Level 3: Developing in Public

[robmoffat]

Feature Request

Description of Problem:

Describe best practices around maintaining / developing open source projects (over and above mere contribution of bug fixes).

Also include vulnerability disclosure and outbound security.

[pholleran]

@robmoffat - I started stubbing out this issue as a new document, but quickly noticed a number of existing stubs that seem to overlap the content.

• docs\bok\Activities\Level-3\Public-Development.md seems to be a placeholder for general good practices for participating in a public forum.
• docs\bok\Activities\Level-4\Outbound-Security.md appears ready to talk about security disclosure processes
• docs\bok\Activities\Level-4\Open-Sourcing-A-Project.md looks like a good spot to talk about good public practice around ensuring things like a disclosure process, contributor engagement automation, and such are in place (and/or link to other articles in the BOK covering maintainership, incubation, etc.)

There may be a place for some separate discussion about good communication practices (code reviews, PR authoring, general communication tone and suggestions, etc.), though I'm not sure if it warrants an entire article.

My inclination, as of now, is to build out existing docs over authoring a new one. What do you and the group think?

[robmoffat]

Hi @pholleran ,

Yes that's right - the stubs are there for you to expand on. They're labelled with "THIS IS A PLACEHOLDER" at the top to indicate that no one has seriously thought about the content yet. I've updated the title of this issue to say "Level 3:" because as you point out, that main "Public Development" article placeholder is in Level 3.

There may be a place for some separate discussion about good communication practices (code reviews, PR authoring, general communication tone and suggestions, etc.), though I'm not sure if it warrants an entire article.

Yes, I would say all that's in scope for that article. Remember, if you can find pre-existing (GitHub, perhaps?) authored materials then just link it - we shouldn't try to reinvent the wheel.