OpenSSF Best Practices for Open Source Developers WG, 16 Aug 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Best Practices for Open Source Developers (August 16, 2022)

Description

Notes: https://docs.google.com/document/d/1ttqkcYPmYZyqvtkaHs92bx2UeVUiXDhuzP-0WbP11Fw/edit#heading=h.nyhcw2azogc

A

Ooh a prop a prop.

B

C

All right folks, um we will start the meeting. Do we have anyone that is interested in helping us take meeting, notes and scribe today? Please.

A

I will contribute as best I can. Thank you, david.

C

Many hands make light work.

C

Alrighty, uh as is tradition with this group, welcome to the august 16th edition of the best working group. uh Do we have any new friends that wanted to introduce themselves to the group and say hello? Hey can I see your hand hi.

D

My name is dan applequist, I'm just joining sneak and I'm here, because I really really think developer education and best practice is like the key important topic. uh But what do I know? I'm the new guy so uh yeah, that's kind of me, oh by the way, I also have. um I also participated in a lot of um activities around web standards. So if you're familiar with w3c, you may have seen my name around.

C

Awesome well welcome dan. I think everybody here loves developers and we're focused on trying to help them be more secure. Awesome. Anybody any other new friends that wanted to say hello and introduce themselves.

C

All right well again welcome dan we're looking forward to having you in our little family here uh first off. uh Does anyone have any opens? They want to add all right. So, let's touch on those after I talk about a couple things here, my prop. We have some petitioners that are interested in joining our group.

C

We have some friends at microsoft that are interested in proposing an open source software secure supply chain framework.

C

This is a set of good practices focused in on open source software consumers, and they are interested in joining our group kind of being a member project, and they actually have a call starting later today, and I will put a link to that if anyone's interested, but just so you know we'll have some friends come and talk about this framework and see if it's going to be a good fit for this team to collaborate with any questions about that.

E

Vicky, so are they considering having this being an official project that they're going to uh donate to openssf, and it will be under the auspices of this working group.

C

Yes, that is their proposal, and that is why you'll see I have some administrivia uh that we'll need to deal with next meeting kind of more formalizing some stuff and we will have them come, do a presentation and we will vote to see if the group uh thinks this is a good project to add in.

E

And then it goes to the attack after that or I.

C

Would not have to. I will inform the tax if we agree, but we don't have to get their permission it's under our discretion to take on whatever projects we want.

E

C

Now, if they need funding, that's a different story, but mr russo.

A

um I welcome all new participants, but is there not a supply chain specific team in the ossf, the supply chain, integrity team? There.

C

Is and um for a little more context, mr wheeler and I have talked with these folks a couple times- a nice group of folks and we initially thought well. How does this compare to salsa and salsa is more focused on those that maintain ci cd infrastructure, whereas the um the new proposed framework is focused more on consumers, helping them evaluate uh it was assault. Was software made properly?

C

Did they follow good security practices so again, we'll have them come in and talk and see we'll see if it's a good fit here or not, or if we want to steer them more towards a supply chain, but this is definitely not a. This is more of a complementary piece of work to salsa than would be a competitor.

C

So did I answer your question david awesome. Thank you.

E

Something we should keep in mind is that there is a new nascent, uh little baby fledgling metaphor uh working group uh for end users specifically, um and this might be the sort of thing that would make sense there or at least be a collaborative effort on that side as well. um So uh I will bring that up in the end users call later this week and see whether we can at least get some of them to show up to our call uh next.

E

The next time we have a call to see whether uh you know they're interested, stop babbling and multitasking.

C

um And they their call is at 12, pacific.

E

uh Let me check the calendar it's this thursday, at.

E

uh Yeah, so the end user working group is at 7 a.m: pacific on thursday.

C

E

And um this week there's going to be a discussion, whether that is a bi-weekly call or what, but it should remain at 7 00 a.m: pacific on thursdays. This will be our fifth call for the group.

E

It is not yet on the oss calendar laurent, because it is not yet an official working group. um Hopefully that will be happening happening imminently, since this is the fifth call of the.

C

Yep, that's one of the requirements as you need to have so many participants, and so many contiguous calls so cool uh that it is not uh lauren as she mentions it's not in the calendar yet, but hopefully we'll be very soon and again. I will encourage jay and that crew to come here to present to us to see if we think it's a fit or not or if we have a suggestions for him as well.

C

Any other comments about the open source software, secure supply chain framework.

C

F

C

All right, let's jump into opens, and then we will go to our concise guide for evaluating open source software. So it looks like our friends at skf have a couple things. They want to chat about.

D

B

Hey so uh the first one I want to show and we're really happy with this one.

B

So if I'm correct, you see the format of the old labs that we have right now. Yes, so initially, we hope that we could just to search and replace, because somebody helped us with the designs, but as it turned out that wasn't the deal. So we had to do this copy casework for 270 laps, but at least we did it in a way that if we want to refactor it the next time that we can do search and replace so we fix that.

B

So this is the old setup, and this is how the new labs look like right now, so we pushed everything to a separate uh repository.

B

uh Oh sorry, on the skf labs repository on the separate branch, and we will probably merge that somewhere this week and then all the labs are updated and then well. We have this nice new format for all the labs. So uh now that it's changed to this, this suddenly looks really old, really funny how quick that goes.

B

um So that's one thing. uh Another thing that we've been working on is: we wanted to also have at least create a proof of concept for a lab that helps deliver the idea of threat modeling, but can also be used in track modeling training.

B

So what we did pretty much is we created an app that has a bit more functionality than normal labs would have normally a lab would have just one problem case like a cross-site scripting across that request forgery, uh whatever this has a couple of problems in it. So this one has cross-site scripting cross-site, request forgery.

B

It has insecure randomness when generating password reset tokens. It has a sql injection, hidden somewhere and all that good stuff. So we have the app right here and what we did around this lab, and we will also put this in the right tip. Is we also for this use case created like used, face or fake use stories and that you can dive into like hey, there's a description as a registered user? You want to be able to authenticate yourself and then also add in a couple of sequence, diagrams that you can use for the threat.

B

Modeling a wireframe because it looks nice and then guides people through how to do uh list centric, based threat, modeling approaches and ideally then well use skf and the asps with this to generate the right security requirements that we're also looking at using kpec somewhere somehow in this, but I'm still not really sure on how I want to do this because we started recently working on it. So you have like the the use stories here.

B

You have a more or less finished used stories with some asvs controls that are generated with the asvs, so we want to put these contoured or these examples in the right tip that we would normally have where we would guide everybody through the reconnaissance phase and the exploitation phase and all that good stuff, uh but instead of doing that, while really guiding through uh the used stories and how to track model this and how we derive the security requirements for this.

B

um So yeah we're kind of uh working on this one right now. So it's a fairly simple app. It has a user, the user can log in you can reset a password.

B

It can read and write some notes and then we put for the use cases, some abuse cases and we try to correlate them uh but yeah and then also guide you through the whole process and how you would use something like skf to derive the right, asps requirements for your news stories that you see here so yeah long story short. That's what we've been working on, because I kind of wanted to give the threat modeling training for our software developers.

B

Internally, where I work and I found like yeah, it's not really anything that I can just grab from the internet and use. As is that's, why we decided like hey, let's, create an app and also make the use stories for create some fancy diagrams uh that people then can later again. Then later we use. uh If you want to do the same thing or also, if you want to learn about it and then go through the the write-ups that we have.

C

I think this is pretty cool ricardo. Are you um looking for any uh contributions? I do know some expert threat modelers that might be have some thoughts and ability to help contribute.

B

That would be perfect, really awesome. So if we could make this extensive enough, it could even be a separate training track uh in the learning paths, so that would be brilliant, but I first wanted to have something uh at least something you know, and then we have something to to create good discussions around.

C

Absolutely always better to have a diagram to start with than a blank piece of paper.

B

Exactly that was the idea so yeah. If anybody wants to jump in on this one yeah glad so.

C

B

I would ask you.

C

If you want to send a note to our mailing list I'll reach out to people behind the scenes, but if you want to send a note to the analyst to officially say we're looking for some collaboration, I think this is uh very worthwhile work. I like it. Okay,.

B

Awesome sounds good.

B

F

C

Any additional thoughts or comments for ricardo.

C

B

C

Cover the new labs design.

B

Yeah yeah, so old design, new design.

D

C

Excellent, all right, let us um let's talk to.

C

Laurent and jeff, do you want to talk about the work you all are just about ready to unveil on the world.

F

uh Yes, hi everyone, um yeah jeff and I have been working on the npm best practice document uh with a focus on supply chain. So not not how you implement proper. uh You know javascript code, but more like how do you handle dependencies and uh what the best practices are around. You know dependency management, so I I put a link in the doc. It's the final pr that will finally tag the document as v.

F

1.0 um we've had a lot of help from people, especially from you know, people who know about npm and node.js better than we do so uh yeah. Thanks a lot to them. We we're preparing a small blog post uh to announce it. um I hope in the next two weeks we should be able to get it out uh if you have any ideas of what we should write in the blog post yeah. Let me know uh I'm not the best at writing. So yeah any help is welcome.

F

Yeah yeah, that's my update.

C

Awesome. Thank you. I think this is going to be a pretty cool piece of work once we unleash it to the world and thank you for focusing on this very, very useful stuff.

C

All right, I will yield the floor to mr wheeler. Let us talk about our concise guide for evaluating open source software.

G

Alrighty, so we have it's really hard to talk about this guide without talking about the other guide, which is about how to develop secure software, because each document refers to the other. But let's talk about the evaluating uh the concise guide for evaluating open source software first, so let me quickly, I'm gonna repost in the chat, a link to the google doc.

G

I think we're getting a lot closer, um uh you'll notice, there's a lot of just little tweaks here and there uh we had a section, the very bottom of a to do, which is more just kind of listing other documents we can point to. So what I did is I just turned that into an other resources.

G

You may wish to consider and just listing them because I'd like to get this document closer to at least a version, if not a 1.0, at least a 0.1, a document where it's cleared or it's it's providing value, even though it could be improved.

G

So um I'm hoping that we're getting more towards that state uh for the rest of it there's a lot of little creeks here and there um somebody was saying that uh the you know various questions need full pages by themselves.

G

um I mean you could write an a phd dissertation about probably each of these points, but the uh the goal is to give something relatively short and links off to more information, rather than trying to do it all here within this document.

G

um Excuse me, yeah, vicky.

E

Yeah, um since we have this new project on the horizon, it looks like there might be rather a lot of overlap between what it covers and what this covers, as far as from a consumer perspective, how to evaluate projects so, um according to yes, he's pointing at a thing, so I'm wondering uh yeah.

C

E

I love yeah how how are these two going to interact, and I understand it's likely a bit too early to determine that since most of us haven't seen this other new document, that's come up.

G

But the answer is, I have no idea.

E

Yeah and so I'm wondering um am concerned about putting a lot of effort into this when we may have to shift gears for the other project and crop looks like you have an answer for us.

C

I would propose, since no one has shown up and shared any materials. Yet that means that that is not a blocker for our existing work. We've been toiling away at this for a while now, so I don't want to impede it like david. I think it's better to get a 80 complete product out there and used, and then we can refine it in the future, and uh so I would not wait for something that may or may not occur. The group might say this is something supply chain or uh end user group is more applicable.

C

F

C

What I would I would.

F

Not hold up ourselves.

C

A

David, uh I I agree with with that statement. In fact, I suggest that we put a plan together for at least the timeline for this document, so we can have some uh milestones and dates. Try and finish it up. The the one pager is is great, a lot of good content there. It took a long time took a long time for us to get there. We have a lot of good feedback on this document as well.

A

I think we should put some some lines in the sand as far as we want to have the review complete, so we do have a 1.0 which can obviously be updated and changed depending on what happens in the future.

G

Yeah, the goal has been try to finish it up by the end of this month. That doesn't make it reality, because you know you know: do g isn't ready enough to release, but.

A

Well, let's, let's make it a reality! So what needs to happen by the end of this month, for which we have one more of these meetings for us to be ready.

G

Yeah, so as with all things everything takes longer than you expect, I mean frankly, probably get you know I I have left.

G

I have left uh things unchanged if somebody put in a comment, I just left it as a comment, if I have tried to only add suggested text so that people can decide whether or not they approve it as opposed to just making changes to the doc. But if we went over and just didn't, accept all- and I think most of this, I I need to walk through all the comments, because I don't know if all of it, I'm hoping that most of the comments have since been resolved, probably need to walk, do a pass through.

G

We also need to talk about the other doc, because the two are connected. The guide for uh developing more secure software.

C

So the other document, the one page guide, I would like to not go through and adjudicate and add additional comments right now. I feel we need to close that up. I think that is ready almost ready for production. I think we need to spend maybe five minutes and then moving move that forward.

G

Okay, I mean, I think, the main thing to be done on the one page was there was a discussion about how to reorder and uh the way I've been trying to solve it is by reordering as a pain. Let me let's talk about that when we get to that topic.

G

uh Let's talk about the evaluating open source, though um what I propose is, let's start by just accepting the changes that have been made that are currently listed as suggestions, and then, let's see, if there's anything else that, uh because I think we just accept all the changes we'll we will we've gotten fairly close for uh both well for this document at least.

G

Does anybody object to that.

C

I second the motion.

G

Okay, so let's, uh let's accept all, and if you, if you uh after that, it'll be easy to review, nobody has any any ideas and proposals. uh However, I think at this point comments are helpful, but not very helpful. We really need uh change x to y as suggested text.

G

uh For example, vicki found one in your mind.

C

Vicki found a dead link, so we want to make sure we get that addressed, but yeah.

G

Right, here's! What I need, I don't need the hey, it doesn't work. I need here's, the new link, I think she did in that case, but that's the kind of thing of you know telling me there's a pro telling us that the problem is good, telling us here's. The fix is better agreed.

C

Does anyone have any objections to accepting all current suggestions on the concise guide document.

G

All right now I gotta figure out how to do it, but.

G

It's here somewhere anyway, yeah, okay, so how's this. Let's, let's, let's do that and if you've made a comment, uh but not a change, see if you can figure out a proposed way to actually make that change. Oh somebody uh already accepted some of that. I'm.

C

Clicking the button.

G

Clicking the button all right, I was looking for the button earlier. I know there's a button. I just got to find it. I don't.

C

Know where the master.

E

It's under tools, um tools, review, suggested, edits and.

F

Then there we go okay, you have to accept all.

G

Excellent, I know where it is in word and open office. I got to find out on this. One oh, but uh looks like krobe has beaten me to it so awesome so.

G

Yeah, I guess the other issue, probably the one of the first comments. This is by vicki, um which I think is is worth discussion here is aren't maybes covered by the developing secure software one pager um a number of these are, I think, it's worth highlighting a few of them as especially important for the evidence that developers work to make it secure. So my theory was um let's list someone some that are especially important and then link to the other document that doesn't make it the right solution.

G

That was just the suggested solution, um so um I probably should put that last then uh I don't know if anybody objected so so I was hoping that that would kind of um deal with with that particular issue. But if that's, if that doesn't then, let's let us know.

A

So what activities do we need to do in two weeks from today, at our next meeting, to make this done.

C

hmm I will convert all of my comments into either links or we will I'll table mine if it does not add additional.

E

Value to the document.

C

I would encourage everyone else to do the same. So, for example, I say hey. This would make a great blog.

C

Let's note it in the meeting minutes and think about how we can present this and get it used as a blog, not necessarily.

F

Have it attach the document.

C

C

So encourage everyone else to go through and look at your comments and either make it an actionable suggestion change the document or, let's put.

F

It into our meeting notes as.

C

Something we need to address in the future. Does that sound okay,.

G

Yeah, okay, so.

E

Wait, quick, quick one! Yes! Yes, please! um Rather than putting it in the uh in the meeting notes where it can get kind of buried and a lot of meeting notes to take a page from an earlier conversation in the last meeting. Could we just open issues for each of these.

E

C

Connection, I'm.

E

Guessing that's a yes! Okay,.

G

I'm sorry repeat vicky what.

E

um For things that uh we would like to do in the future, rather than adding them as notes to the meeting notes, agenda move them from the document to an issue in our repository in our github repository, so we can then track them and work on them there. For instance, if somebody says this would make a great blog post awesome whip up a quick issue open it up, we can track that. Oh.

G

I see yes, yes, yes, but but if it's a change to the document itself, I would suggest.

E

G

It in the dock as a suggested theme. Yes,.

E

Exactly I see okay.

G

E

G

Was thinking all right got it got it. I'm separating those two ideas out now exactly.

E

um As we move through, and we look at the comments in the document, the things that we can address for the document that are relevant to the document take care of those anything else. Air lift them out and drop them very gently and kindly into an issue.

A

Could you have the link to the repo handy.

E

Nope, I just sort of start typing and give.

C

Me a second and I'll post. It I'm just typing an issue right now, when I'm done I'll, give the link in the chat and the meeting notes.

A

Thank you judy.

A

All right, while kroger is typing away his issue david, once all those comments are resolved and or converted into issues and or links are provided or information is provided beyond suggestions.

A

What else, if anything, do we need to do between now and next meeting.

G

Yeah, so maybe we need to have a deadline. Pens down, uh let's see here if we can have all proposed changes by uh next week. Seven days I mean this thing's been open for a while. So it's not like. You only have seven days to write, uh but you know if we can get all proposed changes in by next week. um The problem is, I don't want to just unilaterally make decisions. I really do want this to be a group and I'm sure crow feels the same way. We want this to be a group decision.

G

um You know this is an awful large group to try to work through a document, though um I mean do we want to try to work through the document, or do we want to make a little subgroup that kind of walks through and tries to adjudicate the changes and then bring it back to this larger group.

C

I would suggest we set up a doodle and anyone interested and able attend that call to go through the focus on the document and then come back and present. Those uh final proposal to the group next time.

A

I think it's reasonable to ask for all input to um be in the document by a week from today.

G

Yeah so all and and then we'll try to set up between seven days and 14 days and we'll do a doodle poll. um Hopefully I know I'm interested krobe you're, probably interested uh vicki, I've, gotta, guess you're interested and if not maybe I can talk into it uh but but.

E

You can probably yeah it's more a matter of you know fitting in the cracks, but I will see what I can do to lend a hand message. My friend.

G

I I I I am sympathetic to this problem. Yes, I am, you know, because I noticed that several folks have spoken up. A number of times submitted a number of comments and those are all greatly appreciated.

G

So let's get those folks, especially you know, whoever you are, um let's take that last pass and um uh and then we'll have uh two docs and you know what it's okay, if later on, there's, I would not expect there to be no changes in either these. I would expect these to be updated and improved um and frankly, the first time we'll release it. We'll get a whole bunch of suggestions and that's so, let's get that process started.

G

Yeah two docs uh marta uh one is the one page guy for developing more secure software, and the other is the concise guide for evaluating open source software.

H

And my point was that it was whom, who posted link to the existing uh existing guidelines for developing uh that? I don't know if we finished or not.

H

G

What are you talking, which one are you talking about? Are you talking about the developing open source or the concise guide for evaluating open source.

C

um Remember last year we went through and assembled a bunch of existing security guides and good practices. That's already right, yeah, that's a resource, that's different than these two things.

G

Right right, but the the um the guide for developing more secure software does not try to list all resources available. It is very much a um a curated list.

G

uh Do we want to go on briefly to the one page guide.

G

Crook, okay, so uh let's move on because they're really, in my mind at least they're a pair, um so the the key thing about the one page guide is, I mean really it's been mostly done for a while. There's a couple comments and comments in there, but really the the big challenge here has been figuring out. The order of the suggestions, I think part of the problem is that people have disagreed on how we should order things eric tyson's had a number of, uh I think very helpful uh comments and is eric. Are you here?

G

I am here, oh excellent, all right. So thank you very much for for your comments.

I

I just wanted one quick, quick note, since you called me out, I did have my development team go through all of this. Oh okay, they all agreed. It was very helpful. um They didn't have any major updates other than order uh similar to what I had but yeah. Overall, they found it to be a very good initial guide to help them out.

G

Oh fantastic, all right, so I'm trying to deal with a technical limitation and that's that in google docs you can easily suggest you know word changes, but it's kind of hard to track order. Changes they just kind of happen. I mean you can leave. You know, leave all the ordering changes and suggestions, but what you get is a whole bunch of line outs. It's not at all obvious where things moved.

G

So I don't know if it was the best way to handle it. But uh what I did is I just copied the items below and then tried to reorder them. um Eric tyse suggested that I actually probably should ask you to uh to just complain, but I interpret it as put the more focused easily done items first and then later either the more general or you know harder to do for various reasons later.

G

So it's semi-ordered in terms of priority- and you know you do this than this than this- a semi uh temporal order um eric. If I misrepresented you, please uh correct what I just said.

I

No, I think the reality is in certain points with that within it. There are things that are precursors like when you mention tooling, and then you mention you know, package managers and other things. You know if you're fairly new to this, if you're not as an experienced developer, you're, not as familiar with the the um the different areas that are being brought up in this document, it's helpful to just kind of nudge them into it. Not everybody who's going to be using. This is going to be a senior uh developer.

I

A number of people may be more junior, so getting them into each aspect of it at a as it will help their application, and some of these things you know just inherently- are good best practices regardless of security, but it uh just that's my feeling, as and all of them kind of build up to attaining that best practices badge at the end.

I

So if you're you're not doing a number of these things that are called out and actually the check marks of the best practice bags that make sense to me that they're somewhat ordered in that context. But that's certainly up for debate.

G

Okay- um let's see here um it, I think the main change in the or so we we've been busting around with the ordering. It looks to me like one of the main questions left, is uh moving seven, eight and nine between three and four uh in the second list. So basically it would be use a combo of tools uh to evaluate your pipeline and then evaluate software before selecting it use package managers, use automated tests and then monitor for known vulnerabilities is that um uh is that a reasonable reorder?

G

I mean we're not arguing whether or not something should be done. We're just arguing how about how it should be ordered in the list. So is everybody? Okay with that that tweak in the new order.

C

I'm fine with it. Okay, I will just like randall, is any other thoughts.

G

Okay, I'm going to switch over to editing mode and we'll just do that now: you'll notice that I'm moving these things around in the lower list.

G

Okay, um I will take on the job of making the actual test above text above matt below, uh but um there's just you know sorry about this weird thing of handling order, but I just couldn't figure out a better way of making it. So people could see what was being changed while it was be see the proposal without just having it happen.

G

G

Okay, yeah so basically yeah, so the list shows up this one page guide: it's listed twice. The first is the actual text and the second is just the proposed reordering all right. So in fact, we've already done two of those all right, so I will take on the task of making it one big, happy family and I think we're pretty close. I mean we can always make improvements, but I think we're getting pretty close for this one page guy we've been beating on it for a while marta.

H

Yeah um I have, uh I got a number of comments from developers. I put them as as comments in the document when they apply, but this one uh there was one recurring thing that uh that multiple people reported.

G

H

I summarized that, as this guide for them looks more like an integration guide and less as a guide for for the developing on its own. So the thing they don't missing is, for example, code reviews, doing code reviews and doing code reviews from security experts or security-minded people from the project to improve the general quality.

G

Right well, we could certainly add two code reviews um and.

H

Definitely, but when we are reading stuff, that's not the best moment to add a new item right.

G

Well now we do have third-party security code review and audit. I mean it's in the list.

H

So they they talk, not not actually it's third party in the project, security, too.

G

Have others, you know know, have others review before accepting changes. Basically,.

H

Basically, yeah.

G

Okay, uh good, I I mean I I think one challenge, of course, is.

G

uh You know that not all projects have multiple people, but uh um all right. So let's talk about that. Where would that go in our list?.

G

You know sign releases, make it easy to update.

C

F

C

Question to have a separate point for an internal code review versus a third party.

G

That that's what that's! How I'm interpreting marta's uh comment.

C

Would we meet your desired goal? Marta, if we changed item 21 to read, complete and internal and or third-party security code review instead of adding a whole semi-redundant line.

H

I I think it would be good to to, because I agree with the comment that the in the in a project called security review is something that comes first and it's more important. That third party added for the general quality right.

G

I I don't know if it's more important, I actually do agree that should be separate in part, because many many more projects can have a second person review than pay for a third party security audit. Those are those can get pricey.

C

So could you change the line to highlight conduct an internal code review and then at the end of that statement, say, and if you have uh resources and time consider, a third party review make the third party kind of an afterthought, because we again we're balancing budget here we only have so many lines on our.

G

Right right, complete uh security code how's, this complete secure um security code, audit, slash review at least to internal, uh consider doing an external, but I think the problem is no matter what it's going to be two lines: yeah. Well, that's, okay, but I would like that case. We may as well have in separate bullets, because I think adding the internal review is going to happen long before you do the external I I wouldn't.

G

I I'll tell you what I would not pay for a third-party external review until I started to get the internal reviews first, because they're going to find out stuff, I could have found out myself, but.

C

What, if you don't have the skill set or time and then.

G

You then you skip that point.

C

Well, that's where outsourcing it to a third party could be helpful if that is again part of your project's goals. To achieve that.

G

Yeah, well, I see dan raised his hand. Please.

D

Hi, sorry, I am the new person, so I'm going to be very prone to asking stupid questions, but um one thing that uh occurred to me when I was reviewing the one pager here is that um you're talking about scanning for known dependencies you're talking about uh creating a security advisory um on github, um in particular around secure scanning for dependencies. I know this has been a sensitive point in sneak where people are.

F

D

Towards dependable and uh there and I've seen a lot of uh discussion internally about uh wanting to ensure that openssf language is vendor neutral, so uh yeah, I'm uh probably that's what I ought to be inputting um or pushing out there. I don't know how to make that better, neutral, obviously being a member of the community. I know this is valuable advice, but, but also, I I do think, maybe there's some way that it could be made more vendor neutral without necessarily listing all different products that somebody might use.

D

uh You know in in the one page.

C

That is absolutely one of our goals and how we've been operating dan. We typically will, if there's a good exemplar, we'll say here's the practice as an example. If you're in github here's dependable achievements, um so we try, we do try to do that. um We may have missed uh reading normally aza from github is the harshest critic there is. He wants us to be as neutral as possible, but he's uh not here today to yell at.

G

Us you know what I I just changed. The text right now to examples are yeah, and hopefully that will at least.

D

Okay, yeah yeah yeah that helps.

G

Yeah, I can't quite get to one line all right, so we we may have to play with the indent games, but uh to make this one.

C

On the web, there is no one page, it's all one page.

G

Well, if we post this as a pdf, it's still one page, one page still matters so.

A

I can guarantee we can make this fit on one page. If that needs to happen.

G

That's right! That's right of a guideline.

C

G

Yeah, maybe maybe we should rename this also to the concise guide.

G

Since the other one's the concise guide, what do you think.

F

I just left feedback on the document. I think really. All our guides should be named similar for branding purposes, maybe open ssf guide to xxx or something like that, rather than even concise, guide.

G

I I think the problem here is that I expect that we may have multiple guides, so I I hate to say the guide.

F

No, um I was thinking like your brand first guide to whatever that guide is to keep all the guides similar entitled.

G

So I'm, okay with the similarity I don't think open. Ssf should put the name in the title also because openssf is also the author, so you come up with the the open ssf's open, ssf guide for developing more.

F

Secure software.

G

Yeah we're already the source, so I I don't think we have to put our name in there also.

F

Maybe just guy I don't know, concise, guide one-page guide cheat sheets that they seem problematic when they grow.

G

Well, I understand that's why I'm suggesting- maybe I should give up on one page, because uh I think some people call this a tweet. That was one of the comments, but uh I like concise, because it's concise.

F

Yeah, concise guide for all yeah just keep branding the same. I suppose cheat sheets all all named. Maybe a template for future guides.

G

I'm just worried about the the number of characters in it. To be honest, uh is everybody okay, with concise that for the title.

G

I see okay, all right good, so we'll have them both be concise.

G

Having the whole group just figure out, what the title is of the thing, they're producing seems reasonable enough all right, very good, um all right, so we are at least being consistent.

G

All right, so I will try to work out a scheduled doodle poll I'll I'll try to work out a doodle poll, everybody comments by next uh week. This time the title should be locked um and uh then we will uh try to wrap this up. So the goal is by two weeks from today uh next meeting to have final versions as final of these things ever again,.

C

Yeah and in parallel, uh referring to the awesomest new issue in our git lab number 71, if anyone's interested in starting to compose a blog that talks about these and why they're these guides are important. uh Please kind of raise your hand to start to collaborate on that. So, ideally, as we get ready to publish these, we might have the supporting marketing material ready as well.

C

Any other discussion on this- I have a business point to talk about for next call, if not.

C

All right, uh so our next call I would like to review our working group charter and get that formally approved.

C

I will publish a list of attendance who has attended and like who qualifies into there's certain things in the charter.

C

They talk about maintainers contributors and collaborators, so I'll kind of I'll provide that list of who qualifies in each section, and I would like the group to formally vote and get the charter accepted or edited, and then I would like to start a schedule on reviewing our backlog of issues and prs and that will help us decide on give us a structure to vote on things like our friends from microsoft, who have a framework they'd like us to collaborate.

F

C

E

So I'm probably going to throw a bit of a monkey wrench in your charter idea. Oh.

C

E

I know I'm sorry, uh but the tac was working on a single kind of template charter that would apply to all working groups, um and I know this because.

C

E

It to me- and I haven't finished it yet um because they were so busy wrangling- uh the infamous issue 112.

D

Or whatever it.

E

Is now um yeah, so I don't know where that is, but um would we like to hold off on that until we, so we don't have to vote twice on that sort of thing all those there are certain things like you know, looking at attendance and stuff that will be required regardless, but the definition of who is a maintainer who is a core all that sort of lovely stuff is potentially going to change or um otherwise, possibly right.

E

The attack has to decide that sort of stuff and as a tech member you're very very painfully aware of uh how that process works. So.

C

Very aware of the like 700 comments on pr 112.

E

Yeah, I will fully admit just thankfully, I'm I'm very grateful not to be a tech member, so I don't have to be as clued into that and I can just watch the comments go by, but I do know that standardizing now for all working groups is something they want to do um so I I support the effort, but I don't want to duplicate it.

C

So we've had that item out and ignored it for a very long time we need to. I want this group to democratically decide. Do we want to ada, be a big brother, big sister to the microsoft people for their proposal, and then I also need to propose to the group. I want to give people the ability to express their opinions on. Are they happy with how the group is being led? Do they want to make any changes there? um I want to give us some structure on that.

C

Why am I all fuzzy um on how the group is conducted, so I want to make sure I'm giving everyone fair ability to express themselves and make any changes that might be desired from the team.

E

Yeah, I I support all of that yay and I love that you want to do that. I'm just wondering whether there's a way to do it that isn't quite as official and set in stone as say a charter at this moment in time, since the charter is something that with attack might be in flux.

E

So uh maybe there is some sort of interim measure that can accomplish the same goals and um do I have suggestions for you? No, I'm not going to be helpful. That way, but.

C

So how about based off the current guidelines that are documented in the charter today, but not ratified?

C

I will divide us up into the three categories of maintainer collaborator and contributor, so we kind of understand uh how that might look in the future and then we will vote on like things like microsoft or if we want to potentially make changes to how this group is land or run.

E

I think that's a great start. um One thing we should certainly.

C

Do backlog stuff.

E

Yeah one thing we should certainly be looking at is making sure we have an official vice chair, so.

C

We have zov, but he has not been able to attend as often as he used to so. We may want to approach him about that.

E

C

Yes, we absolutely absolutely should have a vice chair and we do need to do backlog pruning. You know, that's something. We've definitely not done, and that's that's bad on me, uh mr russo.

A

uh So, based on that decision, what is the homework for everybody here to prepare for that exercise? Next week,.

C

um Our homework would be, please read through the existing issues and pr's, so we can have a conversation about them and then hopefully I'll get jay the microsoft crew in to talk through and explain to the group what their proposal is and how they might like collaboration.

C

And potentially I don't know, if we'll be at a point to vote on that, but hopefully the pr 112 will be closer to being finalized. So we have that structure. So we will know exactly how we might do the business.

E

C

Working group, as opposed.

E

To the fun stuff, like we just.

I

C

With david's docs.

C

That sound okay.

F

C

Right and then also think about um other additional homework would be think about. Are you satisfied with how this group is being run? Are you satisfied on how we're structured and do you have any suggestions on proposals for changes and we'll talk through those next week?.

C

And then our next in two weeks and also we'll be doing the final rush through of david's two docs.

C

Any other comments or suggestions or feedback.

C

All right, thank you all. I really appreciate all the help on these two concise guides uh very excited to see those almost done and uh we're looking forward to talking to you very soon have a great day and if anyone wants to help with the blog issue, 71 uh just note that and I'll set up something to a straw. Man for that blog thanks, see everybody.