2018-11-06 Meeting notes

Stepping through the Jan doc Jan 11, 2018

1. What users are we currently serving with each service
   1. caDSR - LexEVS RMI
   2. CTRP - branch EVSRestAPI
   3. cancer.org - CTS2 - look through email to get specifics
   4. Editor representatives of CDISC, other value set consumers
   5. Various downloaders with local installs
2. What "types" of assets do we have
   1. RMI api
      1. compare application
      2. ncit and ncim browsers
   2. LexEVS rest api
      
      1. lexevsdocs
   3. EVSRestAPI - 2 branches
      1. CTRP
      2. NCIt focused
      3. report writer 2
      4. new browser
   4. Term Suggestion
   5. URI Resolver
   6. Value sets
   7. NCIThesaurus mail address
   8. SPARQL endpoint
   9. wiki
   10. FTP

Identify and prioritize areas where we need technical writing

• Overview document - simple, 6th grader document. Refer back to Sherri's example page.
  • If you are using java go here
  • if you are using rest go here
  • if you need to browse - go here
  • If you want the ontology or research information go here.
  • etc
• Administration manuals
  
  • Browsers
  • LexEVS loading
  • Jenkins projects and procedures
  • Value Sets - loading and debugging
• User manuals
  • Browsers
  • Report Writer
  • LexEVS REST
  • EVSRestAPI
  • SPARQL REST

Should be part of Inventory. Not in scope for future services planning.

Might be leveraged to create RDF import to triplestore. Joann Wong administers server?

Used differently in different documents. Clarify that we mean electronic data services (better description?)

Software services

Technical services

GitHub crawl report highlights issue - how do we rapidly respond to security issues.

Requires investigation of possibilities and risks each time.

Architecture issue? Microservices might help compartmentalize risk and effort.

Spring version interdependence requires wide updates - for LexEVS RMI.

EVSRestAPI uses Spring boot and it handles versioning of Spring dependencies.

Options: deploying a jar with embedded container is attractive, but raises security issues. Systems uses containers fronted by Apache.

Current issue with spring - Kumar setting up meeting? Updating Spring would force RMI users to update jars. Need to notify stakeholders. Does this matter to security? Is NHS getting these reports and holding us accountable, or is this a CBIIT local issue? How important does CBIIT consider this to be? Who is in charge of this now that Phil Hartman is gone?

Is AppScan testing Rest APIs appropriately?