Education SIG  ## Metadata - Author: [[OpenSSF]] - Full Title: Education SIG - Category: #articles - Document Note: --- tags: - #opensource - #education - #linuxfoundation Author: Education SIG Participants Source: YouTube — Education SIG (July 12, 2023) Reference: https://www.youtube.com/watch?v=nH-tH9YYUkg date created: 2025-08-25 21:23 --- # Title: Education SIG Call — July 12, 2023 ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 DARVO Analysis](#-darvo-analysis) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) --- ## 📝 Summary: This Education SIG call (July 12, 2023) discussed **funding delays**, the ongoing **mobilization plan audit**, and the push to align with the **Linux Foundation’s 5-year roadmap**. Members highlighted the need for **course updates, new express learning modules, and workshops** to improve contributor education. Key points included **maintainer fatigue**, the importance of **hands-on security workshops**, and strategies to **increase content visibility at conferences** such as KubeCon and Bilbao. --- ## 📖 Main Content: The group opened with light-hearted talk about time zones and parenting, before shifting to serious updates on the **mobilization plan** and its uncertain funding status. The lack of immediate financial resources pushed participants to brainstorm **low-cost/free education initiatives** such as repurposing internal courses, building new express learning modules, and piloting project-authored courses. Concerns about **maintainer fatigue** were raised, with participants noting that bureaucracy and uncertainty are discouraging contributors. To counter this, the SIG is working to produce **targeted, practical training** like S-BOM automation, supply chain security, and scorecard usage. Workshops and conference outreach were emphasized as critical for scaling education beyond the immediate open source ecosystem, particularly targeting developers at **Cloud Native Security conferences and KubeCon**. --- ### 🗒️ Notes - [00:03](https://www.youtube.com/watch?v=nH-tH9YYUkg&t=3) Icebreaker: Time zones, kids vs. engineers, and laptop mishaps. - [06:40](https://www.youtube.com/watch?v=nH-tH9YYUkg&t=400) Mobilization plan under audit → aspirational 5-year roadmap + near-term security tool belt. - Funding approval paused. - 2024 budget prep underway → critical window to secure funding. - [09:50](https://www.youtube.com/watch?v=nH-tH9YYUkg&t=590) “Newbie course” exists but is **internal only**. Audit + adaptation planned. - [11:21](https://www.youtube.com/watch?v=nH-tH9YYUkg&t=681) LF piloting **project-authored course platform**. Maintainer fatigue flagged as a risk. - [16:19](https://www.youtube.com/watch?v=nH-tH9YYUkg&t=979) CNCF security slam → 4 express learning courses: - S-BOM provenance automation - OpenSSF Scorecard - Security self-assessments - Documentation of supply chain security - [20:39](https://www.youtube.com/watch?v=nH-tH9YYUkg&t=1239) Focus on **gap-driven education**. Target where maintainers lack skills. - [24:58](https://www.youtube.com/watch?v=nH-tH9YYUkg&t=1498) Adding **short video intros** to break up course monotony. - [29:24](https://www.youtube.com/watch?v=nH-tH9YYUkg&t=1764) Code-to-Cloud workshop → software security, dependency management, CI/CD practices. - [33:42](https://www.youtube.com/watch?v=nH-tH9YYUkg&t=2022) Strategic outreach at Bilbao + KubeCon. Push to get outside “the bubble.” --- ## 📖 References: - Linux Foundation Education SIG archives - CNCF Secure Cloud Native Security Slam resources - OpenSSF Scorecard documentation - LF training catalog --- ## 🗣️ Paraphrase: 1. Original: *“Approval right now is on hold. No one has jumped up to hand us a pile of money.”* Paraphrase: Funding has stalled, and without new budget commitments, no immediate financial support is forthcoming. 2. Original: *“Everyone focuses on input, but we should be focusing on getting content into the hands of developers.”* Paraphrase: Instead of producing endless new material, the priority should be distribution and adoption of existing educational resources. --- ## 📰 Newsletter: 📚 **Education SIG Update — Funding on Hold, But Training Expands** The July 12 Education SIG call wrestled with **budget freezes** but pressed forward with exciting education projects. LF is piloting a new **project-authored course platform**, while the CNCF Secure Cloud Native Slam will deliver **four express learning modules** this fall (S-BOMs, OpenSSF Scorecard, security self-assessments, and supply chain documentation). Maintainer fatigue remains a challenge, but workshops like **Code-to-Cloud Security** are proving effective. With KubeCon and Bilbao ahead, the group is planning more **strategic outreach** to developers outside the usual OSS education bubble. 👉 Want to get involved? Check out [Education SIG resources](https://www.youtube.com/watch?v=nH-tH9YYUkg). --- ## ✅ Action Items: - Align Education SIG goals with **2024 Linux Foundation budget cycle**. - Prioritize **free/low-cost initiatives** (repurposing internal courses, modular express learning). - Support **maintainer well-being**: reduce bureaucracy, ensure contributions are visibly impactful. - Promote **hands-on workshops** as scalable, effective educational tools. - Strategically expand outreach to **non-OSS developer conferences**. --- ## 🧪 Hypotheses: - H1: Express learning modules increase contributor confidence in supply chain security tasks. - H2: Workshops improve adoption of secure software practices more effectively than lectures. - H3: Conference outreach expands the diversity of OSS contributors. ### 📊 Methodology: - Pre/post surveys of workshop attendees. - Adoption metrics of express learning modules. - Demographic analysis of contributors pre/post outreach events. ### ❓ Questions: - How can education SIG ensure maintainers see their contributions as valued? - What balance should be struck between “free” initiatives and funded programs? - Can project-authored courses scale without quality control risks? ### 🔮 Future Research: - Comparative study: express learning vs. traditional courses. - Longitudinal analysis of contributor retention tied to education access. - Role of **hybrid workshops (in-person + online)** in global scaling. ### 💡 Implications: - Could influence **budget prioritization** within LF. - Offers replicable models for **other open-source ecosystems**. - Helps address **maintainer fatigue** with clear value delivery. --- ## 🧠 Learning Styles Assessment: - **Visual**: Weak → add infographics, flowcharts. - **Aural**: Absent → no podcasts/audio versions. - **Verbal**: Present → strong discussion with analogies. - **Kinesthetic**: Strong → workshops emphasize hands-on. - **Logical**: Moderate → structured but lacking data-driven breakdowns. - **Social**: Present → collaborative planning. - **Solitary**: Weak → few reflection exercises. - **Naturalistic**: Absent → no environmental tie-ins. Readability: ~12th grade (college-prep level). --- ## 📊 Accessibility Assessment: - No explicit screen reader or alt-text references. - Recommend: add transcripts, alt-text, semantic HTML in course materials. - Keyboard navigation not addressed. - Course content: improve with contrast checks + text resizing support. --- ## 🌍 DEIB Assessment: - Inclusive language: mostly neutral, but needs refinement. - Cultural relevance: limited — focus on US/European contexts. - Neurodiversity: support present via structured notes, but long sessions risk overwhelm. - Rep - Summary: Agenda – https://docs.google.com/document/d/18GBwvQJNcPnwxKrnp43DhBZC7K1JM0xzGkDoKh5mu8U/edit# Slack – https://openssf.slack.com/archives/C03FW3YGXH9 Mailing List – https://lists.openssf.org/g/openssf-sig-education Git Repo - https://github.com/ossf/education - URL: https://www.youtube.com/watch?v=nH-tH9YYUkg&ab_channel=OpenSSF morning folkshey folks how are you todayhey Max good morning[Music]good afternoon I guessit's always morning somewhere that is myexcuse my excuse to drink it so um youknow it makes greetings easier Sam in Los Angeles timeyeah man that'souch that is morning uh it's 2 p.m herein London so uh well I I usually get upat four so that helps that that takesthe edge off of it a bit yeahit's coffee cups by nowI don't really drink coffee souh that's that's how you're able to getup at 4am that's the key no I actually had a really bad stomach infection thatused to get me up at like 4 a.m nomatter what for like a couple of yearsand then since then it just became habitand now I have to because like afterthis call I have like a seven hourtrainerlike I have to train a trainer for pietorch so it allows me to get some stuffdonebecause I also have to manage a group ofchildren all dayoh Lord bye-bye children I mean Developersuh young children or or softwareengineersyeahI find that uh small children are a loteasier to deal with than softwareEngineers yepyeah I deal with both quite a lot and umthe only thing is that you know you cantell a software engineer to just goleave you alone for a bit and they likethat children like that a lot less so true truewell I'm sure we'll be on topic but Ihave to tell this story first I had anessay that I worked with who had atoddler and he was like walking aroundin his house with his computer in onehand and his kid in the other and we sawon the zoom call this kid just likeroundhouse like rev up and punch him inthe face and that's the last thingbefore it just drops to the ground andhe broke his work laptop oh man it's a hazardalso walking around carrying yourcomputer is a hazard with without thechild yeah I mean toddler and computerbut hey thousand Buck lesson learnedcheese yeah I mean that's that'sdefinitely a worse scenario though orsomething bad happens on the computerand the toddler gets droppedoh geez yeah of the two to dropprioritization is right there for sure cell you might want to correct yourum I mean I'm I'm down with all the uhsonotype name dropping but uh you mightwant to adjust that for your own sakeanyway what do I have on sonotype on theuh the dock for this particular callgood call I'll fix that foreign it's like everybody's rolling in nowall right anyone's welcome to help heron the calloh we've been we've been making smalltalk for for quite some time it just kind of died down right abouttime you guys got here because it wasabout I mean um it just kind of dieddownwhen they uh when the teacher comes intothe room everyone goes quiet rightmanohall right uh one second I have like eight people teamsing methis is awesomeso yeah somebody wants to run thingsI've got a couple things to deal withhere silently I'll be here but listeningbut I'll be right backI would do it but I only got 30 minutestoday but it sounds like funding isfirst on the list here what do we want to talk aboutI can add some coins next to that uhsorry I'm coming from a bit all over theplace right nowum yeah I've missed these calls for thelast couple weeks just great to hear anupdate on what's going on with uh withall thingsumall things leadership and fundingapprovals and um you know the the goodold shocking cannon firingum and us being obviously shock doing some uh some work Beyond uh you know thethe voluntary scope that we've got herewas that a question Maxyeah sorry you just killed the questionwhat's the latest onum on the funding approval and uh thesign off of the plan and and all ofthose good things uh approval right now is on holdI shared it with uh omkar it's beenshared with the governance committee andthe TACuh everything around the mobilizationplan is kind of uh in flux at the momentas we go through and we're doing afoundation-wide audit and we're workingthrough omcar's prioritization his dreamis going to be that the mobilizationplan evolves into the five of The Five-Year Plan so it'll bevery aspirational things and we'll havethings like the security tool belt thatwill be more near-term things we aredoing and we will do in the next uh 1224 monthsbut all this is still kind of in flighthe's having a meeting with his staffthis week I'm surprised Dr Wheeler isn'tthereuh where they're going to kind of walkthrough some of these things and some of his priorities but right now there is nouhno one has jumped up to hand us a pileof moneyjust kind of on hold uh I know talkingwith omkar he's going to start puttinghis 2024 budget together andin september-ish August Septemberfor a presentation to the GB I believethe member Summits in November are you saying thatanything we're wanting to dowe should be trying to get onto the 2024budgetuh that's probably our best chance ofsuccess if we need some money if we wantto do some free stuff we can start rightnowand again I don't have to be on the callto do the free stuff I actually havesome updates on the free stuff yeahyeahum so first of all I found the course that you were looking for the Newbiecourse like intro toopen source apparently we have onehowever it is an internal staff facingcourseso I have talked to Tim about gettingyou that content because he thought itwas a public-facing course and we canswitch that around but there needs to bea Content audit because a lot of ourstaff facing courses could use let's saya little bit of helphey man I thought that was publicsee a lot of helpers it isn't it's even in the description that it's an internallike it's meant for LF staff onlyprogramso yeahum so I'm I I let Clyde know and I letTim know and they were gonna fix it orthey were gonna address it and yeah butTim like I I need to work with Flavia onthatand but yeah Crow that's headed your waybecause we do have like an introductionlike what like what it is to be amaintainer how you could get started like yeahbut uh Randall I took those coursesabout a year and a half two years agothey definitely needed some help a lotof updatesum and that's not that's being veryliberalous was needed some help by theway yeahum so I sent inI don't know 40 pages of comments Ithink uh so it was a ridiculous numberdon't quote me on the exact number itwas a very large number of comments butthey were very very specific change this to that change this to that so uh my andand I'll be honest I thought that thosewere public so I my mymisunderstanding no basically some ofthem are like summarizations of ourpublic courses but like I think the onewe're talking about is like LF uh Idon't know it's it's it isn't internallyfacing I found the link and I sent it toTim and it even says like on the frontpage like it's a it's meant for LF staff but it's pretty much exactly what wewanted in like an introduction to opensource so they're okay I did talk tothem they're okay like switching thataround and changing the description isjust we gotta figure out like where itis and that's where it stood and youknow how those questions areyeahokay I would so you you can't have anETA I imagine butumI mean if we could if if we could make some updates and make them public I meanthat sounds like a good thing yep yepand then the other update I have andthis is a very cool update is uh Tim andI are piloting a program where projectsthis is kind of uh somewhat an extensionof Cassidy's ideathat she brought to the best practiceone of the 12 people trying to get ahold of mewell um we're piloting an idea of aplatform where projects are cable to essentially author their own courses andhave those courses like pushed to acertain degree by LFeight so that should be incoming in thenext three monthsyeah so um she's actually pinging meabout the express learning classes rightmeow and I'm ignoring her because I'mhere with all you uhand I will say back to the funding idea um and I meet with omkar uh once a weekand in our conversations he isa little perplexed about the lack of uhdrive around things like incidentresponse and educationso that's something that is near anddear to his personal heart and I knowthat the chair of the governing boardJamie from IBM former educator very strong supporter of education so we havea lot of important interesting peoplethat support the idea and I think it'sjust a matter of From amkar'sperspective trying to get hissea legs underneath him as we start thisjourney and then he can start to seewhere he would like toPoint some additional Focus to and thenideally uh you know we have our planit's documented we canre-highlight that to him but as we haveother ideas like some of the stuff I've talked with of Eddie or Maxum who had the potential to potentiallyuh you know submit those ideas and againthe the 2024 budgeting is coming up soonso if we had specific smaller things areoutside of the plan uh we can kind ofhave those waiting in the wings asthings start to firm upsoon after uh not too long after omkarcame on board he and I talked and heexpressed an interest in me spendingbeing spending more time on educationbecause my time is something my time is divided a thousand places uh but I cancertainly focus on something ineducation I mean I've done that beforedelighted to do it againum and just Chrome System since you'rehere uhum you know back when the open ssf wasfirst founded I was trying to show up atevery working group everything trying tostill do that man I still do that uh andbut I I think uh how's thisum I want to be at everythingbut perhaps the time for that to heyhaving somebody else to try to pull somethings has passed I still want to showup at the best practices work in groupmeetings but yeah but uh yeah but um youknow perhaps I need to if I pull back onsome meetings I would have time toactually do other thingsI too will be reducing scope very soon uh trimming outuhthings like this I sorry I'm speaking ofyou but I just I'm seeing this acrossthe board I'm seeing a ton of basicallymaintainer fatigue and open ssf andwe're looking at another six months ofnot knowing if our contributions arevaluableum I was just like literally justcomplaining about this to somebody butinside of finnos uh the project that I'ma maintainer of got really slogged by like bureaucracy and trying to just moveobstacles to work uh to the point wherewe went from having 20 person calls ofpeople joining and saying what can I dothis week to three people active stilltrying to clear obstacles two yearslater right and that kind of seems likethe trajectory that that you guys arediscussing right nowand I'll say Sal I value everybody's contributions I think our work is makinga difference like you know David and Italked about the best practices stuff inVancouver and we got a lot of greatreaction on that so the what we'reworking on is valuable we just need tofind ways to get it out to themaintainers to get using it and then toget the the backing to uh yeahI everybody nobody I love all the workeveryone does here it's why I'm here forfree but um it's the like the wholepremise is that I utilize the foundation to be able to mobilize information rightsome marketing and solutionsum and that there's got to be some wayto stop this Gap within those next sixmonths otherwise look that we're doinggenuinely just won't have the intentthat it has by working with the LinuxFoundationrightI I do want to make it clear I'm notpulling back I'm I'm just saying that uhI think so many working groups are nowactive they don't need me specifically uh and so I want to spend more I'mprobably going to be spending more timeon focused projects and letting theother other folks pick up that ballwhich is great that's not a complaintthat's that's a good thingum but uh but yeah I I we don't want tohave bureaucraciesumimpede the work the whole goal is tomake it so that we're working togetherand not cross purposes yeahyeah I'm pulling back and I'm focusing in on things I like like this group andthe best group and the vulner groupwe won't let you run away from tackthoughoh gosh I I have to be involved with theattack for the next six monthsokayum okay so on the previous point beforewe uh wrap the topic of the LF trainingumI didn't give an update to the wholegroup uh so I'll start from square one on this uh so I run the cncf uh secureCloud native security slam it'ssomething that Sal helped start a whileback and for this upcoming year we'reincreasing the scope of it uh and thereason that we're increasing the scopeis because I felt like it would be agood opportunity to increase likeoverlap with the education goals here sowe're increasing the target goals forthe cncf projects of what we're asking them to accomplish and uh therebycreating stretch goals for theorganizing organizers to create theassociated educational content to equipthose folks to do the things they'reasking them to do in the area of supplychain security Provident you know allthatum and as part of that we secured anagreement to create four expresslearning courses uh they're due at the end of the monthand I wonder if I canI'm just going to Rattle it off to youthe four courses are going to beum s-bombs in provenance automation sokind of salsa related stuff uh open SSopen ssf scorecard just outright andthenum security self-assessments and uhdocumentation of supply chain securitythat one's a little bit vague for me toexplain right off the bat right here but that's the fourth one uh and so all fourof those we're going to be creating uhby the end of July and they are intendedto accomplish education goals while alsoa complicate accomplishing the otherstuff that I mentioned for the cncfthey should be live in Septemberdo you require any assistance or wouldyou like any feedback from this group sohelp would be immensely valued um right now I have I guess I could I'lldrop in the links to the design docsbecause the design docs for all four aregetting turned in todayand I only have one other volunteer thatis uh authoring helping to author acourse and the the other three are goingto be finished by myself so I'm going tobe taking the outline and actuallyturning it into three different coursesand then Colin Griffin is going to bedoing the rest um if anybody wants if anybody seessomething on here and says like hey Iwould like to do that then uh today isthe day to volunteer because I'm turningin the course design documents and thoseneed to have the author attributionum I volunteer as tribute on thedocumentation I really really want totouch I want to got some stuff to coverthere okay um yeah that one so we needto have a conversation about that onebecause that one's uh a weirdso so yes absolutely yeah it should be a slack and we'll discuss but if I canhelp elsewhere but also mostly just likeactive on the slam see what we can doit's like the most exciting time of theyearI'm down yep I will message youEddie that's awesome um I have somematerials that uh you might be able toBig borrow steal fromuh you know for the for the score cardprobe and I have given a presentationand will again the slide deck but you know that might be helpful for you uhand of course there's the course ondeveloping secure software thefundamentals course which might haveyeah I don't know how much of theseparticular topics it's going to coverfor you maybe for the securityself-assessments for it to actually bein excess of that one okay all rightgoing through that one okay it fills agap right and we're trying to find othergaps to to fill so that's that's verygood okay excellent excellent yeah and uh on that note David I did talk to Timabout making a security score cardsExpress learning so we've we've thoughtabout that I think right now he wantedto do an Express learning on what isopen ssf and I think that was one of hismain focuses is just getting like oneExpress learning done and then gauginginterest on that and then going fromthere on different thingsum but I will also have this update thatSpyros has been writing an Expresslearning about opencre which is technically an open ssf projectand maybe someday they'll come back tothe working groupyeahthey're around they're around they'rehard to get a hold of but yeahSalum yeah I want to make a note so thereason why we're really particular andwhen I say we I guess not me but stillsecurity slab we're particular about thecontent that we put in it because it'sliterally like we're going out to the interventions and then we find wheremaintainers have gaps and we onlyprovide the information they need rightso the s-bombs we figured out because noone knew how to do them and it took uslike six different maintainer teams tofigure it outyeahum but I think what's going to be reallyvaluable about that is uh coming out ofthat slam you're gonna have a goodamount of pragmatic tools-baseddocumentation for maintainers so makesure that there's an additional wrapblog for that tooling chain right because it's basically right it's apractice it's a pragmatic approach togetting to the limit of that Sterlingstool chain tool chain as it currentlyexistsand if you can get those links out EddieI can donate the next hour minus myconversation with Cassidy and the cto'sassistant who is also pinging me the links are in the call notes rightnow movie[Music]um I will I got an update from ourintellers the management training isstill moving forwarduh we're going through have been goingthrough some austerity measures uh based off the global economy and that has uhreduceduh some head count internally which hasimpacted people's work so when they gaveme original optimistic estimates uh nowbecause people are doing additional workthey have less time to devote to it butit is still moving forward and there isa back catalog of other items that I'llbe donating so it some point in the nearfuture we'll have a whole newinstructor-led class to look at andstart to shape and adjust and um like this maintainer class fromthe LF I would love to get Christine andJay'sDeni group taking a look at it with thelens of trying to cultivate newcontributors so if there's additional uhthings we need to add for you knowtechnology newbies or career Changers Iwould like to maybe look at it with thatlens as well what's nextusESthis is on the plane yeahCrow this is really I think for youalthough it's useful for an FYI one ofthe feedbacks we got on the fundamentalscourse is uh that they wanted to have alittle more variety of you know okay we understand why you don't have videos allover because they're hard to edit but atleast you know occasionally break it upa little bit furtherso I'm going to slip in a couple ofvideo introductions and krobe you're onthe hook for for one like 60 secondintro of this section it's the goal isto have an intro that will stand thetest of time even though things changein detailI I think it's a great idea maybe if it's like the sections or like talkingabout a core thing likecoding principles that type of thingthat's right it's basically a sectionintros and that way uh we avoid theproblem of well certain otherorganization I'm gonna beat on herebecause I don't think that's fair butcertain other organizations created someawesome video content and thenupdating is is it videos is expensive soit didn't happen and very quickly theyall being a very helpfulso you know the principles all stay thesame but once you drill in details itgets more it gets more challenging yeahvideos aren't as expensive as peoplethinksome Joker like me can do it on aHouston budgetI I I've made videos uh for for my ownbut it takes time is the problem it'sthat time yeah and also just videos aren't usefulfor technical content right like if it'sif it's something I have to execute I'llneed a video I'm gonna have a YouTubevideo on the background while I figureout why it's not runningbut uh yeah I think composability rightit's something that Randall's beenthinking a lot about the way that atleast they're building their content andI doappreciate itwe're actually overhauling a lot ofthings I can't talk too much about itbutum all all contact David because David's course has been like the Cornerstone ofwhy we've been doing things and breakingstuff up David is actually one of thethings we've been thinking aboutwell right now my thinking isn't so muchbreaking up as in section intros but uhI'm happy to chat about all these thingswe had earlier talked about in insertingvarious little links uh so that you knowuh it would be easier to bring things inand out and all that sort of stuff andas far as I know that's still in the plan I just haven't heard back from youon exactly how you want to do thatyeah we're moving towards a like we'retrying to figure it's been a longconversation because you know there's alot of politics in the LF system thatyou got to deal with but uh our currentsystem TI live severely limits us whichis kind of what we've been talking abouthow we can move around those things andyeah and also we currently have like theEasy Button which is it could take up to like 10 minutes sometimes even 20minutes to load a lab so we need tooverhaul that in LF in general but yeahyeah and that that's a problem so I Igot that for your videosI'll haul out the stage lights and thegreen screenand uh is fancy wow I was just gonna godownstairs and have the uh the the goosepuppet in the background so I have my whole background be a goose with thegreen screen oh manI'm a little scareddon't use it often but when I do it'sspectacularall right I don't have anything elseand I guess you know as we're movingforward especially into like thisbudget uh phase that's coming up soon ifthere are very high value items we can think of like if only we could provide Xor Y and we hadum some viable estimates on you knowwhat it would take for volunteers or umcontractors or third parties or whateverit might take to achieve that kind ofkeep that in mind nothing's off thetable but just remember in thisstrange economic environment we're in uhthere isn't going to be a lot ofadditional money because right now our budget is uh zero dollars and DavidWheeler's time probably the mostexpensive costforeignand sadly there's not enough of itif we had a really great if only wecould go to developer conferences and douh really involved application securityCFT and that and that would solvethousands of cdes you know and make it come up with a reasonable estimate onhow we could solve that uh let's let'snotthrow that idea out let's uh chat aboutit and see if we can massage it and makeit look niceokayVictory goes to those who are preparedum I uh sonotype we created a workshopI mean it's we created the outline forit we ran it in uh kcbc it was hard to stretch out to four hours because that'show long the kcdc workshops areum but we ran this workshop and it'sit's basically like uhwe call it the code to Cloud securityWorkshop so it's looking atum software security dependencymanagement uhthreat triaging secure CI you know justlike all of that kind of stuff cool andwe've got it it's been accepted tomultiple I think it's been accepted fourtimes uh it's a pretty it's a pretty well received wrist drop so farI don't know how that would fit into theeducation Sig stuff well and that'sdefinitely another tactic we could do wetalked about you know conferences andboot camps and nonsense but Workshop isanother completely viable way and Ithink uh being that there's probablymore Hands-On practicum potentially thatis much more valuable I think forgetting some of the developers timeyeahyeah that's the kind of stuff that I I have a hard time with I also likeumI mostly I'm mostly like trying to findgaps that aren't being filled ortheorized around so like I wrote anentire novel that explores socialengineering attacks DDOSdependency management vulnerability inAI systems and all this kind of stuffand it's like my way of addressingknowledge gaps but I don't know how anyof these ideas I have actually fit into the education plan so I just I'm justdoing them off on the sidefunsoundsEddie I would love to talk to you aboutJim's initiativebecause that might be a good platformfor you because that's kind of why itwas built or is being builtyeah and you already know Tim so youcould talk to Tim about this as wellbecauseI'll be honest this is mostly Tim's ideaand Cassidy and I arelike that on you yeah if you can slack me whatever andthen I can follow up with Tim as neededyeah yeah absolutelyyeah yeah I willand I think we we have a lot of greatideas and I feel we need to invest sometime in thinking about how to get theideas and content under the hands ofdevelopers moreand I know that like travel is veryexpensive I'm going through the exerciseof petitioning to have funding to go toSpain but we probably should maybe for 2024 plan you knowpick three conferences and pick a couplepieces of content and try it very hardto get out there to get this out intothe hands of the community I am alreadyapproved for Bilbao by the wayI'm going to Bilbao no matter what I I'mgoing on vacation the week after so Ihave uh just bought my hotel for theconference this week and I have thewhole next week plan now I just need toget there that's cool yeah I I I'm pretty sure I put in a cfp for it but ifthere's anything I can help with alsojust getting my DMsand things like open ssf day itself isokay and we don't get a lot of externalmaintainers so it but it's very nice tohelp connect our community of peoplethat show up but I would like topotentially maybe be more strategic likethe next uh next year's Summits how dowe get our content out into the cloud native security conference into theLinux security conference and go outthere and do presentations about all ofour different exciting projects andartifacts well I'm speaking at supplychain security cons so if you want me toput a slide in yesget in my DMsall rightsounds goodany other topics we'd like to discusstoday I I just it's not a new topic but I should just warn you that I also planto be there in Spain so sorry about thatwell you'll have to suffer through moreof me which is good because we'representing together we will go and enjoysome tapas togetherI don't know what those are should Itiny little meals it's like a kind oflikecharcuterie on steroidsoh okay this sounds promisingjust tiny little bite-sized foods and funand you're you're you'll be in Spainwon't you ChristineI think you had a talk accepted yeah shesaid she's planning on it cool Iactually plan on being on Spain tooTim's dragging me out to that onedragging me out to a beautiful countryand talking about people you know howthrilled I am with childhood[Laughter]sound thrills yeah I'm trying to work outI'm best behind my desk but I don'tthink I'm going to be able to get to getout of that oneI'll also be a couponwe'll be introducing the new SKF atkubecon and I think like events likecoupon especially are important weshould we need to have more of ourcontent not just education content butyou know all the working groups andprojects we need to have more of ourcontent in these other places yep get outside the bubbleit's dryso any other topics for today folksall right I will try to get all of myextra work addressed before the top ofthe hour and then I can look at Eddie'sdocuments maybe for almost a whole houryou'll see I'm presenting to the CTOtomorrow I don't think there's that much content it's mostly just a coursedescription that is being turned intodayI have lots of opinions so I'm glad toshare them for freegreat I'll brace myself well I got nolike part of the vulnerabilitydisclosure working group the hyperLedger folks showed up and they wantedhelp with their security policy so I satdown for half hour andjust gave them feedback like you shouldconsider this have you thought aboutthat what do you do about this and like the dude was like responding at two inthe morning last night this is so greatthank you so muchnice good stuff make it a little betterplace all right folks will you enjoyyour day I will see some of you laterand for those who don't enjoy your restof your awesome Wednesday hiyeah there you go, Education SIG, OpenSSF, 01h65a90ehce9a2hd0bhdvt9nq.