alpha-omega icon indicating copy to clipboard operation
alpha-omega copied to clipboard

engagements/2023/jquery/README.md: Unclear purpose (introduction)

Open Chealer opened this issue 1 year ago • 2 comments

The README file about the jQuery engagement starts with an introduction:

The purpose of this Alpha engagement is to provide security resources to the jQuery project in key areas, including:

  • Secure the consumer web
  • Reduce potential security incidents for jQuery by modernizing its consumers and its code
  • Conduct an ecosystem security risk audit
  • Modernize infrastructure
  • Web Modernization Campaign

Please clarify what the following fragments mean:

  1. "the consumer web"
  2. "its consumers"
  3. "Conduct an ecosystem security risk audit"
  4. "Web Modernization Campaign"
By the way There is a typo ("Janurary") in the first item of the _Monthly Updates_ section.

Chealer avatar Apr 02 '24 12:04 Chealer

On the ask for more information here, this is content from the OpenJS Foundation (jQuery) and we should follow up with them for clarity if available.

My belief of each item is:

  • Consumer web - websites consuming jQuery files.
  • its consumers - part of the phrase 'modernizing its consumers'. In this context I feel they're talking about other projects depending on them; which shows the lack of clarity caused by using the same term if the meanings are indeed different.
  • Conduct an ecosystem security risk audit - Referenced in 2023-03 https://github.com/ossf/alpha-omega/blob/main/alpha/engagements/2023/jquery/update-2023-03.md#2-ecosystem-risk-audit - this was a first stage of the web modernization campaign; I'm reading it as measuring the modernization status due to 2023-06's "IDC presented the final survey results readout for the jQuery and foundation team. The team will be taking this information and packaging it up for communications content for the Web Modernization Campaign."
  • Web Modernization Campaign - a marketing campaign they described in their 2023-03 report as "Plan to build a sustainable model to reduce the footprint of legacy jQuery code through an integrated communications campaign." - https://github.com/ossf/alpha-omega/blob/main/alpha/engagements/2023/jquery/update-2023-03.md#2-web-modernization-campaign

hyandell avatar Jul 09 '24 15:07 hyandell

Thank you @hyandell If you're correct about #1, this should be phrased much more precisely. Regarding #3 and #4, you are visibly right, but it is very hard to guess that. Either the labels should be more precise, or they should link to details. For #3, it should be clarified which ecosystem is referred to. For #4, even the details are quite unclear (what does reducing "the footprint of legacy jQuery code" mean?).

Chealer avatar Jul 14 '24 18:07 Chealer