AevaOnline / supply-chain-synthesis

Collating an overview of the open source software supply chain landscape -- and synthesizing that survey in a hopefully-useful way.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Background and Intent

Human languages are ever-evolving, and meaning is imputed by the speaker, and this is doubly true within technical domains where domain-specific language is crucial to efficient collaboration and communication.

2021 demonstrated that there are already wide-spread differences in imputed meanings of identical technical terms within the overarching domain of 'supply chain security', and these exist across many open source organizations and commercial bodies. Furthermore, there has been a general lack of understanding outside of domain-experts in what these terms mean, as no one other than security wonks needed to understand this DSL. This has only led to further confusion as new folks join existing communities and appropriate terms whose legacy they may not fully see.

My hope in starting this work in the summer of 2021, and continuing now in 2022, is that by first gathering lexicons from disparate organizations, I may help us all arrive at common understandings and overcome the trap of the tower of babel, which, I am afraid we have all been falling into, no doubt moreso because COVID has made in-person gatherings less common or comfortable.

I make no claim to be an authoritative voice on any one, let alone more than one, of these domains, and invite correction wherever I have misrepresented, or failed to account for, distinction.

In the end, I will consider this effort a wild success if it facilitates more efficient communication of designs and expectations between domain expters, and helps the community-at-large identify gaps in the supply chain which we can collectively work to secure.

Status

WORK IN PROGRESS

I am moving my "Analysis of the supply chain landscape" gDoc from google to github to make it easier to track changes and take contributions, and begin working in earnest on the 'synthesis' portion of this effort.

About

Collating an overview of the open source software supply chain landscape -- and synthesizing that survey in a hopefully-useful way.

License:Apache License 2.0