Attending: Eriol, Chelsea, Bernard, Fredrik, Dan, Rosy, Chris Zubak-Skees
Apologies: Allan, Karl (maybe),
Agenda
-
Anyone needs any specific time to discuss ongoing work?
-
Add here
-
Intros (if any new folks)
- We did mini updates on new things we’ve learned or done lately including, India payments, healthcare, open source servers, boat repair, fish care, Parent park comms, smokeless incense.
- Review what’s changed/completed in the past month
(See new releases: Releases · HyphaApp/hypha · GitHub)
-
Frederik notes that only 2 releases have been done, given finance and compliance work for OTF. Fixed some date widgets in Wagtail. Sidebar detail view is now ordered a bit differently. Have limited tokens to only access public API. More work is needed for “headless” authentication. Vendors can set up bank accounts, so staff can review/ask for corrections and coordinate with finance team and financial system.
-
Grateful for Chris’s fixes
Review of work expected to happen in the coming month
-
Dev
-
Security issues
-
Public issues: [META/EPIC] Security Audit recommendations from Aug 2021 · Issue #2642 · HyphaApp/hypha · GitHub
-
Private issues (potentially exploitable:https://github.com/HyphaApp/hypha-issues/issues)
-
See a mini burndown of completed issues in the we.hypha post:https://we.hypha.app/t/penetration-test-report-from-radically-open-security/140/8 (locked to security role in the forum adopters maintainers should have access)
-
examples of work: 2-factor authentication, requiring PW to make changes. Now this work is urgent, then finance and compliance work.
-
Finance work (OTF)
-
Next step: contracting and contract workflow. Approval form where staff can add needed info. Aims to be flexible, to work with both large and small orgs.
-
Design
-
Compliance work, PAF (OTF)
-
Working on making compliance steps flexible for different size orgs.
-
Trying to learn more about OS docu-sign, as some folks only want to
-
ACTION: put Chris Smith (G1FEF) in touch with Frederik and Bernard (Rosy)
-
Files tab: [Files tab spike]: what does the files tab need to do for users · Issue #2634 · HyphaApp/hypha · GitHub (waiting on OTF prioritisation)
-
Things like contracts will go here!
-
Reporting (connected to PM updates): Miro | Online Whiteboard for Visual Collaboration & Reporting functionality: Discussion and clarity - #14 by eriol
-
Got feedback re: “boring video” that the concept works
-
PM
-
Reporting feature feasibility scoping started and located here: Feasibility Review Template - M&E and Reporting - Adopters Nov & Dec 2021 - Google Sheets: Feasibility Review Template - M&E and Reporting - Adopters Nov & Dec 2021 & Jan 2022 - Google Sheets
-
Waiting on some comments from Allen re: DDP’s perspective on reporting, ideally to be received by the end of the week.
-
Eriol, Frederik, and Bernard did some feasibility scoping (linked above). Eriol shares screen to go through list.
-
Next stage of spreadsheet: need to get some questions answered from adopters.
-
Rosy asks about answering questions - how to share answers? Eriol recommends starting with comments in the doc and then moving to larger conversation if needed.
-
Submitting issues
-
how it currently happens and how it could be changed
-
Wishlist issue process pitch - mini demo
-
Reporting bugs
-
proposal to use marker.io: a browser plugin that allows the reporting of a bug/issue directly from user’s browser by creating video/audio
-
This saves the need to use github
-
Docs
-
Organizational changes - user-based instead of task-based, check it out here: https://docs.hypha.app/
-
Populating blank pages - please @ Emily (in we.hypha.app) with suggestions for pages you’d like to see
-
Soliciting contributors (add content to pages!) or testers (read documentation and see if you can achieve the goal laid out in the doc, give feedback on content/structure of individual pages)
-
Adopters
-
opportunity for them to talk about anything Hypha-related they’re working on this month.
-
No updates this month
Review new challenges/insights/issues identified
-
@allan might take us through DDP’s grant workflow if he is available - In 2022 we’ll catch up with Allan
-
Let’s talk about what Adopters want to happen with security audit details: https://we.hypha.app/t/penetration-test-report-from-radically-open-security/140
-
If security issues are found after a security audit, there needs to be a “period of quietness” during which critical fixes (i.e. can be used to exploit Hypha instances) are made. Proposal is 6 weeks.
-
During this 6 weeks the issues are fixes and adopters are updated on progress.
-
How long post-core implementation of recommendations do Adopters want to ensure their security is good, parity etc.?
-
most recent audit here: https://www.hypha.app/reports/Radically_Open_Security_2021_Hypha.pdf
-
What level of openness of publication of the security audit do Adopters want? https://we.hypha.app/t/penetration-test-report-from-radically-open-security/140/5
-
API for open calls - public & private quick update and call for future conversations (API for open calls - tokens, access and how adopters want to discuss): API for open calls - tokens, access and how adopters want to discuss
What else do folks want to discuss? Reply with agenda items!
-
Documentation: Adopter preference question & configuration method
-
Do any adopters want Reviewers to be able to contact applicants directly, within Hypha or outside of it, like via email (or conversely, want Reviewers not to see applicant info/be able to contact applicant)?
-
Not an existing functionality
-
From fredrik, not something that any adopters have wanted
-
Is it (it being showing applicant email to reviewers, and/or allowing reviewer-applicant communication within Hypha) a customizable setting?
-
“being showing applicant email to reviewers”
-
Not currently available
-
Fredrik: discussion about making some fields viewable by Hypha users with the correct permissions
-
“allowing reviewer-applicant communication within Hypha”
-
open an issue
-
allowing/disallow reviewers to comment on applications - Per role- on particular applications etc. Reviewer role has not comment posting permission.
-
AP: Eriol can ask Allan if they implemented on the FE removal of some PII fields to be more unbiased in selection.
-
@bernard says there is a way for applicants to not be visible to reviewers, but doesn’t remember how/where it’s done.
-
@dluong, do you remember whether this is the case? And if so, how we do it? < Di responded in the Doc WG we.hypha post: API for open calls - tokens, access and how adopters want to discuss
-
Hypha Summit 2022 - wanted or not wanted? - Pushed to next adopters call
-
Who pays/how do we pay for a summit?
-
How long and what topics? e.g. Governance, Upstream/Downstream processes if and when deployments of Hypha are not updated through the main repo, Stakeholder agreements. Example: Community Pledge v2 - January 2020 - Governance - Open Food Network Community