OWASP Nest Sponsorship Program

[arkid15r]

Hello everyone,

I’d like to start a discussion about a new idea -- an OWASP Nest sponsorship program. This initiative is entirely separate from GSoC and will operate as a standalone effort as long as funding is available. The initial funding will come from the money I earned as a mentor during GSoC 2024 (over $1200 USD).

The idea is to let project leaders put a price tag on interesting and complex (typically full-stack) tasks that need to be implemented. Each task will have a strict deadline and acceptance criteria (covering functionality, tests, and code style) to ensure quality. We also need to carefully design the task assignment process to prioritize candidates who have already demonstrated their skills on similar, though perhaps simpler, tasks rather than assigning them to newcomers.

Payments would be handled through the GitHub Sponsors program, and in the future, this sponsorship program will be integrated into the Contribution Hub. The design and implementation of the task assignment mechanism (possibly via a Slack shortcut or another method) is WIP.

I invite you to join the conversation here or in #sponsorship channel on OWASP Slack and share your thoughts, ideas, and feedback on how we can shape this sponsorship program to support our community effectively.

[yashgoyal0110]

This sounds like a fantastic initiative to incentivize contributions and ensure high-quality work for OWASP Nest! A few thoughts and questions to refine the idea:

How will task pricing be determined? Will there be a standard rate or will project leaders have flexibility?

Prioritizing contributors with prior experience makes sense. Would there be an "entry-level" set of tasks for new contributors to prove themselves?

Could we use GitHub Issues labels (e.g., "Sponsored Task") alongside a formal selection process?

[arkid15r]

How will task pricing be determined? Will there be a standard rate or will project leaders have flexibility?

I believe the project leaders should have a freedom to determine the price they are willing to pay for a task depending on its complexity/urgency/etc. But I think there should be a minimum price enforcement.

Would there be an "entry-level" set of tasks for new contributors to prove themselves?

It'd be great to have them but it's also depends on the specific projects. For now for OWASP Nest we have a good pool of contributors to test this PoC on.

Could we use GitHub Issues labels (e.g., "Sponsored Task") alongside a formal selection process?

Yes, that's a good option to somehow mark tasks available for sponsorship

[Naveen-Pal]

Great initiative, and I really appreciate your generosity in funding this!

Few Questions:

1. Can the tasks be subtasks or full tasks from issues labeled GSOC' 25, or are they entirely separate from GSoC labeled issue?
2. What are the different task categories in terms of time commitment (e.g., 20 hours, 50 hours, etc.), and what would be their corresponding bounty amounts? (on average)

[arkid15r]

1. Can the tasks be subtasks or full tasks from issues labeled GSOC' 25, or are they entirely separate from GSoC labeled issue?

They can be similar to those in terms of complexity but I'd prefer to keep it fully separated from GSoC program to avoid any confusion.

2. What are the different task categories in terms of time commitment (e.g., 20 hours, 50 hours, etc.), and what would be their corresponding bounty amounts? (on average)

This is very specific suggestion, we should consider how to measure the tasks' complexity/time. It'll be totally up to project leaders how they determine the price for a task but I expect some hard/recommended threshold in the system itself.