OpenSSF Best Practices for Open Source Developers WG, 26 Aug 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Best Practices WG Working Meeting - Complete Concise Guides (August 26, 2022)

Description

Notes: https://docs.google.com/document/d/1ttqkcYPmYZyqvtkaHs92bx2UeVUiXDhuzP-0WbP11Fw/edit#heading=h.nyhcw2azogc

A

Anybody else have any weirdness with github today.

A

I have not been poking around get up today, so fine weirdness I'll try to open a link to a repo. We have a web browser and it spins forever yeah, I'm in pretty quick, quick for me.

B

I am happy to report. I can hear you krobe. Can anyone hear me? Yes, oh good, all right, uh there will be a day when there are no tech problems. Today is not that day. Tomorrow is not looking good either.

B

Okay, so let me um so. Are we expecting anybody else by the way.

A

It's your meeting, I don't know.

B

Okay, well I mean it's it's my meeting on behalf of you frankly, so uh I think it's all our meeting, I'm going to immediately uh step back from this particular volunteer line. um Although you can, I guess you can have. I have to admit, blame for this whole idea in the first place, but other people thought it was okay. So uh it's great all right. So so here's what I intend to do, I'm gonna post. I propose basically here's the goal. We have two documents: one's two pages, one's a little more than two pages.

B

We've got a lot of proposed changes to it. My goal is by the end of our meeting that we will have no comments, no changes. It will basically be a clean. We accepted all the changes or rejected the changes, and I would propose uh that we start with the concise guy for developing more secure software. I'm gonna post the link in the chat right now did that oh awesome, okay and then oh actually, that's the other one. um Oh wait a minute wait a minute. You have a different url than I do.

B

I'm on the I'm.

A

Clicked on the heading, so the url is a little different.

B

Yeah but oh yes, okay, good, good, good, it's, but the heading is different, all right and then I'm gonna, I'm gonna post the evaluating document I mean I would like to do both today um because I think we're close enough. We can actually get away with that. So um if you don't mind what I'm gonna do is I'm going to share my screen, but anybody can click and see what I'm doing also um and then we can all just kind of look at it together, walk it through.

B

I I I think we can make. We can do this. If we don't, then we'll just schedule follow-up, but I think.

A

I know we can do it.

B

All right, we are all right. Confidence is always a uh well, I don't know if it's always, but it can be a good thing.

B

A

Right if we can't get this first one done, I quit you. Oh man. Oh that's, brutal.

B

All right, um okay, so, let's see here, uh let's see here, click on all the links. I think. Basically, this is a update link. We have it, oh, what is today's date when we start start being serious about this 26.

B

all right, uh I think we're switching to concise everywhere. Is that yes, all right? So let's do that. um I tried to I added the word all because somebody was asking hey: is this open source? Is it proprietary everybody, so all should cover that all right, um let's see here, I'm gonna for the moment accept your comment probe, because if we, if we find a bad link, we can fix it. I don't know of any bad links at this point all right, marta, oh marta's, not here, oh, I wish she was okay.

B

um Marta general mark uh integration, okay, first of all, is on the integration aspects. I I don't think so I mean we're talk. We we have all sorts of stuff uh about um writing code, particularly the use of the tools and the um you know, and the thing that points out to education.

B

Another comment missing point about code review: we've handled that that has been added since uh reads like an ad referencing to the open ssf. I'm going to argue that this is an open, ssf doc. This is what we do. It should be unsurprising that we referred over that things, uh so I I think that um I mean some of these did cause some changes, but I think we've resolved it and you're very also get good with accepting this.

A

Yeah, I'm good and I think once we get this published into the public eye, we will get more developer feedback and we can refine it.

B

Yeah, that's true, too.

B

Okay, next up um evaluate software before selecting it as a very important point should be well visible. We don't have a mechanism of them bold. So that's number four.

A

Number four is pretty important.

B

Number four is pretty important, that's right, so I I think we're done there. uh Okay only add it if it's needed, okay, really that's just a wordsmithing, I'm trying to make it. I think if we accept everything we can get this in two lines. First, once this goes to markdown, but you know I think in general the goal has been to try to make this short.

B

So this is just a minor word smith. Oh, who did the apostrophe s? Shame double check it's excellent and ensure it it's retrieved. Okay, that's fair! All right.

B

All right so we're down to three lines there. So hey everybody good with that all righty uh keep dependencies reasonably up to date. Can this point to another guide sure, but I don't have one to point to eric. This is your comment. Oh yeah,.

A

Yeah I mean it's, you know definition of reasonably is kind of wide open right.

B

It is, I, I don't think you know one pager. We can do better um because.

A

B

A

Yeah we link to everything else right so I mean I, you know it's. We can come back and find the appropriate link later, but I think some definition of or at least pointing them toward a another, more robust guy, like we do for just about everything else.

B

Well, you know what that this, what you may have uncovered, sir, is we are missing a guide and the best practices group could create one and then link to it.

A

You're looking for a new project after this one finishes.

B

Well, in fact, I think we just we just identified the lead for that project. Didn't we.

A

B

Eric you better jump back fast.

C

I'll, certainly code, if somebody else.

A

C

Good good, our peer pressure worked.

A

So I got some changes in my job a bit here, but they're happy too happy to co-read it with somebody else. But honestly that does feel like there's a gap, or at least we haven't found the right artifact and it's something that kind of feels like this would be part of this group to work on next. Maybe.

C

Yeah, the mpm has a guide that they're publishing open so yeah because I'm editing it. Oh yeah.

B

Well, you're talking about the mpm one right, but that's specific to npm, and I think that we, what we're talking about here is a more general, but you know what. If so, I would say for the moment I mean the python speed article I would expect just from the url is probably python specific um but yeah. My guess is the word. Reasonable really depends a lot on the product.

C

We just linked to the repo to the best practice the package manager, best practices, repo.

B

um Yeah, I mean that's, not crazy, although I'll be honest I suspect. What's reasonable depends more on what kind of project it is than the ecosystem, because, if you're doing, if you're developing software intended for safety critical you, your idea of what's reasonable, is probably a little different. That's true so anyway how's it so eric. I think I I agree, but we don't have a good link that anybody knows of so I would say just accept it and we'll and that this may become future work is that are.

A

B

A

With that yeah yeah, that's perfectly fine. I just want to make sure at some point we come back to it. I just.

B

A

A agenda item for the working group talk next week next time.

B

That sounds perfect. Okay, all right next oops, all right review before accepting changes. I didn't see anybody scream screaming too hard enforce it. Eg with github push protection was just trying to uh now push. Protection is just for secrets.

B

That's not true at all. I I I don't understand.

B

Yeah yeah, that's, okay! That's just not true! I mean I just in fact. I literally enabled push protection on a project that I manage uh called metamathset.mm and I and it had nothing to do with secret scanning or.

A

B

Am I or maybe you're thinking protective branches? Maybe that's what we're thinking about here? What does github call it.

A

The article is talking about the specific use case of using protection for pushes around secrets. I don't think that's the exhaustive, oh.

B

Okay, all right all right! Well, you know what they're called protect you, I think. Maybe what we really need to do is talk about protective branches. I think that's the more accurate terminology right.

A

You have to talk to a real developer.

C

I think I think he's right. I think it is protected branches. Wait it's under your settings. uh Let me find it yeah.

B

Here's here's the link right here.

A

Exit branches. There you go, I mean.

B

I I literally did this earlier yeah great, so all right.

B

So, let's see here just a moment, I'm going to actually because there was a comment earlier about actually having links good idea. Okay, so how's this um okay, we all right. So I think the problem is we. We meant protect, uh protected, protected branches, fixed okay,.

A

B

A

Lab also have similar functionality. I'll add that link here once my computer wakes up.

B

B

Okay, get eg, for example: github yeah! Do you? Okay? If you want to go back and make that suggestion, we can go back and look at that yeah. Oh there's a period missing after dp, okay, um all righty yeah christian, now, you're gonna make it too long.

B

All right, I was trying to make it one line, but maybe sometimes I just can't get my get what I want all right, probably document how to report vulnerabilities and prepare for them. This is just wordsmithing. Anybody object.

C

I I should mention that gen 2 bought me a shiny slew of like grammar tools that I could run these through at the end, where it'll point out, like you should like replace this word for better comprehension, you're missing commas, apostrophes all that stuff. So.

A

I think everybody should have the free version of grammarly if nothing else. Okay, I.

C

Know he's not precise, which is why we've had to buy like three different tools because there's a lot of opinions but yeah.

A

I am all in favor of using the best grammar we can and be as clear as we can, but if doing that is going to initiate another set of reviews because of those changes, I don't think we should do it.

C

Actually, grammarly is pretty good about making sure that, like whatever they suggest, is and does not change the meaning of every of anything, usually so yeah.

A

Well, it's good enough for my professors in my mba program, so working.

C

But yeah I could do that at the end. So that way we don't have to spend time on it.

B

Well, no we'll we'll have to spend time on it if it's not so, uh but we, it may not be too.

C

Bad, that's it. I will you're at 29 errors right.

B

Now yeah, I will quickly observe that um uh uh google actually includes some as well. It will wind and complain about things as well, so how's this, let's walk through what we have. If we can do that, that's awesome, uh but I I want to at least have a shot at completing something today and then we can always we can. Oh, you can always polish it later. What we're polishing! I will leave to your imagination.

B

All right, probably document prepare for all right, I'm just re replacing that with them and provide contacts.

B

It's it's very simple uh directive, so good with that looks good to me all righty, let's uh another little knit here, all right, we can rescore cards checks. What's going on here, all right eric wanted a url, but I wasn't sure what you really wanted. Instead, currently it goes to the scorecards checks, which is in fact this. This list.

B

Did you want something different.

A

B

You can read the scorecards checks and if you follow the link, it's not just a url, I don't know if you've noticed, but this is. This is a url with a with a sharpness after it. So it jumps specifically to the list of the checks. It runs. Yeah.

A

I know when I looked at it the first time it uh it seems to go to the top of the broadcast.

B

I I bet I bet the link changed based on your comment and we just didn't accept the cut. We just didn't note that we did it yeah, that's fine, so I think I think I I agree, and I think uh that has been done so awesome all right. What's next uh more knits trying to make this shorter.

A

Ichi, well, you can choose you've achieved your one page, david.

B

Woohoo, so right that that was.

A

No more that's all! I live.

B

For that's all I live for you know this is counting pages yeah except, of course, we're going to convert this to markdown and it all doesn't matter anyway, but but I think concision has a value. Oh okay and I- and there was some stuff about minimizing dependencies and their scopes and adding internal review, but that has now been done. So I think we can delete that.

B

So, let's see here all right, so I I guess the thing is and versions. I think that the intended text was to tell people what the fixed versions are, but that wasn't clear. So I added this word fixed everyone good with that.

B

Yes, all righty, okay,.

A

We are the champions.

B

Eight months.

A

B

Excellent on pitch too, I'm impressed all righty um okay, so let's go back and then if we have a chance to the next doc and then, if we have a shot, uh somebody can propose grammarly suggestions that they think make sense and go from there.

C

I I can share my screen and you could literally just run down them.

B

Okay, well how's this: let's, let's do the other dock first yeah, all right! We can remove the word draft. Oh there's a comment from the chaos, but I I think at this point a lot of their comments are obe, so I'm gonna just remove that and we had a date on the other one. So we should probably oh no! No don't do that.

B

Problem solved.

B

All right, concise guide um that we need to describe purpose and goal. Although this was back in july, correct, I think I think we're.

A

B

I think the text underneath it resolves that I mean I don't. I agree with the with what you said that that's important, but I think we got it.

A

B

Okay, so all right, uh this is weird. We said you everywhere else, but somehow this one became we.

B

So this is entirely just uh oh. Can we avoid it adding it don't? Need that word and changing to be consistent.

B

There was a proposal by adding it exponentially and I I don't think exponentially is right because it, but it I think a lot of people were confused by the phrase attack surface here, especially since it's the first thing we talk about, so this text here was supposed to explain why it increases the tax surface.

B

I think that that parenthetical comment addresses the underlying concern. It's not just the new dependencies, but its dependencies itself as well, and now we have its transitive dependencies.

A

I agree and exponentially implies some degree of quantitative measurement. We don't currently have right.

B

Right, I mean you, could measure counts, but it's just I that brings us down an argument. I don't think we need. We just.

A

B

All right next up we're making great time, uh obviously the that we, I think we have a shot at the grammarly thing. So all right are you evaluating the ice one I'm proposing changing official to correct, because I don't think we care necessarily what's official, you want the one that you intended, which may not always be the official one.

A

Intended then correct implies uh value of judgment.

A

B

Good call, oh my gosh, I'm glad you're here all right, that's even better! So what intended intended all righty that is evil all right! I'm gonna do the same here for exactly this. um Are you evaluating the intended version? And now I'm just going to delete official, because that really that's what you know.

B

All right check its name now check its name and the project website, and I added a few here creation time, it's popularity and also an explanation of why this is to this helps to or at least one reason, this helps to counter type of squatting.

B

What works good with these editions.

A

B

All righty, oh uh whoops, oh- and this is this whole thing- was moved up to number two that was permarta. I presume nobody has any objections to evaluating whether whether it's the right one before you.

A

uh Yeah, we don't get an ordering argument.

B

Oh whoops, I missed one. I added the word new new, a subversion of the new dependency, because this is a you know. Can you avoid adding it? It's really a new dependency that you're trying to avoid adding and it seemed to be confusing all right, I'm good! All right! Unmaintained is a risk if it's unmaintained. It's also likely to be insecure part of a rationale of why to include that. I.

C

B

Yeah, thank you all right, whoops and hey. I will try to not push random keys on the keyboard, all right, um okay, this was actually a proposal from me. I just added based on a discussion within a different. I think it was another openness meeting where they commented about. You know, although there's a lot, you don't know. In most cases it simply puts zero dot in the version string.

B

That usually says. uh Don't trust me very much. uh People will sometimes use them anyway, but that's a that's a signal that people use. So I think it's reasonable. You know it's one of the few signals we get so mention it.

A

Yep yeah, like an alpha or beta, almost yeah,.

B

B

uh Oh, you have a good point there. um Maybe we should generalize this okay, yes,.

A

It's not about the number, because that depends on a different specific. uh Whatever the project wants to to follow, a sunburn is the most common, but it's like what is the is stable latest stable version, or it is mature latest stable version. Something like that: okay, whatever they defined.

B

All right, I'm gonna, switch to suggesting mode, because I think what krog mentioned is the real issue. um I do even if you don't follow semver it's it's I mean at least goes back to at least the 70s. The idea of a version, zero dot means. um Does a version string indicate instability, eb begin with zero include, you know, say alpha.

B

C

You're gonna your baby begins or ends, because sometimes they also put the alpha at the end.

B

Yo, okay include a begin with. Zero include alpha, et cetera, well I'll, say alpha or beta.

B

Okay, look at this an offhand comment and all of a sudden we're writing new text here, grove all right, everybody good with this yep.

B

Okay, is there evidence, that's developers, work to make it secure.

B

All right determine okay, uh you know, aren't these a lot of these covered by the one page we just did, and the answer is yes, but.

B

Where do we indicate that.

A

B

Sorry it's at the bottom here it's the concise guide.

A

Other resources.

B

Right: okay, we basically ended it with that uh we're developing more secure. We've changed the name of the document since we, uh since it was added.

B

Yeah- and I had put it last.

C

You're still, in suggestion by the.

B

Yeah, I am um I'm okay with that, because I want to make sure that.

A

And it's okay to have two artifacts. We, the the stated purpose of this is for to help someone evaluate the software just because there's also a developer focused set up prescriptive guidance. That's okay! I'm fine with that and we're going to put we're going to be making a blog that talks about both of these to provide additional context. If we need it, so I'm I'm fine with it.

C

A

Totally fine, because evaluating doesn't mean doesn't mean that you need to develop somewhere. You only are a consumer yeah yep.

B

Okay, so with that, so I think that we'll just um you know, we.

A

B

That yeah and we do we do reference it. um um This is an addition by marta. Does the project fix bugs in a timely manner,.

B

I mean that doesn't seem like an unreasonable thing to look for great yeah, so.

B

Well, okay, we gotta make sure that we use the correct terminology. We had this problem earlier, um it's protected branches, so we gotta be okay.

B

Do they use um it's branch protection, not push. Protection. Is the.

B

um I mean this is a little bit duplicative of uh things like scorecards, which focuses on this, but I'm okay, with uh with emphasize with with repeating, especially since scorecards, really only works with uh github right now and we're hoping someday to add get lab. But not everybody uses github and get lab. So I'm okay with having this as a separate item, even though it's kind of covered, so I'm accepting I'm fine with just saying yes, but.

A

B

All right and it's branch, not oh.

A

I I added also or get lab.

B

ah Very good good for you, okay, excellent! uh What's the next chain, all right, then exchange is the one we just we made the title actually the right title. That seems like a good plan. All right uh is it easy to use, but using use after evidence and we okay. We did that.

B

That was a comment about the ordering, but that ordering has been done. Scorecards all-star.

A

So that would be one indication of uh the security posture. I don't know if we could use that. I'm.

B

Gonna push back up on you a little bit krobe. I I would say that all-star and scorecard are really part of four evidence. Rather than making it yes secure. Now I thought we already have scorecards there. Oh, you know we don't have all-star.

A

Well and that that's an old old comment.

B

Okay, do you want to mention all-star back and forth or not worry about.

A

Yeah, it's not worried about right now, all right.

B

Okay, so I I think we do have it covered it's just in the other one. um All right are the default configurations. Secure, eq encryption turn on my default network protocols.

B

Okay, I mean that's, I think, that's the final example. Yeah I'll be honest. You know, if not avoid it.

B

uh I mean we could even go further and say https instead of http, but I I think for this context: it's fine, okay.

B

The next change that I didn't see ensure every component has all right. This is just the I couldn't figure out what the it referred to. So this is just trying to clarify, but hopefully not changing the text.

B

All right add in the code.

B

Is there evidence, oh okay, this was based on a comment from uh vm from vicki. uh She wasn't sure what the difference between nine and the other one is uh of, and.

B

You know what we could just say clearly, what's your own evaluation of its code.

A

B

So italic, oh every sure every component has a license.

A

It was italicized, I didn't think that was on purpose, so I suggest it.

B

It was, but it's perfectly fine without so I say that's great, um uh let's see here.

B

So evidence in the code I mean it said in the top, but it probably doesn't hurt to repeat it here.

B

Because otherwise, it looks so much like the other one we're trying to develop. Secure software. Okay, we've changed the the text to make it clearer.

B

All right, so I think that we've resolved that um all right, uh I removed the I proposed removing the parens.

B

um I mean I.

B

Either way it's hard yeah, all right, I'm actually thinking. Maybe it is better to just have the friends all right. He, uh oh we've got a new addition. Let's see.

A

But we never mentioned test cases, and sometimes they are important that the projects have them love. It.

B

uh Yeah well, okay, and that's it to ensure the software really passes right.

B

Yes, is that the uh just trying to clarify why we would do that? Yeah, okay, but yeah you're, absolutely right! That's it! That's an easy one and I have seen him fail.

B

uh Let's see you're considering running all yeah. Thank you so much, let's see here and here's what in the world.

B

Okay, I don't understand.

A

I think that's just leftover artifact of the formatting from there.

C

There's an extra bullet point at the very end of the article.

B

I see okay, well, hey! You know what I will switch over to editing mode and use my great power to remove the empty.

A

B

Yes, that backspace I have, I have the all-powerful backspace, uh but I'm gonna try not to do it too much, because that doesn't help if you use it too often.

B

All right, um hey well, that was faster than expected. Yes, um and my thanks for the all these little last. I guess I'll call them last minute improvements, but they are. They are absolutely improvements, I'm sure we'll see more once these get published, but this is I I think we are well beyond the point of hey. Is this good enough?

B

Now? I understand that we have some polishing suggestions. uh Please don't ask what we're polishing, but there is a muff, but with buster's article about it, and you can do that.

A

Yes, they did prove. That is the case that.

B

Is the case okay? So um so who is our uh so? I can't see all the ground.

A

Releases grab the screen randall.

B

Yeah all right, let me ungrab the screen because I think it wants only one at a time so.

A

B

Right, how do I.

A

B

I think the part of the problem is: I need to not share my screen through.

A

The green button at the bottom of your window.

B

Yeah, I see the green button all right, but that's just letting me share. How do I knock here.

A

Is there a carrot that gives you more options.

B

There is a character, it says multiple pair participants can share simultaneously, but I don't want that.

A

B

Oh, I see it nevermind, it's completely separate button, because that makes sense all right, bye. All right, you should be able to share all right all righty. Now you can use your infinite cosmic powers to make it even better.

C

All right, so that's the first one.

A

Could you possibly increase your screen size, a touch yeah.

A

C

So it wants us to move this at the end for clarity.

B

I I don't agree, it's more important for us to identify the people first and what they're doing second.

C

Fair everyone, fair. Okay, that's.

A

C

So it says that this is not clear.

A

um So that's the task of ensuring privileged developers use yeah.

B

That's the task.

A

Of ensuring multi-factor.

B

Yeah, I I think it's perfectly clear yeah I mean it's the only sentence that precedes it. We're asking them to do one thing so um grammarly may be confused, but I think humans will not be confused.

B

I mean it's okay. I have no trouble using a tool that sometimes reports things that I don't agree with. That is I'm still grateful for the reports and it's.

C

Why they made the little delete button.

B

Absolutely yeah, so I don't agree with that suggestion.

C

This no not a commit. Oh wait.

B

Wait, no! No! I I was referring to this word, so I don't.

A

B

With that this game.

A

I don't agree with this because we are describing two privileges. Yes, so it doesn't understand the nuance of that same here.

C

Accept and accepts: are we good with that? Just deleting that.

A

Yeah delete it.

C

This is also unclear.

C

B

Thing I think it's clear for the humans. Okay,.

A

That one, you could change to something like consistent use of mfa tokens and there's just so. You don't use the word this twice.

C

B

Well, you know what you could say. Mfa hinders instead of this.

A

Put something there: yeah david's got his eye on not making this three lines long, keeping it two lines, long.

B

I I do indeed, although.

A

You know: hey, there's one letter less than this.

B

A

So it's probably our capital letters they take out more space.

B

Oh no! No! No! No! I I checked it's about the same.

B

In all seriousness, I do believe in brevity as long as you don't lack as long as you don't lose understanding, just nobody wants to read more than they need to.

C

There, so I think this is wrong too.

B

Yeah I mean that there is plural and the only mechanism is singular, so they has to mean tools.

C

Right, so we're go with that, so it says that this it's is unnecessary.

B

Only add it if needed, yeah! Oh yeah, that's right! Okay, I'll agree with that.

A

And we just save three letters: an apostrophe and.

B

An apostrophe woohoo.

C

You get me all the time, the passive voice, because it really doesn't like you talking in passive tone.

C

I don't know if you want to do anything about that. I think it's fine. I know.

B

I think it's fine, I mean the pro. There are problems, sometimes with passive voice, but passive voice exists for a reason.

C

B

It's true so, yes, uh the main problem with passive voice is it emits the subject and sometimes that's a terrible idea, but.

C

It says that our and or is not liked in formal writing. It's frowned upon.

B

uh Don't care this is.

C

Not formal writing so container level within hyphen.

B

Yeah because it's matches with language level.

C

Okay and then we don't need of them.

B

Oh yeah, I agree with that. That's a good good change, enable rapid updates, yeah, that's perfectly clear in context.

B

Yeah: okay, okay, it should say pass that.

B

um Include negative tests and those are tests that yeah we probably test that what shouldn't happen doesn't happen. We probably shouldn't have used. The double quotes probably should be. That's probably a little unclear tests that what um that what shouldn't happen doesn't happen yeah I would delete the double quotes and change this to what.

B

And the match yeah. What do you think folks is that clear.

A

What shouldn't happen doesn't happen. Yeah.

C

No now we're repeating the tests.

A

Today, yeah, are we going today, uh where's.

B

The day here.

A

Right, it's insert it's changing the test.

B

ah The problem is that we really do mean all tests and ensure the tests.

B

Yeah, I think we need to say the test, because if we say they, it would imply just the negative tests, not the entire set of tests, it changes, meaning if we, if we did that switch there.

A

What, if it says, all tests instead of the test.

B

Well, no one test can be thorough enough, so if you're gonna do that, I think that's a point, but I would say I would say ensure that test suite is thorough enough.

C

I like that really good with that.

B

Okay, so we we did make a change. It was just different.

C

And then this is otherwise needs a comma right.

B

Yeah, where, where I'm having trouble finding where these things are.

A

It's highlighted in like light green on the screen.

C

Yeah, so it was right here where it says otherwise: okay,.

A

And now he's on pushing which is a line below yeah.

C

Okay, all right, but I think pushing is correct because.

C

Get lab protected with uh apostrophe.

A

B

A

Examples of but they use the same term they use.

B

The same term, although it is missing a period, everything else ends with a period and.

A

B

C

Monotonous passage, oh.

A

A

Machines have gained intelligence, yes,.

B

I exactly disagree. You want sometimes punchy. Okay, you know that churchill. Churchill was a master at that.

C

That's true another passive voice.

B

Okay, the question is: do we want okay.

B

Yeah, I disagree. uh I I I you know we we it's obvious who's going to be making the editions it's the developers. We don't need to say it. This.

C

I think important is also good here, yeah, essentially what it makes sense.

B

Yeah, I think important's better.

C

Unknown word: we gotta add it we'll add it.

B

A

B

A

C

We don't do, we want open source and a hyphen. I know microsoft says that it should be hyphenated before now.

A

Microsoft's not here.

B

No we've been consistently not using a hyphen.

C

Fair enough punctuation inside of, is it a quote.

B

No, I I um at least everywhere else. I've always been using logical quotation and not typographical. Note uh uh quotations so that in that case, no it's it would be.

A

Incorrect, it's not as like a spoken sentence.

B

Well, even if it was a spoken sentence, then the question is: is the period part of the quotation in a lot in the logical coding systems? So all right? What's next scorecard.

C

And score cards. I think it's fine, oh uh because you could read.

B

This it's always score cards. Isn't it then, should.

A

It name the projects.

B

Is it scorecard or scorecards? What's the name of the project, it's security.

C

B

I'm looking now as you, okay, the urls is singular, but the title as soon as you go to it. The first line in the readme is security. Scorecards.

A

Scorecard checks below yes without the s, so we have two without s: what, with an s.

B

uh Oh, and by the way, their first question is what is scorecards.

B

So so they're you how's this. The scorecards folks view the plural as the as the name, not that's actually plural. So.

C

Should this be capitalized, yes,.

B

Up and now it's not part of the link.

B

Oh you're gonna fix it that way. Okay, fine you're gonna have another s to get rid of yeah. I've seen this game played before I see that I type within the link and then do the edit reverse.

B

So I don't have to do that and.

A

All star is lower case. I believe.

C

It is, I think it is too okay, maybe.

B

And there's our ulcer yeah: okay, no, no, not just the url, oh no, they do capitalize. It.

A

All right, so I guess lowercase all-stars something else.

B

Oh, look at that he's gonna. Do it that way? Fine fine.

A

C

So it says this is very wordy.

B

Now is that one word I can't tell there's commas or periods in there. I think it wants.

C

To get rid of or review this chain yeah, it wants to get rid of. Let's go to the example.

B

Why don't we don't want to get rid of the example we might want to edit the text.

C

Maybe yeah I'll just dismiss this, but yeah. Are we good with this? It is kind of wordy, but not really.

B

I don't know that. That's that bad me kind of you know it's all examples at that point. So.

C

Yeah pretty much unless you wanted to make some of these like a separate, but then you'll make it longer and makes it yeah.

B

And they get the cve id and and the on github are separate sentences. Anyways, don't think, don't think it's that long.

C

This is unclear, but I think we're referring to our link here. So yeah fine get another this. This is s bombs. I think that's. Fine third party needs a hyphen. Are we good with that.

B

C

Make sure we remove the space and review audit, I think yeah and how clear it wants to change the transparent.

B

The word clear, transparent, um where, where are we.

A

B

uh Okay, I'm fine with replacing the word clear, but not to the word, because in europe that has the opposite, meaning I have this problem with tannenbaum uh tenenbaum is an american but he's been living in europe. For so long he often uses european phrases and transparent means what you can see through and therefore you can't see it.

A

I, like opaque.

B

Oh, no, no, no, no, no opaque means you can't see through it. Transparent means. You can't see it.

A

Oh, like invisible, okay, right, transparent means invisible. So you.

B

A

Want to have maybe we change clear to documented or I'll just leave it clear. Just just leave it clear: okay,.

B

Or we can look for a synonym, real quick, looks.

A

C

Yeah, you double click this I think it maybe not. Maybe it doesn't give you a cinnamon.

A

B

uh Let's see here understandable, comprehensible, explicit that does have problems.

A

It's clear: it's fine all right! I think we.

C

Saw less letters, so I think this was good. It says.

B

All right, let's do that, let's do the next one I may have to get myself grammarly, because, while I disagree with some specific suggestions, the idea of having another checker on my language does seem useful.

C

I need edit access on this one to run grammarly. Oh.

B

Okay, uh you make the request and uh I will deny it immediately bam: no, no yeah, no uh okay, randall's requesting access, no soup for you, wow. That was actually darn. Quick too. It's almost like these computers uh can talk over fast networks.

B

Still giving you a question, no, I just click on the I had to yeah. I have to click on multiple buttons, because one button is not good enough.

B

We have it set locally. So are you wait a minute? That's outside the linux foundation? Are you sure- and the answer is almost always yes,.

C

But this one has 40. the other one had 33.

B

All right, you know what, though we we scheduled this till four. I think we can totally do this and get it done. um We do this before three yeah, so.

C

We have an hour, this title is 16. This title is 14.. Do we want to make them the same size? No.

B

I mean let's, unless both are 14., I'm fine with making them both 14. If you want.

A

Just for consistency, yeah, oh point size, I'm sorry, okay,.

C

B

C

The font size on one is 10 and the other one is 11.. We want to make them both 10.

C

B

Well, don't don't change it there if you're going to do it, you want to change it in the normal text type. It.

A

Won't matter when it goes to markdown anyway, no.

B

Well, that's true, too, all right! So, let's yeah.

C

So here we have our first one is to evaluate it wants to change, to assess.

B

No because we just said evaluate at the top, not so sure everyone knows what assess means anyway,.

C

Good point dependency: we definitely don't want to change evaluating I'm assuming we'll measure yeah.

B

Where is this document.

C

Right here evaluating.

B

Yeah we're using evaluating everywhere so.

C

Yeah version of the song- oh.

B

No, no, no, that has a specific technical meaning. Everyone calls inversion.

C

Yep, so it says that we have an extra comma here in florida.

B

Maybe, oh, I see I'm not a pro and not a personal fork. That's actually true. It doesn't.

A

The comment doesn't need to be there.

B

Yeah, I mean, I think it's grammatically fine, but it's it wants to be.

C

Clear if we remove it, sorry wants to change that sentence, ensure you're evaluating the intended version of the software, not a personal fork or an attacker controlled work. That's not terrible.

B

Yeah, the comma before yeah the end, not yeah, make sure you evaluate.

C

B

Version of the software comma and not a personal fork, yeah yeah a comma before the end. Not that sounds good. Did it? Do it yeah, wait, wait, wait, wait, wait, wait, wait, wait, wait, not a blank, no oh they changed or to nor. I don't know why I did that it should be, nor not.

C

A brazilian is not like a formal term.

B

No, no, no, no, no, not states, not okay, okay, not a personal fork, nor an attacker controlled fork. There you go there. We go.

C

All right so correct, word choice. I don't even know where this one means it still doesn't like it. What because nora, I don't think, nor is it seems reason it can seems that conjunction news may be incorrect here. I think this is wrong.

B

Yeah, I think I think grammar is wrong.

B

It probably doesn't seem nor often enough to learn the rule.

C

And then I'm not too sure and if and if.

B

Yes yeah: where is that.

C

And I think it's just that this sentence is throwing it off. Maybe it's just too long for it yeah, it's a harder, read sentence, so maybe we should split it up into two. Maybe.

B

I mean we could change it to a whole bunch of short concepts. You know check. Well, you know I I think we can just make them sentences check its name in the private website for the link period verify the fork relationship on github, github.

A

Oh below we have abcde, we could change that into a list like the others and have them be individual. Smaller, oh.

B

That's true: we could do that. You want to do that. uh Yeah! Won't we at least oh, and now it's molded for some weird reason: why is that molded.

A

We can fix that hold on there. You go thank.

B

You all righty uh all right check it for the link period next line.

C

I'm gonna verify or correlation on github.

B

Yeah, I think that's fine. If you use those, you know what those are already and if you don't you, don't use them.

C

Checking the project affiliated with a foundation in this case, you should be able to access the official source and repository website period, I'll fix them all individually. There, okay.

B

Check it and check this pops off okay, however, the last one is not an item on the list. I think we need to move that either it's not a bullet item or just move it into two. Oh okay, that works well, uh move.

A

It up move it up to the top yeah.

B

Move it up into the text of two that'll, make it easier when we convert.

A

B

A

These techniques help instead of this.

B

B

Techniques techniques.

A

Or steps helps.

B

Your health help to counter. I think it's help to counter.

C

Common, that's fine. Passive voice is fine.

C

I'm going to read the pass, how does it see cass it it? It glitches out sometimes.

A

Okay, it's not perfect.

B

Think this is one of the few commercial products written in common lisp. So can't make a mistake like that.

C

I mean I'm not gonna lie it's pretty impressive for what it does.

C

uh Yeah here's the nor come just did he is affiliated is passive. Case needs a comma.

B

Right yeah, in this case yeah, that's clear.

C

And then we'll here now we're at 3a.

A

I think it's right the way it's written or maybe.

B

I think it's right, I think they're suggesting has significant area occurred, which is also.

A

Going to occur.

B

It's moving yeah it's moving. Instead of there been it's has saying occurred. um I I think I think the rewrite's actually f, um probably a little better.

A

C

Here we go we're we're still moving with quotations out or.

B

Yeah yeah, I I I mean unless somebody really objects, I prefer logical, quoting.

C

A

I don't know the project has earned or.

B

Or is on well in the way yeah, that's correct, that's just to screw up on our part. Yes, good job grammarly! You are correct.

A

Determine whether I mean change theirs to there is.

B

I mean grammatically, it's the same, but.

C

B

huh They couldn't figure out their apostrophe. Yes, all right. Shame on you, grammarly all right! What's next.

C

In a timely manner promptly or on time, oh.

B

Well see the I think. Actually we really do mean in a timely manner. Promptly is in the eye of the beholder.

C

That is true, that is subjective, and now now it goes back to baton. This is.

A

Sassy again, are you good with dismissing this I'm good with dismissing that.

C

Take advantage developers that wants to change it to use.

A

B

Yeah, that's right! That's much better!.

B

It doesn't like uh apostrophe.

A

B

Of for ownership, but for examining software's security I mean it will be okay without it too, so I'm okay with removing it. I think it's, I think it's right the way it is, but I think it is in doubt shorter software.

C

I guess, if we're talking about this software, that's.

A

C

That's that's just software.

B

Yeah, so I think in this context the apostrophe s is correct, um but I think it's also correct without it well wait. Wait we really do mean this software, though.

A

I would or the I would put the or this.

B

The software security yeah- oh and you know- maybe it's happy now.

C

Yeah, it didn't complain all right come up here what's next, so all of that you're hearing k do they apply. Many of the I think that's incorrect. I think grammarly is incorrect.

C

Or wait because practices do they apply? Many of the concise guys for developing mobile security or more secure software practices.

B

Yeah, although you know I could certainly see, do they apply many of the practices in in and then follow with the doc with the we might want to just rewrite this anyway and just move practices earlier many of the practices, the many practices in the and that way we're ending this entire section with the other doc link.

C

Right, okay, so here it wants to we're missing a comma.

A

uh Where, after the eg yeah that's correct, grammarly.

C

Correct it's missing a subject.

C

B

uh I mean all of the there are they're in parallel. All of them are missing subjects yeah pretty, but yeah yeah. So I mean grammarly is correct, but we don't want to change it. I don't think yeah.

C

And then we don't, we want to change this to a question mark.

B

A

B

Because it is formed as a question yeah, that's right. Grammarly is right.

C

And then easy to use has no no hyphens.

B

Oh, my gosh, it's removing hyphens, I didn't know.

A

I was allowed to do.

B

A

I agree with that: yeah yeah.

B

I'll agree with that, usually it likes to add them.

C

No, where are we here? Use seven software with many users or many large users may be inappropriate for your use. I think that's.

B

Yeah, I think that's I think grammarly is incorrect.

C

However, there's more likely to how this is. This is not right. However, there's more likely to be useful, and I guess it is right information on how to use it securely and more people who will call care about it. Security.

A

I I would again change that to there is it's more formal.

B

There is more likely to be used, but you know what, however, a widely used software is instead of there, because that I think I think that we talk about users now widely used software yep.

A

Even though we added three words.

B

Okay, it's more likely to have useful information instead of b, yes to how to have useful information.

C

Would we like the word offer, offer more useful information.

B

C

B

B

Well, I don't think you need the more you just say, offer useful information, because we already said the more more earlier.

C

It doesn't want to rewrite the sentence.

B

More people who will care we can probably eliminate the who.

B

Other than that, I I mean rewrite it to what I I think we're: okay, as it is, we've already rewritten it a little bit. Okay,.

C

We already went through that one big impact, but licenses can have a big impact. It wants to change it to significant.

B

um I mean I'm okay with that change.

A

B

C

A

Still saying that we're using too many words your words.

B

I don't see the crisis, I think it's fine as it is yeah. I.

A

C

Owen may be redundant.

C

A

B

It is redundant. What is your evaluation.

A

On the software yeah, this is wrong. Passive.

C

Voice, where are we right here at 90.

B

And look for encoders that are encrypted yeah. They well, the implied. Is you it's a directive, so I think.

A

I think we're okay. I.

B

Think we're fine, I mean it says: what is your evaluation so in context? I think it's pretty obvious.

C

But it also said it's a harder read sentence.

C

A

Think it's just.

C

Because we have a lot of commoners, maybe.

A

B

And I think, uh but but into the common elements, are, I think, pretty clear. So I I I think he.

A

Also doesn't like kind of a jargon.

B

Yeah, I think it's probably getting thrown off by some of the words. So I I'm going to just crash and move on and.

A

We got left one comment too many. I think that's right, yeah agree. I agree with grandma any use cases. Yes,.

B

Look at that, oh my gosh yay, and you know what uh we I mean. I didn't agree with everything grammarly suggested, but I think the results even better now yeah.

A

Pretty nice tool.

B

Okay, something else I may have to add to my. uh I have actually thought about adding that so you're you're doing a good job in sales here, I'll I'll have to ask you.

C

Later, what your cut.

B

C

Well, I started volunteering for writing a lot of blog articles. I think I'm writing the blog article for this. So when genji was like you haven't used any of your allotted budget I was like might as well use it on grammarly.

B

Okay, all right, so thank you all right. Yes, just any! I I think we've got good stuff. I guess we now need to talk about next steps. um I guess the plan is to take this, convert it to markdown, or do we make a little pdf in markdown, or how do you want to do this.

A

um I think we should uh provide a pdf as a downloadable resource, but this should be converted into a markdown file, so we can have it into our our get repair.

B

Yeah and now the problem is once we move it to markdown, we will no longer have as much control over the formatting unless we dual edit. I will note that is in fact how I handle the secure software development course. We have an internal google, doc and the markdown, and when the markdown changes we change the google doc to match it's a crazy approach, but hand.

A

Work, I I don't know if we need to do that, for this yeah.

C

A

Probably get it close enough in mark down yeah if we need to change from a to a one or one one or whatever you know I, I I'm okay with that.

B

We might be able to even find a way to get it pretty enough to so that from now on, we just use, we always use the markdown and.

A

Yeah there's gps yeah.

B

Yeah, I I do think that, for um you know, for for grabbing for certain purposes for short guides like this, the pdf does have advantages, because then you've got the nice pretty formats. When you want that.

A

Well, we also could turn that into a marketing ready slick to hand away at conferences, yeah.

C

uh Well, I know there's tools that you can convert mark down to pdf.

B

Right right, in fact, I've used pen doc, for example, which does that um uh there's always limitations with those tools. uh Shocking a shocker, a conversion tool can have limitations. Tell me when this you've heard this before.

C

But I don't think that any of the stuff that we're doing in these documents, like we don't have pictures and we're not writing any of like the yeah. So it should be fairly easy to convert.

B

I agree. Okay, um I think that dorian has uh knows some magic skills on uh conversion to mark down. um I do too, I have me, oh you do oh fabulous.

C

Okay on the log seed team, I helped with luxie.

B

Oh spectacular, what would you be willing to make a shot at it then yeah, okay, so.

A

Maybe there's a create, um would you want to put that under our docs folder in the repo.

C

Let me let me ask this, because I've noticed that by editing a lot of documents in a lot of the repos we have no like.

C

If somebody wanted to make a contribution, there is no rules on like how you should go about like formatting your document- and I don't know if that's something that we might want to do so, therefore, because like like, if the mpm best practices, one for example, actually breaks in vs code, because they have like hard-lined line breaks which throws off the the markdown reader in vs code, but it doesn't throw it off on github.

C

So I don't know if that might be something we want to also add like just standard like markdown lint or something yeah.

A

C

Sure that it like works with everybody's markdown, reader and whatnot.

B

Well, everybody's, a pretty long list- uh and you know having very long lines I think, is pretty much accepted practice. I would propose that in general, try to stick to common mark. You know, maybe extensions if you need.

C

But common mark is not compatible. Flavored markdown.

B

It's not but for most documents it makes no difference. No darn difference.

C

Okay, so it is, does it matter? Well, because I was the most people would probably consume this on github's preview, correct, yes,.

B

That would be my guess.

C

So yeah I'm just throwing that out there, because would we want to make sure that those rules are enforced because they have a super linter github does that we could check into the repository now that I have you all cornered into looking at my screen.

B

Yes, I mean we, I certainly wouldn't object to adding a linter to the repo sounds like a good plan um to run a super. Oh, oh, this is their linter to end all winters.

C

Well, yeah, just because you can add it as a github action and it basically has all of the linters integrated. So you it just automatically runs so.

A

Tell people like.

C

Hey these are all the linters they have and for markdowns right here, markdown.

B

Mark john lynch yeah I've used markdown lip before. um Hopefully, if it supports uh configuring the linter, if you have to, I assume it does most good of actions too,.

C

Yeah it does it it, you can figure it more like you would normally.

B

All right, I would propose that adding that lentor is a separate um issue or slash pull request, so I'm all supportive. I just think we ought to. I think we ought to raise it as an issue on the repo.

B

Let people comment, I can't believe anybody would say no and then we'll merge it in and we'll say, yay team.

C

Okay and then we can format documents after the fact right.

B

Oh yeah, no, I mean that's. What pull requests are for right.

C

Yep perfect yeah.

B

Yeah, so if you wouldn't mind uh converting them to uh markdown uh these two docs and uh then we can check it in and tweak it a little bit and um and declare victory uh too, quick obviously make sure the bolds come through. I would I would really like to have one and then a inside I don't know if we really really get that choice, um but you know make sure the links come through and if possible, it would be nice if the curly quotes came through they don't it's. Okay, life will move on.

C

I think those come through, but I think that, like you in markdown, you don't have like it'll automatically format like the inside.

B

Yeah, I I think that's true um there are. There are some tools that will accept extensions. To I mean worse comes first, you can always use html and tell it what the what the lists are, though, not all marketing.

C

Go as far as using mdx.

B

Let's try not to use the sledgehammers.

B

Actually, to be honest, if you use pandoc in its full glory, um you just gets ready to sit down.

B

All right um so, okay, so that was randall, so randall any idea when you'll have a chance to take a crack on it, I'll, probably in the next 30 minutes I'll. Have it awesome? Okay, and just do, uh I guess, do a pull request and um yep and throw in the two docs. I would presume right into the best practices working group, um uh repo right.

A

Yeah there's a docs folder yeah. Let's.

B

Just put them in there yeah, I would suggest whatever file names you use would be pretty obvious.

C

I'm just gonna use, probably just concise guy. Just this okay.

B

Yeah, just don't include the date because obviously that's gonna change and we want people to link to the current versions. Generally.

C

Yeah, but I will get this in there right now- awesome.

A

C

And then so our plans.

A

Will be we're going to uh we'll share with the group next time you will be writing a blog to do an announcement at ssf day in europe, but we're.

B

Formally unveiling.

A

B

Right right, net and now the question is: do we want something that looks fancier and spiffier at least the uh the first one? The.

B

You know the consent that one.

A

uh Like with foundation letterhead and the goose.

B

I like, like, like harder stock paper and you hand them out and open this.

A

Yeah, I I that would be. I would like that. Yes, I think we should have some to hand out like okay.

B

Yeah, we don't have to make the decisions today, but if we are going to do that, then we may we'll need to figure that out cool. So awesome. So tell you what I will first await the and and frankly probably if we print it we'll at the bottom have to put a link, because obviously all these hypertext links won't work so well on the paper. Yeah very disappointing.

B

Well, we'll update paper later.

C

Well, what we could do is we could add if we really wanted to. I think that there is a markdown plug-in for this to like make a bibliography yeah.

B

I I don't think we need to do that. Most people are thinking I'm expecting to look at this online, I'm going to go clicky clicky, so I I don't think I I think that would be far more than necessary. If anything, I would at the bottom. You know for the electronic real. You know just the url of this dock right, but we don't have yet because you have uh made the pull request and they pulled in soon.

A

I will get.

C

On that right now and I will make those- and I will also- I will also open the issue for uh the winter cool yeah.

A

B

Okay, thank you so very much great work, team yeah. This is spectacular. Thank you. Everybody.

C

Thank you guys thank.

B

C