CIRCLE WITH A DOT

@gnomon @Gina

so one idea we've been working on for determining the split in contributions;

1. host a kaggle sort of data science competition where people predict the value of each dependency in an SBOM

2. collect ground truth data from maintainers for a subset

3. model with least error score gets its weights across entire SBOM

Deep Funding GG24 Web3 Tooling and Infra Round

GG24 Deep Funding Round Update The GG24 Dev Tooling and Web3 Infra Round approved $350,000 for allocation via deep funding, with Devansh Mehta, Clement Lesaege, Allan Niemerg as round operators and Conor Svenson & Andrew…

Gitcoin Governance (gov.gitcoin.co)

(not the EFer OP refers to, but i work on funding mechanisms there)

@BenDoubleU another issue is also generating accurate SBOMs, as ive found with my work on deep funding (assigning weights to an open source dependency graph)

the 2 key issues were;

1. too many irrelevant dependencies that maintainers dont see valuable

2. some of the key dependencies not being in the SBOM

we actually had to go through 3 iterations before coming up with a proper dependency graph

(not the EF employee OP refers to, but i do work there)

@slink @Gina @ethereumfoundation

Not the EF person OP is referring to, but i think you're alluding to the idea of credibly neutral funding mechanisms! my specific area of work actually. they are basically recommendation algorithms deciding on the value of different contributions

here's the reference you may have seen. still an open question how they can be fair, but it solves a genuine issue of low overhead becoz otherwise consultants like deloitte decide allocation

Credible Neutrality As A Guiding Principle

When building mechanisms that decide high-stakes outcomes, it’s important for those mechanisms to be credibly neutral.

(balajis.com)

@projectmoon @Gina @ethereumfoundation

Im not the one that spoke to OP, but broadly blockchains help in price discovery which can be applied to getting weights across a large dependency graph

for example check out deep.seer.pm where we're trying to distribute $350k across 98 repos and their 3,677 dependencies

there's a genuine need for low overhead in weights to SBOM, unless you prefer government consultants like deloitte deciding how valuable dependencies are?