 Hello, it's Rachel Larson here again from the Drupal Association and today I've managed to bring back some of the initiative leads from the automated updates strategic initiative team. So today we have David we have Ted and we have Tim with us. So welcome everyone thank you for coming back. Thanks for having us again. Thanks very much. Thank you. So, I wanted to ask a few questions about what you know what's been going on and someone with automated updates and I thought I'd start off with a really easy one so we've all had a few weeks after Drupal come now which was pretty intense. And I know what have you been up to since then. Ted. Yeah, we've been, we finished some issues from the contribution day we got some people involved so that sort of led to some work in the week or two after that. Actually, we found like a really good sort of sort of security related I mean I guess with automatic updates everything security related but the issue somebody pointed out on contribution days so we were working on that and yeah just sort of pushing, pushing forward on their core stuff and the libraries. It was good to get people involved in the competition day. Yeah, that's good. I think, you know, after taking a long weekend post con to chill out a little bit and recharge the batteries the other thing that was really big is, you know, the announcement of the new initiative for the project browser at Drupal con was a really big deal. And, you know, trees have mentioned that the work for the auto updates initiative is doing place and groundwork for that. So, for myself, I had a lot of folks chiming in asking about that project browser initiative and, you know, how what we're doing in auto updates affects the composer side of all that kind of stuff so there was a nice little opportunity to cross pollinate with a new initiative getting started. Yeah. Okay, so you talk about Drupal, Drupal con that we changed quite a lot at Drupal con North America this year we you know we changed it so that everything was far more focused on the strategic initiatives that we selected, including automated services, I'm really bringing them into focus. Now, what was it like for you, leading a strategic initiative to have to organize a keynote two sessions throughout the day. Be there to help organize the contributions in the afternoon or everything that was quite a big deal that you went through to do that. And what was the experience like, Tim. Yeah, let me start from kind of the overview. I mean, first of all, I think big kudos to Ted who did a lot of the actual groundwork in terms of building the keynote and, and doing some of the key session selection all the things that you described I think, some folks of us involved Ted did a large chunk of those, but stepping back a little bit, you know, the, the main thing I observed is that it's a lot of work. And we knew that going in, but it's a huge amount of work for, for everybody involved. So the worry was, is this going to distract from executing on the initiative from the time we would spend just getting things done. And you know maybe that's true to a certain extent, but the value of getting organized and actually doing that issue triage to see where we are and what needs contribution next. And, you know, getting ready for recruitment, I think was really high. I mean I think it's super helpful to be able to communicate with folks. And to be able to create a way to where things are and to have things available for people to chime in and help us work on so I'd love to do it again, but I would think that we could expand further into, you know, recruiting a Drupal con project manager or something to help all of us out for the initiative on top of our mentoring partner and everyone else who joined in so might help us out a little bit. I don't know what did you think Ted. I think it was interesting to have the keynote, which was sort of very general but not really assuming much like technical knowledge and then have a separate session for the technical stuff which the people who are involved in the various parts of the initiative, you know, sort of spoke to where if people did want because a lot of people obviously aren't. They're not interested in auto updates but they don't really, if they're not going to work on it. They're maybe not interested in the real details. So it was good to have a separate session for the like why and then the how details. So it was, and I think it was also good to have sort of everybody involved in helping with the slides for both of those sessions so that we could sort of be accurate the people involved or are updating them but also so that if you're not involved in that particular section, even if you're in the initiative, sort of seeing the slides keeps you update with where the state of everything is. Yeah, I think that's a good point it's a nice chance to like take the take the blinders off for a minute and look at the big picture again, which is something that actually you kind of run away from when you get laser focused on a specific part of the initiative. David you also invited the sort of PHP tough team. The top team. Sorry, excuse me the top team since we're the PHP tough team. Could you could you speak to that a little bit it turned out to be a really good opportunity. We're working on similar challenges in the sense of how do you manage trust with modern encryption portable implementations of this sort of infrastructure, and be and have infrastructure that is designed to support incremental improvement and increase in the trust in the sense that a lot of infrastructures sort of involve you committing from day one of exactly what scale of trust, you're going to be able to support with that infrastructure. One of the things that has always impressed me about tough is that we can do everything from supporting the last mile of trust to provide compatibility to to broad versions of PHP and web hosts that may or may not be fully up to date in their own internal infrastructure for things like like open SSL and certificate authorities, but we can also stretch that all the way back to development if we want to in the sense that once tough as deployed, we could even be assigning things like possibly Drupal releases themselves before their pack as their package before they're even uploaded to infrastructure. And the and the design of tough supports mirroring really effectively, and means that we actually can validate our implementation against a different reference implementation. So before you're dealing with security sensitive topics. It's good to have additional eyeballs on it. A design that's actually been vetted by a lot of people in the sense that we're mostly worried about security issues in the gap between the spec and our implementation, not also in the spec itself. This takes a good number of risks off of Drupal's plate in terms of this and honestly, it's just been a pleasure working with them. Like they're just like they've been really courteous and providing assistance pointing out any deficiencies from their perspective and our implementation or common pitfalls. They've also been responsive to our needs on the project like when I was setting up the testing infrastructure and wanting to have that work terministically, it actually required some advice and possibly some changes even upstream and and they're actually pretty sympathetic to these needs. So, and on their side they actually get the benefit of another implementation of a spec. I believe this is the third implementation. And if anyone has had heard the like rule of thumb about specs, like, it's not a real spec until you've implemented it three times. There's the reference in in Python, the second one and go and then this one in PHP now. Well, I've never heard that before, but it's like it makes sense. Yeah. Yeah, absolutely. I've learned something new already. So, you went through this experience. Concentrated time. Did that experience change anything about the initiative direction? Is that the same as before? Did you gain input from people you didn't expect or maybe even brought in some new team members? I don't know. David, anything come up your mind makes you think. Well, there's, there's a lot of opportunities for initiatives at Drupal con beyond just sharing sort of status updates and an overall perspective on where things are at. I think Drupal con is best seen as a bi directional experience for initiatives in the sense that it's a chance to interact with the community, a chance to interact with other stakeholders, especially ones that are not directly involved with the implementation of it, which are really the stakeholders to consider because the people who are implementing this, this sort of integration with composer actually don't overlap necessarily a ton with people deploying Drupal in situations that are going to most benefit from auto updates, because we're trying to target the long tail of deployments. It's also an opportunity for us to onboard potential contributors because sometimes there's a noticeable barrier to entry of actually getting some things done. So it wants to show up to try and get something done, and then run into a blocker and not really and sort of be lost on that or have to wait days to have it unblocked because the enthusiasm has dissipated by that point. That's when that sort of situation happens so it can be great to have an opportunity where you're not you don't just have sort of entry level issues that are intended to provide an honor amp into the project, but actually, the project team around is ready to catalyze getting past them so that someone feels productive and appreciated and like, there's also no nothing like the nothing quite as neat as the feeling of having your first contribution to a project integrated because it's, it's sort of like you've gone through the whole cycle at that point. The, it's, it provides a lot of confidence and being able to make other changes and contribute other ways. Yeah, I would say there's only one thing better than watching that first contribution get get get used, and that's mentoring someone to get in that first contribution implemented because that is incredible I've got to say. I was watching this video from, I believe a video game designer on what he likes about playing games, especially ones that you can only play once because they provide that first unique experience, but he also said like the second best experience is to watch someone else have that first experience. It's really true. I think you know speaking of some specific things what one of the things that's really cool is I think we have maybe 40 new people who joined the auto updates channel in Drupal Slack to follow along faulty. Yeah, you know they're not all people who are actively contributing but they jumped into the channel at least just to stay and stay, you know, abreast of what's going on. It's really really good. We also had a great meeting about the UX of the auto update system that followed Drupal Khan, which was really a key feature because we've got a lot of very dev oriented folks but this is a feature that needs to be really transparent and easy to use in order to get the option that's important to it so no those were some some really good outcomes. It's funny you should say that people coming into the channel and just kind of watching because I've just come from another webinar a few moments ago about open social and what we were talking there about was how we noticed in some of the introduction sessions we had quite a few people who were acting simply as flies on the wall, they were just watching what was going on. And that's great that we were able to facilitate that because it gives us an opportunity, it means that some people can come along, not necessarily be active but just see what's going on. And maybe next time or maybe the time after that they will then become the active person. So we're giving them a much smoother on ramp, which is really interesting actually things that I hadn't thought of before we got involved in Drupal Khan I'm really pleased. So I should move on a little bit so looking into the future. What's, what's next for automated updates. Anything on your mind Ted. Yeah, so since Drupal Khan we got the security advisor highly critical security advisories notifications inside Drupal core. So now if there's a really not like every advisory but if there's a really highly critical one that comes around inside there will be notified to say, hey, you know, there'll be something coming up very soon, or there's a, you know, highly critical security lease for something that you have installed that you should do right now. And we're working on a follow up to that to make have the email notifications. We've been working a lot on the PHP tough library. And we have it sort of getting it to the latest version of their, their spec specification and working on a lot of testing for different kinds of attacks. Basically, you know, we, we don't want to just make sure it works if everything's okay we want to make sure you know if, if, if something goes wrong that you're notified and you don't you don't actually try to update so there's been a lot of progress on that. We'll have the readiness checkers which will be the first thing hopefully to get into core for automatic updates, and that's pretty far along and after that we'll have that's just sort of the API for that but after that patch gets in the merger quest. And then we'll have all the different like checkers like is your composer Jason not hack do you have file permissions so will be a lot of sort of smaller issues after that one's in that people can help out with and a lot of that will be moving the work from the contrib module to core. So yeah, a lot of good progress some stuff actually got into core and yeah, it's been good. And if people are wanting to watch out for those opportunities. Where can they watch out for them. So, on the Drupal core issue q if there if you look for issues tag with automatic updates initiative right now there's not an automatic updates module because that first thing is not in once that's in you'll, you can filter by the automatic it's module but before then I'll look for that tag or if you go to our GitHub. PHP tough PHP dash tough organization there's three active libraries there and you can sort of jump in and look at the issues there. And of course the pound auto updates on Drupal Slack. And we have the bi weekly meeting which I think the next one is next Tuesday. So if people want to come I don't actually know the time but you don't have to show up right then you can sort of see it after the fact to. Yeah it's an async protest text based meeting like many of the other initiatives. So you can join whenever make sense and and just chime in on the topics that are important to you. Right, well that's wonderful. So we'll finish with a question that I've been asking all of the different initiative teams. Which is, if we had another initiative focused contribution event into the future. Which initiative, either a current one, or a new one that you've just thought of. Would you like to see us focus on. This is such a good question. Obviously the project browser because it because it really relates here but also I think if there was sort of meta but like a sort of initiative to make it and I think in the trees know it went over this a lot like. Initiative to make it easier to contribute to contribute you know. And a lot of that the DA is doing, but I think there's a lot of room for a lot of people to help, whether it's like documentation just to be like okay where do you start. So, I think that would be interesting. I love that idea. And I think, you know, going together with that. If we had this. I don't know what we call it the contribution initiative with the initiative initiative, like, you know, having something where we could recruit more folks to support the mentor team recruit folks to do what I was talking about earlier in terms of like helping project manage the contribution event for an initiative. So I expand the, you know, all of the teams that that presented at the last year upon did some awesome things and I think, taking those and standardizing them and documenting them it would be really really cool. Yeah, I think that's awesome. I can't just write on Ted's coattails what else would I would I try and add as a new initiative. I think it would be interesting to see almost a new version. It's not exactly a new version of the decoupled initiative but a almost like a speculative speculative fiction initiative about what could Drupal do in with, you know, 10 years from now with whatever the next set of digital experiences mean right we've we've just seen people start to do voice integration with Drupal. Yeah, that's one of the very, very early like sort of next gen implementations. It would be cool to have a whole group of people just literally speculating about what do we need to account for in terms of the sci fi future of what Drupal could do. It's been really interesting actually. Yeah. Well, thank you very much. That was really interesting and yet again I've learned something during one of these so I'm happy. I'm just going to keep doing these on those stuff by the end of it. Is there is there still time for me to opine on some initiatives. Yes, absolutely there is. So, I have, I have sort of my my like loftier one and my like very concrete one loftier. I'm actually totally on board with the direction that Dries is is indicating in terms of some of the more like the project selection. The reason why I think that that is a really important one for us to be pushing forward on now is because the plumbing we're adding with auto updates actually provides a really robust package manager for doing interactive changes to a site to install additional modules and their dependencies. And it would be a shame if we only use that for automatic updates. Okay, so I'm, I'm pretty excited about the idea of being able to support a more richer experience in general of being able to install and extend Drupal. That supports that. I also have something I worked on years ago that I would love to see a little initiative done around. I just put the link into the chat for here. It's a project I worked on called light foot, and it move it basically makes CSS and JavaScript aggregation happen on a lazy basis. It uses it does it digitally signs, or actually, I think H max the, the combination that needs to be aggregated, and therefore allows the aggregated content to be assembled on demand at the, at the request of that aggregated content, which means it doesn't have any CSS or JavaScript aggregated files to the file system. And then it caches, it caches the aggregated thing in like a reverse proxy cache or even Drupal's page cache. That's really cool. Yeah, that would be I'm trying to imagine the complexity of that. Yeah. Well, I did it. Actually, the Drupal seven implementation is is actually very dirty, because like the way it basically does you know that sort of thing where like has a hook and then it manipulates the data in it. The Drupal eight implementation is actually fairly clean that I did for it and I suspect it would be fairly clean in nine as well because it basically just changes the handler in a more way. Actually, next steps on here 1234 I actually had Drupal eight core. I haven't touched this since 2017, but it's the sort of thing that I'd love to actually integrate. At some point, I'd love to do it possibly along the same lines as providing a mode for image styles that does not write the disk either, because like what I'd like to see is for all of this derivative content to be cashed in a reverse proxy or CDN layer, which is more consistent with the ways that that people are deploying things today, rather than writing into the file system, especially a network file system then has to be synchronized across the nodes super fast. So this would, it's So yeah, I guess that's my little pet like I guess self contained little technical initiative that I would love to see. Yeah, now, now the more you talk about it, I'm really thinking that we write the things to the desk both image styles, JavaScript CSS, we are really using them as a cash. Yeah, and, and yet we're sat with a frankly better cash nearby. I mean, it completely makes sense now. Now, now I've had a chance to absorb it. Yeah, I like it. Sounds really interesting. Brilliant. Yeah. It's not one that I thought about before. Right. Well, thank you very much. Yeah, and look forward to seeing you in the auto updates channel on Slack for the meetings. And the next time that you're all getting together to push the project forward so thank you very much goodbye. Thanks.