►
From YouTube: End Users Working Group (July 6, 2023)
Description
Meeting notes: https://docs.google.com/document/d/1abI65H4pF5y8YtA2_TuDBAaI47v9mTfpr5mwVvccX_I
D
A
A
E
B
A
No
all
right!
So,
let's
move
on.
We
have
a
couple
of
bits
of
of
work
that
we've
updated
over
the
last
couple
of
weeks.
We
would
be
useful,
I
think
just
to
review
just
down
on
the
call
he's
not
so
I
wonder
if
we
can
bring
up
the
technical
Charter,
because
I
I
believe
Dan
did
some
update
work.
It
was
one
of
the
issues
that
we
had
last
time
and
Dan
made
some
updates
to
it
and
it
got
merged
appropriately.
A
A
All
right,
if
you
want
to
raise
a
pull
request
for
a
move,
a
technical
chart
that'd
be
awesome,
but
thanks
very
much
for
to
Dan
for
spending
a
lot
of
time
and
effort
into
updating
our
Charter.
We
are
now
chartered
so
we'll
just
write
that
one
off
the
list
I'm
not
sure
if
anyone
else
contributed
to
that.
But
if
you
did
thank
you
very
much.
A
A
A
So
if
someone
wants
to
raise
a
pull
request
to
adopt
said
Charter,
otherwise,
I'll
nip
in
and
update
it
Happy
Days
right.
The
next
one
is
issue:
five,
the
ingestion
Manifesto.
So
there
were
quite
a
lot
of
updates
to
that
and
I
think
it
was
discussed
in
a
fair
bit
of
detail
last
time
around
I've
just
checked
and
it
it
isn't
in
move.
It
is
actually
you
know,
Humanity
right,
Church,.
A
So
the
next
thing
is
well
what
we
actually
do
with
that
right.
So
I
know
that
I'm
personally
interested
in
in
signing
up
to
that
from
a
personal
perspective
and
I
think
there
was
a
suggestion
to
reach
out
to
the
ossf
leadership
to
see
if
they
would
be
interested
in
getting
behind.
That
is
that
is
that
correct
any
other
thoughts
of
moving
that
forward.
C
B
A
A
A
F
I
think
those
are
the
only
ones
we
discussed
in
the
past,
but
I
don't
know.
If
you
have
any
suggestions.
I
know
I
have
a
a
draft
blog
that
needs
to
be
updated,
based
on
all
the
feedback
and
changes
we
have
here,
but
it
sort
of
just
covers
the
impetus
all
the
stuff
we've
talked
about,
which
I
think
makes
sense
and
go
from
there
and
I'm
happy
to
be
available,
I'm
not
available
on
the
25th,
but
can
help
form
shape
anything
we
need
to
put
together.
You
know
I
want
to
talk
about.
F
B
C
B
A
Very
good
all
right
progress,
so
I
will
certainly
close
the
tech
Charter
issue.
I
guess
we're
kind
of
getting
there
with
the
ingestion
Manifesto
issue,
but
I
think
you
know.
Maybe
we
get
it
to
the
tech
and
then
then
close
that
one
all
right
anything
else
to
raise
on
the
ingestion
Manifesto
before
we
move
on.
A
G
Right,
this
week's
meeting
was
canceled,
it
should
have
been,
should
have
taken
place
on
the
Tuesday,
but
because
of
to
drive
fourth,
that
we
decided
to
drop
that
next
Edition
we'll
follow.
The
new
schedule
happens
on
Mondays,
a
half
past
I,
think
it's
half
past
six
European
Time,
and
then
you
can
do
the
math,
where
it
takes
time
in
your
time
zone
other
than
that
I.
G
B
A
You
can
move
any
level
of
granularity.
You
want
it's
still
useful
at
the
granularity
it's
at
and
allows
us
to
look
at
the
different
supply
chain
standards
that
are
out
there
and
map
them
to
that
architecture
with
that
level
of
threats.
Clearly,
when
we
drop
lower
down
and
we
select,
perhaps
a
product
like
a
CI
product,
there'll
be
a
whole
host
of
additional
threats
and
different
medications
that
are
product
specific
and
maybe
that's
a
later
time.
A
A
I
think
the
other
comment
is
really
still
looking
for
additional
additional
assistance
on
that
one.
That's
definitely
one
where
helps
needed
if
we
do
have
any
additional
threat.
Modelers
I
know
there's
a
couple
from
City
coming
in
to
help,
but
if
we
do
have
additional
threat,
modelers
or
people
interested
in
assisting
that's
definitely
a
place,
we
want
to
dive
into.
D
A
H
And
I'm
here,
so,
if
you,
if
you
did,
want
an
update,
you
know
every
every
meeting,
I
try
to
put
a
rallying
call
out
to
join
the
Sig
and
and
becoming
more
more
involved
in
this
progression.
We
got
some
really
great
feedback
lately
and
we're
making
great
improvements
to
the
to
the
spec.
So
if
the
group
does
one
an
update
of
a
formal
of
day,
we
could
definitely
put
something
together.
A
My
main
reason
around
that
was
just
as
I
was
sitting
there
doing
the
the
threat
modeling
for
for
that
may
not
architecture.
I
was
just
sat
there
on
the
ingestion
piece
for
quite
some
time,
coming
up
with
threats,
as
I
said
a
whole
whole
through
them
and
then
highly
likely.
There
is
a
part
where
it
starts
to
speak
to
the
s2c2f
stuff,
so
it
kind
of
kind
of
connects
yeah.
H
That
would
be
wonderful.
Are
we
actually?
We
actually
have
two
additional
threats
that
we've
actually
written
or
written
into
the
spec
based
on
feedback
over
the
last
couple
of
months,
so
Jonathan
anything
else,
you
got
by
all
means,
bringing
the
board
have
people
come
and
bring
that
stuff
in,
because
we're
always
looking
to,
of
course,
improve
so
yo
Happy.
For
that
kind
of
information.
H
A
All
right,
so
next
one
up
is
reports
from
other
working
groups.
I
appreciate
that
quite
a
lot
of
them
have
been
canceled
and
quite
a
few
people
are
still
off
due
to
the
Fourth
of
July,
any
updates
from
any
any
other
groups.
People
want
to
race
or
anything
else
in
the
supply
chain,
industry
that
it
would
be
useful
for
end
users
to
think
about
Jack.
D
The
great
repository
audit
is
still
taking
shape
and
moving
forward
for
those
who
don't
know
the
the
basic
concept
is
that
Alfa
Omega
would
stand
up
some
money
for
audits
inspections.
What
have
you
of
large
repositories
of
software,
so
ruby,
gems,
IPI
and
the
like,
and
also
provide
funding
for
remediation
for
anything
that
was
found
so
that
we're
not
just
dumping
stuff
in
people's
laps
and
yellowing
way?
D
So
that's
that's
in
progress
last
I
heard
it
was.
It
was
basically
formed
up
enough
that
it
could
go
to
the
folks
with
the
money
in
Alfa
Omega
land
and
that's
the
last
I
heard
that
they
were
that
they
were
going
to
do
things
so
I'm
expecting
to
learn
more
about
it
next
week
because,
as
was
the
case
with
many
things,
July
4th
cause
things
to
be
held
off
for
the
week.
I
Got
your
hand
up
yeah
thanks,
so
a
quick
update
from
the
memory
safety
Sig.
We
are
currently
working
on
a
I
just
pasted
the
our
repository
we
are
currently
working
on
a
we,
the
re-architecting,
the
text
from
the
mobilization
plan
around
memory
safety.
We
are
interested
in
hearing
from
end
users
about
the
challenges
that
they
have
in
adopting
memory
safe
languages.
We
are
currently
also
approaching
distributions
operating
systems
distributions
to
get
their
support
in
also
supporting
memory
safety,
language
natively
in
the
os's.
A
A
C
Grobe
I
participate
in
the
Vex
working
group
within
the
the
larger
s-bomb
efforts
and
if
you'd,
like
my
partner
in
crime,
art
Manion,
is
also
very
heavily
involved
across
all
the
different
CC
groups.
So
if
we
want,
we
could
try
to
petition
art,
maybe
to
come
in
and
give
us
a
readout
of
all
the
working
group
activities
from
CSA
side
to
kind
of
give
us
a
state
of
the
art
of
s-bomb.
If
that'd
be
useful
to
this
group,
art
is
not
shy.
He
likes
to
talk.