The purpose of the Metrics & Metadata (formerly Identifying Security Threats) working group is to enable stakeholders to have informed confidence in the security of open source projects. We do this by collecting, curating, and communicating relevant metrics and metadata from open source projects and the ecosystems of which they are a part.
I am seeking to write a "metrics explainer" in which, for each metric on the dashboard, we document things like:
Security impact: Details about how a given metric relates to the security of software in general; rationale for its' inclusion and interpretation in the dashboard; other context that can help a user make an informed interpretation of a given metric
Computation of metric: How the metric was obtained or computed, including whether this is something our backend computes (and based upon what input) or something pulled from a third-party source
Interpretation of scores: What is the potential range of scores for the metric, and how to interpret a score
We will eventually publish this as a resource for users of the dashboard. TBD how we will integrate this (will discuss in a future meeting with @rhaning as we get closer to knowing the overall dashboard UX of the version for initial release)
In terms of next steps:
@rhaning / @scovetta can you share (here or by email) a list of metrics which are intended to be present in the initial release?
I will create a working draft, and share it here
Anyone who would like to help should let me know - currently, the collaborators are me and @mayakacz
I am seeking to write a "metrics explainer" in which, for each metric on the dashboard, we document things like:
We will eventually publish this as a resource for users of the dashboard. TBD how we will integrate this (will discuss in a future meeting with @rhaning as we get closer to knowing the overall dashboard UX of the version for initial release)
In terms of next steps:
Feedback welcome!