Open source project data is not open data

@GeorgLink @GeorgLink Open source project data is not open data
Georg Link SCALE 18x 6pm, room 104 March 5-8, 2020, Pasadena, CA

@GeorgLink @GeorgLink Today’s Topic: Analyzing Communities • Legal Challenges •
Technical Challenges • Metric Best Practices

@GeorgLink @GeorgLink About Georg Link Omaha, NE Ph.D. on Open
Source Metrics Cofounder of CHAOSS Project Bitergia

@GeorgLink I am not the expert

@GeorgLink Thought Experiment: Contributor Imagine you are an open source
contributor. You engage in an open source community to get work done (or other reasons). How would you react to the following scenarios? • The community creates contributor proﬁles that show how much everyone contributed. • The community regularly recognizes the most active contributors. • A dashboard shows how the level of contributions evolves over time to show how strong the community is.

@GeorgLink Thought Experiment: Company Now imagine you work at a
company and developed a piece of software. Your company agrees to your proposal to open source the software but requires you to show the impact that this has for the company. How would you approach the following: • Ensure that a vibrant community forms around the software project. • Identify areas that need attention in the project. • Report progress to your manager.

@GeorgLink The role of Data In the thought experiments: What
data did we talk about? Who were the data producers? Who were the data users?

@GeorgLink The role of Data In the thought experiments: What
was the relationship between data, its producers, and its users?

@GeorgLink Community Data as Trace Data Created accidentally Contributions and
their metadata Metadata typically has no license Contains personal identiﬁable information (PII) like names and emails

@GeorgLink Is community data open data? Open data is data
that can be freely used, re-used and redistributed by anyone - subject only, at most, to the requirement to attribute and sharealike. -- https://opendatahandbook.org/

@GeorgLink @GeorgLink Legal Challenges

@GeorgLink General Data Protection Regulation (GDPR) https://gdpr-info.eu/

@GeorgLink A gist of GDPR Art 4. (1) ‘personal data’
means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

@GeorgLink A gist of GDPR Art 4. (2) ‘processing’ means
any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

@GeorgLink A gist of GDPR Art 4. (7) ‘controller’ means
the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the speciﬁc criteria for its nomination may be provided for by Union or Member State law;

@GeorgLink A gist of GDPR Art 4. (11) ‘consent’ of
the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

@GeorgLink GDPR: Rights of the data subject (Chapter 3 excerpt)
Section 1 -- Transparency and modalities Section 2 -- Information and access to personal data Section 3 -- Rectiﬁcation and erasure • “Right to be forgotten” • Restriction of Processing • Notiﬁcation obligation

@GeorgLink GDPR grey area: Open Source Was created for business
and government organizations that collect data. Open source communities collect data for their own purpose, but not in the same sense that organizations do. Personal data is freely given to an open source project.

@GeorgLink Prior Informed Consent in Open Source GDPR is agnostic
to the fact that data is already public! Two options for consent: • OPT-IN ◦ safe option • OPT-OUT ◦ requires demonstrating “legitimate interest”

@GeorgLink What we need to do Inform community members before
processing data • How can we reach all community members and document that you informed them? Obtain consent • Provide means to OPT-IN or OPT-OUT

@GeorgLink CCPA: California Consumer Privacy Act 1798.140. (c) “business” means:
... • An open source project may not qualify as a business

@GeorgLink Inform community before processing data Demonstrate “legitimate interest” Provide
OPT-IN or OPT-OUT Be transparent and communicative Recap: Legal Challenges

@GeorgLink @GeorgLink Technical Challenges

@GeorgLink Where is the data? Where is the community? Git
GitHub GitLab BitBucket Jira Gerrit Conﬂuence … Wiki Discourse Mailing List IRC Slack Meetup.com StackOverﬂow …

@GeorgLink @GeorgLink How to get the data Extract: • Get
data from data sources Transform: • Unify data • Manage identities • Calculate metrics Load: • Visualize

@GeorgLink Extracting data Easiest step Query logs Use APIs Challenge:
Changing APIs and data formats

@GeorgLink Transforming data Unify data • Date formats • Level
of detail • Metadata about different contributions • Convert everything into the desired database structure Manage identities Calculate metrics

@GeorgLink Transforming data Unify data Manage identities • Who is
who in the community • Who do contributors work for (now and before) • Different usernames and email • Assigning contributions to the correct person Calculate metrics

@GeorgLink Transforming data Unify data Manage identities Calculate metrics •
Primary metrics - summarizing original data • Secondary metrics ◦ Calculation from different data ﬁelds ◦ Combining data from different data sources ◦ Value judgements on data - e.g., quality models

@GeorgLink Loading data Who is the data user? How should
the data be presented? What visualizations are most meaningful? What story does the data tell?

@GeorgLink @GeorgLink Technical Solutions

@GeorgLink Software solutions CHAOSS GrimoireLab CHAOSS Augur Apache Kibble CNCF
DevStats GrimoireLab

@GeorgLink GrimoireLab Tools for Each Challenge Transform Extract Load Manage
Identities GrimoireLab

@GeorgLink Extract with GrimoireLab Tool: Perceval GrimoireLab

@GeorgLink Transform with GrimoireLab Tool: GrimoireELK • Unify data •
Calculate metrics GrimoireLab

@GeorgLink Transform with GrimoireLab Tool: SortingHat • Manage identities GrimoireLab

@GeorgLink Load with GrimoireLab Tool: Kibiter (Kibana) GrimoireLab

@GeorgLink GrimoireLab

@GeorgLink @GeorgLink Too complicated? Try Cauldron.io

@GeorgLink Cauldron.io

@GeorgLink Cauldron.io 1 2

@GeorgLink gitlab.com/jsmanrique/cauldron-dashboards CHAOSS metrics Prebuilt dashboard

@GeorgLink https://community.cauldron.io/c/docs Best place to ﬁnd help with getting started

@GeorgLink @GeorgLink Metric Best Practices

@GeorgLink About CHAOSS Short for: Community Health Analytics Open Source
Software Linux Foundation project Started in 2017 Focused on “creating analytics and metrics to help deﬁne community health” -- https://chaoss.community

@GeorgLink The Idea Behind CHAOSS Metrics Software

@GeorgLink Deﬁning Metrics in CHAOSS 5 Working Groups: • Common
Metrics • Diversity and Inclusion • Evolution • Risk • Value https://chaoss.community/metrics

@GeorgLink Goal-Question-Metric Approach Goal Question Question Metric Metric Metric Metric

@GeorgLink Metric Best Practices Follow Goal-Question-Metric approach Use metrics to
tell a story Evaluate the usefulness of metric strategy Minimize gaming of metrics Start small and “get off zero”

@GeorgLink @GeorgLink Recap Legal Challenges Technical Challenges Metric Best Practices

@GeorgLink @GeorgLink LinkedIn/GitHub/Twitter @georglink Email [email protected] Q&A

Open source project data is not open data

Open source project data is not open data

More Decks by Bitergia

Other Decks in Technology

Featured

Transcript