►
From YouTube: CNCF Security TAG Regular Meeting - 2021-08-18
Description
CNCF Security TAG Regular Meeting - 2021-08-18
C
So
yeah
from
the
supply
chain
working
group
standpoint,
we
are
sort
of
consolidating
around
writing
up
the
architecture
and
just
starting
to
get
like
pen
to
paper,
and
we
had
a
couple
of
breakout
sessions
over
the
past
few
weeks
got
a
bunch
of
additional
details
now
we're
trying
to
get
a
few
folks
just
to
who
can
contribute
the
time
to
really
do
sort
of
a
a
first
pass
of
you
know
putting
everything
down
and
yeah.
That's
really
about
it.
Andres.
B
Well
we're
we're
looking
for
volunteers
and,
as
michael
said,
people
willing
to
roll
their
roll
their
sleeves
and
commit
their
time
so
yeah.
You
should
be
able
to
find
us
on
the
slack
channel
as
well
as
yeah.
The
regular
meeting
cadence
is
posted
or
feel
free
to
reach
out
directly
to
michael
or
myself,
if
you're
not
unsure
how
to
get
involved.
But
it's
something
you
feel.
B
A
So
I
will
give
updates
on
serverless
working
group
and
there
are
two
meetings
being
held.
Actually
three
meetings
being
held
for
serverless,
one
is
east
coast
time
and
one
is
west
coast
time
and
one
is
a
pack
time,
a
time
zone
where
people
are
meeting
and
discussing
the
white
paper
that
we
are
writing
on
the
serverless.
A
There
has
been
some
progress
made,
but
we
are
still
looking
for
more
volunteers
to
contribute
to
that
who
have
worked
on
serverless
platforms
and
have
the
knowledge
we
had.
Some
new
participants
joined
that
working
group
in
the
last
couple
of
days.
So
hopefully
we'll
see
some
more
progress
coming
out
of
that
working
group.
D
A
A
F
F
A
G
H
You
hi,
my
name
is
justin.
I
this
is
my
second
time
here,
but
I
never
really
said
anything
we're.
I
run
I'm
responsible
for
fostering
the
adoption
of
curie
fence,
which
is
a
cloud
native
or
cncf
sandbox
project,
and
basically
it's
a
application
security
platform
for
cloud
native
applications,
and
I
really
look
forward
to
meeting
you
all
or
talking
each
week.
G
B
H
B
Yeah
well
since,
since
you're
new
to
the
group,
we
used
issues
on
github
for
planning
and
tracking,
so
we'll
use
that
to
coordinate
with
you
and
the
rest
of
your
team
find
a
suitable
time
help.
You
prepare
the
presentation,
typically,
those
those
take
a
30
minute
slot
of
this
one
hour
meeting
when
we
have
one
and
we
lost
some
time
for
a
q,
a.
H
G
B
F
A
E
Oh,
I
don't
think
we
have
any
particular
items
that
we
need
to
work
through.
There
are
a
couple
issues
that
you
know.
We
just
want
to
do
a
quick
triage
and
just
show
people
what
are
the
current
issues
that
are
being
discussed
in
the
triage,
and
you
know
in
their
free
time
they
can
comment
on
that
or
if
they
want
to
have
some
discussion.
So
maybe
I
can
spend
five
minutes
going
through
two
three
issues
and
then
I
think
if
we
don't
have
anything
else,
then
we
can.
We
can
call
it.
A
E
E
E
So
the
idea
of
this
triage
again,
just
just
for
just
as
a
reminder,
is
that
we
want
to
be
able
to
revisit
some
of
the
issues.
A
lot
of
these
issues
have
been
inactive
for
a
while,
and
we
want
to
kind
of
highlight
them
again
in
the
community
to
see
whether
there
are
any
new
thoughts,
any
new
flames
that
I
can
build
that
are
interested
in
working
on
these
issues.
If
not,
you
know,
sometimes
we
have.
E
E
So
the
idea
here
is
that
you
know
how
we
have
the
member
speech.
We
would
have
basically
a
page
similar
with
the
indication
of
you
know
I
can
do
assessments
I
can
do
you
know,
apply
my
expertise
in
cryptology
things
like
that,
and
this
would
act
as
both
a
way
for
people
to
to
find
volunteers,
but
also
to
be
able
to
connect.
E
E
E
E
What
do
we
do
with
those
assessments?
Are
they
still
better?
You
know
what
do
we
do
with
that,
and
I
think
this
has
occurred
once
or
twice
with.
I
think
the
the
over
and
the
in
total
review
and
what
we've
done
so
far
is
kind
of
like
just
checked
back
with
the
authors
of
it
to
ask
like
okay,
has
there
been
any
significant
changes?
E
E
E
A
D
I
like
the
way
you
say
that
security
papers
is
just
about
to
comment.
I
think
that's
our
ongoing
version
yeah.
I
I
just
thought
that
was
in
the
agenda
there
to
talk
about
a
few
of
these
things,
so
I
think
we're
wrapping
it
up.
We've
got
a
bunch
of
good
learnings
out
of
it.
I
have
a
bunch
of
comments
that
I've
been
in.
How
would
I
say,
staging
in
a
a
gift
that
I'm
gonna
actually
copy
over
to
the
the
actual
issue?
D
For
this
I
see
emily
ping
to
me
on
one
of
the
other
ones.
That's
been
related
and
sort
of
sitting
idle
issue.
I
can
find
it
really
quickly.
Of
course,
I
can't
yeah.
I
can
534
about
how
to
basically
align
some
of
the
comments
we
had
coming
out
of
this
list.
We
want
it
might
be
beneficial
if
there's
a
bit
more
teeth
behind
us.
Just
saying:
hey
it'd,
be
a
nice.
D
If
so
I'll
make
some
comments
on
that
as
well
and
see
if
this
is
something
there's
definitely
some
benefit
of
out
of
it
there's
definitely
the
community
really
appreciated
it.
I
think
it
comes
down
to
how
we
both
executed
and
sort
of
how
we
get
people
to
become
part
of
it.
So
I'll
put
those
comments
and
we'll
see
where
it.
E
F
E
So
yeah,
I
think
that's
just
something
to
keep
keep
in
mind.
Maybe
you
know
going
forward
as
we
are.
We
are
yeah
kind
of
digesting
the
whole
experience
and
yeah
what
we
want
to
do
going
forward.
You
know
ago,
cd
would
be
a
good,
a
good
project
to
maybe
have
the
next
experiment
on,
or
you
know,
if
you're
gonna,
assemble
army
or
people,
okay,.
D
Cool
I'll
I'll
test
base
with
her
and
yeah.
I
think
I
think,
definitely
what
we've
seen
from
this,
the
probably
a
little
longer
than
we
wanted
to.
I
think
that's
okay,
but
I
think
we
definitely
picked
up
early
site
came
up
sometimes
for
how
we
can
sort
of
attack
this
better
in
the
future.
So
yeah
I'll
stick
back
with
her.
A
Great
yeah,
I
also
wanted
to
share
that
the
kos
engineering
working
group
out
of
app
delivery
they're
doing
some
good
work
in
terms
of
planning,
they're
writing
a
white
paper
which
describes
how
to
do
chaos,
engineering
and
we
are
also
plugging
in
from
a
security
standpoint,
how
we
can
do
some
offensive
techniques
to
create
cures
from
a
security
point
of
view
and
then
validate
resilient,
a
cloud
native
platform
or
service.
So
that
is
interesting
piece
of
work.
If
anyone
wants
to
get
involved,
feel
free
to
join
that
working
group
as
well.