Welcome to Making Security Makes Sense to Users and Clients. My name is Jamie Schmidt. I'm a community evangelist at Sitelock. We are a web security company. I'm a freelance designer and developer. I'm passionate about WordPress and Ripple, and I'm passionate about content also. I'm a proud cat mom in Portland, Oregon. Yes. What we're going to cover today, a list of things here. Securing your own site, why it's important to secure your own site and your client's sites. The benefits for you when you do both of those things, how to communicate the benefits to your clients and users, and explain it to them in a way that they'll not only understand, but in a way that they're going to want you to actually secure their site, including in the project scope, and then we'll go over some security best practices, and then end with adding security in your maintenance program, and then going over some maintenance reporting options. I'm also going to touch a little bit on the GDPR. It's a big topic right now, and it goes into effect next month. So it's something that everybody needs to at least have an idea of what it's all about, even if you're not necessarily directly collecting data. So I just want to talk about why securing your site is a good first step. So securing your own website. You want to own your reputation. Website hack attempts happen every single day, and you're the person that's providing this service. So having familiarity with what is all involved in securing your site, and also having a site that is not hacked is a good thing. It always looks good when your website doesn't show an error message on Google, that the site has been compromised. So you want to go through the process yourself so you know what you're talking about. Having the familiarity with security best practices means that you're not only experienced in that, but that you're going to have first-hand experience to be able to communicate to your clients.   But the clients that have never had it, or if you have never had it, it might be hard to really understand why you need security. Because if your site hasn't been attacked yet, it might feel like it's secure, but that's not necessarily the reason you haven't been hacked. It's just a matter of yet. And then protecting your own business. It's directly related to protecting your reputation. You don't want your business to be compromised. You want any information that you may be storing on there to be compromised. You don't want to have a reputation as the one person in town whose website was compromised when somebody did a Google search. You pretty much only get one chance when they go to your website and looking for website services, and your site has hacking things on it, or it's redirecting to a third-party site. They won't come back. They're going to go to somebody else. There's plenty of website services out there. So you really only get that one chance to have a site that's secure. So making sure that your own site is secure is first step. And then the benefits of securing your client's sites. So I have a little bit of a story of my own experience. And if we're web developers in here, we probably have experiences with various levels of hacking or security compromise. So I had a client last year. I took on an existing WooCommerce site. And when we were talking about her collecting payments, she wanted to move from PayPal I think she was using to something more advanced like Stripe. So we went through what she was currently doing and she mentioned to me on the phone, I couldn't tell this from looking at her site, but she mentioned to me, she said, well, when people buy something on my website, my last developer set it up so that I get email forwarded their credit card numbers and their information. And I was like, oh, you're doing that right now. Okay, we're gonna stop that immediately. So if she hadn't told me, I might not have known that right away. And I might not have known to look because that's not something you assume is happening. Most web developers won't do that. In this situation, either the developer she had wasn't knowledgeable enough to know that that's a bad idea or he was knowledgeable enough that he didn't care. Either way, it indicates that there are probably other things going on with that site than there were. But so it's in your best interest, especially if the site was developed by somebody else because you know what you've done, you don't know unnecessarily what you're inheriting.  They'll come at like Friday at like eight at night. And then you spend the entire weekend fixing something that's hacked.  And it's obviously not convenient to them either. You wanna avoid that situation obviously.     There's a lot of different factors. Some of the things that we go through today are gonna mitigate a lot of those. But the peace of mind that you've done basically everything within your power. We can't force a client to take our services. We can't force them to have security. We can't force them to do anything really. But we can educate them and we can tell them that this is what should be done. We can also say that we don't take projects unless they also have the security in place.  So the benefits of educating clients. Like I said before, clients that haven't had their sites hacked probably don't know or care about security. Or if they already do, that's great. But for the ones that don't, it's sort of our job as developers to work to make the internet safer. We're the ones that have the knowledge. So it's sort of our duty to educate clients and tell them these are the best practices. These are the things that you should be doing. When I build websites, I make sure that I build them in a secure way. So when I was talking to the client that had the emails forwarded to her, I said, I don't do this, we're not doing this. If I'm taking on your site, we're getting rid of this and we're I'm doing an entire security audit of your site before we do anything. Because I don't wanna be, I don't wanna look bad. I don't wanna be liable for anything. I don't want her to lose her business which she easily could have. So just awareness, general awareness, making the internet safer for everybody. So then the question comes down to who is responsible for security? So your client probably thinks that it's either you or the web host. The web host thinks that it's you and the client. And you know the truth that it's really, it's everybody's responsibility. Ultimately, it's the client's responsibility because they're the end point. If information gets compromised, they're the ones that are gonna get sued. In turn, maybe they can sue their host, maybe they can sue you, but they're gonna be the first one that this dropped down on. So ultimately it's them, but you're the developer. So you need to communicate that to them. I needed to tell that client that in the event that somebody were to log into a Google account and see these, the credit cards, her life would pretty much be ruined. She would, she would be over. So I had to flat out say that and say, you need to learn about these things. I'm gonna tell you about them and we're gonna put things in place. But it's ultimately up to you. So the web host also has some responsibility here. Their responsibility and their interest is mainly protecting their servers because especially if you're on shared hosting, they're hosting many other websites and the same server as you are. And depending on the type of vulnerability, it's possible that somebody could get in through your website and worm their way into other websites on that server. And once that happens, then the hosting company is responsible for those other websites because that was, you know, the vulnerability happened at their point. But then it's also your irresponsible. You have to tell the client what they need and you have to know what the client needs. So that you can tell them, make sure you have a host that has so-and-so in place. Make sure that you're, you know, keeping things updated, using a secure password. So it's not always, like you don't wanna go up to a client and be like, look, this is your responsibility. Just, you know, you just have to do it. I think that making them understand, so I have like this little analogy. I love analogies. It helps me to explain things to clients. So if you think of this whole situation as like an apartment complex, a condo complex. So you are the person that built the building, right? You went through and you're insured that it was up to code. You made sure that you built locks on the doors that maybe the lobby locks, maybe it's gated, whatever. And you made sure that the wearing works. You built the building. You put the security pieces in place to be used. You don't necessarily enforce them because you're not living there. But so then the web host comes in and they're sort of like the maintenance person or maybe they're sort of like the superintendent. They make sure that the locks are always in working order.  And then it comes down to the website owner who is responsible for locking their door. If they have a lock on the door and they're not using it and someone just walks into their house, like it's not the person that built the house. It's false, right? It's not the maintenance man because the locks work. So kind of understanding that, yes, everybody has a part in it and understanding what everybody's part is can kind of show them that the responsibility lies pretty much on everyone. Yeah. So I have a question. Did you, the client clearly has to identify that yes, I agree this is my ultimate question? So I offer it as either an ongoing thing or a one-time setup. And then I have a verbiage in place that says that if you don't take this, you're responsible for setting them up on your own and I'm not liable. I think it's like I have gone through educating you on what you should be doing, but it's ultimately up to you to take it. So just, I'm gonna repeat it for the camera. He asked if there's a clause in my contract that holds me not liable for a year in case the user uses an insecure password and then somebody logs in in their account and deletes a site. So I don't have that specifically, but part of my education is secure passwords. So there are things that you can put in place to make sure that they do use secure passwords and you can show them ways to store and manage their passwords so that they're not getting hacked. But if you have a disgruntled employee that leaves and you don't change the password, that's on you, you have to change the password. You have to get rid of their accounts when they leave. Right, that's why you sell them backup security. We will, if you were in the talk earlier, I think it was yesterday on backups, there was an entire talk on backups. So if you missed it, the talks are gonna all be on WordPress.tv, so you can check it out. Did you have a question? I don't know the exact answer, that's a very specific legal question. Well, I don't want to assume that Google is taking your private email content and selling it.  This is where you say, I'm not a lawyer. Ask your lawyer. Anyway, moving on, another benefit to addressing the security issue with clients is additional revenue. A lot of people, a lot of developers are not talking security when sites are built. There was an agency that when I first started doing web development, a couple of them actually, 10 years ago, even less. Neither of them really did security at all with the client. And I didn't know it then because I was just starting, but I know now that the websites that I was building at this company, we had some general security services. Like we had a service that was like SiteLock, like what my company does. Well, we didn't have any education in place. We weren't doing updates. If the client wasn't taking the updates, there were, like we weren't doing that education. So like that's sort of like ground zero for the beginning to your security plan. So a lot of places aren't doing it. So knowing about it and then communicating to potential clients that this is an important thing and that you're knowledgeable about it and you know how to put these things in place to protect them, it sets you apart from other developers. And even if the client doesn't go with you, there's still a chance for them to come back later and because they know.  But that's a client that now trusts you and they know that when they talk to other people that don't mention security, they'll be in the back of their mind thinking, well wait, they didn't say anything about security. Like this other person immediately brought it up. So, and then there's the residual income, including security as a service that you offer or including it as a one off or even tacking it on to a part of your overall project that people can pay more money for that.  So, the benefits of communicating the need for security effectively. It starts with education, educating the client that it's a thing, it's a thing that they're responsible for. It's a thing that the host is not responsible for. Clients will kind of, sometimes when you start getting very technical, they'll tune out, they'll assume they're not technical enough to understand it to make a decision. But if you break it down into like sort of like three basic questions of what's going on with security issues, it kind of makes it easier to understand. So why do hackers hack websites? Granted, there are still people sitting there in dark basements that are just like nefariously like hacking away at things. Like the 90s movie Hackers, if anybody remembers that. But these days, the majority, like the biggest majority, hackers are done by bots. So it's not necessarily for defacement anymore, like somebody hacking your site and saying, oh, I was here, cool, I hacked your site, I'm awesome. It's for financial gain. So these sites are getting hacked and they're getting redirected to other websites. They're distributing malware on your site that can possibly infect your visitors. So even like small sites, hackers don't discriminate. They will go after small sites if the vulnerability is there. Even if it's a small site, you can still be distributing malware with your site. So they don't really care. So why and how? I mentioned that it's mostly bots. First, sure, the majority these days are bots. So that's where the word malware comes from, malicious software. And this is really the most efficient way for hacking these days. Scripts are written that can scan the internet and they can look for known vulnerabilities. For example, when WordPress puts out a security update, they'll see what the security issue was. They'll do a search. Sometimes they can do a search for contents of a file on your WordPress site. And they can get those results as a Google search result. They literally will just have a list of all the sites that are able to be hacked. It can be that easy. Not always, but scanning through things. They look for things like outdated software. They'll automatically be trying your login form with passwords, trying for different passwords that are easy to guess. Any newly discovered vulnerabilities. So it's not people just sitting there typing in things. It's bots and bots are fast and bots are constantly running. They're constantly attacking. But when I said constantly, I kind of gave that one away. Hacking attempts happen pretty much all day, every day. So we recently published a quarterly security report and we figured out that on average, websites experience 44 attacks per day. That doesn't necessarily mean that you're getting hacked 44 times a day. It means that bots are making an attempt. And if you have things like a firewall in place, they're not even getting to your site. If you have something like two-factor authentication or something like limit login attempts on your login form, they're making those attempts and failing. And you might not necessarily even know that these things are happening, but all the things that are preventing them to getting to your site are all security measures that are in place. And a lot of those things will keep a lot of them away. But a lot of the things that you can do are gonna keep the rest of them away. So I had a little video here. This isn't the live video because the live video, oh it's gone, oh come back. No, okay. Well anyway, if you go to Norse, the Norse Security Vulnerabilities Map, I tried loading it on the site but it's not loading. So they actually have a live map that's up. And it's pretty fun to see. It loaded for a second there. But it's got, it's a visual of sites that are constantly going and being hacked, where they're coming from, where they're going to. And it's not showing all the attacks that are happening because there's millions. It's just giving you an example of what is being targeted from their own targets that they have set up to measure these things. So it's kind of an interesting thing to look at. Well it's not, hey it keeps, I don't know what's not working. Well it was zoomed out a little bit. It's the whole world, it's not just the US. Okay, so benefits of implementing these five simple website security best practices. And they're not hard to implement, fortunately. Doing these five things are gonna get you really up to speed and ahead of a lot of other people that are not doing these kind of things and they'll mitigate most of the security issues that you're gonna run into. So the first one isn't necessarily gonna prevent anything, but it's backups. So having backups are obviously going to help you in the event that you do get hacked. You have something to restore while you work on figuring out what the vulnerability is. I have a fun story again. I was taking out a new website and I was migrating over to another host for my client. And I was looking at it and it turns out that their site was something like 30 gigabytes. And it was an e-commerce site. She's like, oh we have a lot of products. I'm like, I don't think you have that many products. But I'm like, okay, we're gonna get migrated over and then we'll figure it out. So I ended up trying to migrate it and it turns out that I couldn't even set up the staging because her site was so big that she would have had to go to the very highest level. She had no business with her small business being at this highest level. So I was like, okay, let's look at what you actually have stored on your website. Some people upload, like maybe they have videos they forgot about. Sometimes people just dump the entire contents of their camera straight up. So you know, it's usually content. So I was poking around and I noticed a folder in there. I don't remember what it was, but it was a backups folder. And I popped in there and it was about 30 gigabytes of backups that they've been storing on the website since 2012. So don't host your backups on your same server. Not only because of that issue with size, that's not even really an issue. But because if somebody can get into your hosting, they now have access to everything, backups a lot of the time, even backup databases. So even though, if they were to get into FTP, they wouldn't normally have access to your database. But now that your backups are stored there, they can grab those backups on Zipm and now they literally have everything. See, don't want them stored there. So I kind of went through this. There's backup solutions. I know that Peter talked to her yesterday. I'm not gonna go into it too much. But so there's basically three main ways. And one is through your host. A lot of hosts will offer backup. Don't assume that they do offer backup. And if it says they do, don't assume that it's the right kind of backup that you will need to recover your site. A lot of times hosts have backup and it's only for their own use in case a small thing goes wrong and you don't necessarily have access to it. And it's not necessarily restoreable. Sometimes they'll only backup a certain part of your site just so it's more efficient for them to store. So if they are doing backups, take a look. And if you wanna go that route, see what they're offering. Make sure that it's happening on a regular basis and make sure that you can grab that and fully restore the website on your own from that backup. If they don't do it, or if you don't wanna deal with them, you don't wanna pay for whatever. There's other solutions that are more WordPress based. There's VaultPress, BackupBuddy, UpDraftPlus. Those all sort of allow you to schedule backups and then save it to some other place. They also allow you to save it on your server, but don't do that. I'm getting a little fancier if you do some kind of more involved development setup. You can run scripts that automate these backups or you can do a manual backup, kind of a pain, but it's possible and sometimes you have to do it for whatever reason. Updates. So this is the biggest and easiest thing that you can do for website security, keeping your site updated. Like I said before, bots keep track of vulnerabilities. WordPress is open source. When we find a vulnerability, we don't publish it right away. We figure out a fix, we push the fix, and then it's published because anybody can look at the code and see this vulnerability, which is why WordPress tries to push out an update before publishing it to the world. A lot of WordPress security updates are automated. But you can turn those off for whatever reason. So making sure that your client or you are keeping the site up to date, WordPress core, vulnerabilities are found in core and they're fixed as soon as they can be fixed. But that's only core. So when security issues are found and core fixes them, there's still your plugins and your themes that are reliant on a lot of those functions. And if one of those functions was insecure and your plugin was using it or your theme was using it, then the vulnerabilities could still be in your theme. So not only keeping your core updated but also making sure your theme and your plugins are updated is pretty critical. And I just did a blog security series on WP district, which is our site like security blog. And it was a five part series that kind of goes through everything that you need to do like backups, keeping things updated, what to do when an update breaks your site, how to set up a staging site. So if you go to our Twitter, it's sticky posted at the top and you can learn more about that entire process. So number three related to your questions is the strong unique passwords. There are a lot of things that you can put into place that'll basically force the client to be secure. Like you mentioned the two factor authentication, which means that in addition to putting in a password, maybe the client has to confirm that they are who they say they are by receiving a text with an authentication code. It can go so far as literally having a USB stick that they have to plug into their laptop in order for it to be authenticated. That sounds like futuristic and sci-fi will be, but those things are all in place just to make sure that passwords are strong, the person logging in is who they say they are. And clients and people in general, not just clients, like to use passwords that they can remember and passwords that they can remember are usually like single words or the word password or like one, two, three, four, five. So there's a website right here, this have-i-been-pwned.com slash passwords and yes, that's a P instead of a W. It's a website where you can type in your password and do a search and it'll tell you if that's like a known password that's checked when bots attack your site. So now, once you type it in. Well. Do they save it? No. Well, we don't know they don't save it. We don't know anything, that's true. We don't know anything if you tell anybody anything you don't know, they're gonna keep it a secret. But it'll tell you if it's known in a database of passwords. Use a password manager. Password managers are so amazing. I try to get a client set up with them. Did you have a question? Oh, you're just stretching. I use a password manager if you have an agency and you have to share passwords between your company, especially if you have people working remotely. Using one of these password managers makes it easy to share passwords rather than sending it through an email or sending it in a Slack chat. But also as a developer, you can keep all your log install the sites that you're working on and it can automatically generate a very secure password for you. It'll save it in your local repository. You do have to remember one password which is the password to open, the password protection management which also should be a secure password but it's only one to remember. And there's a lot of times they'll have mobile versions. So you know, not just for client sites, but anything if you're logging into amazon.com or Facebook, like all those places. There've been a lot of reaches of security that we've heard of historically and recently. And you don't want the same password, if you're using the same password across 40 different sites and one of them gets compromised, they'll be able to log in everywhere with your username and they can try it. They have all the time in the world because their bots don't sleep. So firewalls and CDNs. So now we're getting into like more technical things. And these are things that you necessarily are not gonna build on your own. So firewalls. There's two basic types of firewalls and so like firewalls are hardware and software solutions that prevent certain bots from even getting to your site in the first place. So like the analogy of like the gated community. They'll come up to the door and they'll be like, please show me your passcode or your card. And they don't have the card. They're like, okay, good day sir. And they turn around and they leave. So they can't even get in. That'll protect a lot. Hackers and bots are constantly pounding on these firewalls trying to get in and they do a really good job of preventing them. So there's two different kinds. There's a network that lives on your host, your web host and then there's the web application firewalls that are the responsibility of the site owner. And that's an add-on service and that's an add-on service that you can communicate to your client. But also knowing that your host has a firewall. Good information to know. And another thing that they do since if your site is constantly being attempted by these bots that can take up bandwidth. And a firewall makes sure that that never hits your site. So it can speed up your site. And then a CDN is basically storing your files in a distributed network across the world. So that will help with load time and sometimes the security scans will be done on these CDNs. These CDNs typically have very strong firewalls in front of them. So those are two things that you should put in place that'll stop a whole lot of things. And then finally the con... Well, I'm glad you asked. Sightlock actually does have a web application firewall and there are other ones also. Talk to me later. So continuous monitoring. This is pretty much a hands-off thing for you. You're not able to constantly look at the FTP of your site and look at all your files and be like, oh, that file drilling down for folders deep, that file was changed today. I should check that file and make sure that it wasn't an injection of some kind of code. So you're not gonna be sitting there looking at that. So there are services out there that do continuous monitoring of your site. They can tell if any code has changed. And then they can tell you that it's changed and be like, hey, we noticed this code has changed. Did you do this? Was it meant to happen? Or is this something that we need to check out? Some places do automated mailware removal so that once it gets popped in, it gets detected and they just spit it back out and they upload the fresh file to your site. So this is another service that you don't have time to sit and do all these things. So having a monitoring service that can tell you when these things happen is another way that you can add on services to your client. How long do I have? 10 minutes, okay. So including it in the scope, including the focus on security in every step just shows you as a professional business owner. It shows you that you're informed, you're knowledgeable and that you are willing or you require this focus on security and that you care about ensuring the success of their business. So it makes you look good. Informing the client from the beginning. It's much more, you have much more success if you include it at the beginning of discussions than if you go to push the site live like maybe in three days and you're like, oh hey by the way, security services, we need to talk security, this is a thing and the client's like, what? We didn't talk about this at all. You mean this is gonna cost me extra money, like. So if you say it at the end, they're gonna assume it's not that important. So make sure that you tell about them in the beginning so that they're aware, so that they know that it's just as important as having nice pictures up on your website, just as important as having a site that loads quickly. Okay, so including security as a service.  And it also sets you up to offer ongoing services, ongoing maintenance, one-off services. Speak your maintenance. Setting up a maintenance plan. I believe there was a talk this weekend about maintenance. So I'm not gonna go into it too much, but how many people in here already have some sort of a maintenance plan that they offer? Okay, so this is probably about half. So tacking on security to your maintenance plan is an option. So now instead of just saying maintenance, you say maintenance and security. Or when you define what a maintenance plan is, you can say it includes security. Or you can offer it as separate to your maintenance plan. But as we discussed, like back with the security best practices, keeping your site updated is like huge part of website security. And that's typically one big thing that's included in a maintenance plan. So you can also be saying now, this maintenance plan is a security thing. So that'll help you sell your maintenance plan in the first place, but then it'll also help you make them aware that security is a thing and that it's not being done automatically. So I recommend two to three levels of maintenance plan or security plan. Starting with something basic, maybe you check it out, you watch for stuff maybe once a month. Maybe it just includes notifying them when something happens. Going all the way up to something that's a little bit more aggressive, where you have content scanning, where you will automatically remove any malware, where you will do a site review occasionally. So depending on what is practical for you, you still have your regular business to run, right?   I was once the grunt at an agency and I had to do all the maintenance before I became a real developer and it's all over the place. You get asked to do all kinds of things. So maintenance isn't necessarily fun. But listing on what you're able to do, decide that, like how much time do I realistically have to spend on maintenance a month or maybe even a week? How many clients do you have? How many people are you gonna be able to sell these services to and price it appropriately? It's not necessarily worth it if you're just coming out even, right?  Another thing is offering a monthly subscription so that they know that they're protected for X amount of money a month. Make sure that you have the caveats in place that if your level doesn't include automatically fixing their hacked site, which I recommend it doesn't because hacked sites can take anywhere from an hour to like a weekend to fix. But make sure you communicate that so they understand what they're gonna get if they take this level, this level, this level. So recurring billing, we were talking about this earlier. PayPal does recurring billing. Fresh books and Stripe also do recurring billing. So you don't have to necessarily chase them down every single month. And you have that knowledge that you have X amount of money coming in for sure every month and that's really cool. As a freelancer, I was a freelancer for seven years and the Feaster Famine that they talk about of you've got a project, you don't necessarily know where the next one is coming from. You're kind of panicking at the end and looking for a new project that happens sometimes. Knowing that you have these recurring payments coming in is like, okay, well I have another $750 a month coming in for sure. Like that's like financial security for your business. And then you can also add it as an add-on service. So that's the one-time cleanup of a hacked site which can lead you into offering the security as a service because they've now learned that they need it. Initial setup of, we'll all put this in place. It's up to you to monitor. You can evaluate. So that's what I did with the client when she had the emails coming in. Or you can just do a consultation. So all those things can be priced out individually. But I highly recommend if you are doing some sort of monthly thing, use a schedule because you don't wanna suddenly remember at the end of the month that, oh my gosh, I have to go through and update all these websites. And wow, I actually wasn't paying attention. There was a huge vulnerability that gravity forms just fixed and oh, it turns out that this fix breaks sites.  And when you have a schedule, it keeps you on track to start to be aware of those things as they're coming up. So it's not all a huge surprise at the end. So you can automate maintenance and reporting. We're developers, we love to automate anything that we can. Any sort of repeatable task. We're gonna try to automate. If you can, you should. So things like maintenance and reporting are things that can be automated that you don't need to be sitting there and manually doing all the time, including backups. So SILOT provides maintenance and reporting tools. Manage WP has, they're another company that you register all of your websites that you have with them.  So this would be like from one website or no, it's two, multiple. It tells you how many themes there are total, 36 themes, that's a lot. How many plugins are there. And then it lists the plugins.  Look, it went from version 266 to 267. And then it has this little update button, which is like, it's a scary thing to push. I recommend just doing a grand sweep of every single website you have and every single update there is, because things break. But you can get an idea of the kind of things that are having updates and you can take a look at them and be aware of them and be aware of who you've all updated for that month. Infinite WP is another one that does it. And then SILOT shows you. So, in summary, security is good, no security is bad. But there's a bonus slide, so I'm gonna get to it real quick. How to get the kitty in there. So GDPR is a thing. Does anybody in here know about GDPR? I know, nobody can really say you're knowledgeable, right? Because everyone's sort of panicking. As if we didn't have enough with Gutenberg coming down and threatening to break everything that we have, there's now GDPR on top of that that we have to pay attention to. And so what GDPR is, is a EU regulation, the European Union. It goes into effect May 25th and it's basically in place to protect data for EU citizens and residents. But it's not just citizen and residents and websites in the EU. It's any website that a citizen of the EU could use in the entire world. It remains to be seen how this is going to play out for sites that violate this. But in a nutshell, what you have to be aware of and ready for is being informed. Are you a controller or a processor? So figuring out if you're the person that's processing information. If you are a controller of that information, Google, Mailchip, SEDGrid, Salesforce, like we're not any of those websites, they have a much bigger thing for GDPR than we do. Well, we have to figure out, are we processing data? Are we storing it any place? How long is it being stored? Do we actually need it? So you have to kind of go through and audit your data so that you know what's all going on. And then in addition to that, it requires transparency. So in your privacy policy page, which is probably something that you haven't been paying too much attention to, you might've just Googled it and grabbed one and just thrown it on your website. It now is a place where you mentioned that yes, you did look into the GDPR, you put these things in place. You follow all these new rules that are in place. So one of the rules is that you have to have consent options at the collection of data. So if you're getting someone's information, you have to have them authorize their consent for collecting that information. And then they have the right to be able to erase that content just by asking you for it. And another thing is that it has to be set up to be like the most, what is it? The privacy setting has to be set at the highest level. So if you notice, if you use Facebook, they just recently had the whole little thing about Facebook information being used. But if you look now at their privacy settings, those are all set to like highest level of privacy. And now you have to go in and authorize those things manually because obviously everyone thinks of Facebook when they think of like privacy and everything. And they're one of the big ones that had a whole lot of work to do for that. Miners, if you have a website that's collecting information on minors, you probably already know that there's laws that you need to follow already. But then we have to make sure that there is verifiable consent from their parent or guardian that they're aware that you're collecting that information. And then finally, designate a DPO that's a data protection officer. Doesn't necessarily mean that you have to hire out a new person for your two-person marketing company. But it does mean that you have to know of someone that's gonna be able to be there for you as a consult or you have to have somebody in your business that is taking it as their responsibility to be informed and to get you ready. So GDPR is a whole another big, big talk and I'm not gonna go any further into it. So thank you. Thank you. Thank you. We're at the word press developer person because there's no way I'm gonna be on top of all these high-level security issues. Obviously you can subscribe to these things but it seems like as individuals who are doing smaller business, getting people set up on websites, we couldn't possibly know all of this. So is there that next level? My client's a one on security awareness and I'm a four. Who do we go to? I'm all right, so maybe a certain is using the last pass at some of these sites but who do we go to for the security help? So her question was as a developer that is not very informed on security and doesn't necessarily want to take it upon themselves to dedicate their life to learning and implementing security, what do you, what can you do? There are security services that you can subscribe to that will take it all upon themselves. Sometimes your host offers that, sometimes it's a third-party service where you can sort of put that trust into them and some of them offer things like white labeling where you can sell it to your client and say, hey, I include security, here's the security results and it just says the name of your company but really you've outsourced that to a third party. So for sure, same thing as like your web developer, you don't necessarily know all about SEO, you tell a client that you can offer the service of a third-party SEO person whose job it is to be really good at that. They also have the same thing with security. So because she can't sell it on stage, I'll say there's site block, who I use for some of my clients, there's a curry, another one's out there, and the client, the customer, my customers don't really care who I'm using or how I'm doing it. They're paying me to have contact to me to do it. I sell it out based on each client, based on what I need, based on the risk factor that I put into them. Deprocated themes, deprecated plugins that clients don't want to pay to keep them maintained, I pay out of what they pay me to do it. It's worth it, so the site block's a great one, it's a crazy good one, you know, so there's a handful of those as well. Those are two bigs. Yeah, so basically Adam said if you don't want to do it, sell it. Sell it out. So we're friends, we're friends also, by the way. We're friends, yep. Security, we're friends. The question goes, have you seen somebody basically try to close the doors that are commonly hit online? So, rename WP.debt, dash add. So, security buy up, it's called security buy up security, right? Can you see anybody doing that? Are you talking about locking down the site so nobody can get access to it, like HTX is kind of. Can you name WP, the people that try to get that? Yeah, that was a practice that was, and is still being done. Honestly, it doesn't really do very much because they can still find them, so. Okay, so then the second question is have you seen anybody talking about the National Institute of Standards and Technology as a nice framework? It's the National Initiative for Cyber Security Education. They're missed as the ones that come up with the password. This is how you, this is the definition. Yeah, so we have, so at my company, we have an entire team that's dedicated to research and development, that's not me. I'm sure that we do, but I have not personally been involved with that initiative. I'm a member of the work group. Okay, so what was it called? It's the National Institute of Tech Standards and Technology. National Institute of Standards and Technology, NIST. And the initiative, it's a presidential initiative called NICE, which is National. Presidential initiative called NICE. And it's called the National Initiative for Cyber Security Education. Initiative for Cyber Security Education. So they have a whole new framework that they're basically pushing out. Oddly enough, I haven't seen anything talking about Wordpress. No one in the community is talking about applying it and they're not giving any guidance. I've seen the guidance coming. Are you on the security WordPress team? No. You should check that out, because we're always looking for people that want to get involved in WordPress. And if it's something that you're very knowledgeable about, it would probably be welcome if you wanted to contribute. And we would love to have you contribute. I think there's actually a connection now. Either WordCamp US, and Google was there, I think it was Google, because they're tying it in to do some support. I think it's Google, because they're like, right, to help make WordPress more secure of that aspect, so that way Google reports it better as a platform as well. Okay, so Adam said that Google was at WordCamp US and they are taking on initiatives to try to help make WordPress more secure also. Is there a person that you can say, this is who's looking at? In Wordpress Core? In the WordPress community, yeah. I don't know. The first person I'm talking about is Aaron, but I don't know if he's on that team anymore. Aaron Campbell? Yes. Possibly Aaron Campbell. But if you go to justwordpress.org, make.wordpress.org, there is a whole team dedicated to security. And if you get in touch, they will be happy to have you and someone will reach out to you right away and let you know what you can do. Yeah. Do you recommend SSL for all of you? Yeah, so SSL, yes. There's different levels of SSL. And then like eCommerce, all of that. Right, yeah, so SSL and HGP2 are additional like security pieces that you can put into place on your site. A lot of hosts offer a basic SSL that's fine, but if you're doing things like credit card gathering, you need to be up a little bit level. And then that's where PCI compliance comes into effect. If you're processing payments on your site, you have to make sure that you're PCI compliant and hopefully your developer knows that or at least your processor knows that and they will direct you to what you need to have in place for those because there are standards in place for that too. Yeah. It depends which level of PayPal you have. If you just have the PayPal standard, what it does is it redirects the buyer to the PayPal site and that is PCI compliant because the payments are not being taken on your own website. So the payments happen on Google, it says yes, it's been paid. They push the person back to your site and tell your site that it's been paid, but your site is not collecting credit card data. There's other levels of PayPal that are more advanced and for those payment types, you do have to look at that. So if you say a payment gateway, you don't have to do the day-to-day or the day-to-day on it. Well, my payment gateway wouldn't install on my WordPress site. It's good like that. Yeah, so she said that her payment gateway would not install until she was PCI compliant and yeah, that's true. So if your, that leads me into, I'm actually doing a talk at WorkCamp OC. I know it's all the way in the other side of the country but I'm actually talking about securing your e-commerce site and PCI compliance is a thing that I'm gonna be talking about a little bit more in-depth. We're out of time, but e-commerce way, way bigger for security. Way another talk. Thank you very much. Thank you. It was remarked about products. No, in the, in the preview. Closing.


Apple Form 1040 using LASERT software to populate it. You don't need tax software to follow along, but if you have access to it, it's a great tool to run scenarios with. You could also get access to the Form 1040 related forms and schedules IRS website, irs.gov, irs.gov. Our starting point as usual is gonna be the single filer Mr. Anderson. We don't have any dependents down here to kind of confuse the picture. 100,000 W-2 income. We've got the 12,950 at the standard deduction. The 87,050, we can mirror that over here in our tax formula worksheet, where I'm gonna say the income is gonna be 100,000, pulling over to the first line of the income. 12,9 standard deduction, 87,050, that matching what's on the taxable income. Page two, I'll let the software do the tax calculation, 14774 in this case, 14774, that's where our major focus is, but we have the 15,000 that we're assuming for the withholdings as well. Okay, so let's add some interest here, because that's what we're interested in at this point. So we're gonna go down below. The interest is gonna be pulling in down here where we have the tax exempt interest on line two A and the taxable interest on line two B. If we go over a threshold of 1,500, then we could attach the schedule B or must attach, I should say, the schedule B in that case. So that's the general rule. If we're looking at the form for interest, we're usually looking at an interest income, 1099 INT type of schedule. This might come actually from a financial institution. So you might not have like this whole thing, it might not look exactly the same, but it'll be say 1099 INT on it somewhere generally, and it'll have the same box numbers. And if it's a taxable component, you're gonna have box one, because that's where they'll put the taxable amount. If it's non-taxable, if it's something like tax exempt interest, possibly you're gonna have this box eight down here. These are some of the more common type of calculations of interest. Now for most taxpayers, of course, we would expect the primary source of income if they're in their working years to be W2 income, for example, and then the interest income would be on those investments that they have, usually investments that are outside of even a 401k plan or something. So we would expect that the interest income for most people is not gonna be the most significant part of their income. If they're retired individuals, and they have more money that is invested in earning interest, then you would expect the interest might be larger. Obviously, when we think about interest, we're thinking that if someone has a large amount of interest income, you would expect that they have a significant amount of savings that are saved somewhere, oftentimes would be generally the case. All right, so we can jump to the data input possibly. I'm gonna go to the 1099 interest, and let's say that this comes from a financial institution. I'm just gonna say bank one here, and let's say that we had $500 in interest. Let's just start it up, 500. If I pull on over to the tax return and say, what would happen? We still got our 100,000 W2 income, but now we've got the 5,000. That's the taxable interest income. Notice there's no Schedule B popping up over here because it's not over the threshold of 1,500 to be on the Schedule B. And so that of course increases our taxable income. And so on, I can reflect that on our schedule over here on the income line. Now, I might make another schedule called a Schedule B, which I don't have yet. So I might say, let's make another schedule, and then I'm just gonna call it a Schedule B. Now, in this case, I don't have a schedule. I'm not using the Schedule B on the tax return, but I'm gonna call it a Schedule B interest and dividend, because, and then this is where I'll pull the interest and dividend over to page one, whether it's over the threshold or not to actually have a Schedule B populated on the tax return. I'm gonna select this whole thing, right-click the worksheet. I'm gonna format the cells and just build this as we go. Currents here, I'm gonna do this fairly fast because it isn't an Excel class, but I think it's useful to see how we construct this thing as we go. None here, I'm gonna say no decimals and okay. Scroll in a bit. This is gonna be, I'm gonna say this is interest and dividend, dividend, boom. And so let's make the whole thing like bold too.  And then the first part I'm gonna say this is interest. And I'm really just gonna be focusing in on the taxable interest that's gonna pull in to our tax calculation. I'll make this a little bit larger. And so I'm gonna leave some space here for like a few institutions that could be input because I might have multiple financial institutions. I'm gonna make that blue. So we'll go up top and say font, making it blue. If you don't have that blue, it's in the more colors. Standard, I'm using that blue. You don't have to use that blue, by the way. I just use it because I like it. Home tab, font group, border dropdown. And there's the borders. And so this is gonna be bank one, put the 500. And I'm gonna sum that down here for the total. Total interest. And sum it up. And so we just put a little worksheet together so we can recalculate this. Let's check the spelling of it. Check the spelling. Why don't you? Because you can't spell with nothing, man. It's horrible. Look at that. What are you talking about? I spelled everything right. Any case, we're gonna pull that to page one. Let's pull that on over to page one. And double click on the income line. And I'm gonna go to the end of it. And now we're gonna add this other schedule. Just pulling into this line one. And that's gonna be the schedule B. And I'll say the total interest. Let's pull that in. I'll probably have to modify. Let's actually modify. You're gonna modify it and attach it to the stuff. For that right now, I should modify that a little bit differently. That's gonna be the total interest. And then I'm gonna have dividends. Dividends.  Black and white. And then let's say that we have our space for the dividends we can have here. Boom. And let's make this bordered and blue. And then I'm gonna say this is total dividends. Total dividends, which will be the sum of this outer column. And then I'm gonna say, I'm gonna have a line that says total interest. And dividends. And this will be the total of the outer column. Interest and dividends. So that line one on the form 1040 should pick both those up. So I'm gonna delete this last bit. And I'm gonna say, I wanted to pick up that bottom line, the bottom line.


Hi everyone. Today I will be speaking on the topic building mentorship opportunities at your open source organizations. First of all, thanks for providing me this opportunity to share my insights and experience on building relevant mentorship opportunities at my open source organization. And today I will be speaking about the very same experiences. Before getting into the topic, let me just quickly introduce myself. My name is Harsh and currently I'm working as an engineer at local stack. I'm also overseeing the technical community at Mojo Global. Mojo Global is an open source community under the Linux Foundation where we basically develop climate action tools so that we can reduce the overall greenhouse gas emissions in the land use sector. I will also be heavily talking about Mojo Global and how we developed our own mentoring initiatives over there and how we are supporting a community of more than a few dozen contributors so that they can contribute to a wide array of the projects that we are developing over there. So just tighten your seat belts and let us get started with this whole session. So before getting into the notes and grids of my session, let me just quickly introduce what Mojo Global is. So as I mentioned before, Mojo Global is a not-for-profit open source collaborative organization under the Linux Foundation and we have a huge community of scientists, experts, policy developers, contributors who are mostly students so that they can help us develop our huge series of open source software, one of which includes Flint. Flint basically stands for full land integration tool and it is a C++ framework that allows different countries, entities and organizations to independently develop a measurement, reporting and verification software which we basically colorically call as an MRB. So through the Mojo Global toolings, we are helping these users and entities so that they can estimate these greenhouse gas emissions and they can credibly track it and remove it from the land use sector. The reason why I'm speaking about Mojo Global is because a lot of the things that we have put forward in this session, these things have been practically done and learned by developing various range of mentorship initiatives at Mojo Global itself. So this topic is quite close to my heart and that's the reason we are just mentioning about it. So I joined Mojo Global community back in 2021 as a very new contributor and back then the community was not that very great. We had less than half a dozen active contributors and we had many of the people who were just contributing for the sake of some sort of an open source program like maybe Google Summer of Code or Google Season of Dogs or something further. So we did not get selected for Google Summer of Code but we did get selected for Google Season of Dogs and during my tenure at Mojo Global as a Google Season of Dogs intern and further as a community manager, we heavily invested upon increasing the size of our community, supporting the various community members who are looking to contribute to our projects and making sure that they feel home while they are contributing and they simply don't feel left out. So the result of all of these initiatives have almost led us to more than 400% increase in just the last year. We don't have the exact numbers for this year but I guess we have been simply growing over the time. So this is a kind of interactions and this is the kind of example that I want to put forward before we officially begin with this session because it sets the course for all of the lessons and all of the things that we have learned over the time that will help me communicate this much better. So at Mojo Global, we have like various working groups like mentorship working groups, documentation working groups, interface design working groups, implementation working groups. In this session, we will talk about how we do things at the mentorship working group and how we further develop these mentoring initiatives at Mojo Global itself. So with the whole course set and with the specific context set about the whole session, let us get started with what the agenda holds us for today. So in today's agenda, we will be covering over five basic pointers. First, we will be identifying the pain points in bringing forward the new contributors to our community. Next, we are going to find like what sort of relevant mentorship opportunities are there for new contributors and what kind of things that they can participate in and how we can officially support these new contributors coming in our community. Third, we are going to talk about how to build a mentorship working group by taking some of the lessons that we executed at Mojo Global itself. Fourth, we are going to talk about how you can bridge the gap between the mentors and the new contributors so that these new contributors don't feel left out when they are contributing for the very first time and how the mentors can officially take the charge of building the capabilities of these new contributors and make sure that they feel welcomed and they feel safe within the community. Fifth, we are going to talk about some of the best practices, like what you can do to make sure that you get inside these mentorship programs. You make sure that all of the mentees whom you're like basically mentoring, tutoring and doing all sort of things, how they are officially supported so that they can build out their careers and more of these things. Finally, we are going to have a Q&A. Since this is a prerecorded meetup, I will be available on the relevant Q&A channels so that I can clear out any specific questions that are coming up about my talk or about anything in general about open source and mentorship. With this in mind, let's get started up now. The very first agenda of our talk today is identifying the specific pain points in bringing the new contributors and some of the lessons that we have learned over the time about why do these new contributors don't exactly contribute and what are the ways that we can make sure that they feel safe and they feel included in the community that will further prompt them to get started with the contributing. So let us ask the very first question to us. Why exactly do these open source participation matters? So open source as we all know, it's a collaborative model to develop software and it can include various aspects of software development, not just coding but also some no code contributions which might include documentation, bug triaging, user interface development, user experience development, product management and much more. So open source which was obviously regarded as a one-dimensional aspect earlier where people are just hardcore software developers committing a lot of code to make sure that this project exactly has a functionality that you might expect them to. Now open source development has multiple separate dimensions altogether and this makes it even more easier for people to contribute because now everyone can feel included in the community. They can be software developers, they can be designers, they can be documentation writers and everyone can feel free to contribute in whatever way that they can. So the reason why open source participation matters, the very first point is that you get to fix these bugs, these issues, these enhancements, these feature requests collaboratively and by reducing the overall risk. If the whole open source project is a one-man or one-person show, it might just lead that the one person is responsible for everything. They will be responsible for creating new features. They will be responsible for fixing the old bugs. They will be responsible for supporting the new users who might be just having some troubles using that project. So we need to make sure that people are doing this in a collaborative manner so that we bring a sense of shared resource and we bring a sense of a shared responsibility as well. The second point is that we need to have shared development resources for reduced costs. Obviously, if one developer is working on that project, that will just make sure that the whole technical depth on that project will be accumulating over the time. Sometimes it can go for maybe a month or two, sometimes it can even go for decades where one single person is so much overburdened that the whole technical depth has been introduced to the project and we simply have no sense of how we can get out of it. Third, we want to build some training resources so that we can build internal capacity. Internal capacity can refer to something of a capability building that every open source organization has so that they can fix the old issues, enhance the new ones and also bring out some new features that can support an ever-growing community of users. And finally, you get to find a mentor for yourself. You can basically teach to learn. You can grow your reputation. You can go to various conferences just like me and maybe share your experience and that can overall lead to a great participation model within your community. So why exactly is open source participation good? This question can be answered from a lot of different perspectives. For users, you get to become a part of the community. You get to get some visibility. You get to attract some other users. You also get to find relevant service providers. You also get to find some donors and that's something that we're not going to cover out. The second, it is for the contributors because they get to provide some feedback. They get to improve the code, the documentation, the new features and everything that can help improve that project. For maintainers, we need the open source participation so that we get to streamline our strategy. We get to streamline our direction. We get to build the tools that can meet the needs of the new users, the new developers, and we can also exchange our expertise with a huge community of users, developers, contributors and much more so that the overall steering of the community is straight in the right direction. But now the dilemma for most of the new contributors and, sorry, not the new contributors but the new maintainers is that why are we not getting enough contributions? We just build a huge fancy, great open source project. We have open source data. We have a really nice, maybe a readme. We have a really nice website. But why exactly are the people not contributing? What is that that it is holding them out? There are many three reasons for that as far as I've seen in my experience. The first one, the contributors don't find enough supporting materials. Pretty sure that you must have some great videos, some great resources, a great readme. But in the essence of trying to market your open source project, everything just ends up to be a marketing material and not something that the contributors will exactly find useful. So that's the reason why you need to heavily invest upon specific materials that can help improve your project. The first one to start with is obviously the official documentation. If you don't have something like a developer documentation, you don't have something that can allow a developer to set up the project on their local machine. You don't have references, you don't have guides, you don't have tutorials. Most of the people who start up being a contributor to an open source project, they first try to use that project themselves. And if they have no references, no tutorials, pretty sure that they will be lost in the first instance itself. Second, contributors exactly have no one to look up to. They don't exactly find the relevant mentors, the community navigators, the maintainers, whom they can ask a relevant question and basically get clear about. And further, sometimes even if you happen to get some of your contributions merged, you might not feel appreciated. You might not be celebrated. And this might just lead to further demotivation.  So lack of open source collaboration can just open up a Pandora box of multiple ill doings. First, it will lead to a low adoption drive because no one knows about what your vision is. No one knows about what your practices are. It will further lead to an overburdened work schedule on maintainers because they now get to do all sorts of things. They now need to build the new features. They now need to fix the old bugs. They now need to support the new users, everything. And finally, like the lack of contributions can just lead the existing users to turn away because since a maintainer is overburdened, since they have no one to basically delegate their work to, most of the users will not exactly find themselves confident of using that project. Maybe ask yourself, you go to an open source project and you find over a thousand issues open and maybe over 500 PRs open. Most of the users, including me, we will feel entirely motivated to exactly use that project. And due to all of this, the product will simply crumble under the heavy development scope and this will just lead to a short in lifespan. Your project will be dead even before it has started. So to build an active and vibrant community, we need to make sure that we have the following things. The first, your project is easy to use and easy to understand and easy to for others as well. So if I'm building out a project and if I need to communicate it with others, it should be literally easy for me to get started with. Second, I need to build a contribution guideline. I need to build a community funnel so that I can bring in more folks who can feel included within the community. This is one of the first and the foremost things that I actually evangelize, that if you're starting out with any open source project, better get started with a contribution guideline and better get started with a community funnel. Third, you need to build diversity in your community. A lot of the projects literally face poor diversity, poor representation of minority groups. And this can further lead you to lose out on some really great ideas that can further improve your project. And finally, you need to make sure that your project enforces a code of conduct. A code of conduct will literally help you to focus your synergies on the right things and also weed out the bad actors because not everyone is really nice online and you really need to make sure that the good people don't turn away because of the bad actors. So bringing out a code of conduct can literally make sure that people feel welcomed into your vibrant community that you're building right now. So this ends up the first agenda of our talk and now we are going to talk about what sort of relevant mentorship opportunities that we can build out for new contributors. So the first question itself, why should I be exactly bothered about mentorship? The very first thing is the open source teams are volunteer based. No one is exactly getting paid to contribute to your project. Most of the open source contributions are volunteer based because people come in as volunteers. They find out some free time in their schedule and they just want to get started with contributing. They are diverse. They are distributed across the globe. So you might end up mentoring someone who might be sitting in a different part of the world and this can be a hugely enriching experience. You get to build the capabilities within the community. Remember what I talked about, the capability building in the community and the resources. This is the exact moment when you want to do that. The third one, the mentorship programs will help you find some new contributors who the heck doesn't want to get new contributors on your project because the number of contributors that are increasing on your project, the more confidence people will get in using your product and these new contributors will further become the future maintainers because once they get past their initial learning stage, they can now independently do stuff. They can independently execute their own plans and they can get to partake in the overall decision-making process. And finally, as a maintainer yourself, you get to trust your team and you get to delegate your task. You literally cannot do everything on your own so you need to trust so that you can delegate it to others. So within Mocha Global itself, we have been working with various mentorship initiatives, various mentorship opportunities. Some of these include the Linux Foundation mentorship itself, something that we call or call as the LFX mentorship. So over the past two years, we have been a regular participant in the LFX mentorship. We have literally mentored over a dozen mentees through various projects and we have been supporting these mentors, these new mentees by asking them to work on some of the projects that we have. Some of the ones that I have listed over here is using machine learning to predict deforestation, cloud native climate change mitigation, and environmentally sensitive growth model and online courses for Mocha Global's purpose. So LFX mentorship is an open platform for all of the organizations that are a part of the Linux Foundation. So if you have not started with that, maybe you can just get started with an organization profile and you can start listing out the various projects that you have in the mine and you can start looking out for relevant funding sources. So LFX mentorship is a really great place to find some new people who are just getting started with open source and it is a really great way to build up some new talent and retain them out. Next, we have Google's open source. So Google open source has been running this particular program called as Google Summer of Code. I've been a Google Summer of Code participant last year and this year I'm a Google Summer of Code administrator. So Google Summer of Code is a 12 weeks long open source program where people just basically get to participate in over 200 plus organizations contributing to various aspects of software development. Google has also launched the Google Season of Docs, which is primarily focused on technical documentation and documentation engineering. And this is also a great program for technical writing as well. I have been a participant and a mentor in Season of Docs as well. And finally, we have got Outreachy. Outreachy specifically focuses on people coming from underrepresented sections of the society. So they might include women, LGBTQ plus and more so that they can get to participate in open source development around various organizations itself. I have been a participant in almost all of these open source programs either as a mentee myself or as a mentor and all of these mentorship opportunities help us to find some new mentees who can get to work with us and they further take up some new responsibilities after their mentorship gets over. Some of them become maintainers of the respective project themselves while some of them just go forward with their career trying to mentor some other folks into getting started with open source. So as I listed before, there are multiple mentorship opportunities. There's Google Summer of Code, Google Season of Docs, Outreachy, LFS mentorship. If you're not able to participate in any of them, you can also start with your own mentorship opportunity. Over here, I have listed an example from Async API. Async API is also a member organization of the Linux Foundation and they hosted their own mentorship program because they got rejected from all the others except Google Season of Docs. So they decided that they have some funds through Open Collective which was nearly 15,000 US dollars. So they selected nearly 10 people to work with them offering each one a sum of 1,500 US dollars over a period of three months that was very, very similar to how Google Summer of Code plays out. And it was a really nice example of a community organizing its own mentorship program in order to support their new contributors. So with the mentorships, you get to build the diversity, you get to sustain your community because mentorships are pretty much low barrier to entry opportunities. Most of the newcomers who are entering into open source, they don't need to feel basically prepared for some technical interviews or technical grounds or assessments. They can just get started with picking up an issue, finding some unique ways to tackle it and you as a maintainer will get to review these, provide some constructive feedback and further.  It will also allow you to support the contribution with a good exchange of background expertise. Sometimes you're familiar with something which your mentee can learn from. Sometimes you're not familiar with something which your mentee itself and that's such a good way of building an exchange of shared practice. And finally, of course, you will build more confidence about mentors because you get to lead your projects, you get to provide these guidance to the new contributors and this will overall lead to a better self-esteem. So we have talked about all of this. So how can we exactly build out a mentorship working group? So that's a very interesting question, but let us first talk a lot, tackle the question on what exactly are working groups. The very first thing that navigating a community is difficult. It is difficult both from a coordination perspective and for the new participants to find the place. For example, let us say a participant joins a Slack community. They say like, hey, I am XYZ maybe and I'm looking out to find a new project which I can contribute to. And without a working group in place, you are just blurred out that, hey, this person says that this person is skilled in front-end development. What project can I exactly delegate to them? What person can I exactly ask to help this person out? What sort of issues this person can work on? As a maintainer yourself, this will exactly fry your brain out because you get to do a lot of things. You get to do a lot of thinking for each and every contributor. But now that you have a working group, you can simply say like, hey, it is nice to meet you. Thanks for joining our community.  You introduce yourself and maybe the working group coordinator can get in touch with you and they can help you find a relevant task to work upon. That's such a nice way of delegating things and working out stuff. So these work groups are not exactly about accountability. It is not to create some silos where people are working and they need to report back to you so that everything is working fine. Rather, they are about communication so that you can build out these capabilities, these new contributors in a sustained manner. You basically delegate these accountability to the folks who are responsible for a specific project or a specific aspect. These are the people that you basically call working group coordinators. And everyone who is joining a working group, they are pretty much joining out of their own interest, out of their own will. And they can do a lot of things. They can contribute, they can help, they can answer, they can help out some other new contributor as well. Or maybe they can discuss out with you about some new strategies. The opportunities are simply endless. So how can a mentorship working group help? The first thing, with the help of a mentorship working group, you get to mentor other folks, obviously. And you also get to outline, plan and execute an initiative. Let us say your organization has decided that, hey, we are participating in Google Summer of Code this time. But now that you have a lot of questions, who is exactly going to write the proposal? Who is exactly going to find the projects? Who exactly is going to find the mentors? These are too many questions that a single person can solve. And that's where a mentorship working group can basically help. The second is a mentoring working group can help the contributors learn and support them. Before any mentoring initiative, I have a mental map that, okay, these are the folks who have been inside this community for a long time and they really deserve to participate with us. So with a mentoring working group in place, you can basically support these contributors. You can oversee them, you can guide them. And you can basically allow them to participate in these initiatives so that they can sustain their contributions. And finally, a mentoring working group can also build a capability upscale because now the contributors will know that their contributions actually matter. It's simply not a voluntary initiative. It is simply not a scheme to get all of your code in and basically leave them out with just some good experience. You want to compensate them out with some really good initiative. And this is the way that we actually do that. So if you are building out a mentorship working group for the very first time, the very first thing that you can do is to actually find the relevant folks who are interested in these kind of things. Not a lot of these software developers are actually interested in planning, execution, evangelism and all sort of those things. But you really need to find out the volunteers who are exactly into these kind of stuff. They need to be interested in mentoring. They need to be like highly diverse. They need to be like purely welcoming to new contributors. And they need to have a good eye to detail who can actually plan things out and who can look out for the new initiatives. Once you have found out a new initiative, you need to plan it out well. Ensure that you have some good enough mentors for any program. For example, if an open source community is going to Google some more of code with, let's say only two or three mentors, it is a sure-short way to get rejected because two or three mentors, it's simply not enough number to support a good number of projects. Third, you need to define an idea of success. Success is something that's pretty subjective for every open source organization. Some might consider success to be a completion of an entire project. Some might consider success to be something that has been a learning initiative for the mentor and the mentee, obviously. You really need to look at it from a long-term perspective and see what is success for you and basically put it in the outline, your mentorship guide, so that the mentees also have an exact idea that this is how you look at success. And finally, you need to ensure that your mentee is taking away enough to learn and grow in their careers. Everyone has a career to build. Everyone is looking out for some new learnings, new opportunities, and sometimes you just need to let them go. But you need to make sure that they have enough learnings in their career so that they can grow out and they can help out the other folks in the community as well. And this is how you get to define some success metrics. Some of the success metrics might include how many mentees continue to contribute even after the initiative is over. For example, at Mojo Global, we basically keep track of how many of the mentees have been contributing for the past one or two years, who have been a participant in various open source programs that we were a part of. You also need to consider on what sort of new things have they learned. It can be technologies, it can be soft skills, it can be experience. It can be some other stuff. And this can be purely communicated by the mentee and the mentor themselves. You also need to consider what the overall feedback was for the mentor, from the mentor about the mentee and from the mentee about the mentor. And this is a really nice way to judge on how good a mentor has been in mentoring the new person. And it is also a good judge for you to understand on what kind of people you want to select for an upcoming mentorship initiative. Because sometimes things might go south but it's simply not your hands to control them. And finally, you also need to communicate with your community, like how the interaction was with the new mentee, how did they perceive your new contributions coming in. What is their exact feedback about it? Because if you're in a community, you need to make sure that everyone has a shared sense of responsibility. So even if the mentor is directly communicating one-on-one with the mentee, you also need to make sure that the mentee is communicating back with the community to ensure that everything is going fine. And this brings us to the next topic which is bridging the gap between mentors and the new contributors. So getting started with mentorship in the community is a tricky aspect. The first thing that you need to do is actually build out a guide. And if you're building out a guide, make sure that it is pretty much out in open source. This guide should include your code of conduct, your ethics, your guidelines so that you can ensure a safe and sound environment. Without a mentorship guide, you're basically ensuring that things might go sound and you simply have no code of conduct to ensure that everyone is on the same line. Second, you need to understand your mentors. What does your communication and mentoring style look like? Some of the folks might be very much interested in video communication. Some of them might be just interested in text communication. Some of the mentors are pretty much about active mentoring. They might just get into pair programming sessions with the mentee or they might just like provide some suggestions, provide some feedback, provide some learning resources and that would be it. You also need to understand how do the mentors see success because there might be some conflict around it. As a maintainer, you might see success as something while your maintainer might see the other thing. So you need to ensure that you have a shared vision of what the success is so that the mentee doesn't leave around dangling between the two definitions that we have put forward for them. And finally, we need to understand on what is the engagement actually looks like. So all of this is something that has been described in detail over mentorship guide. It's an open source website where you can exactly look of how you can build out your mentorship initiatives. It has some really nice templates and really some really nice resources. So definitely check it out and see what are the things that you can do. And before getting started with any sort of mentorship initiative, maybe just sit down and think about starting out with an experiment. Start with some initial mentoring. Maybe find one or two contributors who are exactly interested to learn from you and just mentor them or maybe ask some of your mentors to do that job for you. And see on how the contributors are exactly going about making your first batch. This is a good learning experience because it can help you retrospect of what sort of guides, what sort of references you have built out and it can further help you iterate on them. So you also need to ensure that the people are able to find the mentors through the initiatives. Over here, I have a very basic example of showing how the projects look like over module global. So every project has an abstract and every project has a category plus a rating. So this project has a medium difficulty. It is a low priority project. JavaScript, JavaScript, design systems, UI, UX are the relevant skills that are needed. This is the one 75 hours project. It is for Google summer of course specifications. A preferred contributor can be a student. They can be proficient and the mentors are Gopi, me and Gabriel, who is one of our other mentors. So every time you are listing down the project ideas, make sure that they have a description and they have an idea. Second, make sure that you direct all the interested contributors to the respective mentors and the expected script that they should possess. And finally, help them understand the takeaways of the mentorship and what they would be learning. All three of these are important for helping the people find mentors through these initiatives because if you don't put out this information out, most of the people might just leave out for days and days without finding the appropriate mentor for that. So, if you have any questions or questions that you would like to share with us, feel free to share them in the community or your mailing list, asking them, like asking you to like basically redirect them to the right mentor for that project. So for the mentor share, they might share a lot of things. They can share the knowledge, the kind of things that they know about. It can be related to the domain. It can be related to something out of the domain. It can be related to something that everyone needs in our day-to-day life, from a junior to a senior, obviously. They can share some advices. These advices can be obviously about their career, about their studies, or maybe something that they're exactly planning out to do further. And finally, they can share them a direction and a goal. A direction is necessary to make sure that the mentee is successful in their project or in whatever initiative that they're working on. So, the first thing that they can do is like, they should be doing their own research, which is like D-Y-O-R. So, every time they should be prepared with essentials and have an understanding of what exactly they're looking for, second, they need to help themselves. And this is a golden code that if you're helping yourself, the others might find easy to help you out. So, understand your needs and requirements because I really understood that this is something that I want to learn and I want to understand. And I found myself an opportunity which I can capitalize upon. Finally, do relevant follow-ups. A lot of the mentors have a lot of busy things going on in their life. They might be busy with the project. They might be busy with their job or they might be busy with their family. So, you don't really need to ask a mentor to follow up with you. You should be like doing relevant follow-ups with your mentor or maybe anyone who is involved in the community so that you can let them know your status and what exactly you are planning on next. It is a good way to share your blockers, share the things that you are planning out and some of the things that is on your mind so that the mentor can basically clear them out before you move on to the next thing. And finally, we have got the best practices while organizing any mentorship initiative. So, the very first is building out the relevant contribution project ideas. This is something that we have already discussed before. So, taking down any sort of a project idea, make sure that you're brainstorming with your maintainers, with your mentors and you have defined a fixed goal for your project. Second, understand the need of your projects, the kind of the skills that are required and the kind of skills that a mentor should be bringing. You can also add a separate note about what kind of things that mentor would also be learning because mentorship, after all, is a learning effort. It is not something that the mentor should be communicating to them. And finally, try to build out a shared ownership for the mentor so that they can discuss how they can brainstorm, they can collaborate, they can do a ton of things after all. So, once you have done all of this, define the mentorship funnel, find out relevant ways so that you can recruit the mentees. A lot of different organizations try to tackle this in a different manner. Some of them try to find mentees within their own community. So, once you have the mentor you can do a presentation on open platforms like LinkedIn or Indeed or something else. You can also put the mentorship initiatives on job board so that it is more accessible to people. Second, you should be discussing with the mentors about what's the most credible way of selecting folks. It can be proposals. This is something that Google Summer of course does. It can be virtually interviews. You should be dealing with the rejection. Come on, not everyone can get selected for the mentorship program. So, you need to understand of what the particular person should be doing after they are rejected out. What are your plans to basically make sure that they feel welcome in the community and you are basically supporting them out. These are some of the questions that you have to basically answer yourself depending upon your needs so that it is setting up regular checkpoints with them so that they can share their project updates with the rest of the community. This is one of the most essential things that most of the projects might miss out. They might just wait for the mentorship initiative to end so that they can get an update on their project. Please don't do that because a lot of the people have a habit of filtering within the whole initiative is going on. Instead, try to set up these regular one-on-one feedbacks between the mentor and the mentor so that they can understand the things that they can improve on and the tasks that they can do the next. A lot of the mentors might miss this out but instead try to set up a chat one-on-one so that every weekend your mentor and the mentor can basically share the feedback about each other and the kind of things that they have been doing over the past sometime. And finally, give the work a shout out at the end. This is something that almost every mentor deserves. It can be in form of blogs. It can be in form of videos or conference talks or something else. It is totally up to you. So with this we are at the closing end of this session. So thanks a lot for everyone for being patient and being a part of this session. If you have any questions please feel free to ask me on Twitter or maybe LinkedIn. You can just find me by my initials or just by my username which is Hersh underscore Casper. And that would be it. Thanks everyone for being a part of this session and I really hope you get to build some really nice mentorship initiatives within your community and I would be happy to hear about them sometime in the future. Have a great day everyone. Bye.


We ain't done dancing, but remember what got us here, we're not going to be complacent. We continue to improve. Just don't change what we've been doing, okay? Working together, preparing, playing together, not giving up, finishing full tilt to the tackles, okay? Longer than a guy with a ball. He's got three takeaways, he's got four four down stops, okay? You've made him kick field going, and I'll tell you what, we scored touchdowns. We scored touchdowns. Now, real quick, first player in NFL history, that would be the entire NFL for as long as it's been around. Okay? Only player ever to rush for 180 yards. Yes! What I told y'all, boys, at the end of camp, why not us? We ain't playing. We ain't playing. Believe it. Look at every single one of us in here. We the ones. We the ones they talking about. They talking about it. Keep it up, man. That same mentality. Yes, sir. We going to go all the way, love to believe in each other, bro. We all we got. Hey, tights on three. One, two, three. Tights!


The residents of Adamaa State have cried out over the removal of fuel subsidy while calling on President Tinibu to consider the sufferings of Nigerians. The residents, however, described the removal of fuel subsidy as wickedness, as showed the Nigerian Liberal Congress of their readiness to support the nationwide strike slated for Wednesday. They, however, appealed to commuters to consider the plight of the masses by reducing their transport fare within and outside the state capital. People are really suffering. There is a place from Jamaica to Yola in Adamaa State. People pay 100 naira, presently people pay 600 naira from Jamaica to Yola. Things just skyrocketed immediately. Today, anywhere you go within the city of Jamaica, things are just terrible. We don't know how we will survive this country. We believe removing the subsidy is a good idea, but removing it immediately on its first day is not really good. There is no parity for people to take care of themselves, to prepare for the removal of the subsidy. He just came in like that. It's not a good idea to be sincere. You could have two people who will not be subsidy at this particular time. We love his action. We love his sincerity.  The first government to reduce the price, this price that you used to sell is too expensive because customers are complaining. So if possible, please and please, so we got our request. I came with a whole bobae, 199. Here in the first century that I had this first 160. I don't know where we are taking the money. I don't know where we are taking the money. I don't know where we are taking the money. I don't know where we are asking to give the answer for this. Where are we going to do this? Here in Nigeria, 550 years. Where? I think it's for good. If it is for good, then it is for good. It is coming from the marketers or from the new government. If it is from the marketers, we can say that they are not fair to the government. But if it is from the government, we can say that they are not fair to the masses. This policy is very, very demoralizing. It's a hopeless policy. The only subsidy, I mean the only assistance or leave the government is going to the masses. Is this subsidy? They are subsidizing the fuel. That's why we are able to drive this car. But with the removal of this subsidy, I don't know how, whether we shall just pack the cars at our houses. It's very demoralizing. Now as I was passing, I just saw there is no line here. No queue. I thought they are sitting at 190, or 220, highest. To my surprise, when I entered the queue, they are saying it is 550. So I can see many cars not getting when they heard about the price. They are getting out of the queue. They are moving up.