Random Notes taken on Unconf to which Christoph Rüßler (@cruessler) and I were invited to participate in the Critical Infrastructure group.

My goal is to make progress with #1406, ideally having a grant application ready to go.

Finally, other tangible results could be to find ways how gitoxide could improve its security stance and talk about it, hopefully being a model citizen to inspire others to do the same.

25-05-16

Dependencies Session 11am

• Internal Crates - Nested Packages
  • RFC 3452
  • Publish crates with sub-crates that aren't exposed on crates.io - like vendored/shipped crates, shippable path-dependencies
• **Vet dependencies and trusted crate owners
  • cargo deny rules and cargo-vet
• ESL - extended standard library
  • Could be a set of trusted/blessed crates that people can use to solve common tasks, with certain practices enforced.
• How to crowdsource trust and/or security?

Dependencies Co-Session 11am

• Duplicate dependencies, version-ranges, lacking tooling
  • How to judge crate quality without looking at source-code or going into details?
• How to recognise crates that don't pull their weight (anymore)?
• MSRV
  • Cargo might be on the way to deal better with that.
• Cargo features are hard to manage
  • Bevy CI runs random combinations to save time
• dependency-trees are blown up because crates are split up into multiple smaller ones, sometimes with implementation details.
  • similar to 'internal crates', as this could be solved
  • Suggestion from the room: could there be a cookbook for quality/audits/reviews?
• Both sessions ended up on supply-chain security, maybe related to the 'critical infrastructure' topic in the room.

Free Discussions from 12:30pm to 11pm

• Idea: use the influence of the people in the room to become models for a better security stance
  • stance to be discussed.
  • can people in the room support each other and/or work together more for even more influence.
• Could lib.rs be used to show metrics (or incorporate them) that help make trust or 'security' something that is on display?
• Outcome could also be to find priorities and hand that information over to the 'the other side', to affect the cargo infrastructure directly.

3:30pm Funding Session

• For Application
  • Sequence of Milestones + Pricetag
• Astral Foundation for supporting open-source
  • They have their own rules (should be transparent)
  • Can also simply pay for features
• Josh Aas (Let's Encrypt (8m per year)) and Martin Hoffmann has some experience - happy to share experience
  • there should also be money for basic maintenance, but it's probably harder to fund.
    • SDA has a thing for that. Otherwise it's hard to know what they get.
    • rustls - gets a lot of money
• Try to get packaged money for maintenance when there are no more features to fund
  • essentially getting paid as part of something bigger, like a foundation that hands the money to individuals.
• Operational Expenses - good in the sense that they don't have to wonder if they could hire somebody themselves instead - i.e. support contracts.
• Let's Encrypt
  • 30-40% of income now comes from grants, but it's for a service.
  • even for non-profits it's hard to spend their money for secondary causes. But support-contract is a common business practice, they can do that.
  • doesn't prioritize or offer support - there is no priority attention unless you know people in the organisation
• It's hard to sell support for libraries
• How to monetize open-source projects?
  • Example: LinkerD started selling Git tags (they stopped doing it, to resell it)
  • Sponsorship also means paying in advance for attention, front-of-the-line .
  • Some projects make custom features for money, but maintaining them is a burden over time.
• Sign of virtue of giving everything away for free in OSS-projects might not be necessary at all, open-core is fine.
  • Slint is an example of that
• About Applications
  • When rejected, it's hard to get information about why that was, making it harder to re-apply with increased chances .

10:00am - Zlib-Rs session - Funding How To

• STF/STA wants to diversify do more (or less) Rust?
• STA wants to focus on maintenance apparently
• Apply multiple grants at the same time (Alpha-Omega)
• Argument: Reach of Gitoxide
• Tweede Golf - Rust consultancy as service provider, open source work, NTP, Zlib-rs, Sudo,
  • Trifecta Tech Foundation takes care of open source projects, for public benefit, goal is to have 5 or so people on the foundation
  • Foundation can flexibly transfer people back and forth
• ✅ zlib-rs ✅
  • direct integration without flate2 and libz-sys-rs with direct Rust API

• Trifecta can be fiscal host possibly, it's a problem to sort out later