Kate Stewart | Sean Goggins | Georg Link

Linode

[00:02:40] We start off on the topic of looking at metrics that are useful for identifying what’s going on in a Software Configuration Management system. David tells us what it is and if there’s a difference between building software and deploying it. Also, figuring out which components you’re going to bring in, to your overall system.

[00:07:55] Kate wants to know how much do the hidden dependencies play a role in risk of using Open Source and using projects, and do we see things people aren’t expecting? Sean asks if there are high profile cases where folks did not manage those dependencies terribly well and bad things happened.

[00:14:09] Sean wants to know what kind of metric might help to identify that kind of programmer error that results in malicious code being introduced into a project and are there other ways that we could measure the existence of that phenomenon? CII Best Practices Badge is talked about here.

[00:16:38] Kate mentions a survey that came out late last year of the most popular software that came out recently, and there’s some top packages that were identified through the analysis that had come from the scanners and everything else. Of those packages, how many of them have badges? Frank tells us the analysis he did and the results (report linked below).

[00:19:45] Sean talks about things he’s observed when it comes to packages and dependencies and which ones are more popular in the course of the project. He wonders if anyone on the panel has started thinking about how do we assess things that are within a repository and what challenges does that pose from a metrics perspective?

[00:23:34] License Risk on a project is discussed here by Kate and David.

[00:28:09] Sean wants to know if he’s creating an Open Source software project and he Googles “Open Source Software licenses,” is he in a pretty safe space or are there other Open Source licenses that are pretending that they’re Open Source? David tells us where to look to find out.

[00:29:32] Frank tells us what kinds of metrics or pieces of what they’ve talked about as being significant in both economic impacts and the future of work.

[00:33:53] Sean wants to know in regard to Frank’s survey, what kinds of things he is looking to measure that we can’t with trace data from a repo.

[00:36:39] Georg asks Frank if he’s has some early insights that might be interesting with the survey.

[00:39:02] David and Frank tell us places you can check out to learn more.

Frank Nagle Twitter

Special Guests: David A. Wheeler and Frank Nagle.

Support CHAOSScast