discussion: a survey of cve-bin-tool users?

[terriko]

As mentioned in the weekly gsoc meeting:

Right now, we don't know that much about our users except when they file issues, since cve-bin-tool has no telementry of any sort. I'm not super interested in building in regular telemetry because I'd rather err on the side of privacy, but we could consider doing an annual user survey to give people an optional chance to give us feedback and let us know what parts of the tool they use and where they'd like us to prioritize development.

So this thread is for discussion of what we'd want to know and why!

Some example questions to get things started

1. What types of component analysis do you use in cve-bin-tool? (select all that apply)

• binary scanning
• scanning of language component lists
• sbom scanning
• other (?!)

2. What types of output do you use?

• console
• sbom
• vex
• json
• html
• csv
• pdf
• all of the above
• I didn't even know some of these existed

Not sure how we'd publicize a survey or any of the privacy and data retention details, but step 1 is figuring out what we want to know and why because the data we want to collect will likely impact everything else in the process.

[terriko]

Per our Nov 2024 meeting -- we might also want to know about geographic location and industry. We're talking about alternate ways to fund cve-bin-tool development and some grants may hinge upon showing benefit to say, users in europe, or safety in automotive develpment or whatever.

[terriko]

Oh, and per standard privacy best practice (and also what I'd have to do before getting privacy & ethics approval to run a survey) we'd want to have

• a list of data we'd like to retain
• explanations for why this data is useful / how we intend to use it
• a retention period showing how long we want to store and use the data

I don't know how many of you have had to work with human data within a corporate or university environment, so I thought I'd just mention those expectations here in case it helps us refine what we need once we're done brainstorming!