OpenSSF End Users, 22 Jun 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: End Users Working Group (June 22, 2023)

Description

Meeting notes: https://docs.google.com/document/d/1abI65H4pF5y8YtA2_TuDBAaI47v9mTfpr5mwVvccX_I

A

Today, everyone we'll get started in a few minutes, happy time of day Chuck. Yes, it is time of day. uh It seems to happen after time of day minus n and proceed. Then in two times a day, plus n ope magnets. That strange pattern just keeps happening.

A

Give it about another minute or two and then we'll kick off.

A

All right: let's kick it off of sort of businesses. Would anybody like to be described for this meeting.

B

I can give it a go.

A

I saw you struggling mightily with the terrible, the terrible weight.

A

um The second part of the agenda is we always like to welcome people who are new faces, new friends as we like to call it if you're new and you'd like to introduce yourself or perhaps you're just returning for the first time in a while, um feel free to pop your hand up and say hello.

A

Looks like it's all familiar faces all right. So, let's, let's turn to the first item on the agenda, which was the question of uh Logistics and by Logistics it's mostly agenda Logistics.

A

um What we're trying to do now is to raise items for the agenda through the GitHub repo, um so we're trying to create a some something of a paper trail and allowing discussion to occur. Asynchronously is the the thinking there um please feel free to open new issues on the repo uh with agenda items. You would like to discuss um that helps us as I said, to keep track of things over time.

A

um The main focus, as we know, has been the threat model or the threat modeling over the last several weeks months. Even um but first in the agenda of list of items is the ingestion Manifesto.

A

um Folks, probably remember that this was brought to us a couple of maybe a month or two ago, um and the industrial Manifesto was essentially as an adjuster I commit to these things.

A

um Issue. Five is a great place to give some feedback. uh Joshua kicked that off um with a question about recall. I was wondering if anyone wanted to sort of talk about that. That analogy recall if that rings a bell to anybody, maybe I should try and dig out the Manifesto link for folks. Give me a second.

C

Yeah I think I can speak a little to that um someone we don't have to keep that um watch. My camera keeps growing up. um I think recall, is something like Brian. Fox has used um a number of times and sort of the idea there, but maybe we need to explain it.

C

A bit further is is not like a physical recall of software, but sort of the way a recall notification works when there's a defect or a safety issue with a product um so where the manufacturer has the responsibility and the liability to communicate that defect, to customers um versus sort of the the de facto approach today, or at least like when you look with the executive order um and some of the other legislation in the U.S, where it's basically like, let's just ship this with a you, know an s-bomb or a bill of materials, and then the customer needs to look through that and determine.

C

If something is there, and so the idea is that by a customer tracking, their consumption of Open Source, they can much more easily identify that themselves meet that responsibility and then communicate to the customer the way another manufacturer would we can add that and we can remove the recall language happy to do either or I. Don't know if that helps.

A

A

uh Speaking only for myself, uh I think it causes more confusion then then gain just at the second um would be my feedback and I'll I'll. Leave that on the issue later, um that's the best place to do it.

A

um Yeah it's just sort of sort of hard to like I guess, I followed the analogy, but also just doesn't feel quite the same in the sense that I can't send a signal that makes my software come back.

A

You know all makes, makes people uninstall something if that makes sense, um I don't know what do other people think.

B

um So yeah I kind of agree um just looking at it reading through it now, um the latest version I haven't seen the recall wording, but um I wonder if this could be.

B

B

Adopt and develop open source consumption management, tooling and processes that support.

B

um You know, rather than using the word recall which, which could be confusing um I, don't know I'm, just trying I I'm struggling to think what it could be, but but I'm I just wonder if it could be if it could be Rewritten without the word recall doing you to incorporate that notion. That idea that we will be working together on.

B

Developing the tooling and the processes that support a more robust you know set of mechanisms for uh for him for handling vulnerability problems as they arise. You know, rather than talking about recall.

C

Yeah I think that's reasonable. um I've been away from this for a couple weeks because I was on vacation. So if you want I'll, take a look I'll take this. These suggestions, I, don't think recall, is necessarily needed. I.

C

Think the spirit of it is again that, like driving a commitment to understand your consumption, so you can better communicate right like which is the spirit of a recall at the end of the day right, because you can't, even if you recall a product, you can't force anyone really to bring it in the the magic of a recall is that you've communicated something through any number of pipelines or channels uh to say, hey, there's something here that may be unsafe or there's something that's defective and needs to be repaired.

C

um Here's the issue make your judgments about it. We recommend you bring it in so again we don't have to recall we don't have to get wrapped around the axle so to speaking, to use a auto metaphor um but I think to to um Dan's uh comment. Maybe we can capture the spirit of that in in this here.

D

Or yeah um one way somebody could you know issue this air quotes recall would be through Technologies like vex. That's a way to describe that. There's a problem and kind of how the component is affected and the foundation has an implementation of Vex called openvx, but that's a way that you know a good good citizen of the open source. Community could be as I have problems, I use signaling like Vex, or something to uh share that with the downstream.

C

Yeah I think that's good too, and I mean you know, thinking from like the the vendor aspect and more the responsibility to manufacturer less that like there's this vulnerability that exists and opens because that doesn't indicate any exploitability right at the end of the day.

C

There's there's so many nuances and that's the thing we're trying to get away from, but yeah I think to your point, like the CBD process, um you know with cesa, like sort of aligns with that too, where it's you know, how do you even begin to start that disclosure process, if you have no idea what you're consuming so I think that's the spirit of of this so I can take all this I. Think there's enough here to to remove recall and capture the spirit with maybe even an example or two.

A

Cool uh productive chat, uh any any more sort of thoughts about the uh the RICO language on ingestion Manifesto. What would we like to move on all right? Let's move on uh so the next one is Issue, Number Nine, which is the threat model um this. This is sort of like a placeholder or an identifier for the work. That's been done, I've linked there, the working dock from the Sig.

A

That's been working on this, um it's good reading, uh as it says there, we we need more people and I am guilty of not going because I am slack and a terrible person. No just slack actually I'm a fine person I'm just Slack.

A

um There is a new time for it. Coming up, I'm, not sure what was meant by update new threats. um Perhaps Henrik knows.

E

Yeah I can hey everybody, I can say a few words, so first thing is so the vote is open. I think we circulated the um do the last week or so the vote is open until Friday tomorrow, but it looks like Monday half past six European summer time will be the new schedule, which is a little bit more friendly for people from the US.

E

um So that is the one thing uh we will start with this new schedule as of July um I. Think it's the second or the third. But let's see maybe there are another 20 people voting until tomorrow evening on another day, and so it will not be the Monday. Let's, let's see so far, it's just six people or so overboarded.

F

um And the other thing is yes: um I was just um I wanted to remind that. July 4th is a holiday here in U.S um and like right, the Tuesday. If you want to start maybe the next week, just pointing it out I know we wanted to start a new schedule, so yeah.

E

Yeah I don't know so. If we go for Monday, it would be July 3rd, but uh I guess that many people maybe take the bridge day and yeah we'll be out nevertheless yeah true uh yeah, true so yeah. um You can also do it the week after which would be then the 10th or so and uh yeah.

E

The second, uh maybe update on the document itself, is that um we shifted a little bit gear in the sense that until last week or this week, um we basically developed and discussed all those threads uh together and added them, while, while being in this Workshop in the meantime, John added another bunch of threads to different systems of this um development infrastructure. So I guess this will accelerate the content creation but then of course, changes a little bit the maybe also the the nature of those meetings.

E

So we rather go into reviewing, which was to be a lot of great discussions. I suppose I did the count just a few minutes ago. So by now we have like 20 something different threads listed in this table like format um but yeah. Let's see, maybe some of them will be merged or split or maybe disappear altogether in later versions.

E

That's it from my side.

D

um I've been lucky enough to mostly participate with Henrik he's been leading us through the exercise and I would encourage everybody to take a look at the work and if you have inclination, please try to participate. I think this is really valuable work for a work product for this group to kind of share with the community at large. So please participate. If you can I.

A

Actually had a question: um how do you, how do you see this fitting into the uh initiative of yet undetermined name, formerly known as Sterling tool chain.

D

Well, fun fact: I think that this work will be probably the second Next Step that that group will take is once we decide what the heck we're doing with the security tool belt or whatever the goosetron.

D

We will then start to decide on some security architecture, principles we'd like to be the foundation of our work, and then we would go in and do a threat, modeling exercise to understand um how we can break the system.

D

So I think the work that Henrik and the team have been doing will be invaluable and will help inform a lot of that and accelerate that work going forward that we can potentially have a laundry list of already identified problems and start to think about what Solutions might we have or what recommendations can we make to avoid so I'm I think this work will be very useful in the coming weeks for the tool belt thing, foreign people should participate.

A

I just want to check uh when, when we talk about top health, people feel like they know what we're talking about or is that a mystery, yeah, okay, um cool I'm gonna flick it back to Craig if you'd like to give a like a product summary. Certainly.

D

I can so uh the governing board last year uh decided they want wanted to kind of set some direction to help, motivate the working groups and inform the work of the foundation moving forward, and the idea initially was the uh much hated name Sterling tool chain. uh So that's why you know Jacques pokes fun at me.

D

We're trying to figure out a name for what to call this thing, but the tldr of it is um essentially developing a a reference architecture for how uh soft open source software should be developed, managed and then consumed, and then we'll do activities like threat modeling to identify where we might want to try to spin up additional projects or groups to help focus in on some of those problems.

D

um We gives us an opportunity to identify what existing work we have and then you know, wherever possible, there might be opportunity for partners potentially to fill some of these needs to help ensure we have some of these capabilities like a secure, CI, CD system, potentially maybe there's some open and closed Source solutions that might help a consumer or a producer a and help them have that capability. So that's what you know we're trying to have a a unifying idea of how we can motivate the work of the foundation going forward.

D

So that's the the whole uh security tool belt idea and I will post a link to the meeting notes if anyone is interested in participating, we've got about 15 folks that have been helping us kind of shape. This idea so far, many of these smiling faces here on the call, but patches are always welcome. We would love feedback and especially as we get into more of the architectury and threat modely pieces of this exercise, I'll definitely need some kind of some seasoned infosec opinions on helping us helping us make sure we're doing things right.

A

Is that help Henrik cool uh any more thoughts about the the threat model and the threat model work that folks had.

A

Oh we're making good time today. That brings us to number eight, uh which is the technical, Charter I'm gonna, just call that up on my screen, so I have correctly in my head. What am I talking about?

A

Oh, it's, a very short message: update Charter I'm, not sure what was intended by that.

A

uh Does anybody have more context on this one and a little caught off guard.

A

Okay, so I feel like we'll have to revisit that one in a future meeting to better understand what the intent was.

F

So um I can maybe try to do right. I was I was working with John about this, and he mentioned um that we should open, like initiative, see and review the technical territor and make necessary updates. You know that are required for it from the team. So that's why you know I had opened that one and anybody who wants to take a look and review with this team or the thread modeling game that joins on the other quickly call can add an update and review, and we want to make it a little bit more robust.

F

You know and comparing with other opennesses, if you know Charters and looking at it and I did actually, um it seemed almost similar to me to be honest, you know, but anything that is make makes it much more specific for our team here, end user working group as well as for the you know, threat modeling to be extended and making made more detail, and you know the oriented orientation towards that would be helpful. That's the idea behind that yeah.

D

Yeah um things like the charter and the group's readme file are just invaluable to document what the group's doing so that uh new participants can potentially be enticed to come in, and then the charter helps Define how this group wants to operate. So it's important to have these things documented. Like do we want to hold votes or you know. How often do we meet this type of so documenting so that participants understand kind of what the guidelines are for how we operate. So it's you know very important and again I much like the threat.

D

Modeling I would encourage participation here. You know take a look at that, give some good feedback of how we want this community to work, and then you know make sure we get things in the readme so that external people that are kind of browsing the foundation trying to find where to hop on they can have a clear understanding of what we're doing and how they can contribute to that.

F

Yeah I think we should look at the you know, guidelines on how we are going to engage with. You know the engagement model with external as well as what would be the decision points and how we're how we are doing the controls. You know to keep it clean and open for everybody and without any bias, if I might say, because we all come from different organizations, as you all know, so those are the main things that we want to.

F

You know make it much more detailed or clear for everybody to feel like it's open as well as open for ideas, and you know extending it and expecting it. Thank you. Yep.

A

Sort of interesting, I I wonder if there are sort of, like particular concrete thoughts or concerns that would help sort of gather us together around it. It's it's. You know it's a pretty detailed document.

F

um I think, like a like a like a session to do a Sprint, Spike session kind of to sit on it and you know like, like Henrik, does with this threat. Modeling dog, you know he.

A

Brought me and.

F

A

Always reluctant to spin out another group, um not.

F

A group just a meeting that is oriented towards just working on the doc like right.

A

F

Like one one, one call.

A

Well, I, guess: I guess the thing is like what what sort of perception of future trouble would bring people to the meeting? What what is it that we're we're worried about at the moment? This to me is pretty much the standard boilerplate that everybody adopts and then ignores.

F

A

B

Then right can I I offer an opinion. I I think this yeah, because I mean looking at it. Actually it's uh quite it's quite generic. In fact, it says the mission of the technical of this technical initiative is to mission statement right, I mean so.

B

um However, like when I came into the uh open, ssf um I was used to looking at Charters as a way to understand what technical work is going on in a group, and that's because um that's just because in the other initiatives that I've Standards Initiative I've been involved in like w3c or ITF, that uh tends to be listed in the charter right, like the the working mode and the kind of deliverables of the group, um whereas I think in this uh in general, in open SF.

B

The charter is more like there to um talk about how the group runs and is not necessarily talking about the the content, but I really think it should be talking about the content for exactly this reason. That Krab mentioned that to make it more friendly to use to external people who may not be familiar with openssf and how we're working.

B

So the first thing they're going to look at, is they're going to look at this repo uh they're going to look at the readme and they're going to look at the charter, because Charter is like, especially if you've been. If you're. If you're familiar with working groups, then you might look at the charter and I think it. It is important to have some um some info in there I'm happy to help I'm, not an end user, but I'm happy to help.

B

I mean I am personally an end user.

A

Yeah uh yeah Mike by any question like with the design that um LF uh gifted the working groups, is that it um what's the word I'm looking for it envisages a technical steering committee that in practice, most groups, just don't have um most groups are operating on on consent like pure consensus, um which is fine. It's just I've always worried about the scenario where there's a irreconcilable uh dispute and it needs to be settled by vote um and how that's going to look when it happens. Not if, but when.

A

um Yeah, it's it's difficult to to I think we should do some house cleaning and definitely at least fill in the blanks.

A

um The larger question of whether the concept of a TSC is representative of reality in the open ssf is something that's sort of been left alone.

A

Broadly, um we did a little bit of tidying on this in the securing software repos group and that we actually named a TSC in the document so that it was clear if we needed to who would vote so I have a history in student politics, so I I read the rules and imagine bad people trying to read the rules.

A

Student politics is actually a lot like security.

B

Yeah I mean I I I've experienced people um gaming. The rules in much more recent uh scenario. So I can it's total I could totally see that sorry to interrupt.

A

Yeah, no, no and and like good rules, are a magical I'll. Let you talk in second grade. I just want to say this thing, but I've seen meetings that, uh like literally on the edge of being technically a riot, successfully make legally binding decisions because they have good rules.

A

um So you know get rid of the lesson.

D

Yeah to Echo um Jacques statement, the working groups have.

D

Haphazardly uh worked through and adopted, Charters uh the charter is very much boilerplate. We inherited it from I think maybe this even the cncf with some slight changes and that's just a template that is given to the working groups. The working group is completely empowered to make any adjustments as they desire to. um So.

D

If you want a TSC great, if you don't want a TSC great, but it's important to document how the group wants to operate and when there are decisions to be made so to give participants that structure and kind of understanding of what what the rules of the road are and um I have, unfortunately had the great opportunity to have need of the documented Charter and have that uh description of who is eligible to vote.

D

There have been certain circumstances where you do need to occasionally have a formal vote, maybe not so much in this group, but especially like when you are considering adopting uh donated intellectual property. There's some. You know legal constraints you need to think through and having that documented, who is eligible and who isn't is important and that might not be important to this group. So if we don't want it and don't need it, we can strike it and just say we are consensus.

D

Driven we'll have a a verbal Vote or a vote in email or whatever vote in an issue so just decide how you want to operate just to provide structure for people. They can understand how to engage.

G

Though, aren't there some pretty standard ways of operating for openssf and both the LF I certainly wouldn't want us to necessarily create anything unique that.

D

We can change whatever we want um so that we have that flexibility. Yes, the the template is pretty much Lock Stock and Barrel. What most every working group just uses. Unfortunately, like this group, um we didn't make a little couple changes to say like what our working group name is, um but generally we want to.

D

We want to follow the spirit you know we have to follow the lf's code of conduct, I believe that's stated in the charter, and um but beyond that, like how we operate, how we make decisions, how often we meet who's eligible? That's really up to the the group to decide, and we have that flexibility. If we want to, we can just take what we're given and you know, choose to devote our time more on things like the threat model, or we can.

D

You know, spend some time in getting this parliamentary types of things uh set straight, so that if we have a situation in the future, we need to make some type of collective decision. We at least have that guidance of how we'll make those choices.

G

I think I was reacting more to your comment about accepting donated IP of.

D

Course, but there is a process.

G

For that right, that's what I mean yeah.

D

There's a process for that, but the the group has to decide they want to take that direction before you can start to take those steps. We don't want any one entity to come in and kind of uh full Rush their way through and force uh something into a working group that the group itself doesn't necessarily want to do. And then you know once the group decides they want to do it.

D

Then we will go through and you know commit work with LF, legal or whatnot for that particular transfer in the situation where, like software is being donated good, but you know if this group wanted to uh do uh personas, we wanted to spin up a Sig around personas, the that's perfectly within our uh ability to do. If the group decides they want to do that and state. This is part of our. You know as long as it aligns with our core Mission here.

F

So is it right for me to understand Rob like I mean, of course we will be, you know aligning and uh staying within the you know limits of elephant, openness and stuff. But if let's say if we need to extend our work in a much more a fashion better, there is a project or a program that we want other group to engage in like Alpha omegas.

F

You know mentorship or something that we can engage and that them have Hands-On practical um looking at the threat model- and you know have it on some infrastructure or something like that right in that case, that we will be going with the LF and all of the you know, stipulations and the legal legalities and whatnot, but I'm we're not going that far. Is it.

D

And get that the charter is uh the rules of the road of how this group wants to conduct itself and how we operate. That.

F

Doesn't include.

D

Us from collaborating with other projects, okay, um but again like if there's something like a member, wants to donate software or um Hardware resources.

A

Or whatever it might be so.

D

There's a process for that, and we need to follow that right. You know if this group wants to just do verbal votes on things write that down on the charter. If that's what we agree on or if we want to get it formally documented in a GitHub issue, or it goes out through an email, you just want to again provide those constraints so that people understand and they can feel free, that they are empowered to participate.

F

I think we should scope scope things out like what comes into the scope of it and what we would like to see. It is in boundary to it, and that makes us to look in the technicality of your team yeah and.

D

Most of the work of the foundation like a formal TSC is very heavy. You know that's great for a software project, so things like scorecard or um like Alpha and Omega. They probably should have attendance also should have a technical steering committee, but you know for us doing a threat model. The formal approval committee might be a little uh burdensome might be very heavy. We might not need that much process, but the group might decide they do need it. I know that's up to for you all to help decide.

A

So my feeling is that this one will need to come back again uh in the fullness of time in due season. uh What else I forgot? There's one that one of Australia's Prime Ministers, who used to say I, was in just incredibly obtuse, but I forgotten it. Now, uh let's move on to reports from other working groups uh with. Oh, they see. Dan has his hand up.

B

Sorry, um while we've been talking I've been I, thought I might take a crack at just doing a light edit of the charter document to put the specifics in there I'm not going to invent anything, but just so that we have something to talk about because one one way, my suggestion is that actually um I can do that, um make a PR. Then we have something to talk about right and then we can say: okay, I, like this I, don't like that. Let's make this change.

B

Let's make this that's new note, so next working group call, maybe we can work through it and and actually adopt it and then say adopted because it has an adopted colon date thing at the top. We can say adopted that date right and um so, if you're, okay with that I'm I'm I promise not to like uh you know, invent some kind of new process in it. I'll just use use the building blocks that are there already.

A

And is here by May dictator for life.

A

Just just somewhere in sub close 7A, 47, Epsilon Tau.

A

Yeah Dan thank you. Yeah yeah tie breaking and he's the only voter. So it's pretty easy to tie, break and.

F

That's a good! um You know, thanks for volunteering, then, and doing this yeah, that's a good initial step for um others to follow in propose and make amends yep. Thank you.

A

Okay, were there any more thoughts about the the charter? Icj you've got your hand up.

H

Oh yeah, not not about the charter, although I'm all about getting charges right. uh This is about uh working group, stuff or six stuff. So when we're ready for that one to bring that, but she was getting ready to go there, so I threw my hand up.

A

It's my man, that's clever, were there any lost weights on the chatter or should we move on to a working group reports, they're, being objections, Jay go ahead.

H

Cool, um so you know, amongst the other things that I, that I work on and help out with in in the openness and stuff when things that are near and dear to this uh working group would be S2 c2f.

H

um Those conversations are are uh all right. um Heating up, um Melba has uh put together um her thoughts, and you know, I mean just phenomenally like I mean if you could take like a proverbial tabbing out of the framework and we've been going through that over the last two or three uh meetings, because there's just so much to to go through, which I think is phenomenal.

H

um I put out, uh you know every time we have a meeting I make sure in this working group, I say: hey we're meeting now so come on in, um but I'll say it here as well. um This is a great time we got. We got salsa uh 1.0, that's breathing a little bit um in the ecosystem. uh This is a great opportunity for us to put some uh put some muscle uh and some thought leadership behind what we have going on um with s2c2f.

H

um So if you are so inclined you meet um every other uh Tuesday at 12, I believe and uh that's that's a pacific time um come on in and uh and let your voice be heard as well. um You'll see the issues there that we're working on I think we put up uh uh I, think we uploaded a copy of what Melba has for everyone to look at and um we have new threats that have been um added along with uh our thoughts around an FAQ.

H

That is that that's going to be written as well, and these are all things that come out of that meeting um and it's relevant to this group group Zen users and of course this is a consumer focused framework. Please uh come on in and uh and uh let your thoughts be uh put down on paper. That's it.

A

Thanks Jay uh great great update, um I, see crib has his hand up.

D

I have a couple updates to share if the group is interested.

D

uh First and foremost, the best working group is working on two new guides.

D

um One is about C and C, plus plus compiler hardening options, which is probably less interesting for this group, but that's in Flight getting some good progress. uh The one guy that I think would be a lot deep interest of this particular constituency. Is our source code management, uh concise guide, talking about how to use things like GitHub and gitlab in the most secure fashion, we have some best practices we're recommending so that work is in flight.

D

I will give the group a link that you can take a look at where we are and patches and comments and feedback are always welcome. We expect that guy's probably going to get wrapped up, um probably July, sometime we're pretty good with we're close to a 1.0 draft and then we'll be looking for um additional right. We have GitHub and git lab fairly well documented for security controls and configurations, and if there are other forges that people are interested in, we would love to get contributions for uh how to deploy similar controls and techniques.

D

In those other environments, so any questions about the SCM guide, I'll put a link here in a second next up. I would like to maybe have bring Jay back to the microphone. The education Sig has a Deni committee and they have been operating a set of office hours, trying to engage historically underrepresented communities within open source and cyber security and I think they've had a really great series of office hours and maybe Jay can kind of share that to try to get the word out. Potentially, let you all take that back to your organization.

D

Still let people know this is a thing that exists. You want to take a minute to talk about the Dei group.

H

Absolutely absolutely and chrome knows how near and dear uh to my heart that this is especially when it comes to educating those, not just the the our young people out there that really want to study our craft right. Is you know it's always a delight when they, when they want to study something other than psychology in school they want to.

H

Actually touch is one sincerely, you know, I have a I can go on all day, but but all, but also those that are looking at a career change as well, uh which is which you know, people come into what we do a little bit later on and for any number of reasons, and that could either be because they say: oh well, you know if you, if you want job security, go to Tech or they can say you know what these ones and zeros actually speak to me.

H

I'm working in this organization in HR or Finance or or you know, privacy or something else and they're like you know what working across and watching what these guys do. It looks really cool I'd like to try that right and they don't know how to get it, how to come into the industry or that there are different paths to come in. uh Different paths are coming into what we do.

H

The office hours are a great place for this, especially uh when it comes to those members of underrepresented communities who don't have the resources uh and also the people to talk to and I was like you gotta, you gotta understand right, um you know you get out of it, what we put into it. So when you see in in in Tech the the disparity between you know the the people that you currently see day to day and operating yeah, you can even see them in our meetings.

H

Okay, if you take our meetings here in the openness us up as a gauge, um you got you you got, our meetings are, are a little heavy in one way and a little lighter in the other, and that's just the fact of what it is. But you have people in your organizations, and everyone here uh believes in what we do and believes in the community element of it. So you all know people who want to break into the industry put them in our direction.

H

We got it um also by all means, join the office hours as well and be a voice for the young people. That joint we've had three very great, successful. uh I'm. Sorry for successful meetings already in the office hours where young people have joined, and also people who are changing their careers have joined um and they've gotten so much out of it in the way of what does a resume look like you know what kind of things you should be. Should you be prepared to talk about in interviews?

H

uh What should you look at as something that you want to do right? What should you you know discovering what your Niche is, um trying everything and discovering what your Niche is? Some those things like that and everyone here has time in the game, so you have a voice and you can offer up hey. These are the things that I did, or these are the things that you could look for and, of course you talk to it.

H

From your perspective, I encourage everyone to join I, encourage everyone to discover those that want to come in to come into these come into that meeting and join um and then all and then also these are a good recruiting grounds for those that want to come in, say: hey, join the open, ssf join our working groups join our six know. You no experience required.

H

Don't worry within six months, you'll be able to talk, write and have an opinion right along the rest of us, because that's time in and then you'll be able to take that knowledge and then apply it uh to your interviews and to think hey. I worked as a matter of fact and I'm. Sorry I'm, rambling on because I get so excited about it.

H

But I have one individual who only has six months in the game and they were wondering why they weren't getting any looks by employers and look at their resume and you look at their good reborn, say Hey. You have an opportunity to highlight work that you actually can do and put your hands on. If you choose join the sick, say hey, let me help you work on that code.

H

Put your name in you, put your hands on the keyboard, become a contributor and then speak to that use the star method to say, speak to that situation task. What was the action that you did and then and then what was the result of that action? And now you have hardened things to talk about in these interviews that not you're not just telling them what they what they want to hear you're, showing them what they want. So so these are all areas where that we have uh that we give the impactful on.

H

Thank you Crow for an extra couple of seconds to run my mouth. um Please join the office hours I believe we have those uh I want to say we do those once a month. um Don't call me on that once a month and I believe that we do them. uh What is it is that on Tuesday, as well, once a month, Tuesday at 12 I believe.

D

Thursdays the story about one-on-one with my boss: okay,.

H

Thursday, okay good deal Thursday uh once a month, I think we just had one last week um so it'll be in another month. We'll have it again um without do the same thing. I do with s2c12f I'll. Do that with this group as well, I'll post that and say hey we're getting ready to meet. So if you want to come on and come on in and be a contributor to the to the minds of young people and the minds of those changing uh changing careers, thanks bro.

D

And then I have three other small updates yeah any questions for Jay.

D

Yeah, please spread the word. uh We would love to get as many people as possible, participating both at you know, bringing in uh new people to the trade or people that want to change skills or we're also looking for people to assist and provide guidance for these people. These new petitioners, so you know you could be a mentor potentially.

F

So I just have one follow-up, I think if Jay or you can share that information or the links for the office, hours and stuff and and I've been part of the Adu. But you know we are working on the mentorship and the university programs. You know throughout alphabet. This is a good information to know to extend and uh be participating or requesting others who are interested to join and take advantage of as well. Thank you.

H

If you wouldn't mind I'm, not next to my computer I.

D

H

That down and put it into the notes. Thank you very much on the partner, please by all means reach out to reach out to either of us directly um you're doing some good work. I'd love for you to be part of the dni uh Sig um and and things that we got going on there as well, because that's basically what it comes down to outreach education and then helping the successful, recruiting and retention of underrepresented communities, and you know doing what we uh love and and what we're passionate about. So thank you for that. Yep.

F

D

um I'll track down that link right afterwards. um The best working group also is putting together a developer landing page that may be of some use to the end users, so we've kind of trying to consolidate a lot of the resources and help steer that particular persona's Journey towards uh Foundation resources. So if you have uh comments of other useful resources or groups within the foundation, please submit a PR or open an issue.

D

We would love to make sure this is as useful as possible and then once we're done with the developers we'll work on other personas, like consumers or.

D

Security, Auditors or whomever, whatever groups you want to try to address so that one's pretty short and sweet and then two industry, things there's going to be a one-day Workshop Cisco is sponsoring around csaf and Vex. That's going to happen in July. Csaf is the electronic means with which most commercial vendors produce security advisories.

D

So not super interesting to developers um super interesting to this group because boy, wouldn't you like to have nice machine, readable security advisories when things happen and then also in hand in hand with that is Vex. The vulnerability exchange it kind of helps. People uh share their effectiveness on uh different things, so Cisco's sponsoring a big shot, a bake sale so to speak, where they're going to have people come in and do demonstrations and talk about these two standards and that relates to s-bombs, which again is also of interest to this group.

D

I'll provide a link to that if anyone's interested in just attending or I can come back and give the notes I'll be there with our open Vex crew to kind of talk through stuff I get to interact a lot with the uh ciso folks and speaking of sisa, another area which may be of interest to this group.

D

The foundation is participating with uh sisa and the jcdc, which is an organization within the U.S federal government, where we are conducting a a workshop around uh use of Open Source in operational Technologies and Industrial Control Systems so think uh power plants, nuclear plants, water treatment plants, these types of scenarios. So it's a collaboration between government, those operators and then consortiums like openssf.

D

So if you are in the iot OR ICS space I would strongly encourage you to reach out, and uh you know, observe what that group's going on. And if you have, you know, uh if you're very passionate about the open source piece of it and trying to help these types of systems operate and get signals around vulnerabilities and fixes. You know, reach out to me, I'd, be glad to help get you included in those groups and I'll get I'll get links to all that nonsense here in a second.

A

What's going on this week, um Montana I guess uh just a quick update from this securing software repositories. Group, um the great artifact uh repository audit program, is, is moving forward um at a decent pace. uh Alfa Omega have been briefed and are going to go away and huddle on what they would like to fund and what level and so on.

A

um The basic model envisaged is still that um we, you know basically by process of invitation, asked particular repos to participate. uh They would receive an audit at um ao's expense uh carried out by ostiff and then for findings. There would be funding for remediation either donated to you know, whatever body manages that repo or to hire a contractor to do it.

A

um So that's pretty exciting because you know they're somewhat important.

A

F

Know so um how do those invitations go like I'm with that Ayo right, I'm, Alpha, Omega, um so I was wondering. Is there a specific criteria that you have decided upon to pick? You know the specific ones.

A

F

A

I I think it's uh apparently, um some funding's been given to Pi Pi.

F

A

Might be might be retroactively framed as being part of that program. Okay, um so I think it'll it'll just come down to um willingness really for the participants and and Readiness to go, um we'll probably try to pick one or two to begin with and then roll it out progressively over time and I expect that, as awareness spreads of this of this program, that more more ecosystems will identify themselves uh to the group as being interested in in future rounds.

A

um One thing: that's sort of difficult to see from the outside, but definitely really exciting, is that the mission of the securing software repos group to help diffuse ideas between ecosystems has is actually quite successful for the ecosystems who are aware of it and participating um so I'm I'm, hoping that this effort will also start to raise awareness of folks.

H

And other ecosystems.

A

Yeah, so that so that you know they see the story on Hacker News that Rupert gems has been funded to get a thing and they think well. Why not me and they'd learn? Well good news, you can, you can come and join in. um So that's my hope and that's all I had to.

F

Awesome I'll just follow with you, um I've already updated on the Alpha Omega, so new engagements I've mentioned about are you know, looking at the grants towards prosimo to improve the support for rust and Linux kernels right, improve the rest, results, library, cryptographic, library and um to looking also towards uh options, or you know, work on finding the security audits of openssl through rstf, of course, and open refractory engagement to help.

F

You know complement um besides our Omega work and we do have a website of course, and we I mean it will be Cadence for updating and having the monthly updates or the work that has been done or current or existing engagements will be during the first weeks of the month, so I'll certainly posted website link. So that way you will see the alpha engagements updates on there and Omega work.

F

That is being done like the disclosure checks or the assertions and whatnot and iterations with the you know, vulnerability assessments, so I I'll give you the link. So those are the main things and I think the open, refactory and the step security I think it's going to go into the way we design it is not Alpha Omega. It would be better with the open, ssf school card and probably that team would be taking it up and following with them so a few of those engagements, and those are the updates for this.

F

You know this week or couple of weeks that I have for you and I'll forward you the link to upkeep with the website and do check it out regularly and provide your feedback and make it back. We can make it better because it's a new website we had from last month, so um some other eyeballs will definitely help I recognize the you know what what we don't have or what would be better for is making it user friendly and that's all we have thank you.

D

Cool cool I had one more thing: uh I also work with an organization called first, the form of incident response and security teams, so it represents things like vendor security teams and then also corporate information security teams, which I'm sure many of you here represent uh or represented. uh They are pondering the idea of creating a new conference.

D

uh The current idea is they're, going to call it a Volcan, and the idea is to get groups like first that manage the CVSs standard, the coordinated vulnerability, disclosure kind of Frameworks and pcert and cert Frameworks get them get Oasis. Who manages things like csaf get the cve board so get um many of the CNAs involved, so they're, basically thinking about having a several day conference early next year and specifically focused around vulnerability management, vulnerability, communication tools like cbss and CBE and whatnot, and also get community participation. So things like openss, osv and open Vex.

D

These types of things so they'll be formulating this conference and if anyone is interested in participating, uh I'd like you to reach out to me and I'll put you on the list as that develops. I'll keep you apprised of kind of when, where and how that's going to happen and again worst case. As you know, the consumer uh perspective, uh standardization of these things will be very useful for you all to consume and understand, like I, think we're going to try to get Alan and the s-bomb circus to come.

D

Do some talks too, uh but there's a lot of things to touch on and end users that might be of use so whether you would want to participate like maybe you want to do uh when they have the call for papers right now, so I've been an abstract or maybe you just want to observe and listen, and you know I digest the output of that conference. Let me know and I'd be glad to keep you aware. As uh that develops.

A

Thanks curb um I'll just make a quick joke that I'll go. If there's a like a rap battle between cbss, ssvc and epss, um not likely it happened, we we are almost at time um Dan. Will there be enough time for for your item? Do you think in the other business.

B

It's really just one second,.

B

I can find the link.

B

uh The uh just to note that w3c is doing a Workshop. This is not the official link. This is the GitHub link that I found, unfortunately, but I'll find the regular link we're doing a workshop with w3c open ssf ospin up in JS, which is focusing on web developer security and uh the this was put to happen in June. But we didn't get enough paper submissions um uh we think probably be because it was going to be a physical Workshop rather than a virtual Workshop. So we've now reimagined it as a virtual Workshop.

B

It's going to happen in September 26th through 28th and we're hopping over three days where we're going to have like one hour or two hour sessions or one on each day um and the paper submission deadline is, has been extended until end of July. If anybody has interest in JavaScript security, web security web application security, um how these things fit together between new security standards and what we're doing more, focusing on the software supply chain side of things.

B

This is intended to be a forum to have those discussions and to get people talking to each other, so I'm personally very excited about it. I hope uh any any organizations here that can participate. It would be great and if you have questions on it, please come to me.

A

Oh all, right folks, we are at the top of the hour very productive session. Thank you, everybody for participating today. uh Next time, of course, I believe will be in two weeks. Don't forget to check the notes for things that you can join in. We had lots of calls for Action today um hope to see you again soon thanks. Everyone.

F

Thanks, thank you just.