[Roadmap] Ideas for 2022 Q3 Cycle 2 Prioritization

[iamronen]

This is the discussion to begin surfacing ideas for Q3S2.

How to use this discussion

Surfacing an idea looks very similar to ideas that have been shared in previous discussions we ask that you think about problems, (not solutions) and the impact of those problems. Consider the following questions:

• Who is your user?
• What are they trying to achieve?

Strategic Priorities

• [Strategic Focus] Interoperability  #5488
• [Strategic Focus] Communication #5487
• [Strategic Focus] Simplification  #5486

It's useful to use the following format when trying to reflect this:

When ____ , I want to ___ , so I can ___

We ask submitters to select problems that have both a high degree of impact and a high degree of alignment with our focus areas. If there's an existing issue, please reference it, if not please click here to create one.

We encourage everyone to surface ideas as early as possible so that we can start working toward a project pitch before the next prioritisation week (July 18th).

During the sprint (in parallel with development) we work together to create a pitch that can then be reviewed in prioritisation.

If you'd like to read more about pitches, or generally find out more about our preferred approach to development check out Shape Up by Ryan Singer (it's free)

[Betree]

Force admin users to use 2FA for an organization #5289

Strategic priority: security.

Our users are asking for it and it would help me sleep at night to know that admins of https://opencollective.com/opencollective/ (root admins) must have 2FA.

[iamronen]

@Betree I resonate with your desire to have this in place.

OpenCollective Root

I can see why you would sleep over this and I believe this can be solved internally by asking everyone at OC who has root action privileges to activate 2FA. This requires no development, just a bit of organizational coordination.

Activating 2FA

While looking into this issue I activated 2FA on my OC account and in doing so notice that:

1. I rarely login to OpenCollective and so will rarely be prompted to authenticate at all, let alone with 2FA.
2. Since we use magic links for login, I did not have an account for OC in my password manager and had to create one in order to store the recovery keys.
3. I, as a user, am aware of 2FA, but rarely interact with it. I suspect other users may have even less interaction with it then I did. I suspect that many non-technical users may arrive at the recovery keys screen and not know what to do with it. Practically what that means is that there, if users are forced into this without an awareness of what it is, we may end with users who have 2FA activated without having stored recovery codes.

Forcing Feature

1. I am not sure that adding an optional forcing feature will lead to a desired outcome of organizational accounts activating it.
2. In fact I suspect that only (a few?) security-conscious organizations will actually use a feature like this,
3. I suspect that others will be wary of forcing admins to do anything, especially if it means potentially disrupting their ability to work on the platform.

I wonder, therefor, if a more effective campaign would involve:

1. A social awareness campaign.
2. Adding in organization settings -> team a "2FA is active" indicator that enables an admin who does want to activate this in their org to see who has and who hasn't and to reach out and ask those that haven't to enable it.

[Betree]

I can see why you would sleep over this and I believe this can be solved internally by asking everyone at OC who has root action privileges to activate 2FA. This requires no development, just a bit of organizational coordination.

This is what we do today. Unfortunately, someone in the team deactivating 2FA or a new member added by someone who didn't pay attention would go unnoticed. We ended up in this situation recently, with 3 root accounts that didn't have 2FA enforced.

Since we use magic links for login, I did not have an account for OC in my password manager and had to create one in order to store the recovery keys.

You should never store your recovery key in your password manager as it defeats the base purpose of 2FA: if some hacks into your password manager, they'll have both your recovery keys and your password. Since we're using magic links it's ok at this point, but as soon as we implement #1738 it will become a real concern.

Practically what that means is that there, if users are forced into this without an awareness of what it is, we may end with users who have 2FA activated without having stored recovery codes.

That can happen indeed, but I don't feel like our flow is very different from what's done by Google, Facebook, Github, etc. What do you suggest to improve things there? If you want to extend the thread, I suggest we create a new [Feedback] Two factor authentication (2FA) issue to keep the conversation focused here.

I am not sure that adding an optional forcing feature will lead to a desired outcome of organizational accounts activating it.

As you can see in the linked issue, users are asking for it. Apart from them, I'm almost certain we'll want to enable it for all large hosts: foundation, europe, opensource, accountable, SCN...etc. Sounds like a big impact to me.

A social awareness campaign.

That could be interesting indeed.

Adding in organization settings -> team a "2FA is active" indicator that enables an admin who does want to activate this in their org to see who has and who hasn't and to reach out and ask those that haven't to enable it.

Such a page could be a nice addition, but it won't bring the same security benefits mentioned in this issue. Plus, it puts the burden on the admins rather than the system. I don't think host admins want to spend their time chasing people to ask them to enable 2FA.

Also note that "forcing 2fa" for an organization is a very common practice, among the companies that already do it: Github, Sentry, Facebook, Heroku. I'm actually pretty sure any large service that offers organization accounts has this feature in place.

[iamronen]

added to prioritization, but this needs to be better understood before we can commit to developing anything.

[shannondwray]

#5097 More Social icons at the top of collective profiles

This would help with communication

[iamronen]

I would link this into #5680

[BenJam]

adding the profile page revamp project to the priorities for next sprint.

[kaylarep]

#4564 Showcasing 'Updates' as a 'feed'

There are couple ideas presented in this issue, but ultimately any solution that consolidates Updates from multiple collectives together and makes them easier to view all together would be amazing for amplification. There's very rich content in many Updates

[Memo-Es]

I've been thinking about redesigning the way we display updates for them to be less financial-looking and more social-looking, if that makes sense. Right now, they are too close to transaction components, with a layout unsuitable for displaying media content, for example. Which, in my opinion, would be an excellent thing for engagement. Having that done, we then need to design the right way to have this on a public page, on a 'global' level (All OC Collectives), 'Host' level (Updates coming from hosted Collectives), and 'Collective' level, that would be basically the redesign of the current 'Updates' section in the Collective page.

If we do grab this one, I would like to tackle it together with #1445 :)

[iamronen]

added to board for shaping

[natehn]

#5769 Collective admins can create pending contributions.

I think this could be very impactful! Right now we are using spreadsheets and tracking tons and tons of emails to do this.

[iamronen]

added to board - needs to be better understood - what would it take to make this whole and what implications there may be

[BenJam]

I think we already have this, no?

[alanna]

@BenJam what do you mean we already have this?

[natehn]

I commented also in the issue itself. We do not already have this - but yes, this would expand an existing feature.

[natehn]

And potentially, to some degree and depending on the design, bring some of the functionality of adding funds into the pending contribution side of things, for Host admins.

[natehn]

#5458 Contribution and Expense Methods: Add Venmo option (through PayPal)

I think it is worth our time to scope out how much work this would be - for both contributions and expenses.

[iamronen]

added as surfaced idea that requires more attention (especially given our recent troubles with PayPal?)

[alanna]

#4747 Extra reminders for missed pending expenses

This is a simple one (just re-send the pending expense notification to admins gain after 7 days if it hasn't been approved or rejected) that I think would help Collectives get more of their money spent, and improve the experience for people who otherwise are left hanging waiting for their expense payment. I think it fits with both communication and simplification.

[iamronen]

added to the prioritization board

[alanna]

#2694 Ability to report undesirable comments, orders and profiles

We have done some good work in the area of reducing spam and fraud, but we haven't fully implemented the system we envisioned where users can report all kinds of content. I think if we continue to scale, this will be more and more of an issue. I suppose this fits under "communication".

[iamronen]

I've added this to the board as "surfacing". This is a large project that requires major product attention.

[alanna]

#5229 Allow all admins to see draft expenses

This would address simplification and help users have a smoother experience. I don't see any reason to hide draft expenses from admins.

[iamronen]

I've added this to the prioritization board.

[alanna]

Add Financial Overview Visualizations to Collective Profile Pages #5704

This proposal is shaping up really well and could be a huge step forward for transparency and ability for Collectives to manage and communicate their budgets. When we built the host report dashboard we always imagined something similar for Collectives, and now maybe it's time.

[iamronen]

this has already been prioritized for Q3S1, though it looks like we do not have the resources to execute on it currently and so it may have to be re-proposed for the next cycle.

[BenJam]

I dare say that this could run into the next sprint so still useful to have it represented here.

[Memo-Es]

+1

[alanna]

Fees page dropped from application flow to /foundation #5685

OCF needs the fees info to be included in the application flow. Furthermore, we've talked about using the OCF form as a template for other hosts who want custom applications, so we should ensure it's sound.

[iamronen]

added to prioritization board

[BenJam]

seems like a papercut to me (page routing incorrect) rather than a big thing. paging @znarf

[alanna]

@Betree can you look since @znarf is away?

[znarf]

It doesn't seem to be surfaced in current sprint (Q3S1) prioritized issues.

[alanna]

Integrate with accounting software

This is requested pretty much every time a new host joins or considers joining, and we lose potential hosts on this issue alone. We have a range of options we could take in this directions, from MVP to more complex features. But if integrations is a priority, this surely is one of the top requested.

• Integrate with accounting software #3983
• [PROJECT] integrate with accounting tools and practices via exports and reports #4396
• Simpler version of CSV export for accounting data only #5670

[natehn]

Quickbooks is the one I hear mentioned a lot too, and when I say that it doesn't have a QB integration people are visibly disappointed. Adding the integration would make a big difference for hosts and could lead to increased revenue through new hosts.

[BenJam]

bringing a conversation over from slack:

while I agree with many of the benefits that integrating with QB would offer I am not sure that the current situation at Open Collective Foundation would be solved. Open Collective does not model multiple holding accounts (bank account, PayPal, Wise, Stripe Issuing Balance etc.) as a function of the host's total holdings, so transactions between them are of no concern to Open Collective currently. To solve for this we would (I think) need to model those accounts and potentially the policy that we employ today, for example:

• there are $10k of expenses to pay, $8k are bank transactions, $2k are Paypal
• the balance in Wise is $20k and Paypal has $1k so I choose to top up Paypal with 2k as a float

Open Collective doesn't currently mandate any rules around topping up those holding accounts, so in addition to integrating QuickBooks we would need to build some capacity for Open Collective to recognise those top up transactions as moving money around inside the host in order to reconcile them against transactions that come in with from the bank account through QuickBooks.

Either way I think this is going to need a fair amount of work to scope out so, if we think this is likely to be our biggest priority for next quarter (or more) let's get started...

[alanna]

Yes a full feature for this would be a big project. But I think it's worth digging into and scoping to see if there are any MVP ideas and to get a sense of what's actually needed from Hosts. Almost all potential new Hosts ask "How do we integrate OC with Quickbooks/Xero?" and our own hosts have to solve the same issue, so I do think it's important.

[BenJam]

How do we integrate OC with Quickbooks/Xero

Is a solution looking for a problem. What do they actually want to achieve? That transactions from Open Collective appear in QuickBooks to reconcile against their bank account? Do they want to automatically allocate incoming transactions in Open Collective? Do they need to do the same for expenses?

I need to complete this picture in order to push the project forward. Introductions etc. appreciated but 'integrate plz' doesn't provide enough context to solve the problem.

[alanna]

@BenJam they want to fulfil their tax reporting/audit obligations as easily as possible. For 99% of organizations that amounts to using an accounting package like Quickbooks and making sure 100% of their transactions are coded in it properly. Hosts currently have to deal with OC and their accounting systems in parallel and they don't talk to each other, so keeping them synced is a lot of work, and prone to painful errors (like the recent OCF situation).

[alanna]

Manually subscribe to Updates #1445

I think this is one of the highest-value features for the communications priority. Email newsletters are one of the core tools for community engagement and communication. While our Updates feature is simple, it achieves most of what many groups need, but this one thing is holding it back. Most Collectives I'm a part of have to maintain a separate newsletter list because they want to reach non-contributors too. If we offered this feature, I think groups would get even more investing in OC as their audience would be built up on our platform.

[BenJam]

+1 to this, we know that many open source supporting organisations currently support projects with time from their staff. It would also help if the company is supporting a project off the platform through something like Patreon. Would love for this to be included in #5745

[iamronen]

added to board for shaping

[alanna]

Improve Root actions

Anything that frees up dev and ops team capacity is great, and these actions would help simplify our support workflows.

• Root action to change profile type between individual / org #5771
• Move added funds #5651
• Root admin view to edit an account #5374
• Move contributors between tiers #5000
• Root admins action to ban/unban accounts #4848
• Root admins to differenciate "Trusted hosts" #4841
• Root admin action to change the status of a tax form #4805
• Reset 2FA from root admin dashboard #4714
• Root admin action to delete accounts #4684
• Do not create duplicate memberships when merging accounts #4648
• Root admin action to enable/disable features for an account #4627
• Move expense between Events, Projects, and the parent Collective #3981

If we're taking this on, we should probably also look at: Add a special permissions group for members of the support staff #4628

[BenJam]

most frequently I find myself needing to add myself as an admin to make some changes/contriobutions on a collective's/fund's behalf... But I've never seen that come up ¯_(ツ)_/¯

[alanna]

Yes I need that too @BenJam - can you raise an issue for it?

[BenJam]

FYI I added this to the prioritisation board #5906

[alanna]

Host admin can unhost Collective #3330

We ended up putting a bandaid on this by adding it to root actions, but it's still a big compliance problem waiting to happen for all other hosts.

[alanna]

Incognito add funds #5453

This one is a process that's currently extremely complex, but could be simplified quite easily. Host admins should be able to select incognito when adding funds.

[kaylarep]

Virtual Card Edits #5410

by now, we are getting more clarity about how we/users use virtual cards. Would be nice to tackle some of the issues/feedback from this issue.

Apologies for this issue being a mess, if we choose to prioritize this, I will plan to reorganize it all as separate issues within a Project

[iamronen]

@BenJam please have a look at this,
There are plenty of well-understood needs here but this needs some product attention in order to shape it into a coherent, well bounded, perhaps internally prioritized project. I have a feeling that the things in here can quickly add up to a rather large project.
I've added it to the board as requires shaping.

[BenJam]

I closed this one in favour of the feedback issue which i linked all the feedback up into, worth having a session on this before going any further.

[alanna]

Attach files/notes to Collective #4894

This would really help with simplification and communication for us as a host admin team. We have to track lots of things like contracts and grants associated with a Collective, and linking docs directly would be super helpful.

[iamronen]

added to prioritization - requires shaping

[alanna]

For MVP even a simple text box only visible to Host admins would be quite useful, where we can put notes and links to files in Drive etc.

[SudharakaP]

Add Further Filtering for the /search page #5793

This has been suggested several times although I don't think we have a clear consensus on what we want to achieve here. Nevertheless maybe a discussion to scope this out might be helpful. 🤔

[kaylarep]

#5689 Collective cards in the 'Contributions' section appear as they do in search queries - with Tag descriptors

Currently the collective cards in this section do not share much information. This is one of the only places on the platform where all of a host's Collective's can be viewed all in one place 'at-a-glance'

Will also help amplify Collectives (Communication strategy)

[alanna]

Host admin can set date when confirming contribution #5693

This is a small thing that would be very helpful to simplify accounting processes.

[alanna]

Record merchant account timestamps #5817

This is a request coming from OCF's accountants in relation to improving internal control processes.

[Memo-Es]

Onboarding flow - Find a host #5672

Follow-up with the work to improve our onboarding flow, specifically with the experience to find a host, embedded inside the onboarding flow for Collective admins.

[BenJam]

added to the board under the onboarding project.

[Memo-Es]

Tiers follow-up work

• Custom image for tiers
• Tiers for sponsor organizations setting

*This one is part of #5732

[alanna]

Bug fixing 🐛

We have around 130 open bug issues. Let's consider if we want to set aside space to squash some. It's hard to know how to group them but here are some I think are clearly scoped and either quick easy wins or especially causing pain (and not already being worked on actively). If others want to suggest their own pet bugs 🪲 please do.

• Recurring expense payee not sticking #5820
• Broken search cards layout when too many/long tags #5751
• Collective name and project name is ignored in project url #5749
• Some images from long descriptions are not loading because of CSP policy #5728
• Collective Tweet job crashing #5719
• Fees page dropped from application flow to /foundation #5685
• Large image breaks social share #5659
• Can't reset the location of an event #5490
• Firefox mobile not displaying errors on required fields #5473
• Collective balance > GRAPHQL_MAX_INT #5452
• Taxes refunds are not recorded properly in the ledger #5438
• 'Pending' Application appears as 'Already Hosted' #5392
• Wrong payment method on invited expense #5359
• Events Reading US DST Unusually #5286
• collective-page Profile Page ordering "drag&drop" glitches/freezes/breaks #5228
• New Comment on expense notification: Wrong name #5207
• Number of contributors does not match the number of contributors displayed #5180
• Duplicate incognito profiles (they're not being re-used) #5101
• Events and projects not displayed in the user menu for admins #5077
• Add tax form support for cross-host expenses #5068
• Fix locale detection in formatCurrency #4988
• PayPal payouts not considering payment processor fees #4953

[alanna]

Improve validations in the expense form

Bringing this one @Betree previously suggested [in his words] as it's still causing a cluster of related issues that create a very un-simple user experience flow for expenses.

Complexity: 1-3 days (medium)

We had many issues in the past with the expense flow being unexpectedly blocked and it's still happening to us in different situations. This started after the introduction of grants, where we started disabling the Cancel/Prev/Next buttons if there was an error in the form (even if for some reason the error was made on another step).

The following issues result from this root cause:

• Improve validations when inviting expense payee #5020
• Mandatory fields not marked when inviting organization to submit an expense #5222
• Unable to cancel editing expense #5429
• Edit: Incomplete payout details breaks invite expense flow #5306 also originates from this

It's a really annoying bug because you're basically trapped when it happens to you, everything is disabled and there's no message to explain what's wrong. I had started opencollective/opencollective-frontend#7533 to solve this and would like to take some time to finish it.

[BenJam]

this is already on the board for this sprint https://github.com/orgs/opencollective/projects/5/views/24

[Memo-Es]

#5680 Collective page revamp

This is a significant issue because it adds value to two of our most essential flows: Contribution flow #5732 and onboarding flow #4829. We have been discussing differentiating our profiles, which is the first step.
I estimate two sprints back to back to work on this one, the first one right after the retreat focused on the final definition and design, and the second one to implement it.

[alanna]

Projects and Events can have their own different admins #4611

I think this relatively small change would unlock a lot of potential and users keep requesting it. It speaks to the communication and simplification priorities because it would enable people running specific events and projects to get notifications and take actions relevant to their own areas. Right now unless a Collective wants to make someone an admin of their whole thing, the current admins have to take a lot of actions on behalf of the actual organisers of the event/project and it's messy.

[kaylarep]

Custom payees without invitations for invoices #5894

Submitted from user feedback

we need to be able to add expenses easily to our collective's page. We can't invite companies to be "payees" when adding an invoice. . For example, we use DigitalOcean for hosting/infrastructure. They charge us automatically every month. We can't invite them, but we need to track that expense.

[iamronen]

This thread is CLOSED for proposals.

Additional proposals can be submitted in the discussion thread for Q4S1

[kaylarep]

thanks for adding this note!