Feedback 2023/12/11

ddimitrov

As I am going through the course, I'll be posting in this thread things that you may want consider fixing. Each issue will be in a separate reply, so that it would be easier to link to them.

ddimitrov

The text:

Open source isn’t going away. As noted in "The State of Enterprise Open Source: A Red Hat report", open source software is more flexible, higher quality and has better security than commercial alternatives.

Another key benefit of open source is that it prevents vendor lock-in. This is where a software vendor can either force upgrades or charge license fees that increase over time against their customers’ wishes. As we will see, this practice is incompatible with the license that open source software is provided under.

Is present on both these pages:

• https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/important-concepts/what-is-open-source-software?page=1
• https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/important-concepts/what-is-open-source-software?page=2

Likely the page was split or merged - in any case you probably want to remove the duplication.

ddimitrov

Regarding the copyright, it is a good idea to clarify this statement:

NOTE: When working as an employee for a firm, your firm holds the copyright to anything you write, including software.

Without any explicit arrangement, the firm only owns what you produce as part of the employment engagement, or using the firm's resources (hardware, tools, services, premises). You own the copyright of anything you do on your personal time without using firm's resources.

Some employment contracts lay broader claims, as in "the firm owns everything you produce and you cannot share without explicit authorization". In such firms, an OSS contribution policy constitutes such authorization (as long as you comply to its stipulations).

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/important-concepts/understanding-open-source?page=2

ddimitrov

It may be worth adding a sentence or two, stating what does it mean for code to be in the public domain, and how does it differ from the permissive license. Even better a table summarizing the key differences between the four types of licenses (including proprietary).

I believe that it is an open question if an author can disclaim their responsibilities (regarding licensing, high tech export regulations) by putting a work in public domain.

I would love if we can start phasing out the cutesy "copyleft" and "viral" monikers and use the descriptive "reciprocal licenses".

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/important-concepts/understanding-open-source?page=4

ddimitrov

General comment:

So far - pages are chunked at way too small pieces. I find myself losing context, and getting distracted, looking where to click instead of focusing on the material.

Scrolling is not necessarily bad.

This page is offensively clicky - opening all the boxes to reveal one sentence feels like jumping through hoops.

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/important-concepts/the-open-source-initiative?page=2

ddimitrov

On OSS Criteria:

The program must include source code, or some easy way to get hold of it.

It is worth getting a bit more specific as that is very relevant to corporate OSS - reciprocal licenses require the _final modified source code _to be available to any user; permissive licenses require the upstream code that is being built on to be acknowledged and linked; public domain does not require any of these (and technically does not classify as OSS).

Furthermore, it is important to note that licenses require that code is offered to users of the software - hence if one reuses even a strong reciprocal license such as AGPL, but keeps the usage in the firm, there will be no external obligations.

--
https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/important-concepts/the-open-source-initiative?page=2

ddimitrov

A good way to engage with OSS is to start participating in the user community, first by asking good questions (insert your favorite guide here), then by providing answers, helping new users, initiating discussions about requirements and new features.

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/important-concepts/contributing-to-open-source?page=2

ddimitrov

It is worth mentioning that Eclipse now hosts the Adoptium project, coordinating the activities of the the various Java builders and their artifacts, as well as Temurin - a vanilla OpenJDK runtime:

https://adoptium.net/marketplace/
https://adoptium.net/temurin/

--
https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/important-concepts/foundations?page=1

ddimitrov

Which type of open source license allows the end user to redistribute the software with their own license?

Technically both PD and Permissive licenses allow for relicensing.

---

The quiz results bar chart render misses the last question

---

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/important-concepts/knowledge-check?page=1

ddimitrov

The linked ISO 27001 standard costs 124 CHF - I doubt anybody will be willing to spend this kind of money just to check the reference material. A summary would be very useful, as well as guidance in which cases is it worth reading the primary source.

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/engagement/being-an-ambassador?page=5

ddimitrov

As OSS contribution can be done both in firm's capacity and in personal capacity, do we really need to be on record when not using our firm's identity? Can we have more detailed reasoning if that is the case?

When I hack something on a Sunday afternoon and put it on Github, do I need to ask my OSPO? How about if it is a private project? How about if it is an issue comment? Support comment? Tweet?

I know it is common sense, but this pages in their current form can be misinterpreted, and it is critical to draw good boundaries.

---

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/engagement/electronic-communications?page=2

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/engagement/engaging-the-right-way?page=1

ddimitrov

Quiz 2:

What is the term used to describe communication related to a financial firm's products, services, investments, or other business matters?

also:

From an open source perspective, what’s the difference between public information and classified information?

This was probably in the 124CHF document, but I cannot meaningfully make a difference between "Internal", "Restricted" and "Firm business" - this doesn't line up with my company classification.

I'd rather have a question about what I should and should not do, over "what name did we give to..."

---

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/engagement/knowledge-check?page=1

ddimitrov

It would be useful to show few supply chains to emphasize that it is a concept, not a fixed set of stages and processes.

Besides the provided "server application", few more illustrations would be "library", "mobile application", "pacemaker firmware", or "package in Linux distribution".

---

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/using-dependencies/the-open-source-supply-chain?page=1

ddimitrov

One more criteria:

• Value of reused functionality vs. maintenance/coupling/complexity cost of added dependencies

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/using-dependencies/choosing-software-components?page=1

ddimitrov

It could cause your firm serious reputational damage if it were found that a member of staff had committed code that had somehow aided terrorism.

This is vague example for what is OK and what not OK would be appreciated.

Many of the terrorists use Android phones and end-to-end encrypted messaging (Whatsapp, Telegram, etc) - does that reflect poorly on those projects?

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/regulatory-landscape/regulations-anti-terrorism?page=4

ddimitrov

SVB is no more, and has somewhat negative associations - perhaps we can have a different example?

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/regulatory-landscape/regulations-antitrust-regulations?page=3

ddimitrov

The quiz of section 7 was funny, but not useful. Most of the answers were obviously false, and as such it did not add value. If we cannot come up with useful questions, perhaps it is better to remove the quiz, of fold the "escalation" section in the "regulatory landscape"

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/escalating/knowledge-check?page=1

ddimitrov

This is a weird way to ask a question:

Popularity, community support, documentation, code quality, security and vulnerability management should be considered when selecting software components in addition to:

Pretty much all answers are correct to an extent and one has to guess what is intended.

Similar with:

Requiring approval before submitting personal OSS contributions is necessary to prevent:

The following sentence is hard to parse. (What risk? In what way does it challenge? What are "traditional ways"?)

A new technology has created risks regarding data leakage and challenges the traditional ways of contributing to an open source project involving this technology. What is the suggested action to manage these new scenarios?

ddimitrov

Surveymonkey is blocked by my corporate proxy:

https://trainingportal.linuxfoundation.org/learn/course/open-source-contribution-in-finance-lfd137/course-completion/feedback?page=1

ddimitrov

Bottom line, very good as scope and content.

If I could change one thing, it would be to reduce the number of "slides" - as a guideline, 150-200 words per screen is a good amount. If I have to click "Next" for every sentence, I'm losing context.

Another minor pick is that it would be nice to make sure to minimize the number of questions requiring to memorize nomenclatures, especially when speaking of taxonomies that may vary between companies.