Reword ladder section to emphasise being lower down is fine

[glennawatson]

One theme that is coming across pretty clearly from those who wrote the draft policies is that the tiering system isn't meant to be punitive etc. It's meant to represent where a project is at in the current state of their development.

Either I am thinking it might be useful to put some preamble that being at a lower level is fine, or maybe move away from the wording ladder since people always want to aim for the top tier.

It also might get away from consumers thinking they can only adopt projects in the top tiers.

I'm thinking maybe service level or similar might be better wording.

I think this has been feedback from a lot of current project leaders it puts an additional stressor with getting to the top of their project will be perceived as "not being worthy" and I know that's not the intention based of the policy.

[glennawatson]

I know @benaadams had reasonable wording in one of his comments back about what the different tiers mean. Might be worth adapting some of that in.

[clairernovotny]

@glennawatson You're completely right. None of this is intended to be punitive, even projects that either downgrade or leave the ladder should not be seen as a negative thing. That has been our view in drafting this since the start.

[haacked]

This is a great point. The term "ladder" has a connotation that you want to be climbing up. But that's not really the case here. Most of my projects will probably park at L1 or L2 and I'm happy with that.

In another thread I proposed the term "Matrix" as your position in a matrix doesn't have any positive or negative connotation.

The important thing to capture is that a higher rung (or tier) includes all the the things below it. Here's a few ideas just to get the brainstorming started.

• Project Maturity Profiles
• Project Maturity Matrix
• Project Maturity Tiers (perhaps still loaded, but maybe not as much as ladder?)

If we don't rename it, we should certainly make it clear that we're not trying to push people up the ladder. It's fine to park at any level. It's really a project decision.

[clairernovotny]

I agree that the term “ladder” gives the impression that one should climb it. Matrix may sound too technical, so I’m not sure I’m sold on that either.

Maybe we can start a thread for naming suggestions. People can vote via 👍

[haacked]

Matrix may sound too technical

It's just a 2-dimensional array. Not so technical. 😛

How about "array"?

[glennawatson]

Starting to sound like a computer science lesson :)

[reisenberger]

We/the DNF should give careful consideration to the titles for each level as well as the term describing the framework overall ("ladder" versus "matrix" etc).

• Current title: "Level 4 -- Trustworthy project": could unintentionally imply projects that don't reach level 4 are untrustworthy.
• Current title: "Level 3 -- High quality project": could unintentionally imply projects that don't reach level 3 are not high quality projects.

Level titles have prominence and will likely end up used as shorthand in conversations between devs and engineering managers - or between engineering and legal teams - about whether a given project can be adopted, so getting this right is important.

---

One approach from other domains: Bronze, Silver, Gold, Platinum. All are positive to some degree. Each is clearly an improvement on the previous. Consumers read the detailed description to determine if a given level is acceptable to them.

[svick]

@reisenberger I am a bit worried that when people see something like "the Platinum level", their first thought is going to be "I'm going to have to pay a lot of money, aren't I?"

[reisenberger]

@svick Good point, that implication would need to be avoided.

Perhaps forms of wording could help avoid that, eg: "This project has achieved Gold Trust Status [or: meets Gold Trust Standards] from the Dot Net Foundation."

Equally it could be done without invoking precious metals. Perhaps just "Level 2 Trust Status" is enough.

My main point: the risk of labelling levels with an adjective X is the implied negative "projects not achieving that are not X".

[benaadams]

Something like?

• Level 1 -- Incubator
• Level 2 -- Basic security practices
• Level 3 -- Continuity practices
• Level 4 -- Full security practices

[daveaglick]

I like “profile” for the levels. Another alternative might be “posture”.

[glennawatson]

@benaadams I would maybe just removing the numeric references in the final product but seems better.

[glennawatson]

After doing the PR #38 I changed my mind about the numeric references.

[glennawatson]

If no one has any objections I will close this issue?

[reisenberger]

I'd suggest leaving issue open a little longer. Not everybody is reading at the weekend. It is super important for the DNF to get the headline title wordings right - they will (rightly or wrongly) get used as shorthand in many adoption conversations within corporations.

[reisenberger]

Great improvements going in to the titles.

Re:

Level 2 -- Basic security practices

"Basic" can still have negative undertones. It could play out^* in a negative way in some conversations: "The project only has basic security practices." How about:

Level 2 -- Foundational security practices

"Foundational": it is still clear that it is entry-level, but it carries a stronger connotation of "something good to build on" rather than basic (connotations of "not really up to scratch", eg "it's a bit basic").

---

I'm just trying to be acutely conscious of ^*how the language chosen here by the DNF will play out in conversations within companies about adoption (making it central to the goal of the initiative, as far as I understand it, from the DNF's perspective). Only needling away at this to try to make it continuously better 🙂

[isaacabraham]

@benaadams playing devil's advocate, might someone perceive anything less than level four therefore somehow "insecure"?

I'm almost of the view that arbitrary names should be used eg apple, banana etc. Just something to get away from the hierarchical view which can be unwittingly viewed through a negative prism.