12-16-2025 WG-BEAR Regular Meeting  Hi everyone. I know Marcetta's uh running a little late. I got my dogs back here. So all good. I finally have a break in my schedule. I had a long standing internal meeting they just couldn't seem to get right. Um, every time I asked them to change the meeting, then there would be a a weird rift in the force where they change the meeting and then all of a sudden the meeting would happen and they're like, "Oh crap, I'm missing another meeting." So, but no meeting today. So, I'm here. >> Miracles of the holidays. >> Ready to uh kick off the um the tip of the month though for for for next month. >> Yeah. >> Be some good stuff coming into this year. >> Thank you for taking the lead on that. Good. Be good to get that get that kind of stuff out. Anybody else tired? I was on vacation for three weeks. I came back. I mean, I feel rested, but boy, am I still mentally worn out. I don't know what the I was just mentally worn out. >> Yeah. I'm just tired. It's just I guess the holidays kicking in. My body's just like, "We're done. We're done." No. All right. I'm trying to pull up the notes if anybody has a reading available. It's 2024. It's good to Oh, thank you, Stacey. All right, not see if I can share my screen. All right. So, share screen. Okay. So, if you haven't done already, feel free to chat. Sign yourself in. I know Jay, you're talking about tip of the month. Uh we had uh OSS Africa um final decision and 226 road maples in the road map I think put that in there. All right. Let me find and I think today we're making final decisions on OSS Africa if I'm not mistaken. >> All right. I got thumbs up from Stacy. Let's see if anybody said no. See another not a vote of support. All right, so it looks like everybody voted in support. I don't see any thumbs down. Uh Stacy or Marcela, what would be the next steps? Um I am unsure. I think I don't know if we have other sigs in this. I think the votes are there. So we can just say that it's voted in. Um unless there's any other objections on the call. Um, and then we can add uh the SIG maybe somewhere to the repo, I guess, to make it official. Does that sound good? >> Yeah, maybe we just connect the bear work to um we go to the Oh, it says Africa. Thank you. Yeah, no worries. like >> yeah, I don't know if we want um one of the SIG leads to just open the PR um combine all the combine all the um like the initial issue proposal that you wrote up Stacey and then also the extra content that shared um I think we can just put that in a PR and then um merge it into the repo. >> Okay, Prince, are you comfortable doing that? and I'm happy to assist however I need to. >> Yes. >> Fabulous. >> Hello everyone joining me. Sorry. >> Good holidays around. I think we just started kicking off. Well, congratulations. Sounds like OSA South Africa is officially a stake under the bear working group. Give yourselves a well cheerful screen share. >> I'll make a note in the issue if that's not there yet. Um to say that like on today's meeting we officially declared it. Thank you. Perfect. And then it was on me to put the road map in the repo. I honestly forgot. I thought I had another week. Um, where do we have that road map document? No worries. Oh, we had something. Is it here? Do you know where we put the remote? Did we create a romant? >> I thought there was one. I know. I found it before. >> Try to dig it up real quick. Um, you talked about it like two meetings ago or something. >> I think at our last meeting too. >> Yeah. Is it here anymore? This was the tech initiative document. Yeah. Found the bear working group document. So, or not the bear working group. What am I saying? the tip of the month document. Um, share that here. Stop sharing it to me. I did Okay, this is tip of the month. Uh, let's pass it over to Jay. Any top of mind or questions on the tip of the month? >> Uh, no. I'm sitting here reviewing uh the tips as they're as they're laid out. Um, what I what I may do is I may throw um I may throw a a audible I may pull a audible um and and that will be current event focused right so like for instance I see a couple of tips here you know I'll give an example trust but verify validated testations but let's say some at some point during that month some kind of regulation passes or some type of standard gets um or some type of spec turns into a standard and it's relevant for you know tips that that that we're looking at you know especially like I'll give you an example CRA stuff and and VEX in particular um we're getting ready to publish a blog through OpenSSF and through Oasis um uh signaling the noise uh we're a a consortium of of um industry uh leaders put together a document on VEX in the industry which will complement a lot of the CRA work that that you know that's happening uh with respect to vulnerability disclosures and all that kind of stuff. Um, you know, part of that conversation is how do open-source developers, new open source developers, uh, how do they, uh, how do they join the fund and being able to to, um, create vex statements, especially since they're creating tools that they hope get picked up by enterprises and some of their efforts, right? How do they create vex statements that an enterprise can then use to validate or or or to verify um you know the the you know vulnerabilities that may be present and and or or or how do they verify whether or not no coding and stuff like that um that might be relevant for tip of the month. I I mean I you know stuff like that. Not saying that that that we'll deviate so much but um in an effort to to maintain current along with our thoughts now as as we keep pushing them out for the remainder of the year, we may want to bring stuff up current during that month that will resonate a little bit more than stuff that we thought about maybe six months ago. Right? So um that that's pretty much it. Um but no questions. Uh just excited to get that moving because um you know we we're we're moving in different places and you know especially with this new SIG. It'd be good to get this tip of the month and then get that that that tip stretched as far and wide as it can uh globally, right? So that that's exciting. Yeah. No, no questions. Just just ready to get that moving. >> Yeah. Awesome. Yeah, that was kind of like the idea of it. It's like anything current um that might be coming up like anything the community does like the tip of the month can be I'm just going to say sign your AI models and then you know we point to the AI modeling uh like white paper kind of thing but things like that >> model transparency and all that >> as we begin to build out this whole new phenomenon about AI bombs and all that we can we we can even do some stuff around that right? I mean it's just whatever is relevant. So >> yeah. >> Listen, thank you J. >> Who who's gifty? That's >> I mean >> not to put you on the spot. Gifty >> just >> do want to welcome our our new members. I see few returning familiar faces. Um, and a few new friends. If anybody, we usually ask if anybody wants to introduce yourselves, but we just, we got holiday brain. Just jumped right on. >> I I've got a bit of an issue with my PC, my laptop. Sorry. So, um, but here I'm joining from my phone. So, okay. >> Everyone was gotten a souvenir here. Yes, I got it from visiting. >> I'm so sorry. I did not get to look at time. I was a little bit busy. Good evening for my time. >> Good evening. Yeah, for those who are joining um we officially voted in OSS Africa. So, if you want to send in your your celebratory reactions um either here in the chat or on Slack or reach out to the community members themselves. So, it's it's a great opportunity and great time right now. Um, >> yay. That's so exciting. This is S here and I'm going to be muted for most of this because I'm on a train, but I'm so excited to hear that. >> Yeah, it's so great. Today's a Today's a great day. Um, >> Marcel or Stacy, did we find the road map? Do we have a road map document? >> I could only find the one on GitHub from 2025. I could swear I I saw another one for 2026, but I cannot for the life of me find it right now. >> Yeah, I'm not using the same laptop as I was last time. So, Cash doesn't find anything. We usually post the links. If not, we just start a new one and go from there. Um, outside of the tip of the months, I guess top of mind for folks on what we want to do for next year, I know the other thing was the uh community office hours. We started pretty hashing pretty much hashing this out. So, I'll share that screen. Um, the idea was in January we kick off with a working group landscape kind of call. This is just us kind of talking through the different working groups, let people know um what we're doing and we're kind of collaborating um mixing our office hours with welcome calls just for simplicity at the moment until we can get um a leader for each of the different types of calls. Um so we'll start off with the uh working group landscape. Then in February we were thinking AI and ML working group CRA because those are two of the more um word buzz friendly at this moment. Um and then we find working groups for April. Um we can do bear in April. we can do another one um just to kind of keep things moving and here in technical initiatives I think we're also going through all the different working groups and then who would be like the point of contact person and then we can start assigning like who reaches out to start populating 2026. So that was my memory of what we kind of talked about for 2026 roadmap planning. Um there was the OSS Africa group getting um talks out there for uh that group and then I think seeing which uh conferences we want to set out next year to start targeting for confer papers. Those are I think the three top of minds. >> Yeah. So, I couldn't find a specific talk, but I did find like extensive notes um in the like meeting notes talk on November gosh, what date was that again? November 18 um or you probably talked a bit quite a bit about um 2026 road map. So, yeah, as you were saying, speed engagements um also mentorships is on the list um for for that. So, I actually don't know if there's been an update on budget for that. But yeah, we should take like whatever notes we took on the 18th um so like a month ago and put that into um PR probably. Um >> here it is. Yeah. Yeah. >> All right. Um, and I'm guessing you said nothing yet on the budget. I haven't heard. Yeah, I didn't speak with Adrian. Um, I asked I think it was Kate who was going to speak with Adrian because Kate is actually our mentorship staff contact. Um, Yeah, there have been a few like questions coming in about uh like when when that's going to start again. So there's definitely interest from the community. Um and I think at the same time we need to start asking projects to um volunteer >> for the mentorship. Yeah. Yeah. Yeah. Projects to post mentees. Uh one quick note there. If there's anyone that's come into OpenSS in the last six months, like newcomer projects, it's a good opportunity to reach out to them directly and tell them this is actually a great time for them to bring on documentation. That would be great. You're breaking a cell, >> but uh love the mentorship programs get them paid. That's better. >> Yeah, you were breaking up in the middle of um the middle of your um discussion. I think yeah, the idea of the 11 pizza to have a pizza. >> Okay, can you hear me now correctly? >> Yeah, it's a bit better now. >> Oh, well uh I'll just send you this message. >> Sure, no problem. Um yeah, I I caught some of what you were saying, >> but >> I'll give up. I'm on the track, but uh >> yeah, it does sounds like the packets are moving in time. Um but I got the um reach out to new open-source projects and it might be a good opportunity to bring um contributors there. >> Yeah. Yeah. whether it's um whether it's documentation or it's it's coding um um is that maybe something you could um help us with Stacy is getting out those messages um to projects or even to working groups soliciting uh volunteers like I think we could start with some of the older projects too but >> yeah absolutely >> and like last year's thank you >> to to apply for the mentor mentorship program for next for the springtime. Is that what you're saying? >> No, I think to just get volunteer uh mentors. >> Okay. >> Yeah, because I think even if we do this summer, we want to start the process in the spring just because of how the application timelines work out. >> Um and on the LF side, they need like a month or so to get the whole dashboard thing set up. So, yeah. Like if we could target spring also that would be fine. Um I just think the timeline may be a bit tight. You would have to like be ready next month and I'm not sure we are. Um and yeah, given that we're still waiting on budget uh questions. Um yeah, we I'm not sure we can actually host anyone in the spring unfortunately. Yeah. So, I don't know what um the best approach would be, Stacey, but yeah, I he's been really good about reaching um reaching speakers for the um for the office hours. So, and I think Yeah. Awesome. Anything else on mentorships? Um, just for my own accountability, I'll probably I have like a to-do item to write a blog post about mentorship about like the lessons learned from this year. Okay, I got to call him over. I have a jumper. Um, all right. Jumping over to speaking engagements. Uh Prince, were you able to work with your your team and group to see uh speaking engagements for next year? Where you want to rank them? Where you like to go? What your priorizations? >> Yeah. Um so, um please let me get back to you on that. I think you suggested submitting a CFP for them but looking at some challenges that we anticipated to be sending to not submit but we look at others on the news I'd like to get back to you sty >> okay um let's target the first meeting of a year to just have it doesn't have to be anything perfect or well fleshed out. It's just a general idea of um uh like where you would like to speak to and even it's just a just a starting my image. Um yeah, I have a list of uh I have a list of security speaking engagements for another community. Um I think we need to do the same thing and decide which conferences we want to talk talk at um what our CFP is going to look like. Um, uh, Stacy, do we have or anyone on the call, do we have a list of dates, times, maybe locations for OpenSSF conferences next year? >> I do. Um, let me find my slide that I have internally and I can put them into uh the doc so you can see those. Give me a second. Stay safe. I don't the same. You're right. I still see uploads that I think package management form is already closed. Um I saw security con EU for March 23rd has their craft paper open. >> Uh that one I think is closed. We're working on the schedule for that right now. Um, and then the community day North America as well as open source summit North America. I think they're still building the websites on those. So those CFPs haven't been opened yet. Um, but yeah, the the open source security conu is definitely closed and because they're they're working on the agenda right now finalizing sessions. >> Go cheap. Okay. Maybe it was like that last coffee paper or something. I think um Volcon is still open. Um that one I think closes on December 22nd. I think that one's happening in Scottsdale, Arizona this year. If anyone is in the US and is traveling in the US, um but yeah, I think of the ones on this list, that's the only one that I'm super aware of being open at the moment. >> Okay. Would anybody be able to go to Voncon this year? >> Comments? >> I think I would try to apply a second time. Um, I got my my paper accepted for a talk in April, but because of the visa issues, I was unable to attend. So, I think Gracie suggested that I I reapply so that I speak this time around. So hopefully um I get to submit before the deadline and yeah, nice. Let us know how we can support and help um on that adventure. We would love to have you on this part of the world. Um but if not, we got valid passports and hopefully we'll be able to go visit you on your side of the worlds, which I think is fabulous. Um part of the uh part of the >> Go ahead. >> Please go ahead. >> All right. So um the reason why I couldn't get the visa early on was um because of the timing I got the paper accepted as a later time and so I applied same and a month to the conference date or sorry two months or so to the conference date that influenced not getting there was a long queue of folks who were had applied also. So I think that is something that um I don't know maybe it's conference organizers would have to look at it really affects um applying and getting visas from this part because if the the paper gets accepted say about a month or two months to the or three months to the conference it may be possible for folks from your end to attend but then then there's this issue when it comes to attending from Africa so that is just something I thought of adding >> would it be poss possible to apply for the visa after you submit the talk and then you know depending whether or not you get the talk you decide your travel plans. >> Um sorry I didn't get that. So, so apply for the visa as soon as you can >> like once you submit the talk and then if you're accepted then you can just like update I guess the visa process. I don't know how that works fully on uh for you. But that could be a possible avenue where you're just trying to get ahead of it. So once you are accepted cuz I'm always thinking positively um the visa is already in progress and you can just send them your acceptance. >> Okay. Can I say something? >> Thank you. >> Can you guys hear me? >> Yeah, we can hear you. >> Okay. So pertaining this visa application thing I think I don't know how it is in Ghana but in Nigeria if you want to apply for a visa like that your talk have to be accepted first then you use all the evidence put together and use it to apply for a visa for you to be able to get an approval. So that's how it works and that's like the whole limitation process. I don't know why Prince didn't mention that but that's literally how it works here. You have to need you have to have something to be able to apply for the visa. You don't just apply for the visa. That's how strict it is with us here. >> Okay. Thank you for that. >> No, that's that's actually really good to know. Um because I was thinking at least for the events that OpenSSF hosts, would it be possible to have? I mean actually before I speak I should just look um there are quite a bit of um travel. Okay. So there is already like a visa information section on open source summit North America for example. I know it's not hosted by OpenSSF, but I I imagine it's a similar a similar format on the website. Um, what I've seen in other conferences is that they actually say, you know, uh, if you plan to travel here, you should we recommend that you start applying around this time. Um, is there something and the conferences offer to write letters. So is that something that we could do for um OpenSSF hosted conferences? >> Oh, sure. That's something that could work. So if there is any proof or sign that um Open SSF could give out to persons that are going to apply for visas even before their speaking engagements are accepted, that would work. That would be very perfect. >> Okay. So, I don't know about Voncon um and who manages that, but maybe as a group we target North America. Um send get the letter because we got a little bit of time. get the letter, submit some bare working group talks, um help advertise OSS Africa group and um and then maybe have like a bear meetup or something. That's my thoughts around it. Love to hear audio. >> Um Stacy said in the comments that they we do not write this types of letters to her knowledge. >> I'm sorry in the chat. >> Yeah, we can't write anything ahead of time. Um, and that's not something that we can do from the OpenSSF perspective. Um, I know that the larger conferences like CubeCon and things like that provide letters. Um, but OpenSSF does not as far as I know. I will double check on that just to make sure that our 2026 policy isn't changing. Um, but I can follow up. Okay. So, um, please go ahead. >> No, go ahead, Prince. All right. Okay. So, um I think the Linux Foundation I I got a letter for the open source summit this past November, but there was a similar issue with the visa. So, I was unable to attend as well. So um I don't know if it is possible to get it through the Linux Foundation but that is if you um you are receiving sponsorship from um from the Linux Foundation or the Open SSF and I don't know if that qualifies here of yeah that's that's that was my experience So perhaps if um the Linux foundation or the open as a ser is a sponsor for a particular conference. Um >> so I think most >> okay sorry >> please go ahead. >> I think most of these things make sense if um maybe you apply for a talk and you are a speaker already. Most of these things make sense. So if it is possible for the applications to go out early and approval to come in earlier, I feel do this conversations would not be necessary because this later will be um right in hand for a speaker. >> What what other comes to mind to me is like what other requirements will allow for visa? like what if you're volunteering for the conference or you're setting up a booth. Um because what I'm envisioning is like having uh open SSF I'm sorry OSS Africa come in maybe with its own booth or like having its own that way maybe we can get open SSF to agree with that and then that shows that you're needed for the conference while we wait for the talks to be approved. That's just what I'm thinking of. It all has to get approved on on all parties, but um if the need is if the visa is to speak and potentially work at a conference or represent your organization um at a conference, uh that way you can start submitting it earlier um once we get the okay and approval from OpenSSF and the Linux Foundation. um because I don't see them approving ahead of time. Okay, I see a thumbs up. Um yeah, I think it's just we got to talk to Open SSF and then Um, uh, Prince, if you can understand and learn a little bit more of what's the requirement for the visa and in the conference, um, we can work with that and see how to get you some proof of evidence soon. It might mean that you have to work more at the conference, but um, it's all in the name of open open source Africa. Yes, sure. Um, I I'll work with you on that. >> Yeah. And to Marcela's comment, it it does seem like it's more of an issue of the timing, especially if you're trying to get folks from other areas around the world to join. Yeah. Yeah. I felt those travels. more expensive too. >> Yeah. Like I mean sometimes very you know just a month or slight less than a month times even the travel um that can be tricky with um uh like requesting travel funding and stuff like that. >> Okay. So I think we just have conversations and research to do for this. Um most of the group right now is in Africa and uh the US. We have a few in Europe. So uh maybe we think of what we want to talk about. Um or we can shift over to the next topic which is uh office hours. We do have like 14 months left. Anybody interested in either topics? Talking about maybe what we're we would submit talks on or seeing how we plan out and maybe getting the first um office hours kind of planned. I'm looking up to see when that first office hour is scheduled. We do have one at the end of this month that we have to get cancelled. >> Yeah. Yeah. And the next one the one the first one in January is on the 22nd. >> Okay. Oh, >> there's two there's two calls before that. >> Um, and that one was the welcome column and this was just talking about all the working groups. And this one we wanted to reuse the slide from the opens booth that we had in uh OSS North America this year unless it's been updated. >> Yeah. Uh I haven't updated this slide. Um, and yeah, who's actually going to give the working group landscape? It can be one of us for sure. Um, in like future calls, we'll have working group. Um, >> yeah, we'll have like working group uh chairs like come in and do that. >> Yeah, if anything, we could split it. One person talks hashes at the other the other half or something. Um, and I know Sally has sent me the template before. I just don't know if we already have something like this. I'll take that actually. Okay. I think Sally Cooper just um Sabi mentioned writing a blog post introducing USS Africa. So >> I love Stacey here. So she mentioned that Stacy and I work on it. I don't know if you've seen it, Stacey. So perhaps we work on that together and get it out. >> That' be awesome. Um, I know the the blog that EG wrote and S wrote, >> I think that was recently released if I'm not mistaken or still in the review. >> No, I saw it go out uh part three. >> Part three. >> Yeah, I think that went out this week. Um yeah, actually I was thinking because of the um kisser and s did did all that work. Um not to not to volunteer you without asking um but a would you be willing to um speak as part of the um working group landscape? Um >> oh sure. >> Sure, sure. >> Thank you. Yeah. And we can ask S too if if they're available or not. Um. >> All right. >> Cuz yeah, you guys are honestly the experts on the working groups. >> That's true. >> Yeah. You just take what's in the blog and put it in the presentation and All right. Um, she sent me one before, so I may have it already on Snag. Um, okay. same reason. And um for the last couple minutes, let me know any last thoughts or areas of focus. Um I would just like to say that I posted in the general channel. Um what day was that? a few days ago, I think it was December 9th, there is a a form uh asking folks if they can um fill out uh I I'll put the the form link in the chat here. Um but basically, we're trying to figure out like where our community is located so that we could um support uh efforts for travel and uh event attending and things like this. uh Devril and ambassador program uh possibilities um for particular regions all over the globe. Um so it's just so that we know kind of where our community is. Um so if you're able to give us that feedback uh that would be great. Um and yeah, we'd really appreciate it. >> Thank you. Yeah, I think I think I populated I added the um the template the Open SSS slide template to the chat and the notes. So if you want to kick that off next year doesn't have to be now holidays are coming up. Um there I think that's it that I had any other conversation talking points for the next seven minutes. I'm sorry Stacey. You mentioned something about a link you dropped in the general channel. Please can you I can't see it. I'm checking it. It's also in the chat. >> Oh, okay. >> It's the form forms. Joey, I think yeah, the forms.j is uh OpenSSF is trying to determine where everyone's located so they can do meetups. And then um the last link I sent is the template for OpenSSF slide deck that could be used for January's uh welcome call about all the other working groups. >> Oh, I'm sorry. I'm muted. Okay. All right. I I was answering you. I I forgot I was muted. >> You're good. All right, if there's no other talking points, um, big congratulations to Marcelo who's going to continue in the tech next year. Go ahead and shoot in your congratulations. >> Yes. Yeah, I saw I was like, yay. And then uh big congrats to uh OSS Africa for being official sake. So sending your reacts and yeah you're dancing. There you go. Looks like Prince and Seth are in the same spot like right next to each other. Um and with that, thank you so much for all your contributions, your helping support this year. Enjoy the holidays uh for those that celebrate and happy new year's will. We'll catch you in 2026 to be here and thank you for being such a researcher. I try part of my day job. >> Thank you very much. >> Thanks everyone. Have a good one. >> Thank you everyone. >> Happy holidays. >> Happy holidays. >> Bye. Happy holidays. Bye >> bye., 12-16-2025 WG-BEAR Regular Meeting, YouTube, 01kcrscrdakarw29btwx494ck9.