Define long term goals and roadmap and maintainer roles #731

Activity

1. EndPositive

   added

   documentationImprovements or additions to documentationImprovements or additions to documentation

   on Oct 14, 2021
2. J12934 commented on Jan 28, 2022

   

   J12934

   on Jan 28, 2022

   Member

   More actions

   Hi sorry that this was unanswered for so long, lost sight of it, just found this again as it was linked in the Architecture docs PR.

   I'll try to answer the questions here as best I can, answers might not be complete maybe @rseedorff can expand on some of these.

   Goals:

   Longer term goals should be outlined in a maintained roadmap readme in this repository.

   We're at iteratec are currently working on updating our roadmap for 2022 and beyond on where we want to go with the SCB.
   Should be ready in the 2-3 weeks, I'll update the WIP architecture docs page here and on the OWASP Page when we've finished.

   Features:

   What features are considered core?

   That's a hard question as we don't really differentiate between core and non core features. We try to decide on new features if the should be added to the main secureCodeBox repo on the following questions:

   1. Is this feature relevant to a relevant portion of the secureCodeBox users.
   2. Do we have the ability / workforce to maintain the feature

   E.g. we recently worked on PingCastle as a ActiveDirectory scanner but have decided against adding it to the main scb repo. Even thought we still find it relevant we can maintain the rather complex setup to run it (as it requires pretty deep windows integration which is hard in Kubernetes). So we decided to rather write a blog post about it so other people can learn from our work but we don't have to actively maintain it.

   In what degree will scanners/hooks keep being added to this project?

   Hard to predict the future but I'd guess in a slower rate then the previous years.
   Each scanner & hooks adds a additional maintenance burden. We try to reduce the burden as much as possible but it'll never be zero.
   Hopefully we can expand our "maintenance capacity" this in the future by giving "code owneship" for some scanner and hooks to community members or expanding the core team :)

   Team:

   Who are core, long-term, team members?

   Stijn already named the iteratec core team members correctly in the architecture PR. I'll update the proper roles :)
   We currently have two students supporting our open-source SCB development, I'll also add them on there.

   Who are temporary team members (e.g. interns/thesis projects)?

   We currently don't have any interns working on the SCB at iteratec.

   Who are external contributors?

   We don't keep a list :)

   What is this team's workflow? Already in blog-post format, not directly linked in main repo.

   I'll try to see if we find a good place to link to this.
   Also hoping to open the workflow up more this year to make this more transparent and inclusive for the community this year 😀

   iteratec

   What is iteratec's role in secureCodBox?

   SCB started as a internal project at iteratec (I think around 2015 / 2016), always with the goal to opens-source it.
   iteratec staff has since then always been the primary maintainer and one of the primary adopters.

   Who is financially sponsoring secureCodeBox? & Is secureCodeBox development sold by iteratec?

   iteratec itself is supporting the secureCodeBox for two primary reasons:

   1. iteratec itself is intensely using the SCB to scan the infrastructure and attack surface of iteratec. This has proven to be extremly valuable to iteratec as it has helped us to detect many potential issues early on and has helped us combat larger issues effectively (e.g. Log4j vuln, we're currently in the works on a blog post on how we used the SCB to detect and fix log4j vuln at iteratec)
   2. iteratec has multiple customers actively using the SCB and iteratec is helping them to expand and improve the adoption of the SCB and DevSecOps principles with both consulting and development work.

   In other words, what ensures that iteratec continues development on this project?

   Ensure that SCB continues to be a great tool to implement DevSecOps practices and improve the security standing of companies :)
3. EndPositive commented on Jan 28, 2022

   

   EndPositive

   on Jan 28, 2022

   ContributorAuthor

   More actions

   Thanks a lot @J12934! It makes me happy to see that iteratec is still dedicated. I'm looking forward to see the roadmap.

   @Stijn-FE will incorporate your comment in the architecture documentation. Shall we close this issue in favor of secureCodeBox/documentation#208?

   👍React with 👍1Reacted by Jannik Hollenbach
4. EndPositive

   closed this as completedon Jan 28, 2022