- Idpy-board - lists3.sunet.se

Reminder & Agenda: idpy Board call, 25 February 2019

by hlflanagan＠sphericalcowgroup.com

Bridge URL: https://bluejeans.com/792568291 <https://bluejeans.com/792568291> Date/Time: Monday, 25 February 2019 @ 11:00 PT | 14:00 ET | 20:00 CET Agenda: 0. Agenda bash 1. Administrivia - https://github.com/IdentityPython/Governance - OK to sign the statutes? - OK to formally engage with Commons Conservancy? 2. CLA - GEANT and IPR - Vote (if possible): do we require a CLA for contributions to idpy or do we rely solely on a Note Well? 3. Developer report - Developers meeting, TIIME workshop, 11 February 4. Working with interns 5. AOB

5 years, 2 months

1
1
0 0

Board meeting (mostly f2f, but with potential for dial in)

by hlflanagan＠sphericalcowgroup.com

Hola a todos! I just realized that, while I sent a “save the date” notice, I did not actually send out the calendar invitation. This make this a bit challenging for Mike to join, as this message goes out when (I hope) Mike is asleep! But just in case Mike did the reservation on his calendar despite my (apparent) lack of calendaring skills. You should (even the folks on site) have a calendar invite now. The developers are meeting now, but will likely be ready to end by around 4pm CET today. I’ll open the bridge; Christos and Mike can call in then. If it turns out Mike and Christos are unavailable, we As we discussed on our call last month, the topics for us today are: * voting on CLA, Note Well text, IPR * an update from the developers meeting * talk about how to use an intern And, we should talk about where copies of a signed copy of the statues go (and what kind of signature is acceptable). Thanks! Heather

5 years, 3 months

1
1
0 0

February meeting set

by hlflanagan＠sphericalcowgroup.com

Thanks, everyone, for helping get that date nailed down for our February board call. You should have a calendar invitation on your mailbox for February 25. If you have any questions, please let me know! -Heather

5 years, 3 months

1
0
0 0

Notes: idpy Board call, 9 January 2019

by hlflanagan＠sphericalcowgroup.com

Attendees: Heather, Roland, Christos, Ivan, Mike, Leif, Chris Action items: * Heather to draft the survey text re: Note Well (assuming the board votes in February to agree to using a Note Well rather than a formal CLA) * Ivan to update the Security Incident Response plan to indicate that issues will be logged and kept indefinitely * Heather to send out a calendar invite for TIIME and a doodle poll for the call after that. Notes: 1. Signing Board Participation agreement 2. * Still waiting on legal approval to do this (Mike). Can not make any formal decisions until this is done. 3. CLA or Note Well? 4. * Expect to handle existing contributors and new contributors differently. * o We can always ask all existing contributors if they think they had permission to contribute code via the note well (rather than sign a CLA). “Here is the Note Well we’re adopting for all future contributions. D you believe you have any problems accepting this? Do you believe you might not have been able to accept it for your previous contribution?" o If individuals don’t respond, may need to consider what to do otherwise. We will send the survey, send a reminder, then start trying for personal contacts. And if none of that works, we’ll consider what code they’ve submitted and determine if we can do it a different way. Some of their code might already have been redone so we aren’t as in an urgent a situation with regards to their contribution. * What about the JOT libraries? This shouldn’t be a problem since only Roland has contributed. The OIDF might want a CLA from Roland (that is a separate conversation). * Leif strongly in favor of a Note Well (see draft here: https://github.com/IdentityPython/Governance) rather than a traditional CLA. We want it to be easy for people to contribute; there is an expense when lawyers are brought in, and lawyers often don’t understand what we’re trying to do. 5. Commons Conservancy 6. * Christos has been discussing this within GEANT. GEANT does not have a final answer regarding IPR, but should have a final answer by the end of this week. They needed clarification that all the idpy material would remain in the open source domain. 7. TIIME? 8. * Roland and Mike will not be there; will dial them in from 4pm to 5pm CET (last hour of the developers meeting) * We should create an e-vote mechanism; perhaps launch at a meeting and let it extend for 3 days for people not able to attend. * Agenda: voting on CLA, Note Well text, IPR, possibly an update from the developers meeting, talk about how to use an intern 9. Adding new projects to idpy 10. * pyFF split - the JavaScript component on the front end does not fit into idpy; that component belongs with the RA21 governance group. The backend remains part of idpy. This kind of evolution, since it’s not entirely removing the project, a Board decision. Leif withdraws his request. * FYI https://github.com/IdentityPython/IdentityPython.github.io/wiki/Adding-and-… 11. Incident Response 12. * Ivan has created the incident-response list. Ivan will add the board members to this list, as well as some of the key developers for the various projects within idpy. * o This came up as result of the following almost-bad security issue: https://github.com/IdentityPython/pysaml2/issues/578 * There should be a page on the website re: how we recognize security research. (Some researchers contact developers expecting bug bounties. We can’t pay for this, but we can offer ‘payment’ in terms of recognition.) Look at SUNET’s website for an example. https://www.sunet.se/security-researcher-acknowledgments-for-sunet-services/ * o Heather to follow up on this and add it to the website. o Ivan to update (and Chris to review) the security incident response plan to be explicit that each item is logged and kept indefinitely in GitHub. 13. Next call - Heather to send out a doodle poll for end of February/beginning of March

5 years, 3 months

3
3
0 0

Doodle poll for the post-TIIME call

by hlflanagan＠sphericalcowgroup.com

Hi all, As discussed on the call today, here's the poll to find a time after TIIME for our next call: https://doodle.com/poll/cezna4yc4qkhsiww I avoided the week of the Internet2 Global Summit, thus that gap between the end of February and mid-March. -Heather

5 years, 4 months

1
1
0 0

Incident response draft updates

by ivan.kanak＠gmail.com

Hello, I've added two small sections regarding the topics we discussed on the call for the incident response document. * Add section about storage policy https://github.com/IdentityPython/Governance/pull/3/files * Add acknowledgement for security researchers https://github.com/IdentityPython/Governance/pull/4/files Kind regards, -- Ivan c00kiemon5ter Kanakarakis >:3

5 years, 4 months

1
0
0 0

Doodle Poll: idpy Board call for January 2019

by hlflanagan＠sphericalcowgroup.com

Hola a todos! It's time for our favorite activity: meeting scheduling! https://doodle.com/poll/q43ttxvy497w9a4f If we can make progress on the CLA discussion on the list, that will help make the call itself more efficient. I'll send out a note shortly with further information regarding the number of committers, etc, to help inform the discussion. Thanks, Heather

5 years, 4 months

2
3
0 0

Attending TIIME?

by hlflanagan＠sphericalcowgroup.com

Hola a todos! How many of you are planning to attend the TIIME meeting in Vienna (https://tiimeworkshop.eu/)? Would it be worth adding a governance session at the close of the idpy developers meeting on Monday, 11 February (at the end so that people who might not otherwise be in Vienna could dial in)? -Heather

5 years, 4 months

4
3
0 0

To CLA or Not to CLA

by hlflanagan＠sphericalcowgroup.com

Hola a todos! At this point, I think we've come full circle on the question of whether or not to require a CLA for code committers. Just to get all the information in one place, let me recap/summarize: Arguments in favor: 1. CLAs can be stronger legal protection in case of IPR related issues. 2. Commons Conservancy (our probable home for IPR) recommends a CLA (and has a template we can use for one). Arguments opposed: 1. GitHub Terms of Service are considered by some (both within and independent of idpy) to be more than adequate, particularly after the February 2017 ToS update. 2. Getting a CLA from some committers will be impossible either due to an inability to contact them OR impediments with their employers. 3. Requiring a CLA will (possibly) discourage some committers from continuing participation in the project. 4. Code will likely have to be redone in order to work around third-party code that comes from developers who cannot/will not sign an CLA. A few additional details * There are 108 code committers who have submitted code to an idpy repository BEFORE the Feb 2017 GitHub ToS. This number hasn't significantly changed since then. * In April 2018, I sent email to these individuals letting them know that a CLA might be required at some point. If I missed anything, please chime in. If you have any other questions at all that you need answered before you can vote on this ([Yes|No] to requiring a CLA) please let me know. I'd like to have a final vote on this during our January call. -Heather

5 years, 5 months

1
0
0 0

Very Informal Notes: idpy Board call, 12 December 2018

by hlflanagan＠sphericalcowgroup.com

Attending: Heather, Chris, Leif Regrets: Christos, Roland, Mike, Ivan 0. Agenda bash Given the level of attendance, we’ll likely reuse this agenda for our next call. Heather to send out a doodle poll to find a time in January. 1. IPR - GÉANT and IPR (What is the relationship between IPR and the GEANT project? The default clause in the consortium agreement is that GEANT holds the IPR on behalf of the consortium. Need to see how that would play out if that means handing the IPR over to a third party. Action item for Christos to follow up on.) From Christos: Regarding the IPR, I have discussed this in GÉANT. Unfortunately I cannot provide a final response yet. The topic is in the hands of the GÉANT Execs at the moment. I am nagging them to get it resolved as soon as possible. - Draft Note Well (see email sent 11 December 2018) From Christos: Regarding the draft note, it looks fine to me. Point 3 looks like a very high level code of conduct. [It] is good that we something like this. - Next steps? 2. Review the criteria for bring in new projects to idpy (Practical use case: evolution of pyFF) - https://github.com/IdentityPython/IdentityPython.github.io/wiki/Adding-and-… From Christos: Regarding the criteria for bringing new project to idpy, I do not see mentioning anywhere that the software has to be open source. Are all open source licenses OK? and what about the topic of IPR? 3. TIIME? - idpy Developers meeting @ TIIME, Monday, 11 February 2018 4. AOB Offering a junior developer- Chris has a junior developer who will start on January 15 assigned to work exclusively on idpy project. Discuss tagging releases to make this more acceptable for people who are looking for mature products

5 years, 5 months

3
3
0 0

2024

2023

2022

2021

2020

2019

2018

Idpy-board