►
From YouTube: Alpha Omega Project Public Meeting (March 1, 2023)
Description
B
A
E
C
E
E
C
A
So
Michael
posted
in
the
ID
defined
security
threads
group
that
the
meeting
following
this
of
the
identified
second
interest.
He
won't
be
able
to
join
that
so
he
has
someone
to
take
over
and
I
volunteered.
I
was
not
sure
about
this
one,
so
it
yeah.
Apparently
it
looks
like
that
he
may
be
unavailable
for
this
one
as
well.
Okay,.
E
G
D
E
Were
not
prepared,
yeah
I
will
also
note
that
you
know
what
you
know.
It
doesn't
take
me
longer
at
all
to
Riff
on
something
and
I
think
I
do
know
something
about
this
topic.
All
of
us
all
of
you
should
be.
All
of
us
should
be
able
to
give
the
brief.
You
know
what
is
aeo's
pitch,
hopefully
by
now
that
said,
I
have
to
admit
I've,
you
know
I'm
in
so
many
different
things.
E
G
G
E
E
B
E
I'm
kidding
hey,
you
know
what
I
I'm
I'm
good
with
that
I
mean,
but
as
far
as
I
know,
Alpha
Omega
is
still
the
same.
Basic
construct.
Alpha
is
focusing
on
a
relatively
few
critical
projects
very
fun
to
really
improve
them,
and
then
the
omegas
all
the
analysis.
I
do
think
that
there's
something
that
is
slowly
transitioning
well
I
mean
transitioning
exactly,
but
at
least
for
now
a
a
tweak
in
the
Omega
Focus
and
Jonathan.
Frankly,
you
represent
it.
E
So
let
me
state
it
for
the
record
because,
although
I
think
we've
said
it
before,
I'm
not
sure
how
much
that's
written
down-
and
that
is
Omega-
is
all
about
the
larger
set
of
programs.
How
do
we
deal
with
that?
And
so
you
know
for
a
while,
we've
been
saying:
hey
we're
going
to
use
tools
to
find
vulnerabilities.
That's
still
true,
however,
and
Jonathan
you're
very
much
representative
of
this.
E
As
we've
talked
about
this
one
of
the
things
that's
not
happening
in
really
any
other
place
is
the
looking
for
those
cases
where
vulnerability
is
common
across
a
very
large
number
of
projects
and
trying
to
get
vulnerability.
Patches
proposed
to
a
large
set
at
once.
Currently,
you
know
pretty
much.
Every
project
works
independently
and
if
you
see
a
problem
in
one
program
you
report
it
and
it
maybe
it
may
get
fixed
in
one,
and
so
one
of
the
things
we
basically
have
added
to
the
Omega
toolbox
is
well.
E
E
We've
said
that
in
some
circles,
but
I'm
not
sure
how
probably
that
discussion
has
been
made
and
really
it's
a
it's
a
tweaking
as
we
as
we
go
down
this
path
of
turning
Omega
from
an
idea
into
practice.
Tell
me
if
I
said
anything
wrong
or
you
want
to
clarify
something:
nope,
nope,
okay
and
and
by
the
way
I
keep
pointing
out
poor
Jonathan,
saying
he's
represents
it
because
you
know
in
our
discussions
you
know,
there's
a
huge
number
of
really
awesome
security
researchers
and
that's
great.
E
On
the
other
hand,
when
we
started
talking
about
hey,
how
can
we
scale
things
up?
It
turned
towards
well
wait
a
minute,
although
there's
lots
of
researchers,
we
only
know
of
one
who's,
focusing
on
the.
How
do
I
create
a
large
set
and
Jonathan's?
Frankly,
the
expert
on
that
topic,
so
you
ended
up
being
the
person
we
pulled
in.
A
E
E
A
big
negative
that
Jonathan's
alluding
to
is
that
you
know
typically
each
suggestion.
Each
issue
is
written
by
a
human.
The
patch
is
written
by.
You
know
if
there's
300
different
programs
that
need
to
be
fixed,
that's
300,
different
patches,
written
by
300,
different
humans
and
instead
creating
automated
tools
where
we
really
really
focus.
The
big
risk,
of
course,
is
that
it
could
look
like
a
whole
lot
like
spam
and
that's
not
the
goal
so.
G
E
Trying
so
Jonathan
right
now
is
dealing
with
the
unenviable
task
of
trying
to
you
know,
work
with
larger
Community
to
make
it
clear.
This
is
not
spam.
We're
trying
to
fix
a
real
problem
in
a
scalable
way,
and
you
know
I
I
am
sure
that
we're
going
to
we've
already
gotten
some
pushback,
because
it's
new,
it's
different
and
frankly,
I
think
their
developers
are
rightly
worried
that
if
you
just
run
automated
tools
and
they
produce
garbage
that
they're
going
to
be
overwhelmed
with
garbage
I
think
that's
a
legitimate
concern.
B
B
You
know
I
I,
built
data
flow
analysis
inside
of
open
rewrite
to
be
a
certain,
have
a
certain
set
of
characteristics
that
I
needed.
For
you
know
short
term
like
this
is
what
I
needed
for
the
Dank
Minsky
fellowship
and
I'm
like
this
is
not
sufficient.
I
need
more
so
yeah,
yeah
yeah.
So
that's
you
know.
B
At
a
high
level,
I
I
I
should
probably
put
together
a
document
for
the
meeting
today
discussing
some
of
the
proposals
for
like
best
practices
that
I
consider
around
automated
vulnerable
disclosure,
mostly
from
pulling
from
my
slide.
Deck
of
this
is
the
things
that
I've
learned
and
people
have
been
shot
in
the
foot
by
so.
F
D
B
B
G
B
So
previously,
I
generated
like
100
65,
pull
requests
to
fix,
zip
slip
across
the
Java
ecosystem,
I
also
fixed
a
vulnerability
called
temporary
directory
hijacking,
partial
path,
reversal
and
temporary
directory
local
information
disclosure.
So
those
are
the
three
things
that
I
tackled
with
automation.
B
You
know
long
term
would
love
to
support
stuff
like
SQL,
injection
and
stuff
like
that.
But
you
know,
data
flow
needs
to
be
more
complex
to
support
that,
so
the
data
flow
control
analysis
that
I'm
working
with
only
Sports
single
file,
not
multi-file
data
flow
and
control
flow
analysis.
And
if
you
really
want
to
tackle
SQL
injection,
you
really
need
that.
But
it's
a
bigger
problem
like
first
off
the
problem
of
writing
the
data
flow
and
then
there's
the
second
problem
of
actually
leveraging
it
to
actually
generate
a
fix.
B
H
A
E
Yeah
yeah
and
that's
really
I
think
the
key
step
here
is,
you
know,
creating
a
patch
that
we
know
can't
won't
be
accepted,
is
no
bueno,
so
you
know
being
able
to
make
it
fit
right
into
the
their
existing.
Software
is
key
to
this.
Yes,
yeah
and
I
I.
Think
Jonathan.
Although
it's
you
know
automated
creation,
I
think
the
notion
was
at
least
reviewing
yeah
I've
forgotten.
What
the
the
plan
was
for
for
review
of
these
proposals
before
they
they
started
going
out,
but.
B
B
Myself,
as
a
as
a
you
know,
as
a
one-off
sort
of
event,
and
the
the
longer
term
goal
is
just
the
long
well,
short-term
goal
is
to
set
these
things
up,
as
continuously
running
campaigns
to
automatically
generate
pull
requests
into
the
future.
You
know,
and
that
will
mean
that
any
any
cases
of
these
vulnerabilities
that
actually
appear
in
open
source
moving
forward
will
just
get
cleaned
up
immediately.
E
But
I
think
the
goal
is
at
least
what
I
suspect
would
be
best,
and
so
let's
have
this
discussion.
This
is
a
public
discussion
would
be.
You
know,
just
like
certain
other
tools
that
are
highly
critical.
Usually
you
start
by
you
know
you
know
developing
it
and
then
releasing
it
out
to
a
test
Community,
for
you
know,
you
know
test
it
yourself,
small
test
community
and
then
you
grow
out.
In
other
words,
oh,
it
affects
say
500
projects
that
we,
okay,
we're
going.
E
D
B
E
I
I
think
I
I
I
know
that
you've
done
some
of
that
before
I.
Think
and
I
know
that
yeah
I
think
we
ought
to
be
careful
about
writing
a
lot
of
that
down,
because
I
think
that
that
I
think
that's
important.
I
think
that
we're
also
allay
some
of
the
concerns,
primarily
basically
that
most
developers
are
really
busy
they're
overwhelmed
and
they
don't
want
to
get
have
a
lot
of
useless
spam
that
they
have
to
trudge
through
and
I.
Think
that's.
E
C
E
And
I
guess
the
other
thing
would
be
regard
coming
back
to
the
spamming
thing,
the
worries
about
spamming
and
overwhelming
you
know
I.
Imagine
that
we
want
to
again
do
incrementally,
do
it
in
batches.
You
know
whenever
there's
an
indication
that
hey
we
want
to
change,
50
million
programs-
you
know,
let's
you
know.
Basically
you
know
you
know,
do
rate
limiting
or
something
to
prevent
it
to
prevent.
F
B
B
Maybe
the
idea
is
that,
like
I
mean
long,
so
the
the
long-term
vision
is
so
short
term
right.
Unfortunately,
in
order
to
fix
vulnerability
to
scale
across
open
source,
you
can't
you
have
to
generate
a
pull
request.
You
can't
you
can't
create
a
GitHub
security
advisory
privately
and
disclose
the
vulnerability
there,
because
GitHub.
F
B
Have
an
API
for
automating
the
process
of
opening
ghsas,
and
so
you
end
up
like
as
you're
fixing
these
vulnerabilities
across
open
source.
You
end
up
oding
a
bunch
of
projects
the
long
term.
The
idea
is
that
we
can,
if
GitHub,
can
add
an
API
to
support
opening
ghsas
via
that
by
an
API
that
we
can
work
towards
privately
disclosing
vulnerabilities
at
scale
through
automation,
yeah,
I,
don't
know
that
doesn't
quite
answer
your
question,
but
or
maybe
it
does
I
don't
know.
H
Yeah,
that's
interesting,
I
suppose
what
I
was
referring
to
is
the
possibility
of
having
an
opt-in,
explicit
opt-in
to
this
program,
because
you've
mentioned
earlier
that
you
don't
want
to
go
and
sort
of
spam
everyone.
At
the
same
time,
you
want
to
start
out
with
a
small
sample
check
that
the
results
are
high
quality,
but
ultimately
some
people
will
want
to
have
a
go
first
and
kind
of
jump.
The
gun.
B
Is
there
a
place
for
that
to,
like
you
know,
give
those
to
certain
projects
ahead
of
time.
Yeah,
that's
not
unreasonable.
I
can
yeah
I
could
do
that.
That's
actually
pretty
simple.
There's
a
project
in
modern
called
modern
organizations,
and
if
and
it's
kind
of
tied
to
me
and
my
name
but
I-
could
create
a
list
of
projects
specifically
like
that
want
like
early
preview
like
ERS
to
to
like
be
part
of
that
feedback.
B
H
E
I
would
suggest
it
be
somewhere
in
between.
In
other
words,
you
know
by
all
means
Jonathan,
you
know
first,
look
through
filter
out
the
ones
you
know
aren't
wrong
and
then,
when
it
looks
like
it's,
okay
I
mean
you
know
I,
my
thinking
is,
and
it
sounds
I
think
this
is
what
you've
been
doing
anyway.
Is
you
start
releasing
it
to
a
small
set
and
then
to
a
larger
set
and
right
now,
I
think
the
thinking
has
been
that
small
I
mean
you've
been
picking
the
smaller
set.
E
If
I
understand
correctly,
but
I
mean,
if
there's
a
group
of
projects
that
are
especially
active
and
they're
interested
I
mean
they
could
certainly
be
included
in
the
small
in
the
the
initial
tranches
that
were
okay,
you
have
a
larger
set.
If
you
know
it
would
apply
to
but
I'm
guessing
you
want
to
start
by
sending
it
out
to
a
small
set,
see
if
there's
any
screaming,
complaining
and
then
grow
it
out.
This
is
about.
This
is
the
same
way
that
web
browsers
get
deployed.
You
know
Chrome
releases,
a
new
version
of
Chrome.
E
E
Yeah
yeah
there's
something
deploy,
I,
think
it
it
there's
a
anyway
there's
a
name
for
this
when
you're
going
to
deploy
it
among
a
very
large
set
of
of
things.
But
you
you
want
to
have
early
warning
that
there's
a
big
problem:
hey
I'm,
deploying
the
new
version
of
Chrome,
but
it
doesn't
work
if
you
have
an
HP
printer
attached,
I'm
making
this
up.
C
E
B
One
other
thing:
modern
I
said
this
in
the
AO
chat
but
or
the
private,
a
okay,
modern,
just
added
so
code
ql
index
is
like
30
000
Plus,
open
source
projects
and
I
had
that
list
of
projects
and
I
gave
it
to
Modern
and
said:
hey.
Can
you
create
parity
with
that,
and
so
they
are
starting
an
ingest
job
to
hopefully
create
indexes
to
parody
the
number
of
projects
that
open
rewrite
or
sorry
the
code
ql
indexes
my.
G
B
Security
researchers
write
a
code
to
Aquarius,
see
how
widespread
the
vulnerability
is
and
then
turn
it
into
an
open
rewrite
recipe
to
fix
it,
and
so
this
is,
this
will
make
it
easier
to
just
you
know,
start
with
an
open
rewrite
recipe,
or
you
know
make
sure
that
the
the
what
the
what
coach
you
all
finds
for
a
result
will
actually
be
something
that
it
will
will
parody.
Hopefully,
the
scale
of
the
fix
that
we
can
fit
the
the
vulnerability,
the
open
source
project
we
can
fix.
E
Okay,
so
I
I
just
did
a
lookup,
it
looks
like
phased
rollout
is
one
of
the
terms
used.
So,
let's,
let's
use
that
at
least
for
now.
Basically,
we
could
allow
a
project
to
opt
in
to
be
part
of
the
first
phase
of
a
phased
rollout.
So
at
that
point
you've
done
the
analysis.
You've
looked
across
a
very
large
set
of
projects,
but
that's
not
where
how
we're
going
to
deploy,
because
we
you
you
because,
even
though
you
can
see
exactly
what
the
code
change
is,
maybe
there's
some
weird
surprise
problem
with
it.
E
E
and
you
know
you
look
it
over.
Everything
looks
good,
you
know
or
or
it
could
be
10..
Let's,
let's
mean
make
that
simpler.
You
know,
you
know
so.
First
roll
out
to
ten
everything
looks
good,
you
hand,
reviewed
everything,
looks
good
they're,
the
first
phase
and
I.
Don't
have
any
problem
with
projects
opting
in
I
guess
the
only
concern
I
would
be.
Having
is
if
that
I
guess
most
of
these
most
of
the
ones
are
ones
where
it's
not
a
grand
secret,
that
their
vulnerabilities
are,
they
are
or
are
they
what
I
mean?
E
B
A
B
E
E
All
right
so
I,
I,
guess
yeah.
This
all
comes
back
to
the
challenge
of
the
defender,
which
is
you're
trying
to
defend
the
software
without
helping
the
attacker
too
much,
and
it's
always
a
judgment,
call
and
trade-offs,
because
obviously
attackers
can
do
analysis
and
find
vulnerabilities
in
attack.
That's
what
a
whole
lot
of
them
do.
H
E
E
A
D
A
E
B
Yeah
they're
they're
not
having
it's,
not
opt,
it's
not
opt
out.
Currently
it's
currently
opt-in
and
they
I've
talked
to
Gray
and
he
his
response
is:
we've
just
released
this
thing:
we're
not
going
to
make
it
something
that
we
give
to
everybody
and
meet
like
we're
not
going
to
force
it
on
everybody
immediately.
We
can't
do
that.
Yeah.
E
Let's
see
here,
okay,
I
just
did
a
quick
search
because
they've
been
saying
this
a
while.
So
and
my
apologies
I,
you
know
I,
don't
there
are
a
lot
of
things
to
keep
up
with
so
I
just
did
a
quick
web
search
and
I
found
that
you
know
they've
been
saying
for
a
while
they're
going
to
support
this,
so
it
looks
like
it
looks
like
they've
actually,
finally,
added
it
it's
in
beta,
you
have
to
configure
to
turn
it
on.
Yes,
yes,.
A
It
was,
it
was
introduced
in
the
GitHub
Summit
this
year
or
last
year.
Yes,
one
of
the
big
features
that
were
introduced
but
yeah.
It
is
now
opt-in
and
not
opt
out
and-
and
they
have
initially
had
some
I
mean
based
on
again.
Public
data
initially
have
some
success
on
some
people
obtain,
but
then
latest
taper
it
off
and
I
mean
some
of
the
stuff
you
need
to
probably
like
yeah
I,
don't
know,
I
mean
there's,
obviously
some
politics
that
or
or
some
understanding
this
that's
behind.
A
F
E
And-
and
you
know
what
having
operated
operational
systems
before
I
actually
salute
the
attitude
really,
there's
there's
nothing
worse
than
a
service
that
you
don't
directly
control.
That
constantly
makes
changes
that
screw
up
things.
That
cost
you
lots
of
time,
and
you
know
I
I
I.
Think
in
general
is
this
that
you
know
they've,
never
told
me.
Oh
my
gosh!
This
was
a
terrible
idea.
I
mean
to
be
fair,
it's
back
when
Microsoft
was
acquiring
GitHub.
E
This
was
actually
one
of
the
things
that
they
said
that
they
did
intend
to
do
so
even
before
they
were
bought
out.
There
was
an
agreement
that
they
were
going
to
do
this,
but
they're
rolling
it
out
carefully,
and
while
I
would
like
to
see
this
a
lot
faster
and
on
by
default,
that's
not
the
way
they
have
chosen
to
do
it
and
I
can't
fault
the
I'm.
You
know
the
conservative
nature
of
some
of
this
in
the
sense
that
you
know
this
is
their
General
nature.
E
E
D
E
D
B
I
mean
so
the
the
we
proposed
we
Sandy
and
I
work
or
well.
Yes,
any
created
a
data
flow
graph
of
how
the
ideal
disclosure
flow
would
work
and
the
ideal
disclosure
flow
would
be
hey
maintainer.
We
found
a
vulnerability
in
your
project.
We
want
to
report
to
please
open
it.
Please
enable
automated
vulnerabilities
or
please
enable
display
or
private
vulnerability
exposure,
otherwise
we'll
open
a
poll
request
within,
like
you
know,
two
weeks
right,
14
days
from
now,
there'll
be
an
automated
pull
request
to
open
against
your
repository.
B
C
B
B
E
H
H
All
right
so
last
year,
I
was
looking
at
Robert
Pike's,
quantifying
criticality
paper,
which
is
of
course,
a
an
element
which
is
quite
important
for
this
Alpha
Omega
project,
and
there
were
quite
a
few
typographic
kind
of
quirks,
probably
due
to
a
word,
PDF
export
or
something,
and
so
I've
Rewritten
that
in
latex
and
I
was
wondering
if
this
was
something
that
the
group
would
like
to
take
on
and
publish
so
I
can
share
it
on
my
yeah
Zoom
screen
share.
That's
what
it
looks
like.
H
B
E
B
H
I
couldn't
find
out
where
to
contact
Rob,
Rob
Pike,
and
considering
that
this
document
is
sort
of
providing
the
foundations
for
the
tech
team.
This
sort
of
the
the
long
tail
of
software
projects
that
you
know
the
important
ones
that
are
being
let
slipped
through
the
net
I
thought
I,
would
ask
here
and
see.
If
you
could
point
me
in
the
right
direction,.
F
E
It's
really
heavily
focused
on
popularity
and
and
and
on
things
like
changes
which
aren't
always
you
know
if
it
aren't
always
the
same
as
how
critical
it
is
in
sane
infrastructure.
If
that
makes
any
sense,
it
does
its
measure
best
to
measure
certain
things
and
it
you
know
it
sometimes
doesn't
measure
things
you
might
think
it
might,
because
some
things
are
very
very
hard
to
measure
turns
out.
H
E
H
E
Or
you
can
just
contact
the
criticality
score
folks
directly
I
mean
I,
think
there's
you
should
be
able
to
find
it
within
their
project.
Their
contact
I
mean.
If
you
can't,
you
know,
contact
the
criticality
working
group,
that's
where
they
live,
but
you
know
changes
for
a
particular
project
contact
the
project
directly
is
the
simplest
and
best
way
typically,
but
if
you
have
trouble
doing
that,
yeah
absolutely
go
to
the
working
group,
we'll
get
you
we'll
get
you
handled
right.
Thank.
E
H
C
E
Yeah
clearly
in
the
mathematics,
World
I'll
attacks
all
over
so
okay
yeah.
So
anyway,
yeah
I
would
contact
them.
And
if
you
don't,
you
know,
if
you
can't
contact
the
project
contact,
the
working
group,
if
you
just
can't
get
anything
else,
get
a
hold
of
me
and
I
will
try
to
figure
it
out,
but
I
don't
think
you
should
need
to.
You
should
be
able
to
just
contact
those.
You
know
those
as
well.
Instead.
E
So
maybe
I
should
ask
a
question
for
Jonathan.
I
will
pretend
I'm
the
public
for
the
moment
here,
which
is
so
I
know
you've
been
working
on
trying
to
write
some
of
this
down
so
that
other
people
can
see
and
understand
the
plan.
You
know
if
nothing
else,
to
kind
of
reduce
the
worries
of
some
folks.
Any
idea
when
you'll
get
that
first,
those
first
things
out
for
public
comment
or
at
least
wider's
widespread
comment.
The.
B
Song
about
automated
vulnerability,
disclosure,
yeah,
I'm,
I'm,
sure,
okay,
so
the
plan
there
is
to
do
it
a
little
differently.
It's
I
mean
my
I'm,
basically
gonna,
take
my
black
hat
talk
and
turn
it
into
or
the
best
practices
chunk
of
the
black
hat,
Defcon
talk
and
turn
it
into
a
document
that
says
here
a
set
of
best
practices.
B
B
Could
be
a
a
set
of
processes
and
policies
around
automating
vulnerability,
fixing
at
scale
across
open
source
such
that?
If
you
follow
these
norms
and
best
practices,
you
can
flag
your
your
campaign
or
you
can
have
your
campaign,
get
signed
off
and
say
these
F.
This.
This
campaign
follows
this.
Best
practices
like
these
sets
of
best
practices
that
the
open,
Star,
Security
Foundation,
is
has
blessed.
F
B
E
Okay,
that
makes
sense
so
yeah
I
think
you
know
that
process
makes
sense.
It's
just.
We
want
to
make
sure
that
we
get.
You
know
some
sort
of
rough
consensus
on
that
publicly
before
we
do
too
many
of
these
things.
I
know
you're
simultaneously
actually
implementing
campaigns,
and
we
don't
really
want
to
stop
that,
because
just
writing
documents
in
the
end
isn't
what
what's
helpful.
It's
the
actual
activity
right.
B
Yeah
it
you
know
it's,
it's
just
I
think
that
if
we
can
come
up
with
a
set
of
guidelines
that
determine
that
a
certain
process
is
more
or
less
blessed
by
the
open
ssf
like
we
can,
we
can
have
my
cam.
You
know
the
campaigns
we
do
as
AO
follow
that
Bezos
best
practices,
but
others
can
feel
free
to
engage
in
those
sorts
of
campaigns
to
you
know
you
know,
but
you
have
you're
gonna
just
be
cross
industry
and
it.
E
D
E
B
A
B
Where
they
have
a
lot
of
Grant
like
languages
that
share
enough
similarities
to
one
another,
that
you
can
shoehorn
like
other
languages
into
the
asts
of
java
and
then
dump
it
back
out.
So,
for
example,
like
you
can
write
kotlin
or
you
can
have,
you
can
have
kotlin
be
represented
by
the
Java
AST.
You
can
manipulate
that
AST
and
then
dump
that
back
out
and
have
it
be
kotlin
again
or
JavaScript
or
python,
and
so
that's
that's.
B
A
That
that's
ideally,
is
the
operative
word
here
yeah,
so
I
worked
at
kubernetes
and
Community.
They
have
this
like
Central
ASD
and
where
the
multiple
languages
into
the
same
AST.
But
when
we
were
building
analysis,
it
was
different
analysis
built
for
different
languages,
because
it's
not
I
mean
the
asts
could
be
the
same.
A
That's
that's
a
different
goal
which
may
apply
for
rewriting,
but
when
you
are,
when
you're
actually
doing
this
like
serious,
like
control
flow
data,
flow
related
stuff
languages,
they
have
their
own
nuances
now,
Java
and
kotlin
can
share
a
lot,
but
Java
and
C
Java
and
python.
Definitely
not
Java
and
python
I
mean
because
they're
vastly
different
languages.
A
So,
even
if
their
asts
look,
the
same
means
nothing
at
all
in
terms
of
in
terms
of
what
what
the
underlying
thing
is,
so
so
in
in
C,
for
example,
any
variable
is
addressable
right,
I
mean
you
can
do
an
and
X
or
whatever
in
Java
you
can,
and
so
how
do
you
write
the
same
analysis
in
in
both
of
those
cases?
You
just
cannot
so
that
that's
something
that
that
that
I
am
just
like
I
want
to
bring
in
from
my
experience
in
the
industry
and
also
definitely
in
the
Academia.
A
That's
one
thing
about
Java
analysis
that
you're
doing
I
mean
we.
We
have
solutions
for
actually
not
even
data.
Our
data
flow
is
primitive.
For
that
matter.
We
have
abstract
interpretation
in
in
Java
that
that
does
this
kind
of
stuff.
We
discuss
some
of
that
in
during
the
CNS
form
like
regarding
this
thing
so
specifically
like.
A
What
exactly
are
you
doing
for
SQL
I
mean
I,
know
that,
like
for
zip
sleep,
you
had
a
specific
vulnerability,
it
was
using
a
library
or
something,
and
then
you
were
like
modifying
that
Library
call
or
modifying
the
parameters.
Etc.
That's
what
solved
it
with
SQL.
You
were
thinking
of
rewriting
query
strings
that
are
formed
by
string
concatenation
into
prepared
statements,
but
that's
going
to
solve
the
whole
SQL
problem
or
yeah.
E
A
Mean
that's:
that's
the
the
plan.
Are
you
looking
into
a
broad
scope
like
that,
or
are
you
looking
into
a
specific
cve
for
SQL
that
was
established,
which
is
what
you
typically
do
like
specific
CB
that
got
published,
and
you
see
that
that
CV
is
applicable
to
many
like
more
than
one
repositories,
and
then
you
write
automated
automated
stuff
for
that.
But
in
from
what
we
are,
what
we
discussed
about
SQL
you
seem
to
be
like
looking
into
a
more
common
problem
than
a
specific
CBE
or
anything.
A
B
Yeah
at
a
high
level-
it's
it's
mostly
focused
on
so
so
I
haven't
started
anything
for
SQL
right,
the
the
at
a
high
level.
The
idea
would
be.
Can
we
do
taint
tracking
from
like
user
supplied
arguments
to
the
location
where
those
those
strings
are
getting
appended?
If
we
can,
we
know
that
that
string
value
can
get
tainted
by
an
attacker.
Let's,
we
can
rewrite
this
to
be
repaired
statement
instead,.
D
B
A
Sure
and
I
I
showed
you
examples
that,
like,
for
example,
we
can
fix
this
kind
of
stuff,
but
not
in
all
cases.
You
can't
do
that
in,
like
you
see
like
when,
when
you
do
inter
procedural
stuff,
it
gets
complicated
pretty
quickly
so
that,
even
if
you
can
follow
the
teams,
you
cannot
really
use
that
to
like
rewrite
an
SQL
query,
rewriting
an
SQL
query,
which
is
now
formed
by
a
query
string
tools.
A
Then
we
formed
as
a
prepared
statement
is
a
is
a
whole
new
whole
different
ballgame
because
it
might
actually
require
you
to
change
apis
and
then
stuff,
and
you
don't
want
to
do
that.
It's
not
that
simple.
When
you
go
beyond
the
procedure
boundary
within
procedural
boundary,
we
can
create
with
pretty
much
confidence.
I've
shown
you
examples
and
in
our
case
like
when
we're
doing
a
like
in,
inter
intra
procedural
change
or
within
the
procedure
that,
like
success
rate
for
that
is
like
nearly
like
85
90
of
the
cases,
you
can
do
that.
D
A
But
the
specific
problem
that
you're
solving
I
showed
you
examples
and
then
such
that
we
have
already
done
that.
So
maybe
that's
that's
where
something
that
we
we
can.
We
can
work
or
well
yeah
collaborate
regarding
that
and
yeah.
That's
a
discussion
to
be
had
yeah
that
we
should
be
having
in
future.
D
B
You
know
that
that
makes
a
lot
of
sense.
I,
I
agree
with
you,
no
I,
you
know,
I
I
generally
agree
right
like
the
way
that
you
you
take
any
problem.
That's
massive
you'd
find
the
simplest
solution.
You
build
on
it
and
add
more
and
more
sport
right,
like
I
I,
built
data
flow
and
control
flow
analysis
for
open
rewrite,
but
only
to
the
scope
of
what
I
actually
needed
in
order
to
make
the
the
stuff
work
right.
B
E
We're
nearly
at
time,
but
my
expectation
how
we're
going
to
move
forward
is
that
we're
going
to
use
a
variety
of
tools
to
find
a
vulnerability.
Yes,
okay,
many
different
ones,
and
then
once
we
see
a
pattern,
that's
likely
to
be
in
other
places.
That's
when
we
you
know
so.
Basically
you
know
tools
like
coverity
many
other
tools.
They
can
find
a
problem
which
is
awesome,
but
the
next
step
is
oh
wait.
This
seems
thing
seems
to
be
all
over,
and
so
now
we're
talking
about
things
like
you
know.
Why
do
data
flow?