Naveen Srinivasan, Endor Labs | Open Source Summit NA 2022

This is Textron TV. Hey everyone. We're here back live in Austin at the Linux Foundation open.

Source, Summit we've had well, this is day three of our coverage. We've had some really really great discussions these last couple days and especially today. I feel like we're really digging into stuff.

Our next guest is Naveen shrinivasan. Yes, you're right Naveen is with Endor Labs, but he's really here to talk to us today about being a contributor to open source and open ssf projects, you know for those of us. For those of you out there.

Sometimes we tend to say oh open source is great. You've got this. Army of contributors, right?

There's the countless Untold, you know hoard of people who contribute it's not really the fact Right. The fact is most open source. projects and there's you know the top ones get a lot of after publicity, but there's millions and millions of Open Source projects.

Well software and Source projects really only have a handful of contributors. Who what let's go. Let's call them core.

Yeah contributors and and unfortunately many many open source projects have one or two maintainers that if something happened to them or they get a job or whatever the the future of the project is in. It's Jeopardy. and one of the nice things about what the Linux Foundation does is when they take these open source projects in as part of their foundations, whether it's open ssf or Cloud native or CDF or what have you is that they their mission is to ensure that there's a wider base of maintainers.

There's a wider base of contributors and it's sort of a pyramid and an even wider base of users so that it's a stable community. It doesn't depend on any one person. Anyway, I got that all out.

But Naveen here it informs us that he's probably one of the leading contributors across all the open ssf. Yes problems. I know I just mentioning this I started contributing to open ssf in 2019.

Early December especially on open ssf I've been from then up until now contributing to many projects across open ssf some of the critical projects that I contribute in a multi-maintainer is a project called scorecard. So you were mentioning something right now? There are some projects that are that have only few maintainers and those maintenance go away.

Then it becomes a problem. To answer those questions is where scorecard does like want to talk about scorecard a little bit scorecard essentially. skins a million open source repositories and tells how is the health of the project?

Are they maintainers are they they call it bus Factor. So there's only one person bus like if somebody hits by a bus not that they have to they can get another job or near that. Oh.

Are they updates happening right now in these last six months? Are they updates? If it's not it's gonna be a red flag, so Everybody depends on open source.

I don't know if you happen to see there's an excuse any comic what but with all with large with large infrastructure with them one stick at the bottom. I'm sure yeah people have seen that but somebody from Nebraska maintaining that right the breath your bus. Yeah.

Yeah, right. We've actually discussed this here in the last couple days. So but it's not it's not just a comic unfortunately.

It's all too true. Absolutely. Absolutely.

So that's where I am I've been doing and it's been in fun Journey. They've been ups and downs with everything but We an openness have been able to give this data out to everyone. So so essentially open as this open ssf is helping answer those questions that people don't know should I trust this right?

So if I could put it in my own words scorecard is sort of a health check for the Vitality of an open source project absolutely not talking about the code whether the code is secure the code is good or not. We're talking more about the the community around this project. Is it by it's bought.

Oh both. It's what it does. It has 18 checks right now from do they follow good practices.

Do they not follow bad practices? Well, what kind of good and bad practice so take example. Do they have code reviews?

If it's a YOLO comments, then probably then what line of struggle says is many eyes looked at a code. You're likely to reduce the number of bugs. So same way if I have Commit I'm the one who open to commit and I'm the one who pushes the commit then it becomes kind of a red flag do people are looking at it.

That's that's to make sure that and bad practices. Essentially, I am not securing I'm not a beating my dependencies. I depend on everything else but I'm not beating my dependencies.

So so those are something like is it fuzzing the large critical projects have to be fussing. So those are different things that scorecard does just to give you a general over your wallet. Yeah.

No, I love it. So I I don't want to embarrass you, but how many maintainers are there for scorecard right now? There are four four.

Yeah. Okay. So scorecard is sort of eating its own dog food and absolutely absolutely hard absolutely be a successful viable.

Yes. Project. That's excellent.

Did you come up with the idea for scorecard or no? I didn't come up with the idea that that scorecard was initially a weekend project like anything else by one of the googlers. He started the project contributed to open ssf and there was a blog post.

I've always had this age of how do I solve this problem? There's a block post about on my proxy in 2019. late November I saw that and I'm like that's what I want.

I've been looking for this and initially. There was one other contributor on a computer. and I paid along with them went through the Journey and after the people joined and started started becoming one of the most critical project with an open ssf Actually, we're gonna jump into some of the other projects and openness and stuff.

But I wanted to just tie the bow on school card. Yeah for people who want to maybe take a look at it use it find out more work and they go they can go to open a staff get up org and look for scorecard. It's open ssf get up or scorecard.

That's what it is. So it's open ssf Dot GitHub. It's oh come here flash score.

Yes, right there. You have it. All right, but that's not the only project you contribute to what else are you involved in?

I am in world and another project called Salsa Salsa is about well. Yeah how to have your supply chain from Providence. How do you do that?

And I also contribute to other sister projects of openness difficult sex tour. six stores essentially making the ensuring you are signing your stuff. It's like it's like having TLS certificates on your https.

But you're signing your artifacts and have it with without keeping you the private keys for yourself and have an open way to know what is happening on that. So it's proper authentication verification for you are facts. Yes.

Got it that you keep in artifactory or some Repository. You can keep it anywhere. But how do I like the example?

You got an artifact. Let's assume your glass. It was built like this.

who I Ensure that's the artifact that I am looking for some way to sign that and put it in a in an open registry. So that people can be like is that the artifact is that the shot that I can trust? Was it the like that so that way it helps everybody Trust?

The artifact of what I'm getting is what the it was intended. Nobody did the man in the middle change things and upload something. There'd been multiple of those like code and all those things.

That's what it is trying to want. I got it. Excellent.

So here's another good question that I'm sure our audience is gonna be interested in it. We have a lot of people out here who love open source that would love to be more involved in open source, Unfortunately. They have day jobs.

Yeah, right. So how do you balance your day job with Endor with all of this open source activity? Yeah, I'm gonna tell it.

My wife is not had pretty happy about it. Someone's paying the piper. Yeah, so I've got two kids.

So so anytime I drive them around I'm gonna gas station with my with my but my iPhone hooked up and have my MacBook opening and trying to do that. So trying to balance this is being It's like it's like people love building cars people. Love hobby.

It's a hobby of a love what you do, so. I'm mad, so I said last year. Can I have a day can I have and get up you get a green bar for every day you you commit I said I wanted yesterday last year not to have.

A single day without committing so from 2020 Jan one onwards up until now. I'm managed to keep that straight up. It's just an hobby when you and it's like any of the Habit in your life.

You just pick up a habit and you want to keep doing that and it's great. And then what happens then you start having fun. Then you get to come to these conferences and meet human beings with that and you're like, oh, And can put the face over that my name and I thought they are different but when they when I met them in person.

I get a life surprise. Yeah, right. How much more well not always some people are exactly what you thought.

They are. I I've been doing this a long time. Yeah, you meet people online and then you get a chance to meet him in person.

And sometimes you're surprising sometimes you know, yes, yes, but but it's nice because I don't get to talk to them but writing talking to them going and getting a coffee. I'm sure I'm gonna enjoy this even better as I go about going. Absolutely.

Well, you know, first of all, I want to thank you for what you've been doing because it really is it's on your people like you and your shoulders that this whole open source movement. Is what it is, right thank you know people so congratulations and thank you. Thank you and secondly man.

Keep up the great work, but you know, what is I'm a little older than you and I've raised my kids. They're only this age once absolutely absolutely and sometime with them. Absolutely.

I keep your wife happy. Yeah. All right.

Thank you Naveen srinivas in here largest contributed open ssf maintainer of scorecard check that out as well. We're gonna take a break. We're live in Austin.

We'll be right back.