First initial commit for the Malicious Package application

[6mile]

This is my initial draft doc for the TAC requirement to create a separate OpenSSF project for Malicious Packages.
The intent is to create a Malicious Packages project under the Securing Critical Projects WG.

[calebbrown]

Thanks Paul! I've added some minor comments.

[marcelamelara]

Who will be the hosting group for this new project? Is Malicious Packages meant to be hosted under a particular WG or report directly to the TAC? Either way, ensuring there's a TAC and/or WG sponsor would be really helpful.

[6mile]

Who will be the hosting group for this new project? Is Malicious Packages meant to be hosted under a particular WG or report directly to the TAC? Either way, ensuring there's a TAC and/or WG sponsor would be really helpful.

Hi @marcelamelara I've updated the application to show that the sponsor is the Securing Critical Projects Working Group.

[lehors]

The intent is to spin Malicious Packages out of the Securing Critical Projects WG and into its own project.

I don't think that's the right way to put it because with few exceptions, projects report to a WG. So, they is no spin-out in this case. I think you should rather say:

The intent is to create a Malicious Packages project under the Securing Critical Projects WG.

[gkunz]

Hi @6mile. Thanks for putting the application together. Purely out of curiosity and to understand the dynamics and needs of the OpenSSF community better: why would you like to create a separate project under the WG (e.g., spin the project out of the WG)?

[6mile]

The intent is to spin Malicious Packages out of the Securing Critical Projects WG and into its own project.

I don't think that's the right way to put it because with few exceptions, projects report to a WG. So, they is no spin-out in this case. I think you should rather say:

The intent is to create a Malicious Packages project under the Securing Critical Projects WG.

Done!

[6mile]

Hi @6mile. Thanks for putting the application together. Purely out of curiosity and to understand the dynamics and needs of the OpenSSF community better: why would you like to create a separate project under the WG (e.g., spin the project out of the WG)?

Good question. There are several reasons to make Malicious Packages its own project. First, the Securing Critical Projects WG has a number of work streams and projects under its umbrella:

Securing Critical Projects: List of Critical Open Source Projects, Components, and Frameworks

criticality_score(https://github.com/ossf/criticality_score/blob/main/Quantifying_criticality_algorithm.pdf)

Census II Preliminary Census II

package-feeds

package-analysis

The Malicious Packages repository and its associated work is lost right now in that noise. If its not its own stand alone project, where does it fit? I routinely talk to people who want to participate but who can't find it in the OpenSSF universe of "things".
Ironically, the malicious packages non-project gets a disproportionate amount of visibility outside of the OpenSSF in terms of the GitHub repository itself, and its utility. But doesn't get a lot of visibility inside the OpenSSF.
The idea in promoting it is to help grow its priority and visibility in the OpenSSF, so that it matches its importance outside. And frankly, to bring more people into the core contributing group.

[steiza]

I think it makes sense to formally recognize that Malicious Packages is operating as a Project inside of Security Critical Projects Working Group.

When we were defining TI types (and lifecycles), we wrote:

This document describes the Open Source Security Foundation (OpenSSF) lifecycle process for Technical Initiatives (TI) which include Working Groups (WG) (non-software and non-specification focused), Projects (developing code or specifications), and Special Interest Groups (SIG).

If a TI is primarily producing code and specifications, it should be a Project.

[6mile]

heya @calebbrown I think I've addressed the changes you requested. Can you verify and if so, approve? Thanks!

[gkunz]

Thank you @6mile for the explanation of your motivation. The TI lifecycle process is the tool to support TIs in overcoming the challenges you mention.

[calebbrown]

Thanks for preparing this @6mile! LGTM

The Malicious Packages repo is definitely growing beyond the Package Analysis project it was created within, so becoming its own project will continue to help support this growth.

[marcelamelara]

Thanks!

[justaugustus]

Looks great. Minor grammatical nits.

[6mile]

Looks great. Minor grammatical nits.

Heya @justaugustus i've updated with your suggestions.

[justaugustus]

Thanks @6mile!