Cloud Native Computing Foundation Security Special Interest Group, 3 Mar 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: CNCF SIG Security 2021-03-03

Description

CNCF SIG Security 2021-03-03

A

A

B

B

Sorry, I beat you emily to the attendance list.

C

No worries I was actually getting ready to copy the template over, and I saw somebody else had just done it when I almost hit control v.

D

Sorry I clean responsibility for.

E

D

um So emily, how? How long will you need for your section? I just want to time it out since ava will be joining half an hour. I.

C

Can't imagine I would need more than like maybe five minutes I mean you guys know how fast I talk so okay, but there might be a lot of conversation aside from me explaining it. So I would, I would probably venture on 10.

D

Okay, okay sounds.

D

D

All right, we give it five minutes. Just let people join in see couple folks connecting.

F

D

All right cool, it seems like we have. um Let's say most people join. So let's just kick this off um so as usual, and this meeting is being recorded and cncf guidelines uh applied to this um all right. So I'm going to go through the list of attendance, see whether we have any announcements.

D

um So, let's start magno. I think you had one. Do you want to.

B

Like sure sure yeah uh just a reminder for that or march 17 meeting that we're gonna have uh jen burns since the the last one was cancelled. Talking about tech for containers, some people asked me to remind them about that. A few meetings earlier. So I'm doing that.

D

Awesome: okay, yeah, looking forward to that um that was on the attack matrix right.

B

Exactly on attack for containers, yeah and kubernetes, as well, yeah.

D

Cool all right, uh emily has legend item, so good updates.

D

D

um All right and diego, I'm assuming you updated. This is in the agenda item right, so we covered we're going to cover that later, yeah, okay, uh ash. Thank you for volunteering subscribe. um So let's get started before that. Any other new folks, new introductions.

D

Cool all right, so, let's get started. uh I think that the first, uh the first issue that that we have from the agenda is actually above the cloud native security map. um So um we presented a few weeks ago about the version.

G

D

Of cloud native security landscape, which you can call the cloud native security map, and so we have started a new project now, which is going to be kind of like the the first version one of this native security map. So I'm gonna share my screen really quick here.

D

um All right, so we have this new new issue now, so we we've sent out the email to the cognitive on the security mailing list, so you can look at that to kind of get a good idea of what it's about, but the information is also encoded over here in a different way.

D

So this is really what we're doing is. uh This is taking the concepts of the white paper. uh We are mapping it onto a cognitive security map which really focuses on the the more practical, um practical use aspects of it. So, looking at things like the different projects which you can use on different aspects of cognitive security as well as you know, um what are some examples of things that you could do.

D

Oh, are people having issues with google docs? We are open to flavors of the of this right, so this is vanilla. Maybe you'll do like magnesium with the chocolate for the next iteration you'll. Slowly, add more spice into it.

D

All right um so uh this stands for the previous issue, uh but I kind of wanna really go down into details of this. So uh what we're doing is we're trying to scope this down, really uh bring down several aspects of the original vision, which is like removing some of the thematic aspects. First, focusing on the content- and we hope to get this done by the end of march, at least to have a ready prototype in which we can start refining a little bit and then we're hoping to kind of launch this coupon eu.

D

So this is where we're going to get a lot of additional eyes on this, um and hopefully you know bring this the next chocolate version or strawberry or whatever um so kind of uh uh as an overview. So this, uh together with uh ash and diego, uh we are coordinating this effort, so this is kind of like a quick markup on what it would look like so cognitive security map. So you have the different stages of the life cycle and the cognitive security white paper, so you could go into the different ones.

D

You know security tracks, different ml tests, you go in and you can go into um distribute. You have different aspects of it right, so it's a good way to kind of like explore the different areas of security, and so a lot of this content right now is just content from the white paper.

D

So um diego and azure are going to go through the content aspect of this. So right now, it's all just five people um content. uh What we are planning to do is to you know, include additional details of okay. Here are some projects they can use. There are some examples that that you can carry out as reference for for implementation.

D

So let me go back to the issue.

D

So I, if you're interested and we've got some comments written here. um I think the the next um kind of big point to look at is really this cognitive security map, um google document.

D

We have already some contributors there, putting the name down, so we are looking for contributors both uh in two areas. One of them is in developing kind of the website that we saw earlier so if you're interested in that um do put put down your name in the issue and say that you're interested in development- and we are also looking for content contributors.

D

um So I think diego. Do you wanna diego, actually wanna kind of talk about context, contribution.

H

Yeah sure um so yeah you want to keep the the document open and we'll be fine and I'll have to share yeah.

D

Just let me know where you're gonna go to.

H

Yeah so as brandon was saying, um we would love more contributors to in this effort and in this document that it's linking the issue and just please ping us either put a comment in the issue or see the dog that we are specifying in a channel at the top of here on the edge. You can see the slack channel that we are and just um tell us that you want to help, and here in the document how you can contribute.

H

You can include your name in the contribution table, so here we will assign these specific topics for to each person that wants to help, and if you go a little bit up to the document, we are putting the example on how it's going to be in a specific section that you can add.

H

It's a identifying the projects that are relevant to that area and putting some examples of why that it's a a good example of a practice and even extending other links for more context and information on that topic, and I think that that's the the main thing for now, but we have you, can see in the table a few.

H

A few areas that we need help and yeah the more the merrier and yeah. If you have any questions, please bring us to ash brandon and me and comment in the show, the slack channel. We will um happily impress you to contribute.

H

Did I miss anything else? Yeah.

F

Yeah, I think about everything.

F

Just uh yeah, one more thing to add would be uh the projects in the list can be uh open source projects, uh preferably cncf and other non-cnc open source projects uh and we're also accepting some like commercial projects as well in the list of projects, uh but they'll be lower priority compared to the open source, one so feel free to uh add your name to the contributing uh the subject you want to contribute to and then add the projects in the examples that that you want to contribute as well, so yeah so happy to help you all with those contributions and if you want to contribute to this network thanks.

B

um uh Bj, do you wanna mention what we discussed in the earlier meeting about the white paper and and the branching.

A

B

Of that that paper to this map.

B

B

Okay, uh so yeah I'll go ahead and talk about that, like we had a previous meeting uh me pj and alex about the retrospective of the white paper at the survey that we want to send out to people about the the white paper and- and so we thought at least we discussed this- that um the white paper is more uh uh okay, sorry uh yeah feel free to chime in uh so the white paper is more like a awareness document right so to raise awareness for cloud native and everything.

B

It's not a it's not a tutorial. It's not a cookbook. It's not it's! Nothing like that and we understand that. But we hope that people uh will understand that as well, but but like if, if someone wants to implement a specific section of that white paper right that that the best practice of security, uh uh specifically, let's say for runtime protection right so where? Where do? Where? Should I go right? So what where they should?

B

Should they look for right and we thought that a good idea would be to have this uh this map as a more technical and more detailed uh information from from the white paper instead of having the white paper with like a lot of technical information, I'm not sure if that makes sense.

D

No, I think I think that's that's well said, and I I hope that this this document will kind of like be at least half half of that requirement right. I think that we are still um not going to be at the point of like the cookbook or something, but definitely it's going to be like some starting guidelines to kind of get things started.

D

I think cliff notes if you.

I

Don't mind me kind of chiming in, I think cliff notes are great here right because look they're already in the inundated with you, know, guideline books and best practices right this to me, cliff notes is I use the term if nobody's familiar. It's just like basically like a tldr. This is like a tldr, but it works right yeah.

I

So that's a good way to to put it my brain's, so small. I can only process things in that way.

D

All right cool uh any other questions. We will follow up um as diego and myself we'll follow up on on those uh they have commented. The issues to kind of see see what would be good faces to to kind of pick up, but you know this is good. This is going to be a fully color predicted document. So, even if you just request access I'll give you extra start, writing stuff feel free to go ahead. No one's stopping.

A

So uh brandon just a question, so in each section we need to mention different projects like, for example, we we can take service mesh or anything right, so so projects can be mentioned. But what you want under examples are these more oriented towards different use, cases that that could be solved or or what what should be under examples? Is it use case or is it I mean? Is it right post what what is it.

D

So so the idea of examples really um the the motivation behind it is that uh is to provide like a better illustration of if someone says resupply paper and it's like okay, I need to do this this and that um and then the next question is like how do I do it? So the examples are supposed to serve as a way to say that: okay, uh a control for example, for image, um image scanning or application manifest scanning is, you know you should not run uh application.

D

Manifest should be scanned so that they're not running as a root user, for example.

D

So something I I think it also depends on the specific topic, because some topics are a bit broader than others, uh but the the main idea is, you know it should be uh feel free to really go down into a specific specific example. So in in this case, for application manifest scanning uh you can. We say that you know prohibit, contain images that use the latest tags um you know prohibit uh and for certain registries for containers and things like that so kind of like ideas um that people can look at and be like.

D

Okay, maybe this is something that I can do and you know obviously not a comprehensive list of all the things they can do, but at least gives them an idea of what they can do.

A

Okay: okay, yeah thanks thanks a lot.

D

J

Super quick observation, if I may, this is great stuff by the way on the title of this activity stream. Would you mind renaming this to plane from vanilla, we're an international community and like the nuance of.

G

J

Lost in people, so if we want to call it like plane or high level or basic, that's probably more descriptive.

D

I was going the the android route with naming oh yeah. I I think that it wasn't so much kind of like this would be the plain one, but it's just like a versioning, a versioning game. Okay,.

D

Cool, uh if not, there are other examples in the sdk, and I have already put some. I think um this one was actually written by car reporters written by someone else from the apec apec meeting um but yeah. This is a ton of stuff, that's written here, so you know free, feel, free to take a look at other stuff and then um right, based on that cool.

D

If not, that sums up um this section and um any last questions before we proceed with the agenda.

D

All right, it's not emily audios.

C

Okay, so this is actually kind of exciting, because it's a little bit more actionable for the community, um so we had so we merged in the new security review process. If you have not read it, please go read it. It's very awesome. We're extremely excited about our next projects coming to us for a review that way we can test it out.

C

But to that effect, the security review process, which I talked about last time, is broken up to better align with the project maturity.

C

So we, the co-chairs, had a wonderful meeting with our talk, liaisons liz and justin, to discuss these new changes, and we were trying to discover a way that we could introduce security for non-security, focused products in the cloud-native ecosystem, and one of the recommendations that we came up with was this concept of a security buddy, and what that means is we'd like to look at a one or two non-security focused sandbox product projects to take advantage of our self-assessment template, which is new and the security review process and assign somebody from the sig to engage with them and kind of walk them through completing the self-assessment.

C

Now the self-assessment is designed to be excuse me that initial understanding and self-reflection of a project's state of their security, the security buddy, would explain security concepts to them, potentially have the opportunity to join a security, focused mailing list for the project to help guide the project in making more informed security decisions.

C

The intent is not to have them, be a developer or a contributor on the project per se, but to be more of an independent security advisor.

C

This model is currently in use by container d, which is actually really neat, there's a lot of good information on it, but I wanted to propose it to the group to kind of get generate interest, see who would like to be able to learn more about a project?

C

That's currently in the sandbox stage, walk them through what a self-assessment actually looks like and start engaging in those conversations, it's a good way to bring more non-security projects into a security behavior and also expose them to different portions of the cncf, as well as that cross knowledge and collaboration within the group.

D

So I guess a quick question I I guess some of these details may not be be kind of formed up yet, but this is uh something that the toc is gonna say: okay, every sandbox project will be attached to someone um for certain amount of time, because I know like projects can be insane about so yeah.

C

So this is not at this time, determined to be like you are fixed to the hip for life. This is more just that initial jumping off point to get the projects to think more about security. It's also to provide the talk with evidence of this new security review process and how it could potentially be applied to non-security cncf projects, which is the next logical progression that we'd like to see projects move in. We want. We want the sig to not just perform security reviews on security, focused projects because they're already thinking about it.

C

It's the rest of the ecosystem that could potentially have significant value added, even from the most lightweight review, or even discussions about the state of their security.

D

Is there any particular reason why it's targeted sandbox, not occupation or anything else,.

C

um It could be incubation, there's a fair amount of projects.

C

Give me one second, so not really anything in particular, but we figured if we started with a project that is early enough on in their maturity. The self uh the self-assessment better aligns with that, whereas projects that are coming to us for incubation have are slightly further on.

C

We would expect a self-assessment, probably to have already been performed, and then they would be receiving a joint evaluation with the sig so kind of trying to set it up so that these different templates and documents for our overarching security review process has a better alignment with the cncf phases for early adopters and early majority, as well as uh the the very early innovation um projects.

B

Okay, so so uh my question would be- and I think frederick uh mentioned, that in the chat there like uh the first question would be uh why not security champions right, because on on on the dev tech, ops approach and everything, and we have that concept of uh either a developer or application security person that is involved with a squad or a development team to help them and to champion those security initiatives right so maybe creating a new name would cause uh maybe confusion, and I think that the the concept is very similar here, and I really like that that that that we're doing that, I would like to volunteer as well so yeah.

B

C

So I think the initial thought around security champion is more somebody, that's integrated with the project which we're we're, hoping that these are more independent than an actual contributor of the project. It could be a security champion, I'm not fixated on an any particular name. um We want to approach it from the perspective of a lot of security.

C

Professionals are usually seen at or viewed as kind of like the enemy, the thing that stops developers from being successful or being able to deploy faster, and we want to be that security friend we want to come to them and be be part of their team, but enough that they come to us and they're they're they're listening to us, so whatever terminology works best to kind of relay that message in that position, we can certainly go for it.

C

I will be writing an issue to define a lot of this. So part of the effort is to not only look at what this individual would potentially be doing. We do have some great resources from the container d team, but also actually picking a project, seeing if they have the appetite for this level of engagement and then following through with probably one maybe two different projects to determine. One is this: if is the self-assessment valuable as it currently exists, and two did the project get value out of the engagement.

B

Okay, okay, got it yeah yeah, the name. The name really doesn't matter. I think for from my perspective, but yeah. I think it could be also sidekick right. uh Pop sidekick would be a good name as well. For I'm sorry, what was that for the the security buddy?

B

I think we already is copyright infringement. I think I'll talk.

I

B

No problem um so so yeah, I maybe like my concern, would be if someone starts getting involved into a specific project right and and and then they can't help anymore. They start volunteering. They stop volunteering, for example right so maybe having a pool of security, buddies right that each any any project you go to and ask for help, and then someone takes takes on that issue and help them specifically and and if someone is not responding, then another person can take that that would be a better approach. From from my perspective is advisor too generic.

I

Or is it too advisor seems too kind of like high level.

C

Advisor is actually what they're called for container d, so that's certainly like, but certainly an option. um I think, having a pull of these individuals would be beneficial as like a centralized point to contact. But I genuinely think that having a primary, at least for a limited engagement would be very beneficial, because you've got that one person you know who to go to you know who to have the conversation with.

B

Sure sure yeah yeah.

C

B

Once they get assigned to like a specific project, then yeah for sure that would be the the point of contact there right. But but I think that at least we should have a slack channel off of security advisors right and they can exchange uh information there where, if they need help like, for example, I'm helping this specific sandbox project, but I'm not very familiar with the technology or what they're using. Can you guys give me some pointers there and, and that would be beneficial as well.

K

Isn't that called how much security.

K

um But so seriously, as I'm sort of listening and thinking about how uh I'm not too familiar with the sandbox and incubator here, but thinking about apache and their mentoring for incubating over there. If you know someone, one or two people gets assigned to a project if it's not working out or they get too busy, they sort of go back to the um to the um uh the mentoring team and said: hey. Look, I'm too busy, I tap out and just bring someone else in, so that that's a pretty small deal.

K

I think um the overall idea sounds interesting. I'm curious to see if that becomes something which attracts people into cncf or or the officer.

F

So emily from the six perspective, wouldn't this be like the similar process, like we do for a normal security assessment right we're going to have like a lead security, reviewer we're going to have a team so from a sick perspective, it doesn't need from our perspective it doesn't matter if it's a security or non-security project. On the other end, I think we still have that same structure so that we have some accountability and obviously there's going to be overview by the co-chairs and the etls.

F

If something is not going as expected or is taking too long, then we can obviously intervene so on so on one side, I think it's the same process like on the management side, but the question is: what's the incentive on the other side for a non-security project to actually take this on right.

C

Yeah, so this is I'm in an ideal world. If I had my way, this would be like the dipping, your toe in the water, your first introduction to what it is, what it means to be cloud native, secure for non-security focused projects. Now, if there is a security focus project, we still have a reasonable expectation for them to have some security specific documentation within their repository and that's kind of what the self-assessment does is that it's that introductory tell us about your project from a security perspective.

C

These are the things that you should be thinking about and if they are a security focused project, they've already probably got that we would just like to encourage them to document in a standard format and then that self-assessment, actually a lot of the content there feeds into the joint evaluation, which is part of the new security review process.

C

It's the same joint assessment, joint evaluation that we've been doing with some more detail added on to it. Just based off of the feedback that we've received, so self-assessment is a little bit more lightweight, it's independent. So the idea is not to analyze the project, but more for them to be self-reflective and be there and available to answer any questions that they may have and kind of have that guiding conversation.

C

And then all of that work rolls into the joint evaluation where we do that joint kind of look at the project poke around at it, see how they're thinking about security and how they're applying it and where they fit in the cloud native ecosystem from a security perspective and then from there. Those two documents when they're finalized help contribute to the security audit, which is one of which is later on in their life cycle.

C

We found that a lot of the work that's been done from the security assessments by the sig has been significantly helpful to the security auditors.

C

So it sounds like there's a lot of discussion about it and would be beneficial to have so I guess I will go ahead and create the ticket and we can start having a little bit more documented discussion on. uh What does this mean, then? What are we going to call? It? Sarah had an excellent suggestion to use a very specific name affixed to this. That way, we can define a finite term during that evaluation.

D

Awesome cool thanks emily and I think that um our last agenda item is for the confidential computing project. uh Ava. Are you on? I just joined? Yes, awesome cool! Oh yes, oh.

L

Okay, literally just joined, um so the I wanted to share a project we just launched uh coming out of dslabs microsoft um called mysticos. um The you know. The one line twitter pitch is bring your own application, binary container or vm and run it in an enclave.

L

Some limitations apply um I'm already chatting with a couple folks in this committee and in the cncf about using this potentially in projects like spiffy or nsm, for uh taking advantage of the unclaimed native functions of attestation, setting up mutual tls um and sort of wanted to see like hey. We literally, we just launched it like a week ago. uh If folks want to kick the tires or check it out um and we're we're looking at. How do we integrate this with kubernetes and how do we integrate it with other projects in this space?

L

I didn't have a presentation to give on it, though I could spin enough if folks want me to like do a technical walkthrough of the.

M

Project, so can you uh eva, I had a question. uh This is bene here. So how? uh uh How do we think about this? uh Maybe the one thing that came to my mind is service mesh right. You talked about mutual tls, some kind of a confidential container or a runtime environment and you're, adding on some kind of security capabilities.

M

So how can you just briefly compare and contrast uh the two and how we should probably think about think about this, just trying to understand the enclave a little bit better, so the.

L

uh Are you asking for a broader context of what is an enclave or a trusted execution, environment or more? How does it fit into the container ecosystem.

M

I I think all of the above maybe this does require maybe the the deeper dive, but anyway no worries. Thank you, but I, I think, you're all of the above.

L

Okay, so um a hardware, aided trust of execution environment basically takes advantage of some um properties of processors that are kind of new still coming out, but at this point all the major clouds have uh either sgx or arm trust zone or amd sev as a capability.

L

um A lot of these provide similar functionality through different apis like it's not yet standardized. Each cpu vendor has something different. um Each of the cloud providers has some sort of an attestation service, orthostation model that is layering on top of these and so attestation, in this scenario, sort of the proof of identity of the machine and the proof of identity of everything under it.

L

The ability for the the user of the cloud or the person who is defining the policy and orchestration of workloads to say this particular application or container can only run if the underlying host meets these requirements.

L

This firmware this patch level, this operating system patch level and then once it's running, that container is isolated even from the host, so the root of the host dom0, if you're in zen, cannot access it. It's hardware separated with encrypted memory regions, I'm not sure you know they all do it a little differently different cpus, but the goal being um sort of a blind, hypervisor or blind container.

L

In this case and we're looking at some of the, um I was chatting with a couple folks about using it for mutual tls in service mesh, where the the certificates are tied to the actual hardware id. So you have just an extra layer of proof of where the communication is happening, that something hasn't been moved off the cloud or out of your region, out of your geographic boundary, bandwidth area still early spaces. So that's sort of a shotgun of ideas.

M

Yeah, no that's very helpful. Just one other question is given the the scale and the fm ephemerality and the dynamism of container workloads. How I mean what is the time to set this up, get it booted running and is it even conducive for this kind of workload? Pattern.

L

Great question: um it's going to vary by implementation. I think we're at the early stages right now. Some similar projects launch times a little bit slower than a normal container, but not by much. It might not be great for a function as a service. Yet if you're expecting you know sub second total run time total lifetime for your container, uh because at least in in my testing, some of our testing, the bring up time is measured in the.

G

L

Less than a second, but it's not as fast as a regular container that'll change, depending on how much memory you're allocating. So if you were allocating a very large amount of memory to one of these enclaves that initialization might take five seconds playing a number out of a half um still, if you're going to run it for an hour or six hours the length of your of your ssl certificate. That's still fine.

L

Are it very helpful? Thank you.

D

We have a question from cameron on where are these being discussed so.

L

There is a separate foundation parallel to the cncf, also under the dlf called the confidential computing consortium, and a lot of this work is centered in that body and this particular project mysticos is right now not homed. In any foundation, it's just developers doing some work as far as the discussion of surfacing this up into the cloud-native ecosystem. I think that's here, at least for now, until it grows it outgrows this body and needs its own channel.

N

But hey um I! This is his hand. I mean I made me some contacts here, so I have a question regarding the mutual json part. You mission, so you have mentioned the hardware id. So I'm curious, like do you use some tpm or other technology to make sure that you? How did you present get the hardware id and put that into the trs server.

L

So a tee is another type of hardware different from a tpm. It provides similar functionality, though, so you can think of it in the sense of tpm, provides attestation of uh integrity of some devices in the system as well as some key it might have stored. Yeah, I'm just wrong.

L

Armed trust zone is one implementation of a tee, so is sgx, so it's amd sev uh also ibm pef, cuff right. So each of these you can think of them like a tpm. That also has memory, isolation and execution capabilities for arbitrary programs.

N

Okay, so are you saying like for the key framework you we do not need to care about like it's on server or or um like uh how can the um like the traditional x?

N

It is s6 server right, so it's not a matter right with tt.

L

So one of the things we're trying to do is build a cross, tee compatibility layer in the runtime engine itself.

L

We don't have that today we have the framework for that and we've done the work for one te target and one generic non-te target. If anyone wants to come work on the the trust zone or the sev support, we would love the contributions.

L

It is certainly the product goal from day one to become a runtime platform that spans across all of the different cpus that provide this capability.

D

A quick question on this is this kind of, like a, uh I know, does the enochs project, which kind of want to do that? This is like the work, that's together with them, or just a separate project.

L

Yeah a good question: this is a separate project with different goals. So there's some overlap. uh Nrx is uh wazi, wasm, runtime, abstraction, plus a bunch of the wrong orchestration.

L

um I did it completely. We were talking about interx. I typed with that one second,.

D

Good great hat right.

L

um Mystics nrx is the red hat project yeah, I'm like that dslabs mysticos right now. Sorry about that, um so the the main difference is nrx is focused on waziwazum, plus its own orchestration and key release. Layers mysticos is focused on application portability, so bring your own runtime sorry bring your own application, whether it's a binary you compiled in rust or go or a docker image right now we have support to just take an existing docker image.

L

That is, there are some some limitations of what can be run in our current target of sgx, but uh take your docker image simply migrate. Its format add a at a signing or attestation around it and run it in enclave. No problem. We have a proof of concept with kimu right now to take a kimu vhd file format and just mount it and run it so very different approach, but same hardware, layer.

D

This is something that I I've seen recent work on. um There's a issue in canada containers now that's kind of discussing confidential computing. um Sorry, I was just to keep like you see this kind of like being orchestrated as a type of workload on kubernetes, or something like that. I.

L

Do yeah um in azure today we have a g8 product for aks support for sdx, so it's a type of node or property of nodes. You could schedule workloads to and at the moment that would just be an sgx device available in your in your node.

L

If you had an application that was written to use that it could use the raw device, what we're talking about with this would be a little bit different, potentially or you could you know your docker container that you schedule on a cloud might itself contain uh an enclave runtime like mysticos or oculum or graphene.

L

I think the the kata container work you're, referring to last time. I chatted with that team. They were using auckland plus in clavare.

D

Yeah there's this new revitalization of the issue. Now: okay uh yeah, we started discussing it and then I got pinged a lot on anchor the image and stuff as well, so something to look at again.

L

I see a a question. Is general portability, an issue for an app, um so there are limitations. There are two limitations that are important to mention. One is sgx, doesn't support fork.

L

So some of the sgx runtimes, like graphene, they work around this in a really slow and painful way. That also, in my opinion, reduces security because it calls out to the untrusted host whenever you fork to launch a new process. But if you're, assuming that the new process is trusted because it was launched from in the enclave, the reality is, it was launched from outside the enclave.

D

That's the paper that talks about this. I'm.

L

D

To it's called the road, I'm gonna yeah, it's a conveyor.

I

Ava, can I ask like a simple question and again: why wouldn't you just fold this capability into one of the runtimes like a trio or container d? You know what I mean like have some type of switch. That says, hey take advantage of tee and all that and again you know, you know how I am with cliff notes. I just I try to simplify things right, so I I.

L

Love that you've thought of that um the shorter answer is, we haven't done it yet. But yes, please.

I

Do it because that would be incredible right just talking to those individual people like look now, you have the ability to say yes, my containers are my runtimes are secure and they attach to some type of hardware equivalent like that would be fantastic.

I

I remember back in the day like just way back in the day, docker was doing. I was at hpe. Docker was like hey. Can you integrate? You know hp was like, can you integrate with tpm right to be able to like have it? So you know getting that stuff, and it was like that kind of helped to kind of articulate some of that capability, but that also helps in widespread usage of the tool when it's integrated in all the ingrained in all of those various runtimes right. So.

L

So the ability for uh this to be connected as a container d- runtime plugin, yes, absolutely like that- is incredibly desirable and part of what we're working towards. But you know, if you want to do that, go for it! I'd love to see it.

K

The tricky part there is that that's definitely interesting, but how do you do it for a different um cpr architectures right amd's is different than intel's different. So.

L

The the hope here is that mysticos provides a portability layer across cpu, architectures and then container d simply calls into mysticos mysticos detects what it's on and launches the appropriate way cool.

D

Have you seen kind of like I know each enclave or ece has its own like attestation um framework and some of them match yeah. It is differently. So that's like oh yeah. It's a little bit unsolved.

L

Problem so one of the the bigger work streams in the ccc that I'm co-leading is the attestation working group to try and address both how we, how someone might do cross-cloud attestation, because google, amazon and microsoft's cloud attestation services are different and how you might do cpu across cpu architecture. Attestation. For the point we just mentioned unsolved problem. If you want to work on it, come join our sig.

D

Can you put a link to that that uh that's like there like how hard to join? I think there were a couple others that they were asking as well.

L

We haven't yet uh created the like a mailing list or a slack for that said. Yet things will slowly get started. Sometimes in a a new foundation, um the official vote to create them happens next thursday.

E

Can you post where the uh the sig is, where you guys meet and whatnot if there's an online doc for that.

L

Like I said, it doesn't technically exist yet.

E

L

We are forming it right now. I've been trying to corral that for a little while, um you can certainly join the ccc discussion lists and I'm going to get a link that works to that right. Now, okay,.

C

Here's the main.

L

L

And this should get you to the mailing.

L

Lists and so it'll be a sub project under the tag, but it'll probably have its own mailing list in its own.

L

D

Awesome thanks and and I guess, when the winter stick details up, you can, um if you could put it in the security channel or you can just send it to one of us and that we can dump it in there. That'd be helpful.

D

Awesome we almost all the time so um any questions any call to actions.

D

Awesome, thank you ava. This was really helpful. I I think a lot of people are keen, so hopefully you see a few more new faces soon. um All right. um I think that is all that we have planned for today. So um any additional topics. Anyone would like to bring up.

D

All right, if not see everyone next week, have a good one. Thank.

B

D

Thank you, bye.

D

D