Re: [oasis-charter-discuss] Call for Comment: proposed Charter for Best Current Practices TC

[duncan sfractal.com <duncan@sfractal.com>]

 Hi all,

I apologize for not following all the nuances in these emails. I agreed to be part of the BCP TC because I thought it would be helpful. I didn’t realize it would be a political minefield. I personally saw it as an adjunct and feeder to the TAB, not as a replacement for the TAB. I think I am reasonable up on what documents and procedures exist, and I thought OASIS generally allowed the TC’s freedom within that scope without being too proscriptive. I see the new TC as offering helpful guidance, particularly when one TC discovers some process that might be of use to some other (not necessarily all) TC’s. For example the OpenC2 TC had started using github for change control and issues. We converted from google docs and had to learn some new tricks and write some scripts in the process. Probably other TCs had done similar but we had to reinvent the wheel and others after us would need to reinvent it again. I saw the new TC as being helpful with things like this. I’ll give my opinion on Martin’s comments in response to Bret’s comment that he disagrees with them but wants other’s opinions since this is a member driven organizations. On some I agree with Martin and some I agree with Bret (yes for the record I agree with Bret on some things which might suprise some who have heard us go at it in OpenC2). I’ll refer to Martin’s comments using his numbering:

1) I see Martin’s point but tend to agree more with his later point that we focus on OASIS. Although the IETF does use BCP  a particular way, I think this TC (and OASIS in general) uses BCP like is used in most of industry and in other SDO’s - ie it means what the words mean - best current practices. Having said that, I wouldn’t fall on my sword over it and I could live with “Guidelines and Practices”.

2) I think ‘best current practices’ is a well understood term of art and I think outlawing its use is going too far. Anything that got passed by this TC represents what its members thought at the time they voted - so to say it doesn’t represent other non-participant views is true but begs the question why didn’t they participate. And the statement holds about any OASIS document so I think sets a dangerous precedent (ie we shouldn’t degrade our own outputs because not everyone participated in every vote of every TC). The docs will have public review period like any other thing we come out with.

3) I agree we should focus on OASIS needs and if anyone else can use, it’s gravy. Note I said OASIS and I’ll leave open whether that includes open projects as well. Personally I think it should be within scope but I could live with in the ‘beyond focus but ok if they use’ category.

4) I’m not sure what is being proposed to change. If the comment is saying to remove the text because it’s obvious from OASIS rules, then I think the text should stay even it it is redundant since it everyone might not have all the rules memorized.

5) Ditto my #4 statement

6) I think existing text acknowledges Martin’s point that OASIS has guidelines already. If it turns out that Martin is correct and everything is already covered, then that will come out in TC deliberations and we’ll all be smarter. But it’s at least possible additional value might come of discussing practices in one TC might be of use in a different TC. So I’d vote to keep as is. 

7) I’m not seeing what is “the political statement” in “By providing guidance and practices for how to do specific tasks, these documents would help get new TCs operating efficiently faster and help them avoid common pitfalls.”. I’m guessing there is some history that I am missing.

8) I am not understanding the statement that the output of the TC can’t be recommendations without the board blessing.  In one sense that is true of all OASIS specifications/notes/standards but these reads like any output from this TC would need a special board meeting. I’ll reiterate that I think the TC is for augmenting existing practices not replacing TAB or Board. I suspect this may be another area where there is an unspoken undercurrent that I am not party to. 

7) (note comments used this number again so I am just following original). Martin’s comment is true that TC can’t violate any OASIS rules but that is true of all TC’s. I think it is implicit and no words need to change.

8 (second “8”)  - ditto previous comment. Yes it’s true existing guidelines exist. I don’t think words need to change but wouldn’t fall on my sword over changes if someone wants  to add explicit wording pointing to existing guidelines. If nothing else, the TC might be useful for making ‘how to’ and ‘example’ that make it easier to find the existing guidelines that might apply to different situations

9) I don’t understand what needs to change. The paragraph deals with Committee Notes and the comment says to restrict to Committee Notes. What words should change in existing text?

10) voting rights - Martin’s comment that TC voting rights are defined in OASIS is true but I disagree with removing from scope since voting rights are not defined in OASIS for all situations e.g it is not defined in subcommittees or non-voting meetings (which seems like an oxymoron but it’s come up). And similar to my other comments - if after study there are no situations that need clarification, then the only best practice will be to to follow the existing adequate rules. I don’t think we should preclude that it might be useful. In general I’m against presuming everything is perfect already. I don’t think it hurts to study. People don’t have to participate if they think its a redundant- but hopefully they would at least point out the redundancy and where to find the appropriate existing guidelines.

11) Yes there are guidelines for demos. But I disagree they are adequate. OpenC is planning a plugfest in January and we are polling other OASIS plugfests for what they learned and its been useful. And I’m sure we’ve missed some learnings because we didn’t know to ask whatever TC. I think this is very important topic that will be even more important moving forward. Handled correctly this would enhance OASIS

12) Yes there are guidelines for conformance specs. I have used them and they are useful. I don’t think they should be static documents and I think this is another area where this new TC would allow members from many TCs to contribute. I believe all existing specs conform with guidelines but reading them shows how differently they got interpreted. Getting under the hood on those differences would be useful. Here is a good exampel where something might possibly come out of the TC that would percolate up to the TAB (or it might not).

13) Yes the board or admin could nix anything that is counter to OASIS policy. That is no different than for any other spec/note or any TC standing rule. Hopefully members of TC would point out any offending material long before it made it that far (just like in all the other TC’s).

14) Good comment. I agree we need to baseline what is already there.

BTW this would be way easier as github issues and proposed text pull requests as opposed to long emails losing context.

iPhone, iTypo, iApologize

Duncan Sparrell

sFractal Consulting, LLC

I welcome VSRE emails. Learn more at http://vsre.info/

---

From: oasis-charter-discuss@lists.oasis-open.org <oasis-charter-discuss@lists.oasis-open.org> on behalf of Martin Chapman <martin.chapman@oracle.com>
Sent: Monday, November 11, 2019 8:38:38 AM
To: Allan Thomson <athomson@lookingglasscyber.com>; Bret Jordan <bret.jordan@broadcom.com>
Cc: Chet Ensign <chet.ensign@oasis-open.org>; OASIS Charter Discuss List <oasis-charter-discuss@lists.oasis-open.org>; OASIS TAB <tab@lists.oasis-open.org>; duncan sfractal.com <duncan@sfractal.com>; Bret Jordan <bret_jordan@symantec.com>; Jane Ginn - jg@ctin.us <jg@ctin.us>; Ryan Hohimer <ryan.hohimer@darklight.ai>; Justin Stewart <jstewart@lookingglasscyber.com>
Subject: RE: [oasis-charter-discuss] Call for Comment: proposed Charter for Best Current Practices TC

 

Allan,

 

The main motivation for my comments is on determining the scope of this proposed TC and theboundary  with existing policies, guidelines etc. that have been developed over the years by the Board, Staff and TAB . The charter, as I read it, proposes to develop voluntary practices that do not yet exist within OASIS, though your email below talks about fixing ‘rules’ that are “out of date”, “don’t make sense”, “a burden” or “irrelevant”.  Which is it, as these are two very different prospects?

 

Martin.

 

 

From: Allan Thomson <athomson@lookingglasscyber.com>
Sent: Sunday 10 November 2019 15:18
To: Bret Jordan <bret.jordan@broadcom.com>; Martin Chapman <martin.chapman@oracle.com>
Cc: Chet Ensign <chet.ensign@oasis-open.org>; OASIS Charter Discuss List <oasis-charter-discuss@lists.oasis-open.org>; OASIS TAB <tab@lists.oasis-open.org>; DuncanSparrell <duncan@sfractal.com>; Bret Jordan <bret_jordan@symantec.com>; Jane Ginn - jg@ctin.us <jg@ctin.us>; Ryan Hohimer <ryan.hohimer@darklight.ai>; Justin Stewart <jstewart@lookingglasscyber.com>
Subject: Re: [oasis-charter-discuss] Call for Comment: proposed Charter for Best Current Practices TC

 

Martin & other board members – I’ve beenfairly active in the OASIS TC process for a few years now. I was encouraged by Bret taking an active measure to help document some of the ‘best practices’ because it has been my experience that the OASIS documents and guidelines were either out of date or just didn’t make any sense to active work that I’ve seen or been involved in. Personally, I’ve worked in standards across IEEE, IETF and OASIS so I feel that I have some experience to draw from.

 

I get why a standards organization needs rules. But when those ‘rules’ become a burden or irrelevant then I think the board should consider what is motivating this new ‘best practices’ TC to form in the first place.

 

So instead of trying to undermine its work (by some of the comments provided) maybe it would be good to consider that the folks in this new proposed TC are trying to make things *better* at OASIS and make it easier for everyone working in various TCs to learn from other’s experiences while writing standards.

 

The board should not see this TC as a threat to the rules of OASIS but rather embrace the fact that a *member-driven* organization has members that wish to improve the organization.

 

Regards

 

Allan

 

From:<oasis-charter-discuss@lists.oasis-open.org> on behalf of Bret Jordan <bret.jordan@broadcom.com>
Date: Saturday, November 9, 2019 at 11:22 AM
To: Martin Chapman <martin.chapman@oracle.com>
Cc: Chet Ensign <chet.ensign@oasis-open.org>, OASIS Charter Discuss List <oasis-charter-discuss@lists.oasis-open.org>, OASIS TAB <tab@lists.oasis-open.org>, DuncanSparrell <duncan@sfractal.com>, Bret Jordan <bret_jordan@symantec.com>, JG CTI-TC <jg@ctin.us>, Ryan Hohimer <ryan.hohimer@darklight.ai>, Justin Stewart <jstewart@lookingglasscyber.com>
Subject: Re: [oasis-charter-discuss] Call for Comment: proposed Charter for Best Current Practices TC

 

Oh and just to be clear, while I disagree with most of these comments from Martin, OASIS is a member run consensus based organization.  So I am more than happy to tweak the charter, if needed, to be inline with the majority.

 

Bret

 

 

On Nov 9, 2019, at 6:36 AM, Martin Chapman <martin.chapman@oracle.com> wrote:

 

All,

 

Please find my comments and suggestions on the proposed charter in the attached redline.

 

Martin.

 

From: Chet Ensign <chet.ensign@oasis-open.org> 
Sent: Tuesday 29 October 2019 17:16
To: tc-announce@lists.oasis-open.org; members@lists.oasis-open.org; OASIS Charter Discuss List <oasis-charter-discuss@lists.oasis-open.org>; OASIS TAB <tab@lists.oasis-open.org>
Cc: Duncan <duncan@sfractal.com>; Bret Jordan (CS) <bret_jordan@symantec.com>; Jane Ginn - jg@ctin.us <jg@ctin.us>; Ryan Hohimer <ryan.hohimer@darklight.ai>; jstewart@lookingglasscyber.com
Subject: [oasis-charter-discuss] Call for Comment: proposed Charter for Best Current Practices TC

 

To OASIS Members:

A draft TC charter has been submitted to establish the OASIS Best Current Practices Technical Committee. In accordance with the OASIS TC Process Policy section 2.2: (https://www.oasis-open.org/policies-guidelines/tc-process#formation) the proposed charter is hereby submitted for comment. The comment period shall remain open until 23:59 GMT on 11 November 2019.

OASIS maintains a mailing list for the purpose of submitting comments on proposed charters. Any OASIS member may post to this list by sending email to: oasis-charter-discuss@lists.oasis-open.org. All messages will be publicly archived at: http://lists.oasis-open.org/archives/oasis-charter-discuss/. Members who wish to receive emails must join the group by selecting "join group" on the group home page: http://www.oasis-open.org/apps/org/workgroup/oasis-charter-discuss/. Employees of organizational members do not require primary representative approval to subscribe to the oasis-charter-discuss e-mail.

This call for comment is also available as a Google Doc. See https://docs.google.com/document/d/1AfMM2Hoyu5fsVJ8VUhZf8uwTTq-cK_1YAX0qcqOGQDc/. Comments and suggestions may be left on that document.

Comments received will be reviewed by the proposers and a log of the comments and their resolution will be posted to oasis-charter-discuss mailing list before the telephone call with the convener.

A telephone conference will be held among the Convener, the OASIS TC Administrator, and those proposers who wish to attend no more than four days after the comment period closes. The announcement and call-in information will be noted on the OASIS Charter Discuss Group Calendar.

We encourage member comment and ask that you note the name of the proposed TC (BCP) in the subject line of your email message. Comments received will be reviewed by the proposers and a log of the comments and their resolution will be posted to oasis-charter-discuss mailing list before the telephone call with the convener.

If you wish to be listed as a co-proposer in the Call for Participation, please contact the convener Bret Jordan, bret_jordan@symantec.com, Symantec Corporation. For representatives of OASIS organizational members, a statement of support from their Primary Representative will be required. 

---

Section 1: TC Charter

(1)(a) Name of the TC

OASIS Best Current Practices (BCP) Technical Committee

(1)(b) Statement of Purpose

This technical committee will produce best current practice (BCP) documents to help with all aspects of managing and maintaining technical committees and their work products inside and outside of OASIS.

These documents will not be defined as OASIS Policy documents, but rather as best practices that a TC may voluntarily elect to adopt and may voluntarily then claim conformance to. 

As these documents will be produced by a TC in OASIS, they can be referenced and used by other organizations outside of OASIS.

Business Benefits 

Organizations join standards developing organizations (SDOs) like OASIS and participate in the development of open standards to solve business problems. When SDOs lacksufficient best practices, organizations can potentially waste a lot of time trying to address overhead efficiencies, rather than spending the time doing the work that solves their target business problems.

The OASIS standards development organization has defined high level policy documents that govern how technical committees should work. However, these documents do not define or explain many of the day-to-day details that most TC need. As such most technical committees in OASIS are required to figure out day-to-day operations themselves. This leads to variability between technical committees and proves to waste a lot of time. In somecases this also includes different TCs creating similar but different best practices. For example, TCs often create and circulate their minutes differently, making it difficult for users to find minutes for each TC following a consistent search approach.

The idea behind this technical committee is to enable the members of the OASIS community to define and produce best practices that others in OASIS can use. 

Historically some of this was written by the OASIS TAB, however, it is felt that as a member run organization the members should have a direct say in the best practices that are created, and have the opportunity to create those documents. By providing the recommended procedures for how to do specific tasks, these documents would help get new TCs operating efficiently faster and help them avoid common pitfalls. One example of a BCP that could help new TCs is "roster maintenance". 

(1)(c) Scope

This technical committee will produce best current practice documents to help with all aspects of managing and maintaining a technical committee and its work products. 

This TC will limit its scope to proposals addressing gaps identified in the TC Process and addressing tasks not covered by the TC Process. Some BCPs may be submitted to the Board Process Committee for formal adoption as policy.

The BCPs that this TC will create can help ensure that technical committees and their work products are managed and maintained in a consistent manner. 

All BCPs that are created must comply with OASIS Policy and must not encourage practices that violate OASIS Policy.

It is possible that that this TC may produce multiple different BCPs for a single topic.Obviously the goal is to produce a single best practice document, however, we understand early on that some TCs may have radically different sets of requirements. Even if there are multiple BCPs for a single topic, at least they would all be documented in a single repository and could be easily referenced.  

(1)(d) Deliverables

This technical committee will produce best current practice documents to help with all aspects of managing and maintaining a technical committee and its work products. This can include, but is not limited to, the following initial list of potential BCPs:

* How to manage voting rights across multiple meeting due to time zones
* Guidance for holding Face-to-Face Meetings 
* Guidance for holding a plugfest or hackathon 
* How to conduct OASIS business exclusively over email 
* Accepting and tracking new work items
* Using Google Docs for document collaboration 
* Using Git for document collaboration
* Using Markdown for document content regardless of collaboration tool
* Responsibilities of a TC or Subcommittee Chair 
* Responsibilities of an Editor
* Gaining consensus and dealing with contentious issues
* Distributing leadership responsibilities and holding reelections 
* Writing a conformance section
* Writing a security considerations section
* Writing a privacy considerations section

(1)(e) IPR Mode

Non-Assertion

(1)(f) Audience

All members of the OASIS community including contributors, editors, chairs, OASIS TAB members, OASIS staff, and OASIS Board members that are interested in helping improve the operational aspects of all technical committees at OASIS.

(1)(g) Language

English

(Optional References for Section 1)

N/A


Section 2: Additional Information

(2)(a) Identification of Similar Work

Many SDOs have or produce best current practice documents. Some of these documents may be referenced or used as a baseline.

(2)(b) First TC Meeting

The first meeting will be held by teleconference on Wednesday, 17 December 2019, at 11:00 AM US Eastern. Symantec Corporation will host the call.

(2)(c) Ongoing Meeting Schedule

Other than a kick off meeting (meeting #2 that will be one month after the formation meeting), this technical committee may hold quarterly meetings as needed, to review contributions that can not be reviewed over email. It is expected that all work will be done electronically over email.

(2)(d) TC Proposers

* Duncan Sparrell, duncan@sfractal.com,sFractal Consulting, LLC.

* Bret Jordan, bret_jordan@symantec.com, Symantec Corporation.

* Jane Ginn, jg@ctin.us, Cyber Threat Intelligence Network, Inc.

* Ryan Hohimer. ryan.hohimer@darklight.ai,DarkLight

* Justin Stewart, jstewart@lookingglasscyber.com,LookingGlass Cyber Solutions, Inc.

(2)(e) Primary Representatives' Support 

I, Duncan Sparrell (duncan@sfractal.com) assFractal Consulting’s Primary Representative to OASIS, confirm our support for the OASIS Best Current Practices Technical Committee (BCP TC) charter and my participation.

I, Bret Jordan (bret_jordan@symantec.com) as Symantec Corporation's Primary Representative to OASIS, confirm our support for the OASIS Best Current Practices Technical Committee (BCP TC) charter and our participation. 

I, Jane Ginn (jg@ctin.us) as Cyber Threat Intelligence Network’s Primary Representative to OASIS, confirm our support for the OASIS Best Current Practices Technical Committee (BCP TC) charter and our participation. 

I, Ryan Hohimer (ryan.hohimer@darklight.ai) asDarkLight’s Primary Representative to OASIS, confirm our support for the OASIS Best Current Practices Technical Committee (BCP TC) charter and our participation.

I, Allan Thomson (athomson@lookingglasscyber.com) as aLookingGlass Cyber Solutions, Inc. Primary Representative to OASIS, confirm our support for the OASIS Best Current Practices Technical Committee (BCP TC) charter and our participation.

(2)(f) TC Convener

Bret Jordan, bret_jordan@symantec.com, Symantec Corporation.

(2)(g) Anticipated Contributions

N/A

(2)(h) FAQ Document

N/A

(2)(i) Work Product Titles and Acronyms

BCP

 

-- 

/chet 
----------------

Chet Ensign

Chief Technical Community Steward
OASIS: Advancing open source & open standards for the information society
http://www.oasis-open.org

Mobile: +1 201-341-1393 

<BCP TC Charter Comments 2019-11-09.docx>
---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that 
generates this mail. Follow this link to all your TCs in OASIS at:
https://clicktime.symantec.com/33SbA1Ntd1FyabxaZ7pZ2JW7Vc?u=https%3A%2F%2Fwww.oasis-open.org%2Fapps%2Forg%2Fworkgroup%2Fportal%2Fmy_workgroups.php