►
From YouTube: CNCF SIG Security 2021-03-29
Description
CNCF SIG Security 2021-03-29
A
A
Well,
I'm
sort
of
kind
of
the
lead,
usually
okay,
so
yeah.
Let
me
let
me
tell
you
a
little
bit
about
sync
security.
So
basically
it
started
as
kind
of
a
a
working
group.
That's
called
safe
or
something
like
that
and
then
became
an
official
thing
under
the
cntf
and
around
that
time
it
really
started
to
take
off
and
they
got
more
formal
structure
and
things
like
this,
and
so
one
of
the
things
that
a
few
people
did
is,
for
instance,
I
started.
A
So
I'm
a
tech
lead
I'm
currently
in
shanghai.
I
don't
know
how
much
longer
I'll
be
here
I'll
either
be
here,
maybe
two-ish
months
or
I
will
be
here
until
after
christmas,
but
I'm
unsure
about
that.
Yet
and
while
I've
been
here,
I've
been
trying
to
get
the
asia
pacific
folks,
like
things
to
kind
of
spin
up
a
little
bit
more
yeah,
but
I'm
very
surprised.
It's
three
minutes
passed
and
there's
no
one
here.
A
B
So
we're
a
bit
of
an
interesting
position
that
we're
kind
of
some
were
able
to
bring
some
of
that
technology
or
learnings
from
those
that
have
adopted
fully
cloud
native
and
bring
them
back.
But
yet
also
other
business
units
are
selecting
like
the
right
projects
for
themselves
and
it's
kind
of
yeah
a
lot
of
for
me.
B
This
is
kind
of
I'm
new
to
this
space
in
terms
of
like
kubernetes,
at
least
and
cncf,
and
I
just
really
wanted
to
surround
myself
with
the
community,
because
I
think
there's
a
lot
of
design
patterns
and
learnings
in
the
way
that
applications
are
deployed
and
modeled
and
so
forth.
Using
cncf
projects
that
help
security,
and
so
I
kind
of
just
trying
to
surround
myself
and
try
and
absorb
as
much
as
I
can
and
contribute
back
from
my
own
learnings
in
my
career
experience.
A
B
A
So
it's
a
little
bit.
You
know
it's
kind
of
different
knowledge,
but
it
seems
to
be,
I
think,
a
very
solid
project.
It
handles
a
secure,
introduction
problem.
How
do
you
take
an
ephemeral
thing
and
give
it
keys
and
identities
and
stuff
like
that?
Without
you
know
having
to
worry
about?
You
know
a
man
in
the
middle
a
you
know:
malicious
parties
doing
a
bunch
of
things.
It
has
a
bunch
of
really
strong
parts.
A
Let
me
think
about
what
else
those
are
those
are,
I
think
ones
that
come
to
mind
and
full
disclosure
like.
I
I'm
the
creator
of
the
tough
project
and
one
of
the
creators
of
the
in
total
project,
so
yeah,
but
then-
and
obviously
I
don't
know
if
you
know
notary-
is
an
implementation
of
tough.
That
also
has
some
other
functionality
in
it
to
integrate
better
into
cloud-native
environments.
A
A
A
A
They
will
be
a
man
in
the
middle
right
and
the
goal
of
tough
is
to
provide
you
the
best
security
possible
in
any
of
those
type
of
environments,
while
so
have
like
a
graceful
degradation
of
security.
So,
for
instance,
if
you,
if
a
man
in
the
middle
controls,
all
your
network
traffic,
they
you
know
should
be
able
to
stop
you
from
downloading
an
update
by
just
you
know,
failing
to
deliver
the
bids,
but
they
can't
put
malicious
software
in
an
update
or
do
something
like
that.
A
So,
basically,
when
you
make
your
software,
you
sign
git
commits
check
them
into
a
repo.
You
run
it
through
a
build
farm.
You
have
maybe
a
cacd
pipeline.
You
do
testing
you
package,
it
you
contain,
or
you
know
whatever
you're
doing
containerize
it
you
go
and
you
deliver
it
and
in
toto
produces
cryptographically,
signed,
metadata
and
checks
through
all
the
steps
that
occur
there
and
so
you'll
know
something
like
you'll
know.
A
If
the
build
server
manipulated
your
files
and
added
something
in
or
if
you
know,
someone
didn't
actually
run
the
tests
and
they
push
something
and
it's
it's
all
like
cryptographic
signed
and
verified.
So
it's
assumed
that
those
boxes
on
your
network
are
not
perfectly
trusted,
and
so
there's
been
a
lot
of
interest
in
this
because
of
the
whole
solar
winds,
attacks
and
the
things
related
to
that,
because
in
toto
is
basically
the
only
thing
that
really
has
a
hope
of
protecting
against
something
like
that.
B
A
Yeah
they
do
they
integrate
well,
datadog
did
a
deployment
with
them,
and
we've
also
really
in
toto,
goes
as
far
right
as
tough
and
even
actually
further
right.
Also,
it's
it's
like
more
overarching,
but
like
datadog,
actually
put
out
a
nice
blog
post
where
they
talk
about
how
they
did
their
tough
and
in
total,
combined
integration
along
with
a
bunch
of
stuff
with
git
signing
and
stuff
like
that,
and
we
actually
oh
cool.
A
Actually,
we
found
the
we
found
a
bunch
of
design
flaws
in
the
way
git
signing
worked
and
got
them
to
change
the
way
they
do
tag
signing
over
to
our
architecture
about
four
years
ago,
or
something
like
that.
So
we've
been
kind
of
pushing
at
different
points
in
this
like
software
supply
chain,
for
better
words
of
it
for
the
last
I
don't
know
for
a
long
time
and
slowly
kind
of
securing
them
and
making
them
better
and
better.
A
B
That's,
that's
quite
all
right,
yeah,
it's
good
to
just
start
off
with
some
something
somewhere
in
space,
and
I
can
go
away
research
that
and
see
how
that
could
work
for
us
and
and
likewise
how
I
can
contribute
back
is
a
in
terms
of
these
general
meetings.
Is
there
anything
else
that
goes
on
or
is
there
anything
expected
of
members
that
participate
people.
A
It's
mostly
somebody
says.
I
think
this
is
a
good
idea.
We
need
a
white
paper
on
this
or
we
need
to
create
a
document
on
this
or
we
need
to
do
this
and
then
they
rally
interest
around
and
they
start
it.
It's
not
like
a
you.
Don't
have
to
have
a
motion
to
have
a
you
know
to
have
a
document
created
to
do
this
and
do
that.
You
know:
there's
no
like
there's
not
like
high
overhead
in
in
doing
things.
A
People
just
tend
to
do
them,
and
if
they
get
momentum
then
they
tend
to
be
really
successful.
So
yeah
and
we'll
have
more
discussion
about
that.
In
fact,
I
think
if
you
watch
the
meeting
about
that
was
two
meetings
ago.
We
talked
about
a
lot
of
that
and
I
didn't
watch
the
video
from
last
meeting,
but
that
should
have
had
some
as
well.
A
Yeah
I
mean
you
have
some
of
that,
but
the
problem.
Sorry,
the
problem
is
that
this
there's
only
usually
one
or
two
people
that
overlapped
the
two
meetings
because
they're
in
semi
time
zones-
and
so
sometimes
we
do
have
that
spillover.
Jj
is,
I
think,
he's
one
of
the
chairs
he's
been
to
both
meetings
a
couple
times
and
emily
fox
is
a
chair
and
she
was
in
the
meeting
last
time
that
I
wasn't
able
to
make
it
to
so
yeah.
So
we'll
it'll
happen
from
time
to
time.