OpenSSF Alpha-Omega, 8 Feb 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Alpha Omega Project Public Meeting (February 8, 2023)

Description

https://github.com/ossf/alpha-omega

A

B

I can't hear you, can you hear me.

C

It's just it's just that it's just the mute button. Can you can you hear me? Okay, I. Can yes cool.

D

B

I managed to get video working again.

B

I was having some problems yesterday so because technology.

C

Because technology.

B

Because technology good to see everyone, foreign.

B

C

Usual Suspects.

B

Usual Suspects.

A

Of course, you would say that when I sign on.

B

And we're glad to have you.

D

B

I'm speaking about myself as well so and it's the start of a beautiful friendship as I believe how uh Casablanca is.

C

Give it like one more minute and then we'll get started.

C

All right well welcome everyone to the February, 8th, uh Alpha Omega public meeting, as you can tell my voice is a little bit hoarse today, uh but we're going to get through it. So uh as as usual q, a there's lots of questions, I think like force. Two-Thirds of the folks on the call are directly on the project. So if, uh if you run out of questions, we can give everybody time back. If not, um we can just chat.

D

Yeah, what is Alpha Omega.

C

No, don't start with me it's too early in the morning, um so the the first um you know, major change that we want to talk about was um uh Michael. Windsor is no longer um at Google and it's no longer.

D

C

Position that he was uh on Alpha Omega, uh so Bob Calloway who's been uh well Bob and Brian are both from Google they've. Both been it's just. You know um involved in open ssf for a long time. uh Bob is the like appointed single, like uh personal contact for Google, for Alpha Omega, going forward uh Brian's supporting him, so I feel good about this. I don't feel like it. It doesn't change the mission, it doesn't change the focus.

C

We still have really smart people doing like, hopefully, really good things um but just want to be uh be transparent there um Alpha engagements, um so we still have the same uh same five engagements that we've that we talked about last month.

C

um We are looking at a couple more for if I were to guess, I would say um possibly by the end of March. um We'd have something to announce uh similar similar in these, but we don't want to. You know, talk about them until we're we're further along in the process, um but that does actually raise an interesting point on like are we like? Do we have the right funnel to consider the right consider the right projects so right now? It's a combination of us reaching out to projects and projects reaching out to us.

C

If there's you know, if you know any of you on the on the call um have thoughts on places in the ecosystem, where investment would have outsized impact um like throw them over to us.

C

Yeah you open up, I mean email would be easiest, but um you know anyway, just get in contact with us and you know give us a you know, give us the list, give us a pitch, give us whatever, um but we definitely want to make sure that we're focused on the right things um and and a lot of times I what I'm, where I'm thinking is like we all know about like node and eclipse and rust and and python, um but in the in the idea of like live Nebraska like are there?

C

Are there fundamental core projects that everybody relies on that are never on like the top end list?

C

um And if so, you know I'm thinking more than individual, like literally a lib Nebraska project, but like a oh yeah, this ecosystem actually runs like all the hospitals in the world, whatever uh George.

E

Yeah I'm sorry I can't answer that question. Even though I I can kind of confirm that this is a very interesting one. I was just wondering, like you, have um these engagements they're, basically on on Foundation level, so I think all of them have potentially tons of different projects underneath so I don't know if that is part of the the updates that you host on GitHub.

E

So sorry, if I didn't read up on that before, but how do you pick individual engagements um on for for one of or a particular project um for one engagement like, for instance, in the eclipse, Foundation context, sure I'm, just curious and yeah.

C

So so the reason so so Eclipse you know they're at the beginning, you know they're all slightly well, they're all very different from one another um part of the reason for like, for instance, for jQuery, um one of the reasons for jQuery like Beyond, like it on the surface being a critical project, and all that was because it was different than the others. All the others were Foundation supported, I mean notice, probably in a similar category as jQuery, but like Eclipse.

C

One of the reasons we've talked to we were interested in in Eclipse was you know because they cover 140 different projects, I think uh if memory serves so by investing essentially like one unit of investment, you could improve the security for a wide swath of projects, as opposed to saying you know targeting this investment to, like you know the Eclipse IDE or the C plus plus um toolkit for eclipse or um C python.

C

Specifically, it said it's no it's to the python foundation and because they're in better position to know where, um where, where that that focus should be to have the the most impact we kind of you know, we work with them, but mostly we defer to them to to have that that insight and allocate that um in that way, um if there's a separate question, which is, why do we choose Eclipse, rust and Python and not Foundation a b and c, uh and that you know part of it is the critical projects working group.

C

um We were kind of informed by that the list that they have of the top hundred most of I, don't say most that um if, if you look at that list and look at the list that we've, you know the list here on the screen, there's a big overlap. So they kind of make sense like we aren't. You know, I, don't I hope we're not choosing projects that don't matter, um but there's a huge list of projects that really do matter.

C

So um could we have invested in, you know, take out rust and put in another one sure it would have been in a similar boat um and and that's why I think that the the goal for 2023 um number one is to like continue making more Investments. We do one, we don't want our portfolio to just be five.

C

We want it to be I, don't know 50 or 25 or some number more than five, um but in order to scale that- uh and this comes comes down to like the um the strategy that we have, which is um help help these foundations build capacity themselves on an ongoing like budgetary base. So um we had an off site last week and we were chatting about. um You know some of the ways that we could do this and we talked about like.

C

Could we do matching funds so, instead of giving you know the full amount, we say we will give 75 of whatever you get elsewhere up to some. You know capped amount uh or something just to kind of put start, putting a gentle pressure on these foundations to diversify their inbound um fundraising for security, because at the end of I, don't know 2025. If we have 25 critical projects that every year their security depends on us, writing them a check. I think we've failed the ecosystem, so I I.

C

Definitely don't want to be in that in that position where we wind up, um you know creating that that hard dependency.

C

If that answered your question, it was a little rambly, but.

E

uh Yeah, it did um thanks thanks.

C

Yeah and then there are updates on the um I just merged a couple, um but there are updates on the uh the the site here on on under Alpha Omega, so I think we have ones from each of the five now um and a couple couple just as of as of this morning,.

B

Michael, do you mind if I jump in here real quick.

C

Absolutely I mean no I, don't mind, but.

B

Don't mind I probably, should rephrase that question okay, um yeah, I I agree with that with everything you said, I I think also in in at least some of the discussions that we've already had. That has been interesting. Yes, do find and fix specific vulnerabilities that that's important, that's a good thing, uh but uh also you know trying to help. You know make changes to that uh their own processes automatically detect. You know it basically help them make changes so that future similar problems can't ever happen in the first place.

B

um I I love what the um what the airline industry does, where every time there's not just an accident, but something that is a that that could have if other things had gone wrong, become an accident step back and ask what happened. Why and we're not here to beat up people we're here to figure out how we can change things to make that even less likely in the future and if we just if we all as a larger Community, do that uh these these problems are just going to slowly be squished out.

D

C

Yep I absolutely agree, I mean I, think the problem that a lot of these foundations or larger projects have in general, not just the foundations, is you know they, and this is true for organ for commercial companies too. um They tend to be in kind of jumping from crisis to crisis. So a a big vulnerability happens. It's scramble like the first order.

C

Businesses get the thing fixed that that, like longer root cause analysis, let's steer the ship in a slightly different direction so that so obviously, since in the future, um it's there's that it's the um I don't know. Cobbler's son is the right right there and that, but it's, but it's like it. That is always second tier to um either. You know Feature work like actually doing the thing that you're in business to do- or you know, responding to crises um and I.

C

Think one of the things that I I hope this funding through through Alpha gives is some um a little bit more breathing space so that you know someone can like and I think I think almost all of the engagements we have included um a specific bullets on, like you know, learn about the security with a gaps within the processes and then work to change that and improve that.

C

So so, in addition to just kind of making security releases and Bug Sexes and and vulnerability detection and installing code scanners, it's like the the look at it holistically and and improve things over time and I. Think um uh eclipse is the one that comes to mind in particular that you know with um a lot of what they've done with you know, running scorecard um looking for uh I think they've already started on salsa.

C

um You know things that they can do across their entire portfolio, that that, like elevates the the water level or maybe lowers the water level, I don't know.

C

um So that was the major update that I had I think the next slide is just is just q. A um I mean we're working on a lot of other things, so you know we have um uh Yesenia and Jonathan that I'm sure could be happy to talk about.

C

um What's going on with um on the Omega side and vulnerability detection at that scale.

C

um There's University uh outreach program that we're that we've um are working with the education, the EI Sig uh on, um essentially that we're continuing this kind of grand experiment and some things are going to work great and some things aren't and, of course we learn the better and we can iterate and and all of that, so.

C

Is there anything anybody would like to talk about.

C

F

It Randall I was sent to talk about what you guys wanted to do or at what point, get a kind of an idea. An idea of what Alpha Omega wants to do with the training of the tooling.

C

I'm sorry I missed one word the: what of the tooling the training, the education training, okay, so training on on sorry on how to use how to use our tools, how to use in general, our tools, um I.

F

Know that it was discussed and I know that I don't know if it was discussed with me or Glenn, but I know at some point it was discussed that we would have education on that. Yes,.

C

We absolutely need to do that um if animals on the call I would I would ask her to like make sure that's highlighted on the Trello board, um I mean because so so some of the tools are, let's see so so the the analyzer is definitely usable to the point that a video demo and some better better docs on how to use it would be helpful. We should absolutely do that. We should do that like really soon actually.

F

At the end of the call also could could could we go off camera for a second I wanted to share something absolutely with the alpha omega team, yeah, of course, so but yeah, but.

D

F

Yeah, uh because we can also integrate tooling, that was kind of why I wanted that. Why it came.

A

Up but we can integrate.

F

Tooling, into our actual platform, like we're doing that with zap right now, so you'll be able to like do the actual vulnerabilities, we're also kind of expanding, because we're doing new courses. So we have things like from a bug, Hunter's perspective and then from a developer's perspective.

F

um I know that we talked with the end User Group, about like an executive perspective and different perspectives. There so yeah.

C

Yep uh totally makes sense, and we probably should publish that as part of a like a larger open ssf like training page or like thing like that. But.

E

F

Be absolutely all right, yeah, that's all I had cool thanks and then I have the other thing. The secret thing.

B

If I can make a quick response uh to Randall as well.

D

Yes, absolutely.

B

Yeah, so um you know first I I agree, you know, uh you know to uh training on tooling sounds great. If it's just a video I mean you know, I think that would be.

B

um You know, I'm always big on. You know a small cost, big benefit stuff. So a short video showing you know something you decide to do. It can be a big win. um I'll. Add that you know if you're an existing security researcher, a number of security researchers already have some tools that they're comfortable with awesome. If that's helpful um and those kinds of videos to help them understand and use, new tools is really really helpful. Also.

F

Just wait till it just wait till the secret meeting David, because.

B

F

There's a lot to do with tooling.

B

Well, there's always a lot to do more generally, uh if I, if, as soon as you find a topic, you find a thousand things that uh are worth doing.

B

um But let me, let me just add a quick plug in addition, though, for many many software developers, they really don't know uh they struggled to use some of these tools, not because the tools are necessarily hard, but they can't they don't really understand what the tools are trying to accomplish. They don't really understand what vulnerabilities are in general and so for in a lot of cases. uh What they need is not just here's how to use a tool.

B

You know mechanically or here's some tricks, how to use the tool, but more broadly education on you know: hey what is security? What are common kinds of problems and those sorts of things and I hear that there are courses from the uh the the open, ssf, secure development project. I hear about this thing called SKF Randall. You may also have heard of it.

B

um um So I I laugh for those who don't know. I I led development of the uh of the open, ssf and Randall uh leads on the uh it's at least a part of SKF project, and we work together so so I'm just pointing out that um in many many cases it's not just education, the tools, it's you know the basics of security, and we can point off, thankfully, to uh existing materials.

F

And- and let me also add this for your guys's knowledge- so there's been a lot of talks, and this actually somewhat will have to do with the secret meeting later the covert meeting, but um basically SKF in a lot like so we've been talking about getting absorbed into LF and talks are pretty Advanced.

F

That I could talk about certain things, but SKF is really embracing the framework part of the the F part of the of the SKF, um because it's kind of turning into something like a ecosystem, where we're going to offer uh wide array of free courses tooling and all sorts of things like it's gonna, be like a whole ecosystem because essentially we're the fact that all of our courses are free will not fly as.

D

F

Come again repeat.

B

We lost our audio I.

F

Think sorry, that um SKF is growing a lot because uh we're becoming more of a framework, so there's going to be more tools. There's going like we've talked to project discovery about potentially doing stuff with SKF I.

F

Don't know if you guys know project Discoverer Jonathan probably knows who they are but um but stuff like that, so we're kind of turning in and then we have obviously we're working on our own Kali Linux, which is the hack OS, which we think is going to be a major marketing tool, so yeah, so we're working on a lot of really cool things. That is not just the platform. If you will.

C

A

uh Randall I can help you with the uh Omega training videos, because that's something I would like to do is like have a an entry point for new contributors more on like the brand new, maybe college students or folks that are just entering the fields but like David mentioned, don't even know what security is um so I'll be happy to have.

F

I'll work with you on that absolutely we're working on our first course for that we call it smashing the web for Fun and Profit nice Glenn came up with that title. He said it's a it's an Ode to an old course.

B

Smashing the stack for Fun and Profit is.

D

B

Classic and in fact I teach I teach it's a George Mason and it's one of our required reading papers. Yeah.

F

So we're we're going through all that and yeah and then, as I said there's, so a lot of the secret meeting has to do with OAS and basically there are things happening at oauth that uh yeah, where, where that tooling side of things might get real a lot more interesting. Real fast is all I'm, saying, I'll, say more in the secret meeting, but I thought that being Alpha and Omega you guys would be interested because part of this is so I I.

F

Don't know how many of you in the call, no Mark, but Mark has a lot to do with it and Marge trying to like or was trying to like, restructure OAS and things didn't go according to plan. Put it that way, so that has turned into something else that we will discuss shortly. Cool.

C

Is there anything else we want to talk about on the public meeting.

C

Awesome, okay! So so how do we do this so I'm going to stop share and then David? Can you stop record.

B

I, don't know um all right, so we have to be careful here um when we yes, I can stop recording. However, all the rules involving openssf are, you know, still valid in terms.

D

B

You know antitrust and.

D

B

On okay, so I'm gonna stop uh per request.