►
Description
No description was provided for this meeting.
If this is YOUR meeting, an easy way to fix this is to add a description to your video, wherever mtngs.io found it (probably YouTube).
A
Welcome
to
our
group
container
security
meeting
per
usual
alexander
you've
got
some
demo
items
for
us.
B
Okay,
yes,
of
course,
so
I've
got
two
things
for
us.
Actually,
there's
a.
There
should
be
a
third
thing
on
here
that
I
will
get
to
later,
but
first
of
all
the
assignee
widget
for
the
alert
drawer
is
finally
added,
and
so
that
finishes
the
follow-up
for
the
alert
for
the
alerts
page.
You
can
see
in
the
screenshot
on
the
right
side.
Now
you
can
do
everything
you
can
create
an
issue
you
can
assign
it.
You
can
change
the
status
and
you
can
see
the
details.
B
It's
it's
a
one,
stop
shop
and
also
paul
is
here
but
paul,
and
I
have
been
working
on
the
scan
execution,
epic
and
both
of
us
have
gone
through
our
redesigns
of
both
the
network
policy
drawer.
I
guess
now
it's
just
regular
policy
drawer
and
the
policy
editor
page,
so
you
can
see
the
screenshot
there
and
I
don't
have
a
screenshot
of
paul's
wonderful
redesign,
but
it's
beautiful
you'll
have
to
trust
me.
B
And
then
moving
on
annabelle's,
not
here
but
there's
a
design
issue
that
we
should
walk
through
and
look
at
the
latest
designs.
Let's
do
that
at
the
end.
A
Just
to
give
her
time
to
join
in
if
that
sounds
good,
so
yeah
we'll
skip
down
to
four
a
thanks
for
those
alexander
we're
it's
great
to
see
just
the
constant
iterative
progress
here
so
yeah.
Now
that
zamir
is
starting
on
security
approvals.
Just
to
clarify
for
the
group
he's
now
on
security
approvals,
100
full-time,
so
he
can
still.
You
know
you
can
still
talk
to
him.
You
know,
please
do
you
know,
ask
him
questions
you
can
still.
A
You
know
he
can
still
help
out
in
some
areas,
but
as
far
as
actually
assigning
him
issues,
we're
only
assigning
him
issues
related
to
security
approvals,
because
the
board
of
directors
approved
one
head
count
specifically
for
that
area,
so
they
want
to
make
sure
that
we
have
one
person
focused
on
that
just
to
make
sure
it
gets
at
least
that
minimum
level
of
attention-
and
we
can
always
add
more
people
to
security
approval
like
if
we
want
to
get
more
done
faster,
but
we're
going
to
always
have
at
least
one
person
full
time
on
that.
A
So
I
just
wanted
to
share
with
you
what
we
have
planned
in
that
area
as
well
as
what
we
have
here
today.
I
think
there's
a
lot
of
overlap
with
some
of
the
other
work
that's
being
done,
especially
in
the
policy
editor,
so
it'd
be
great
just
for
everyone
to
be
aware
of
that,
so
that
you
know
when
changes
come
along
and
xamir
starts
making
changes.
You're
not
surprised.
A
So
that
being
said,
let
me
share
my
screen
and
I'm
going
to
start
off
by
showing
you
the
functionality.
That's
there
today,
right
now
to
set
up
merge,
request
approvals.
You
actually
go
to
settings
in
your
project
over
to
the
general
area
and
then
there's
this
section
in
here
called
merge,
request
approval,
so
you
click
that
and
actually
has
all
kinds
of
approvals
in
here,
not
just
security
approvals.
A
A
License
check
looks
for
specific
licenses
that
you
want
to
deny
and
then
vulnerability
check
looks
for
any.
Let's
see,
high
or
critical
vulnerability
in
the
mr
and
if
any
higher
critical
vulnerabilities
are
present,
it'll
trigger
the
required
approvals
that
you
have
specified
here,
so
you
can
spec
you
sorry,
I
can't
talk
today.
A
A
The
way
this
ends
up
showing
up
is
on
the
merge
request.
Where
you
see
I
can
approve
this.
It
says
it
requires
three
more
approvals
from
license,
check
and
vulnerability
check.
The
merge
button
is
disabled
right
now,
because
we're
actually
introducing
some
new
licenses
that
are
not
allowed,
and
then
you
can
see.
We've
got
one
critical
and
four
high,
so
that
met
the
criteria
for
the
vulnerability
check
there
as
well,
so
you
actually
can
block
and
prevent
things
from
being
merged
in
until
they
have
approval
from
the
security
team.
A
A
First
of
all,
it's
only
available
on
the
project
level,
so
that
means
that
users
have
to
set
it
up
for
each
and
every
project
that
they're
wanting
to
apply
this
to
some
of
our
customers
have
tens
of
thousands
of
projects,
and
you
can
just
imagine
the
effort
to
go
through
and
synchronize.
All
of
this
is
a
lot,
especially
when
you
know
things
change,
then
you've
got
to
go
update
it
10
000
times,
so
it's
not
really
sustainable
to
do
this
at
the
project
level,
it
also
lacks
some
granularity.
A
So
ultimately,
the
experience
here
in
the
mr
widget
is
okay,
we're
probably
not
going
to
change
this
anytime
soon,
but
we
do
want
to
set
change
the
setup
experience
for
this
and
move
it
into
surprise.
Our
security
policy
editor.
So
this
will
come
in
the
form
of
a
scan
result
policy,
so
it'll
be
a
new
policy
type
and
we're
still
working
through
all
of
the
details
here.
But
the
idea
is
to
give
the
user
a
lot
more
flexibility,
so
they
can
say
you
know,
maybe
they
only
care
if
sas
finds
a
critical
vulnerability.
A
They
don't
care
about
the
other
scanners.
You
know-
or
maybe
you
know
you
can
chain
multiple
rules
here
together.
So
maybe
you
know
if
das
finds
one
critical
or
if
you
know
das
finds
one
high.
So
maybe
you
know
you're
more
interested
in
your
dash
results
and
then
ultimately
we
would
want
here.
Let
me
refresh
this
real
quick.
Actually,
ultimately,
we
want
to
let
you
also
specify
you
know
the
branch
you
can
do
that
today
as
well,
but
also
whether
vulnerabilities
are
newly
detected
or
pre-existing
and
dismissed
or
pre-existing
and
not
dismissed.
A
So
again,
a
lot
more
flexibility
here
and
then
as
an
action.
You
would
come
down
and
require
approval
from
one
or
more
individuals
in
a
certain
group.
So
again,
some
of
the
details
here
are
still
being
worked
out.
We'll
probably
want
a
read-only
view
of
this
back
in
this
area,
just
for
consistency,
so
that
someone
can
come
here
and
easily
see
all
of
the
approvals
that
are
in
place.
B
Is
the
motivation
I
you
may
have
said
the
sign
may
have
missed
it?
Is
the
motivation
for
putting
it
in
our
policy?
Editor
page?
Is
that
it's
just
a
lot
more
complicated
than
the
other
approvals
I
get.
The
other
approvals
are
like.
Oh,
we
need
one
vulnerability
check
or
one
license
check,
but
this
is
like
for
this
type
of
scan,
make
sure
none
of
these
vulnerabilities
or,
like
all
these
other
things,.
A
Yeah,
it
is
more
complicated,
moving
it
over
also
brings
some
other
benefits
too,
because
we
have
full
audit
logging.
You
know
just
that's
a
benefit
of
get
right.
You
get
the
whole
version
history
of
any
changes
there
and
you
can
actually
have
approvals
on
your
security
project,
so
you
can
now
restrict
it
so
that
not
anyone
can
make
changes
to
the
approval
rules
without
getting
approval
from
someone
else
a
little
bit
of
inception
there
in
a
way.
But
you
know
it
because
these
do
deal
with
security.
We
want
to
provide
the
full.
A
You
know
proper
range
of
security
checks
that
should
be
in
place
whenever
someone's
changing
a
security
policy.
So
that
way
you
know
again,
you
can
have
it
go
through
an
approval
process
to
even
change
the
approval
rules
or
you
have
that
full
audit
logging.
There
are
just
a
lot
of
benefits
to
doing
that.
A
There
might
be
a
use
case
to
move
the
other
approvals
into
some
sort
of
editor
like
this,
but
whereas
our
policies
are
focused
on
security
policies,
specifically,
I
don't
think
it
would
make
sense
to
put
them
in
the
same
place
in
the
ui,
because
we're
really
dealing
with
security
policies
there
you
know
so
I
could
see
like
in
the
long
term.
You
know
maybe
they
use
our
policy
editor,
but
they
call
it
like
merge,
request
policies
or
something
like
that,
but
I
don't.
I
don't
really
think
the
other
merge
request.
C
I
I'm
just
mentioning
that
there's
going
to
probably
be
a
overlap
between
a
couple
of
the
issues
that
I'm
going
to
work
on
with
things
that
alexander
and
mate
paul
is
going
to
work
on,
so
I'm
gonna,
I'm
just
saying
that
I'm
gonna
make
sure
that
I'm
I'm
gonna
tag
the
task
as
appropriated
and
if
any
of
you
would
like,
I
can
thank
you
for
a
couple
of
creature,
front-end
tasks,
just
just
to
make
sure
that
you
are
like
up
to
dated
on
the
changes.
C
I
don't
wanna,
just
like
having
some
misalignment
with
whatever
you
guys
are
working
with
yeah.
That's
a
great
call.
A
Out
also,
I
mean
zamir
is
just
starting
like
this
week
into
this
area,
so
we're
still
figuring
out
our
implementation
plan,
but
I
anticipate
that
there
will
be
a
lot
of
back-end
work
that
needs
to
be
done
to
make
all
of
this
possible,
and
so
I'm
hoping
that
you
know,
because
alexander
paul
you're
kind
of
in
the
middle
of
all
of
this
policy
editor
code
right
now.
I'm
hoping
that
you
know
zamir
can
do
a
lot
of
the
back-end
work
during
14-0
and
14-1.
A
You
know
and
then
we
can
come
back
and
do
some
of
the
front-end
work
so
that
way
we're
just
minimizing
the
amount
of
conflict
there
with
everyone
touching
the
same
code.
At
the
same
time,.
A
Great
well,
thanks
for
letting
me
share
that.
I
again
I
thought
it
would
be
relevant
since
since
that
code's
being
worked
on
and
as
you
work
on
that
front
end
code,
you
know
just
keep
in
mind
that
that's
where
we're
headed
so
anything
we
can
do
architecturally
to
design
it
in
an
extensible
way
that
gets
things
ready
for
zumer
to
come
in
and
do
that
work
will
only
help,
make
things
easier
in
the
long
run.
B
So
it
looks
like
there's
one
more
comment
on
this
zamir:
do
you
want
to
voice
it.
C
Yeah,
I
was
just
wondering
out
of
curiosity:
if
did
we
check
with
the
team?
That's
currently
working
on
the
approvals
if
they
are
interested
in
having
the
these
other
approvals
into
our
dialogue
as
well
in
the
future.
A
So
the
other
team
that
so
right
now,
I
think
it's
the
compliance
team-
is
working
on
getting
merge,
request
approvals
at
the
group
level
like
just
the
generic
ones,
but
not
they're,
not
touching
the
vulnerability
check
and
license
check,
so
we've
kind
of
separated
ourselves.
That
way.
I
do
not
think
that
again.
I
do
not
think
that
they
would
want
to
put
that
in
our
security
policy
editor
just
because
it's
not
a
security
policy.
A
So
would
they
want
to
use
our
ui
policy
editor
at
some
point,
maybe
we
haven't
really
had
those
conversations,
but
I
think
they're
just
they're
pretty
short
staffed
right
now,
so
they
don't
have
a
lot
of
development
time
even
to
work
on
moving
it
to
the
group
level.
So,
as
far
as
all
my
conversations
have
been
that's
really
far
out
on
their
roadmap,
they
might
be
interested
in
it,
but
I
don't
think
they're
going
to
have
time
to
do
it
anytime
soon.
A
Yeah
thanks
for
catching
that
comment
alexander,
do
you
want
to
walk
through
the
designs
or
do
you
want
me
to.
B
As
you
can
see,
I
was
puzzling
earlier
so
this
design
vulnerability
scans
against
running
container
images.
This
is
the
design
issue.
So
let's
see
what
we
have
here
right-
okay,
I
do
remember
this
epic.
So
basically,
when
you
scan
a
running
container,
all
the
vulnerabilities
that
you
find
will
drop
into
the
vulnerability
report
and
we've
got
let's
see
if
we
can
go
to
another
issue
right.
So
we
have
created
this
environment
tab
which
is
going
to
sort
of
house
all
of
those
vulnerabilities
and
you
can
filter
by
them.
B
Sam,
maybe
I
should
have
let
you
do
this
actually,
sam
do
you
want
to
just
take
over?
You
know
these
designs
better
than
I
do
annabelle's
joining
in
right
now,
so
we'll
let
her
take
over
perfect.
I
was
not
doing
a
great
job.
D
A
We
went
through
all
the
other
agenda
items
and
we
just
started
on
your
items,
so
you
have
the
rest
of
the
time
and
we're
just
starting.
D
B
You
did
miss
me
just
looking
at
the
designs
and
being
like
what's
new
here:
oh
yeah,
there's
a
tab
here
now.
Oh
oh,
what
oh
we're
doing
this
thing
now?
This
is
cool.
D
This
is
it
so.
The
the
most
recent
design,
like
you
just
mentioned,
is
the
tab,
and
I
just
wanted
to
run
this
by
everyone,
and
really
all
feedback
is
great,
because
I
sorry
my
kids
are
crying
okay,
so
we've
got
the
environment
and
project
tabs
up
here.
D
The
word
environment
is
still
up
for
debate
or
if
anyone
has
a
better
name
for
this
tab,
where
you're
running
scans
in
an
environment
or
an
external
source
like
a
container
or
potentially
a
running
website
like
for
an
on-demand
desk
in
you,
click
that
and
then
you'll
see
the
container
scanning
as
the
first
iteration
and
then
probably
eventually
dashed
as
well
for
on-demand.
E
Only
annabelle
everything
under
the
tab
is
specific
to
the
tab
itself,
so
the
pipeline
and
the
counters
the
filters-
that's
all
under
that
that
should
change
as
you
switch
the
tabs
and
it's
specific
to
what's
in
the
result.
There,
especially
the
export,
I
guess,
is
what
I
wanted
to
clarify.
D
Yes,
this
is
all
tab
specific
the
data
I
just
didn't
update
it,
so
you're
going
to
see
the
same
stuff,
but
the
export
also
would
just
export.
What's
under
that
tab,
not
the
full
report
yeah.
Definitely
until
unless
we
hear
something
from
a
customer
who
wants
everything,
then
then
we
can
update
it
later.
D
So
you'll
see
that
these
have
kind
of
changed
a
little
bit.
We've
got
scanner
and
that
would
show
either
containers
gaining
or
dust
or
whatever
others.
We
add
for
filtering
by
attributes
that
aren't
common
to
all
scanners,
like
image,
url
and
environment.
I
was
thinking
I
think
I
took
this
from
one
of
andy's
designs.
D
The
reason
why
I
think
that
keeping
these
and
adding
this
instead
of
just
going
full
on
with
the
the
filter
bar
is
because
right
now
I
think-
and
I
would
have
to
ask
andy
and
matt
the
reasoning
behind
this
in
the
first
place,
but
I
do
think
it's
nice
to
see
all
of
these
right
away,
but
also
you
can
do
that
or
operator
like
you'll
see
all
of
these.
Instead
of
so,
our
filter
bar
only
works
with
the
and
operator
right
now
right.
D
So
if
you're
searching
for
issues
you'll
only
see
medium
and
unknown
and
that
doesn't
exist,
I
think
that's
why
they
did
it
this
way,
I'm
not
sure.
But
anyway,
I
think
I
saw
something
in
one
of
andy's
designs
where
he
used
both
it
could
work
or
it
could
be
a
disaster
yeah.
A
So
personally,
I
I
haven't
had
a
chance
to
comment
on
this
yet
on
the
issue,
but
I
really
like
this
approach
because
it
keeps
a
lot
of
consistency
between
the
two
tabs.
The
only
thing
that's
different
is
that
more
filters
button,
but
at
least
visually
it
keeps
things
fairly
consistent,
and
you
know
that
way.
Hopefully,
in
the
future,
we
can
kind
of
iterate
the
project
and
environment
filters
together.
A
You
know,
I
don't
want
them
to
deviate
too
far
apart,
but
at
the
same
time
you
know
we
do
want
to
let
customers
filter
by
things
like
image.
So
it's
kind
of
a
challenge,
because
you
know
we
have
some
extra
filtering
that
we
want
to
get
in
place,
but
we
also
have
this
desire
for
consistency,
and
at
least
my
opinion,
for
what
it's
worth
is
that
this
design
does
a
really
good
job
of
balancing
both
of
those
intended
outcomes.
E
The
filters
are
challenging.
We've
had
a
lot
of
struggles
over
the
last
several
milestones
of
the
existing
filters
that
are
on
the
project
tab
and
I
would
love
to
see
us
move.
I
mean
I'd
love
to
see
this
move
entirely
to
search,
but
the
reasons
that
you
just
said,
animal
make
a
lot
of
sense.
I'd
be
concerned
about
the
level
of
effort.
This
would
take
in
an
early
iteration
to
release
this
and
wonder
if
there
is
a
iterative
approach
that
could
use
filters.
A
If
you
don't
mind,
maybe
I
can
take
that
one
for
just
a
minute,
so
we
actually
are
doing
this
in
an
iterative
way
and
what
annabelle's
showing
you
is
really
more
like
the
second
or
third
iteration.
The
first
iteration
we're
not
even
introducing
a
new
tab
at
all,
we're
just
putting
things
into
that
project.
Tab
like
well,
there's
not
even
a
tab
at
the
moment,
we're
just
putting
things
into
the
default
list
and
we're
changing
the
name
of
the
scanner
instead
of
container
scanning
it'll,
say
live
container
scanning,
so
that'll
actually
be.
A
The
very
first
iteration
will
involve
no
front-end
work
at
all
because
we're
just
putting
things
into
the
existing
ui.
So
you
know
we
can
still
get
this
out
to
customers
and
make
it
available
for
them.
I
think
where
annabelle's
working
is
more
around
like
the
end
state
design,
and
then
you
know,
if
we
need
more
iterative
steps
in
between,
we
can
obviously
figure
out
what
those
are.
D
For
just
spitballing
here,
but
some
iterative
in
between
steps
could
be
if
we
want
to
just
add
more
scanners
right
at
the
top
or
more
drop
downs.
We
could
it
won't
look
very
good
or
we
could
just
add
more
drop
down
items
here
instead
of
the
filter
bar.
So
you
click
that
you
just
get
another
set
of
drop
downs,
especially
since
we're
only
doing
container
scanning
at
first.
I
don't
know
when
desk
will
be
added
to
this
list.
D
F
Just
fyi
I'm
adding
y'alls
comments
to
the
live
doc.
I
would
like
to
determine
that
it
does
seem
the
most
challenging
thing
for
us
with
these
designs
is
trying
to
figure
out
how
to
do
the
filters
in
one
of
the
comments
sam
mentioned
that
customers
really
want
to
have
the
ability
to
filter
by
image.
My
question
for
sam
is:
do
you
think
that
should
be
a
requirement
for
the
mvc.
A
So
I
mean
it's
not
going
to
be
part
of
the
mvc,
since
the
mvc
is
just
putting
things
into
the
existing
ui
and
we
don't
have
an
image
filter
today.
So
I
guess
the
answer
is
no,
but
I
think
we
need
to
get
that
image
filter
rather
quickly.
We
already
know
from
our
own
dog
fooding
that
our
security
team
is
having
a
hard
time
using
container
scanning
because
they
don't
have
that
image
filter,
and
I
expect
that
to
be
the
same
problem
in
production.
A
I
really
can't
see
any
reason
why
it
would
be
different,
so
we
really
actually
need
an
image
filter
in
both
tabs
just
for
it
to
be
realistically
usable
by
a
security
team
so
for
the
mvc.
No,
we
don't
have
to
have
it,
but
we
need
a
short
follow-on
path
to
get
there.
B
Maybe
an
image
filter
could
be
just
a
separate
project
that
happens
in
threat
insights
while
like
soonish,
instead
of
when
this
project
starts.
A
A
If
you're
wanting
to
filter
by
a
specific
package
and
look
at
the
vulnerabilities
applicable
for
that
package
or
for
das,
you
may
want
to
filter
by
a
specific
url.
So
actually
almost
every
scanner
has
their
own
unique
filter.
That
is
strongly
needed,
and
so
it's
a
little
bit
more
complex
than
just
adding
another
drop
down
there
for
image.
So
that's
why
they've
been
you
know
why
they
haven't
solved
that
problem.
A
Yet
I
know
they're
working
on
designs
and
trying
to
figure
out
the
right
answer,
though,
so
they
will
eventually
get
there,
but
you
know
again
either
we
can
contribute
to
them
and
speed
that
up
for
them
as
well
or
we
can
wait
for
them
to
get
to
it,
but
they
are
working
on
it.
So
it's
on
their
radar.
They
know
of
the
problem.
It's
just.
The
solution
is
not
super
clear.
D
D
Andy
is
the
designer
for
threat;
no,
not
monitoring
for
what
is
it
vulnerability.
D
Threat
insight
and
he's
on
paternity
leave
right
now,
but
he's
done
a
lot
of
work
that
I
don't
have
open
with
these
advanced
filtering
options
and
advanced
export
options.
So
you
can
filter
out
certain
things
on
your
export
and
things
like
that.
So
I
know
it's
definitely
on
his
radar,
but,
like
sam
said
I
don't
think
he'll
be
getting
to
it,
at
least
for
a
few
more
months.
A
Yeah
thanks
for
walking
through
those
designs,
annabelle
and
thanks
everyone
for
the
great
attendance
and
participation
today,
any
other
questions
or
comments
before
we
wrap
it
up.