CHAOSS Data Science WG, April 7, 2026  🔗 **Source:** [CHAOSS Data Science WG, April 7, 2026](https://www.youtube.com/watch?v=nDnxUnY8noM) Okay, excellent. Well, we're gonna get the data science meeting started. Um, before we do, everyone just give some quick introductions and what you're hoping to cover today. And if people continue joining in today, we'll uh stop and see what they want to cover. >> I can start real quick. I'm I'm Adrian. I'm here mostly just covering for Cali. I guess I work very closely with her. So, I'm just kind of covering and um hoping to help answer questions about potentially Auger 8 stuff if if those come up, but I don't really have any specific agenda items really. So, >> yeah. Um introduction, right? So, I'm Nest. I have been active in the working group for a while and uh I happen to have made a bit dinner recently and uh most of my work has been on the foundational staff we which we're now trying to build up to become an important project that we call scope. So um that's pretty much about me. I do have a few questions about it not so maybe because of the meeting Sorry, I was saying I think we can probably just dive in. I'm going to set up a little bit around the agenda which is magically happening. I love open source. Um and uh yeah, I think we can have a discussion around augur and 8not and um yeah, I will just take excellent notes. Um, I have a few questions myself. I've been using Augur particularly. Uh, and uh, welcome in. We're just at introductions. So, uh, say hello if you, uh, just come in. >> I think you wanted to, right? >> Yeah. But it's all right if they can't join in at this moment. Um we can just jump in on the augur 8 not discussion. >> Okay. Yeah. Um so um yesterday I I think Sally is aware that I submitted application for the sovereign tech by the SDA and uh you know one of the requirements was to contribute to which I don't think is straight but you know just to meet that requirement I happen to currently contribute to chaos and open telemetry and I just used a not as the third one which my contribution is still at the very early stage. I'm still yet to send the PR but I have like two issues that I think I could you know work on which is um both of them were opened by Khali but unfortunately she's not here. So I responded I think earlier today that if I could get assigned to the issue just for it to be on my profile in case the SDF reviewers are doing that before I sign the PR. But um I think with the current plan that I have that I made in the early hours of today I should if there are no setting up issues you know for contingencies I should be sending a view out in a few days. So the the issues that I want to work on is the visualization that for both activity which Ki raised. I think I can quickly find that and share with you. The point is not necessarily the EU but just assigning me to that particular um um issue name so that it could show on my profile. >> You have the links to these issues. Um >> yeah, bring in the issue numbers and >> um since I'm I'm very I with some of the complications happening in the augur community right now. If you if you're looking specifically to be assigned to issues that are in the chaos or um I have the ability to do that on basically any chaos repo. Um Augur specifically is not currently in the chaos or for reasons I will not get into here. I actually meant eight not the one on red hearts. >> Okay. So 8 8 not technically is not in the chaos or yet either but um I can I do have access to that too if you if if that would help you. I'm not sure how strict the application is on wanting specifically chaos if that's what you're applying for but I I can I can do that if you send me the issues. >> That's no problem. It works really well with our plan and it's just open source contributions. Oh >> okay. Oh it's very broad. Okay. Perfect. >> Yeah, this and uh the second one I will send I will send the second one but this is the one I'm currently focusing on but just for reviewer sake to meet the reviewer too. >> Is that your username? >> Yes. Yes. >> Or did I send Then um today a follow-up question to that is today I noticed that you know the sample environment variable and that has like a mock DB of A. So I was going to ask is that sufficient for me to do whatever I want to do. which rep that was in >> you know the current structure on the um it's not repo there is a environmental variable that is like a sample you know for database connection to a so I noticed that is a mock database and I wanted to confirm I think you should be able to answer that whether is sufficient for me to do all my connections along the way so you know I'm just anticipating problems Right. >> Can you be a little more specific on where you're see is that um in the is that like the sample environment variables like where where are you seeing that in the repository? >> Yeah, I I will send that as well. It is on the root repo for the one I just sent to you now. >> I will send that as well. This is the second issue. Oh, Khali is here. Wow. So >> 8 right now had So we have a I think there's a Docker image somewhere. I need to go dig through the CI config to to grab the exact name. But we basically uh in order to have some sort of vague unit tests uh just to make sure that pull requests don't break. Um, we do I think we have there's a Docker image I built quite a while ago now that basically is just uh it it's basically I took an augur database that's basically freshly initialized. It's empty but it's schematically correct and just shipped it in a Docker container. So it's not really best practice but at least it's enough to have a database to connect to so that 8 will at least start up. Um, so that's what that probably is. Um, I am planning to kind of extend that with uh some more like to actually have sort of a an image that actually has a more current database and or actually has a couple of small repositories in it. Um, so I not 100% sure when I can get to that, but that's that's one of the things I'm trying to work on it. um work on doing soon. Um >> so I think if you if you wanted to try pulling that image and and using that locally that should work and the credentials in that sample should be valid for that. But that's a that's like a basically an empty database. So the the credentials don't get you very much. Oh, are those credentials real or I mean to my knowledge those were just placeholders for people to know the format for the credentials? >> I think they are real. It's just for that um I need to double check, but I I think they there was a purpose for having real credentials in there. Otherwise, it would have just put your password here. >> Um >> yeah, but it's also just like a Docker image that happened at one moment in time. Um, >> yeah, pretty much. I I've been trying to kind of systematic like get that more >> Yeah. >> like I'd like to have um one of my one of my goals for um the the more the more augur side of this is I want to we already have some testing in place that basically will run the Docker container for augur and and for like three minutes or something in CI and look for specific log lines to make sure it started up. I'd like to build on that and see, okay, can we can we also run Augur on a couple of tiny repos that only take a few minutes to collect and then we can actually make some assertions about, okay, this tiny archived repo is fully collected in CI and we can check the database to make sure the data is as we expect. I think that's a natural place to like okay at the end of that build that Docker job build an image and push it somewhere so that somebody can just pull down an image with like if all you need is a good enough augur database with data to connect something else to like that that I think would be a good purpose of that. >> Yes. >> But that's more that's I haven't gotten to that yet. >> Sorry. Is it possible for you to point me to that Docker email that you mentioned earlier that you said you >> working on finding Matt? I think. >> Excellent. Because I think that gives us an opportunity. We can follow up on this like in writing and in the following weeks. But like really getting a chance to build hygienically from that Docker image is a cool opportunity and we can think about it a little bit which is nice. Um, and then from there right now, Ernest, do you think you got any questions on bringing in the foundation stat stuff or do you want to give it a pass through? Sorry, I didn't get that answer. >> So, I'm interested in building out with the Docker image, but I'm also curious about like right now fundamentally for any of your pipelines. Are you blocked? >> Oh, I don't think we should worry about that yet for what we currently have. But, you know, when we want to connect to instances, yeah, that should definitely be the approach. Yeah. Cool. >> So, I'm I'm noticing I found the um Docker link, the Docker image to that empty database. Um and RCI is basically just adding that as a service to the YAML file to the Docker compose. Like I think the service name is mock DB and and then that's the the image. I'm noticing that that's I don't know. I don't think that Docker image like that Docker image should still be around. It looks like it's based in the Chaos or so. So, I don't think that would be affected by any of the the repository things going on in Augur. Um, so that I I would say give that a try first and let me know, ping me on Slack if you have issues uh pulling that or getting that to work. Worst case, I can just run a a local Docker local augur install on my machine on a couple of small repos, wait for it to get fully collected, and then just push a push an image somewhere um with that database if if that would help you. Um like I can always kind of manually redo this until I have the time to actually go and make it an automatic process. >> Yeah, that makes sense. Thank you. Yeah, I just linked in chat what we did for the selfmerge like um visualization. And so the idea would be that for every visualization it would have this like this check mark on the eight side of each of the steps that need to be done to get a visualization um merged into eight not and one of those steps is the notebook and the data science working group. So, it's like a subportion of the overall. And so, I was I'm going to be creating the issues and populating all of them with these check with like the to-do list and opening it on the 8 site. So, any feedback on stuff that I should include or ways to improve that process, let me know because this would be a good time before I go and do a whole bunch of them and then have to update later. >> Cool. I had a lot of fun building out. I'll bring a link for this one sec. But building out this clue line visualization, it might not be the most expected visualization for it, but I went and I just like scanned Kubernetes. Um, I'll bring up a link to it and I'll just uh have it as a reference. But I'd love to see more. Like what I enjoyed about this was trying to get like a minimal visualization of like what countries, what jurisdictions are consuming and producing. Um, so I'll bring that up in uh in just a second, but for now, >> are you familiar with the country like the things that you should be aware of when it comes to looking at country data just as a >> Yes. Yeah. But this is just looking at like jurisdiction. >> Okay. Um yeah, because we pretty much avoid any country analysis like the plague so that we don't have to remove contributors from specific countries. But if you're like analyzing a community that you're not pretty much you're as a community, you are not responsible to know where everybody is at. But if you know that somebody is in China or Iran, um you are liable to remove them from the community. So it is something to kind of be aware of when it comes to doing analysis on location. >> Yeah. Yeah. But the visualizations are really nice. Does it matter? So what about the consuming? So what I'm only able to cons look at are like consumption of open source like I'm looking at who's consuming it. >> How are you what are you counting as com of consume like a download? >> Yeah. controversial. Um, oh no, I don't mean that in a I got that I didn't mean that in a mad way. I mean that in like a very literal um downloads are very controversial and like I like in the overall measurement um community whenever it comes to because of how much it miscounts like that it is a very it could be a a misleading metric. >> Yeah. Um because it can count like I guess but I guess you're looking at purely from like a I just want to see if a location is is represented rather than the scale. Is that what you're going for? >> Yeah. So like in my consumer class I get a lot of questions like okay so is the European Union like actively contributing to the space or not? So I have a line that just shows across all the EU known active like consumption and that works really well and it's a it's a very anonymous aggregate but it did use this baseline to get it >> interesting. Um, yeah, I'd be curious if Don comes back around at certain points or talking to Greg because I would say um a lot of people who've done who do analysis on open source pretty much refuse to look at any download data including myself um because of the like because there's it's a little bit different whenever the mis or not even the miscounts but if the stuff is at scale so it's like oh if in this way this could underount in this way and it could overount in another way. If they're scale-wise similar, then you're like kind of like, okay, that's a bit of a wash. But the ways in which the counting can be done of man, if somebody just like sets up a certain way of downloading a server in a certain way or using a VPN, it just completely ruin like messes with the entire like analysis. Like very small things can like throw things out the window. >> Yeah. Yeah, for sure. Yeah. But I think uh yeah, I think what I'm looking at is like I'm I'm looking for really the proof that some like small areas are consuming like tribal nations or PBLO nations or like >> Yeah. You know, >> if the answer is like consu consumption as a check mark rather than a scale, completely agree. >> Does that does that make sense? Or you're just like saying like this exists here rather than like oh because if you're trying to compare scale that can be a problem. No, I don't think so. Yeah, it's a it's really not something that would go into like a consumer report, but like a government is going to be interested in understanding how much from their citizenship is publicly consuming intentionally because it's a government platform, right? So, >> yeah, but yeah, maybe a discussion that we should probably have and loop in on. >> Yes, I do. I this is a good I'm glad like I think that it's good to bring in a different perspective of this cuz I think that the conversation has just been stopped at no we should not do this for a while and that might not be the correct like I'm I would be very curious for you to bring up like kind of like show what you're doing analysis wise why like you're like kind of backing behind of like why this isn't uh like misrepresentation of counts as like a double negative or like showing why it is like valid for this like thing and having an open discussion around it because this probably was a bit before you were involved, but this was like this used to be like the topic that everyone was talking about all the time. Counting like counting download metrics, why we shouldn't like to the point of like doing a joint um blog post of saying we refuse to count as like um um researchers in this space, please stop asking us to count downloads. Um but I like that you have a different idea on it. I think it's worth discussing again because just because we have been saying it doesn't mean that we should. >> Well, okay. So, I think I think it probably came from a very different space and energy and like very much I come from this I like I have a consultancy with people that never come to this room because I'm just in it building the things with and for them. Right. >> Yeah. >> And here's what it looks like when someone receives the little like cog in the wheel of my system that is augur. So we'll go through first and it'll be like a tribal nation a security council and we'll go through eight metrics but we'll go through everything from hardware to software like what do you have what do you know you have what do you have attestation for like because they have federal and state guidelines right so we go through all the open standards and regulation and then if we want to see how like and specifically like for a like tribal nation very easy to get that if they're doing it on behalf of a government they have to do it publicly as all governments do. So then we can go and track that so that we can show what percentage of contribution they have which is something that they're all very interested in. But if that I would be interested if like from that frame and from that understanding is that unethical that is a question that we should probably have on another call. I wouldn't say the ethics is it usually the conversation but it's more of is this >> do these counts actually give us something useful because but if you're very you know a lot about what are the systems that are downloading these files and is it going to is a CI/CD system that's calling it a bunch of different times or if you're familiar with how this data is being downloaded or not data but the project is being downloaded and the things that go into the account that is different scope which I think is an a better conversation of when is download data useful if instead of where I think a lot of places right now and like the open source analysis space is that download data is never useful and that might not be the right way of thinking about it. Um, and so that's that's more of where I'll be really curious to see the use ca use case and the count and all this different stuff because it's just a diff like it challenges what has been assumed in this space which makes it very interesting. >> Yeah. Yeah. Well, what I mean it might be an outlier case but I think this is an interesting situation of like within the Linux Foundation like >> yeah that's definitely like >> a pipeline that I've built because it's been requested. >> Yeah. Um, and yeah, it wouldn't go into a Linux Foundation report. I understand that. But if it's an issue to do that under this like license and work, we should talk about that cuz I'm I'm curious. I'm I'm super >> there's no license issue. It's more of just like from a method like as a like from the perception of research like myself as a researcher or and I'm only speaking for Dawn and um Greg Suckliffe because they've spoken like very definitively and publicly about it. It's not like an ethics thing, but a um issue with how like the value of like if you're comparing the idea that you're comparing apples to oranges and saying, "Oh, this this one project or in this one place there's a thousand downloads in this one one place there's 5,000 downloads because of the different ways that the like their like counts of downloads can occur. that the scale can be like that doesn't mean like that it does not mean anything and the scope of it because you think about like the different ways that things can be overcounted and underounted and the fact that those things are not at scale to one another. I think I think it's probably not too big of a problem because this sounds like this was probably like a center of report or like something that was going considered, you know, like a research report or white paper. That is a single metric out of quite literally over 100 that I look at. It's not something that we decisions by. Um, yeah. So, I don't think I think it's okay. >> Yeah. In case you're curious, this there is some I I don't think I don't know if Don's put out anything, but this is a blog post from Oh, wow. That is not link not working anymore. Lovely. I'll try to find that. I think Ki is trying to find the >> a link to it. Do we want to I mean in the meantime, this is this is definitely like a topic that we can come back to, but I really think for like my use case, it's just like it's a use that I've had for Aubra. I've used it for other things as well, but um I just liked my visualization for it. That's all. >> Yeah, I would be curious and like I guess where does the down are I didn't even know that auger got download data. >> No, so what I've been No, so what I've been doing is I I created a system which just says okay for what you already have as a security posture, what do you do? And then I compare that to what like OpenSSF has available for example like what are the free and open tools or the hardware that you would want to use and then giving them the option of like do you want to look at the contributor for that if you've been contributing because these are like groups that have identifiable names and they're trying to find themselves. The needle in the haystack is them. So is that a problem? Because that's not for a broad audience. That's not making a big argument. >> Yeah, I guess >> I'm not even because if you're using auger, I guess can you repeat the end like where slash when are you getting download data in this because I'm still not I don't I think I'm that's what I'm >> so on my side here what I what I had the only thing that I so that was that was the thing where we got off on to downloads because I was I was looking at that as well. What I have in here is just a ring that shows like where the like relative geography is for the contributors to Kubernetes. >> Oh, nice. Yeah. >> Is that a problem? >> Um yes. um if you're get if you're providing that. Okay, now I get um so the location data um if that is something that you're providing to the CNCF um I would recommend blacking out any um country that has any type of trade embargo with um the US. Um so usually that they the two big concerns are Iran and um China and so like if the CNCF like Kub if Kubernetes knows that they have contributors that are contributing from China or Iran they are liable to remove them but they are not required to know. So if you do not seek out said information, you are not responsible. But if you do know that, it is a legal liability that you have to remove them from the community. So that's everyone has gone about doing that. So this is like outside of download data, but from the contributor data um of how you go about making sure that that is not a piece of information that the community has provided. >> Yeah. Yeah. Well, I think that's fine. Yeah. >> I'm not like bouncing it back to the community. I do it in printed reports. >> Yeah. Because as long as you're doing consumer reports, then it's like Yeah. Then you're you're fine. It's just something that's like, oh, if you're working with like with the Linux Foundation, if the Linux found if you're working with the Linux Foundation, analyzing a Linux Foundation's projects, and then that report has >> Yeah. Well, it's interesting because I thought like Kubernetes would be super safe because I thought it would be like they've limited their liability and really making sure they know who's contributing. Um, but yeah, it's it's good to just make sure if it's going to be in any way public, which is open source. So, >> yes, >> I'm glad we had this discussion because that's an angle I did not know. Yes, it is a kind of a weird there's so many weird corner cases when it comes to like data and analysis which is the interesting sides of it. >> Yeah. And the antitrust but good good to know. Um okay, I want us to move on. We've got about 20 more minutes. Let's talk a little bit about the like next steps of formalizing our latest like project repository okioscope. I think I'm saying that right. Um but Ernest you've given a description of this before but just give another quick pitch and then we are going to talk a little bit about like where does it fit inside the chaos repository and then within that we are going to put in a like formal maintainer agreement and once we put that in place we should come up with a like good way to make sure that that is like solid and communicated but using that as a little bit of like marketing campaign for the project to get more contributors as well. Um so yeah, I'd love thoughts on that but Ernest take it away. Yeah. So um we got uh the name inspiration from a and he says that because foundational staff project that we started working on the unique value that is adding is that instead of measuring individual projects that does you know we are now interested in how does communication metrics reported across different foundations. How does it help us to answer sustainability questions on a cross variational level? So because that's an ecosystem level measurement. So we now said let us measure ecosystem which is what we now call ecosope. Yeah, that's pretty much about the Navy and um I think that should >> Yeah, what makes this interesting for me is like we've gotten multi-year data from Apache Software Foundation, Eclipse Foundation, CNCF, and we're at a really interesting moment in time with the CRA. We're looking at some of their patterns of contributor activity. um that's going to change because of strong regulation from the European Union right now on stewards of open source. So we're doing this like moment like up to this moment in time analysis and looking for the signals that showed like really positive and robust communities which is very cool. Those structures are both very different in their stewardship of open source and very different in their JSON schematics. So it's not the easiest but we are uh continuing to put those together. So with that it's an interesting like it is a data science project and turning into a dashboard for ongoing uh like analytics. Are we ready to put that at the like project level of the chaos um repository generally? And if so, I'm sure there's a few lines that we'll have to go to to uh ensure that's solid. Any advice? >> So, is the ask the dashboards ready to put it into the working group repository under its own like top level directory? Is that kind of >> Yeah, because it's been sitting inside of the like the like data repository because it started as a data project, but now it is a formal project like Don is happy to have as a project and Earnest is the maintainer. So, we've got everything we solidly need to have it be active at that level. >> Yeah. um putting it in under it's kind of similar which we're going to have to rename but like similar to how we did like the augur notebooks. It seems like it would make sense to have like a top level directory specifically for this. >> Yes. Yeah. >> And it has a good name and I tried to give it a silly little logo that looks a little bit like the chaos logo. Yeah. So that's the Yeah, that's the ask there. I think probably I mean we formalized it as an issue for now, but that was very much just a draft of like here's the template for it. Um yeah. So is there anything that we I mean I'm thinking of this at the level of if there's any more repositories that come up and bubble through this system. Is there anything that we'd want to do at this stage um before creating a like project formally uh within chaos or anything that we need to do cuz I think we've gone through the steps and the issue is public. So I think we're all right. >> Yeah, it makes it easier that we're just doing it under this repository rather than like opening a new repository for another project. Like if the scope grew to that size that would make sense, but I think this is a better approach for like something that's pretty small scale. >> Yeah. And the nice thing is I think with chaos we actually are getting a bit of an ecosystem of projects. These projects work together. So to keep them together. >> Yeah, definitely. And especially like with some of the conversations that are happening behind the scenes. I think there's there's multiple projects that are like data science focused projects that are um talking about donating to Chaos. So, it's going to become which I also think is imp with some of the other crazy things that are going on there. It's not just one person who's developing software here. Um, and chaos. There's a lot of people at this point that are um and so I think that it's good that all the things that are kind of like orbiting around chaos, the more that they are officially under chaos, I think um helps in a lot of way build reputation that chaos is more than just like uh like theoretical like metrics community which it I think it has been for a while and um prevents some people from making some I don't think valid claims about a singular person being the only software maintainer in chaos. >> Yeah, that's uh that's not possible under the by lines unfortunately. >> So, we'll be all right. Okay. Uh the next thing that that brings us to is the maintainer agreement. So, we've drafted a version of this. Uh it's had a couple of review rounds. I've had a couple of just like nice comments from community members on it which I wasn't expecting. Um, which is really nice. Um, so I think we're ready to publish it, make it live, but I want to do that after the repo is like reinitialized at a project level and then immediately I will bring in Earnest under that and then we'll start searching for the next maintainer so that we don't get burned out. >> Yeah. Um, yeah, I was hoping that Kaio would be on the call because we've talked about this a little bit and I've talked about this with Kyle that that would be the hope like there is our like that Kyle would be that next maintainer to kind of come in um and be more involved in this like in this like he is involved but become more of a maintainer in this repository. >> Yeah. Yeah, that'd be perfect. Um, so yeah, I'll bring I'm I can bring the maintainer agreement back in um as soon as we have that repo live. But is there anything else that we need to cover on that or we'll just uh I'll say like bring it in on the next agenda. >> Yeah, I think it'd be good to bring in for the next agenda because I also think there there might be um are we recording right now? I don't >> uh we are but if finish up the agenda we can have a chat afterwards. Yeah, I was just saying that the maintainer agreement might um be nice to adopt in other areas of chaos that might be um looking for more official ways to um solidify maintain >> everywhere because this is how we do it in cyber security and sometimes cyber security is right. >> But yeah, if we want to turn off the the recording then I I can say more. >> Excellent. Is there anything else that we need to cover today on the agenda? I think we're good to go. I think we're set. All right, Adrian, you have control of the recording., CHAOSS Data Science WG, April 7, 2026, YouTube, 01kp8ftbcw06n2zyyhh0t7hhjy.