numbering Authority (CNA) for Perl and CPAN. Subscribe, contribute or join!

1 minute read

Meeting

Tuesday 2024-12-17 @ 18:00 UTC / 19:00 CET

FOSS Funders

Claims & Quotes

  1. Contributions is the life-blood of Open Source projects.
  2. Metrics is useful, but mainly for creating situation awareness.
    • By the time you learn an issue from a metric, it may be too late to address any root causes for the issue.
    • Situation awareness is useless if one fails to act on it in time.
  3. This also goes for funding.
    • Do you offer funds only to successful projects (according to some metric),
    • …or also to projects where funding would make a major (reviving) difference?
    • If you fund a project, make sure it’s one that you use, and that needs it.
  4. Funding is mainly a tool for making Boring things happen.
    • Projects still need competent people who care enough to contribute.
    • Funding can help, but not without the right people caring enough about the right issues.

Boring Tasks require Competent People who Care enough to Contribute

  1. The keyword we should focus on is Boring.
    • Boring is subjective.
    • Competent People who Care can be found anywhere!
    • Let’s make a list that allows people who have different interests and skills self-select where to contribute!
    • (And if your business doesn’t care, then no worries! This list isn’t for you)
  2. This is what we’d like to achieve in the CycloneDX Sustainability WG

Questions

  1. How can we ensure that sustainability information for projects is communicated to the right audience, and made use of in a constructive manner?
  2. What other ways beyond funding and addressing needs can a business/OSPO help with
  3. What signals does a business/OSPO expect to see before deciding to contribute?