GitLab Protect Stage, 26 May 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Defend: Threat Insights Weekly Group Discussion

Description

2020-05-26

A

A

Hello, everyone- this is defense- writing sides. The weekly group discussion.

A

We have an agenda. Do we usually share the screen for the agenda? I can do that sure? Why not right I'll do that I always.

B

Try to scroll it up like earlier I was try to scroll the screen through zoom and I, like.

B

A

So whatever everybody's seen the the is there any follow-up from previous discussions that we need to.

A

That sounds like a no sorry, I.

C

Think there, if I remember correctly, all the previous discussions were based on planning breakdown issues and so I think if we just continued playing breakdown will be good awesome.

A

Hello Daniel welcome hello. We just we're just continuing with the with the previous discussions. We're gonna go down to a planning breakdown. Did you have anything from last meeting that you wanna to discuss, so you you happy to keep going.

B

Happy to keep going awesome.

A

I've seen the demo I have no comments, looks great Alexander. Any anyone else have comments, looks good. Thank.

C

You Jonathan, oh I, should put Jonathan's name next list. This is a team effort, I'm the silent partner on this one.

A

Take take credit if it works well. Otherwise you that's.

D

A UI thing wasn't me.

D

B

Demos come from the front end guys yeah.

A

I know we need to up our game in the in the back. End. Show some terminal screams, get people excited some blog post I want.

C

To see some graph dwell, endpoints yeah getting hit I want to see screenshot or I. Don't know: Dave bass, migration running just scrolling through logs yeah. Alright, alright.

A

Moving on to add ability to undo multiple vulnerability, dismissals I am not super familiar with it, but it looked pretty straightforward. It's already got weights on and do we have anything to add from front-end or back-end.

C

Nope, there's just some initial comments by me: trying not to get out of trying to get out of work but uh Matt and Annie. Unfortunately, he gave some goodie pretty good reasoning and why we need this guess we'll do this you're.

E

Saying the inside part out loud Alexander, oh crap, no.

D

No, no I meant I mean I user cases. We are recording this.

D

Next Oh Tiago, you're, muted, muted,.

A

So you can bribe me later. We fight so I, don't upload it to YouTube, so we I put down the the combined weight. It doesn't look like it's gonna need multiple iterations. Are we all happy for me to move it to ready for dev or do we need refining step.

E

I am the least qualified to assess or answer this, but on the weights do we normally combine for an endless back-end? We.

A

Do was maybe a not very well communicated decision from Lindsey and I. The page. The page actually says the the combined weight should be the closest Fibonacci sequence, but I think that's way too technical I'm just I've just been adding them. So you would have been eight. The next number, but you know potato potato.

A

All I'm interested in is the the ability to to gauge the combined team velocity and it will always fluctuate and it's an estimate, so we don't have to get super scientific on this at some point is just much overhead. Oh I,.

E

Certainly, don't care of just noticing that six, that's the first time I've ever seen a weighted six I didn't know if that was gonna explode everything else somewhere. No.

A

It's all good see if you see it around weights that don't match the the labels. Please please correct them. Go Jonathan and Alexander.

A

B

The refinement on this thing I know from the the retrospective earlier. We talked about putting something like the technical details into the issue from one of the Mets comments, and do we want to have that as a requirement like that? There is some kind of at least technical direction put into these issues before we say it's ready for do. I.

A

Think that's a good idea: I like I'm, I'm, new and I, think it's part of that, but I've had difficulty reading an issue and understanding what exactly was the outcome of it without reading a lot. The whole thing, if there's a summary of so I'll, put in refinement and uh and we'll do that, okay.

B

Is on this issue and he was the one who brought it up, I think to put in like just you know it's just in that issue. Description, yeah, I think Alexander's got some stuff already in there. So if we want to put that in the actual description rather than in the comments below yes, that's.

A

You can move to technical detail to description.

E

Yeah I will just make a section. Folks are good notes. I.

C

Interrupted you go ahead, I'm.

E

Just gonna say you wouldn't mind I, think having a like a technical details, just make another label for it down at the bottom. Jonathan to your point, anything that is going to be sort of part of the final ticket should be in the description. I know this is the thing that I've struggled with there's lots of interesting discussions and decisions get made down in the comments. Don't get carried back up to the top into that description and then they get lost so but absolutely the place to put yeah.

B

I've noticed that a lot to you, especially when there's a lot of discussion going on it's like what was the final decision made on the technical direction on this and making sure that we keep those up to date. Yeah.

A

Three months of discussions that he got to read through cool, that's a short one, yeah, aleksander I've assigned to you for now. Okay, yeah.

C

And met, actually, it was the one who refined this ticket so and he put a little bit in his refinement comment down below so I'll, probably just copy and paste what he said. What I said to the top. It.

A

Works and Jonathan when once Alexander does that you happy for him to move this to ready for their vote. Do you want back-end to have a look as well before? Oh.

B

It's already taken looking back in on this okay.

A

That's we took true I, see that thank you.

A

Do we need to go over these questions? No.

C

They were in a comment in the ticket and Matt and Andy adequately resolved them.

A

Thank you, sir cool moving on to Lincoln existing gitlab issue security vulnerability. So if my communication was choppy on the previous issue, this one is even worse because I didn't have time to go over it. So who wants to take over yeah I left some questions. I.

C

Can do this so basically, this task is for much like an MRI or an issue where there's a section that says related issues, there's now a section like that and vulnerabilities in the phantom page, and so there's really a tissues and there's an ad a human created issue button. That's now separate well this those buttons uh and then I asked a couple of questions below regarding when the creation creates you button appears and whether it's that separate from like resolved with merge, request button.

C

Those are a few questions. I had.

A

Kuso looks like a bit more work before we can add weights to this, so we'll follow up a synchronously is that the plan.

C

Yeah I I, don't think, there's any discussion that needs to happen. Synchronously or you know, sweet.

A

A

Let's go to this one third party ListView step, one.

C

So I does anyone want to go. I can also talk to this one. Yes, please we're good okay, so this one, if you want to scroll I, just know it realized. I was looking at my page when you have you're the one sharing scroll down a little bit to the first screenshot. Yes, so this one is basically is updating this security dashboard view on the right side, there's going to be a scanner column which lists the type of scanner and where it's from and then there's also in the description.

C

There is going to be the line that needs to be updated, both below the main description and its identifier. Okay, so then, with multiple identifiers is apparently only one of them is going to be chosen for the description above the line of code, which I think we do now actually.

C

And I had a few questions on this as well. That.

A

Thing that I want to comment is I, think I think these little widgets are currently broken because of the move from REST API to graph QL I was verifying an issue yesterday they was left open to double-check and either a double checked it wrong, or it's it's indeed broken so before we start on this, just keep an eye on it because you might already be broken.

A

Sorry, oh yeah, yeah.

C

Oh, no, that's that's totally fine I'm glad you brought that up. There's another issue regarding that link and the icons that sit next to it, so that but I don't think that this link is a part of this work at all yeah, because it's handled in another yeah yeah.

B

We need me back in work on this, or is this already available to us stuff? We need here.

C

The I'm, assuming the this is all graphical I'm assuming there will be back and work to make more data visible to the graph QL query I need to verify that, though,.

A

Let me let me make a note generally happy happy to for me to assign this to you to ask you to to verify that sure.

A

A

Any other any other points worth discussing. Alexander. Do you want to talk a little bit about this? You drop down is just a new filter. Is it oh.

C

Yeah I forgot about that. That's that one point yeah looks like I mean we already have the filters. No, we don't we don't know. Oh, we do have a scanner filter. No, we don't I know I have to look into that. I thought.

B

I thought we had the scanner filter, but it's not specific to you know, get levers, white source or third-party scanners, and so there's probably something on the filter side. That needs to be updated. But that seems like I, don't know if that's a separate issue- or it's definitely two different em ours is my thought- is getting that extra column and updating the filter. Oh.

C

Yes, there are many em ours to this issue. That's for sure. If.

A

We, if we think this is gonna, spend more than one iteration Matt. Would you mind, would you mind if I created a an issue and moved sorry an epoch and move this issue to be a design issue in the Derek, and so we can try out the the epoch planning thing that we discussed before yeah.

E

That should be fine yeah, don't see why we.

B

Wouldn't do that the split it out, because we have multiple issues about third party scanners that are needing a handle that probably would have fall underneath there right, yeah.

E

This is already part of a much bigger epic, with just five or six issues already yeah.

A

I, like the way the some of these epics of you know, going up to the to the minimal to complete key result: the the product stage, that's really helpful, so cool if you're happy food for me to that. To do that. I'll keep an eye once once once I have the clarity from the engineering teams so.

B

We have the epic all ready for this. One I think we just need this issue split out into more than into a couple different things here, because we have like what step one point. One and one point two in the same issue is.

A

There is therefore you're talking about this one here then hands dashboard right so that my yeah alright I have a lookup line. If, if I want to reuse this one or not,.

A

Because this one is food, July, yeah, suppose it's not that big cool anyway I'll decide decide offline if, if I want to split or not, but it sounds like we're. Just gonna create issues from from this issue to work on Jonathan.

E

You think you may be right. We had this originally I, think together, and so we I just try to highlight on the screen to I hate that the links are clickable.

E

A

Could anything this one.

E

No, no just just noting that, yes, they are really part of the same issue right now, step 1.1 and 1.2 probably would be better to actually just clone. This issue into you know copy over just the pieces needed for and make an update filters as an actual separate step, 1.2 issue, and then I can update this and the other one or two.

A

That clear enough I'll do that and I'll hand over to you Matt if to see, if I, if I missed anything I just been wanted to practice, some some try my hand, hey.

E

Once you go practice on Sam's stuff.

A

He asked me to practice on yours. He said you, you really good sport about messing up your backlog,.

E

One thing about this: one I I'll have to go, find the issue I think it's the dependency scanning group. They may be in the same area, I, don't know if at this iteration or they were planning at 4 or 13, they have a very similar issue where they want to update that.

E

Well, what's currently named the reports filter which is going to be renamed, the scanner filter that drop down to not just break it out by sass dependency and the defender name, they actually want to get more granular with the specific scanner of type forget labs. So, for instance, you might actually see are different, like SAS scanners listed out or the different types of container dependency scanners, just something to keep in mind. I'll. Try to locate that issue to make sure that there's not a collision with another team.

A

Let me flag this with a cross group label and then, if, if there's no cross group, we'll just remove it.

E

C

A

C

Going off of that Jonathan, there probably be back-end work to update the graph QL for different different scanners and.

B

Yeah I think there are the thing it would be, so I will look into that and interpret some technical details. Those.

C

Implementation- and this is this- was one of the issues. We talked about I'm playing breakdown last week that right there is point one underneath this issue is. We could use some help figuring out how to bring different scanners into our local environments or set that up so that we could.

C

You know what dead locally so.

A

Sam has replied, I've left a comment and he sent a link to his to his project. It is pretty straightforward if you haven't seen it I'll share the link here. Yeah.

C

If you could put the link here, that'd be great.

A

I'll share I'll share in a couple of hours. I've got more more meetings.

A

We've got three minutes left. How are we feeling do? We want to have a look at this call. It a call it a day. I.

B

Can I can go through this real, quick awesome? We, so there was a misunderstood exactly what was being asked for in the original in the issue, so it was well first, it was not doing anything, it wasn't taking the branch it was just going to like that at fault branch I believe that first and so this, what I ended up changing it to was pulling from whatever branch the pipeline ran against no.

B

So now the problem is if there is a squash that pot, that branch goes away and we need to be able to repoint it adds you know where that the the vulnerability would be currently rather than where it was, and that other commit. So basically.

A

You need to update the existing finding to point to the new location. Is there we saying rekt'.

B

It needs to point to you know the correct child like if it gets merged. We get out of the other point to the new one rather than the when I went away. Lindsay went ahead and put this one back into refinement, and so so I can add. I'm gonna look into that one nets and details of that report.

A

Okay, how are you feeling about the feasibility I've read some discussions where people wondering how we would be able to identify them, I, don't.

B

Know that's one of the things I got to look into to see you know and read through that see in how we can possibly possibly make that happen. Yeah.

A

I, don't know I, don't know if it's people.

B

D

A

D

A

Vulnerability there that looks the same I, don't know if the finger printer will give you the right entry, it might.

B

Require some changes to the squash function when you click the squash button in get lab or and or even locally I'm, not entirely sure, because if you squash it locally, it goes away.

A

And well it'll be that's what.

B

A

So then, when the window scanner runs again, you don't you still pick up the verbalizes, but with a different hash and possibly a different line. Then they'll. Do you map that to the previous scan on the same branch? Maybe maybe you throw away anyway, you're gonna have to think about it. I, don't think it's right exactly.

B

Straightforward now this one I, don't think, will be a straightforward one. To have to implement. It'll it'll take some thinking on five to pulling Pierre exactly really, but my computer doesn't.

A

B

A

Oh, who I did it I, don't trust it.

B

The two I think was for the original, what I thought the original issue was Ryan, so that way is that put that weight needs. It needs to go away for now.

A

All right, cool and and from from a product point of view, Matt any any desired, desirable behaviors or any any comments on how you like this resolved.

A

A

Know no just get.

E

B

E

I mean honestly I didn't see this one in in the agenda this morning. So I didn't really look at this one more carefully. I added.

B

E

B

E

B

E

Need to take a look, you know I'll, be honest when we get into the nuances of all of the branches and the commit IDs and all the things all our abilities. I really don't have a great answer for it. I liked a comment that Lukas Charles had made, and a very similar related issue to fingerprinting that he doesn't see this happening in a lot of our competitors products because we have such a complex, branching, just workflow in general. So this may be sort of an us challenge to solve yeah.

B

It I I put it to 13:1 but I. This is probably one of those stretch, ones for 13:1 yeah.

E

I mean that's, that's good with me, I think to take it up a level or two just in general, I think it's going to be a big challenge for us, but also someplace, where we can provide a lot of value if we are able to help people identify if a particular vulnerability has been reintroduced.

E

In you know a separate branch, maybe that was both pulled from the same master at the same time and one was- was a lot blade or somebody may have screwed something up and reintroduced something themselves, just trying to give a sense of hey. We think we've seen this before, so maybe you don't need to look at it, I guess from the fingerprinting perspective. Maybe this is way beyond the scope of this.

E

But do you see that as something coming from the security report like the scanner is providing enough of the you know, be it a hash or that plus line numbers where they're sort of telling us this is the composition of the defect and we make that call just by comparing it or I. Think.

B

I think that would probably be it I think if we can, if we see that if we look at this the vulnerability and we see that this branch no longer exists, we have an opportunity to go, find you know where it might have gotten merged or squashed or you know we can take a look at that.

B

You know it's more kind of almost the best guess yeah, maybe with a flag on it, saying hey that this branch no longer exists where this vulnerability was found, and it we think- and you know best guess- is here type thing: yeah.

A

B

Little dot on that all.

A

Right, I'm calling it it's time thanks. Everyone.