OpenSSF Identifying Security Threats WG, 21 Jun 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: OpenSSF Identifying Security Threats WG (June 21, 2023)

Description

Meeting notes: https://docs.google.com/document/d/14_ILDhSK3ymKqUTQeQBRgJKgfiy_ePoGZIe8s7p3K5E

The purpose of this working group is to enable stakeholders to have informed confidence in the security of open source projects. We do this by collecting, curating, and communicating relevant metrics and metadata from open source projects and the ecosystems of which they are a part.

A

Hey Amir good morning or afternoon.

B

A

There, how are you I am living the dream? How about you.

B

I'm doing all right, I hope my comments about white papers and blogs and all that nonsense made some sense. I.

A

I I didn't I I either that maybe I had a drop about 35 past until.

B

um Yeah, hey: let's have a white paper: hey, let's have a blog post. Let's have titles for these things, there's a lot of things that are blog posts. There are a lot of things that.

C

Are white papers.

D

B

Wanted a little more clarification on what the goal was: yep.

A

Yep thyroidism well always good.

B

Yep, so, uh although I think you know, we I mean we're coming off the AI working group, I guess uh nascent working group hoping to be, but um there's already other folks. In particular the I mean OS has got a small work, but in particular there's an Alf Ai and data Foundation. It has a group, that's doing security, so hey wait.

B

We should talk so Brian's making the connections and uh I I have interacted with I've interacted briefly with Ibrahim, but I haven't interacted with that particular working group because, oh my gosh, there are so many things. One can be involved in.

A

Yep, you need to upgrade the number of hours you have in each day to about 40 45.

B

And then I like that, you know what you know what the problem is: I'd fill them.

C

B

I think that'll just mean I age, faster.

D

A

Feels like a Twilight Zone episode where you're like you get what you wish for. It's like.

B

A

You just like cannot.

C

B

Well, actually, there's a whole kids show with that premise: uh Fairly Odd Parents.

C

Oh okay, I have.

B

Not seen it okay, my my kids loved it and you know what I saw when it first came out. I get this is this is gonna last three episodes I mean you know the the premise is you've got kids, he make wishes and they just come true for through his fairly odd for fairy godparents.

A

Nice, nice.

B

And um and the thing is it's a whole lot like the old Wiley Coyote Road Runner shows you know it's gonna go in badly, but.

D

Every week, another.

C

B

That ends badly and it turns out you can make a whole lot of shows with that new idea in battling.

D

B

Indeed, and what's funny, is that with a little comedy you could keep it amusing all right, yo how's it going to go badly this time.

C

A

Give folks just one more minute.

B

Meeting notes notes.

B

Oh we're doing old style attendance lists. Is that not.

A

Is are we good? That was uh how.

B

Are we doing that last week? Yeah, that's so last week, uh all right, so let me I'm sure we can do more, but uh the problem with that is that they um people are basically, if you just type it in. If you type it in then people don't type in their names all the time or and if you uh and if you do the the Shaded versus fully dark, it doesn't really translate to markdown.

B

E

D

B

Present name org. We can also do the uh pronouns um uh plea, that's an easy table to add, but right now I am just focused on you know getting something here.

B

Do making that fix is relatively.

A

So we have everybody, including those who are not present right.

B

A

B

Now you can put an X and see now all you have to do from the following weeks. Is you put an X and anybody can put an X if they see you, they can also put an X there. Oh.

A

Okay, all right all right, I, I, sure.

B

A

For you, I love, it I love. It tell me.

B

Tell me if you hate.

A

It that is no no, no, no I will never ever. If someone does something for me, it is always perfect.

B

Well, I'll I'll quote that at.

A

B

And you know what uh eventually, the goal is to have tooling do this more, but.

A

Ai is nowhere near there. No nowhere near able to take attendance.

B

You know what actually.

D

What are we doing, yeah well.

B

Ai isn't but um assigning in through LFX, with your um SSO ID absolutely works.

A

um But I can never see it. I can't even see who was invited to these.

B

Do not interfere with the facts? Why would you.

A

Oh, that's why I like security, the problems are so tractable compared to things like you know, meeting attendants and meeting notes.

B

A

Well, anyway, anyway,.

B

The hope is that the goal is to make life easier, translates to markdown and clicking on X's is hopefully a little easier for everybody. Awesome.

A

Cool okay: um let's see we don't have any new members here today, um uh project updates um who would like to go for it? uh I, don't know if anybody really wants to maybe we'll start with dashboard um Jay. How is that going.

E

uh Well, that's what I I wish I had something uh different than uh last week. I, don't know the last time we met at don't um we we, uh the new, front-end person, came on board. uh We go back into uh the survey that was done by by Mike and we and we uh we.

E

You know that it was like I, said fantastic survey, so we dive back into that a little bit more, which will help out a lot with um how we organize front-end development um uh Raul is is still in the process of pushing code to the repo uh so that that can be seen there, um but ultimately we're you know, giving them time to uh to work and get some things done for us to be able to show the working group uh towards the end of uh next month.

A

Awesome I I am curious um for, for the for the front, end Dev um who's paying for that.

B

Elephants, elephants, oh awesome, cool, that's great I, just yeah I know I'm, actually not sure if that's open, ssf funds or another bucket I don't actually know what the is. But I do know that um uh that we are somehow involved with paying her I.

A

Just want to make sure that I'm not personally getting an invoice I.

E

Didn't write a proposal, it didn't go up to you. There was nothing that went up to you to the attack as far as I'm concerned. If they got brought them on board, we had nothing to do with that. I.

D

A

E

It I love it. It's my.

A

Favorite uh cool okay, so a couple weeks demo from sometime in July, I'm, guessing yeah.

D

A

Cool um Amir, it looks like we're good for.

B

Actually, if, if I'm, if I may real quick yeah, so um I actually have separately briefly talked with um uh hurt as well um he's basically trying to you, know, I think you're uh trying to get get things started. uh One thing he's really interested in is trying to figure out how to do more than just present raw numbers, but you know how can we, you know be I mean I I, do think that presenting important numbers is useful all by itself, but but he'd like to have something. That's a little more.

B

You know hey this, you know. Is this good? Is this bad um and I I think what, after some brief discussions when I'm coming away? What he's coming away with is uh trying to convert this if nothing else, to a comparison to other projects kind of score, so you know I, don't know if 30 days is slower fast as a response to vulnerabilities, but if almost everybody else does it in two you're doing it in 30. That's not so good.

A

Yes, I I think comparing one project to one project might not be super useful right like comparing.

B

A

To the median of all projects scanned or that that what in what percentile are you right.

B

Would be that that's exactly right now and, and you know I could easily imagine, maybe you'd be better if you grouped them by you know, say maybe among all python projects or whatever, but I I I. Think the notion, though, is you know um you know how do how do we convert a raw number into something that provides more information? And while there are other ways to do it, I I do think that Zero versus one can one developer more versus more than one.

B

That tells you information without you needing a lot of explanation, but for some of these others it's not obvious, but if we can use a comparison of the projects, we think that'll help.

A

Yeah I think one of the things that we talked about a while ago was the.

A

The concept that um open ssf can have an opinion and an award kind of gold stars where we think that certain attributes are good, so the idea being having more than one more than one. You know, committer it you get, gets a gold star. Only one committer doesn't get the gold star, sorry, um but then being able to like flip the card over or whatever the UI like thing is to see that, oh, you have 47 committers, so you have one. You have zero Outlets unmaintained.

A

um So if folks, don't like our where we've awarded gold stars, they can say you know what I just show me. The numbers, don't don't give, don't give me your opinions uh and that way they can, especially throughout the API they can make whatever different decisions they want. um I think that would be useful.

B

Yeah and I do think that in particular mentioning that, like one contributor versus more than one, you know or one maintainer versus more than one um I think strange as it may seem. That can still be really helpful.

B

um You know, I, don't know if you might always presume you saw the numbers, I think Jay. You did too or basically there's an incredibly large number of projects with exactly one developer.

C

B

Making that very clear that it's only one that's not ideal, it's like 50 of all the projects we scan. So, although that's not ideal, it's also not unusual and I think that information is act, makes it still helpful, even in the case where you don't like it. Maybe that's bad, but don't don't have a cow, don't overreact, because in fact this is a common situation. I.

A

Love your 90s reference to don't have a cow man.

B

Oh, no, no! No, that that was old! Then don't have a cow man. I think that Bart Simpson.

A

Oh you're right that was that.

B

F

B

I think actually that even goes back further I think that's a like a 60s thing. It's.

A

Like Greco-Roman times yeah, maybe I should have supposed to find which city man.

B

Van tells them too.

A

um Yeah and and.

A

You know I'll, say I, think the rattle here for a long time, but like the the single maintainer projects, are kind of interesting because, like I'm on the other end of it, a lot of projects that I that I work on I'm, the only on the only Devon um and I would I think I would take offense honestly if someone called out my project as bad, because nobody else contributed to it because I'm like well yeah. That's what I've been screaming about.

A

Nobody wants to contribute to this to it, but then don't give me the you know a demerit, because you know like, if I'm actively doing something, that's dangerous, or this obviously best practice that I could turn on. But I choose not to fine like and I could disagree with your thing but like it like I, don't go so far as to say like that's discriminatory but like it is kind of like the person.

A

The maintainer is exactly the opposite of the class of individuals that you want to be giving the demerit to well for a single single container projects. They are the only person that showed up so yeah, um but at the same time, I also get it from from uh from an organization's perspective, if I'm gonna put something in a self-driving car or or whatever and I know that it's just one one person behind it. That should give me pause in whether or not I'm willing to to take that. um Take that risk.

A

So maybe the answer is that there are risks are kind of different. One is like project level like not as secure as you should be, not as safe as you should be. Yeah risk there and.

D

A

Is like you know,.

A

uh Another example would be um I, I, I, I, uh I release. All my code on cpan um I have no idea if this is true, but let's just assume that cpan does not support two-factor off in any way for publishing packages. I have no control over that. I cannot influence that as a maintainer.

A

I should not be be given a demerit, because you cannot trust the packages that you obtained from cpan, because there's no signal on on 2fa.

B

uh Let me push back, but only slightly I agree with you. You should not be penalized because repo X, let me not say cpan, because I don't actually know I, wouldn't be surprised that it did support it. So, but.

A

I love Pearl.

C

B

I know exactly what you're talking about so, let's carry on, but let's say repo X doesn't support 2fa or hey. You only have one project on one person on your project. Okay, from the point of view of the recipient. It really is a risk. Okay, it's not that that's not relevant. It is, however, there's a if there is a difference, because, as you mentioned, it's not something you can easily or directly control, I.

B

Think in both cases there are things you can do things like take State, you know make your read means better in your documentation better. So it's easier for people who might be interested to figure out how to come on board for cpan you can yell at cpan or whatever the repo is. If they don't support, 2fa and yellow and say, hey support 2fa, but you can take steps to increase the likelihood and still not cause the effect. You want right right, so I I think that I I think.

B

Maybe we need to clarify that somehow is that sometimes these measures, while they do indicate risk they're, not necessarily under the control of the developers? Yes,.

A

B

A

Think that breakdown totally makes sense like actionable for for the maintainer not actionable for the maintainer, but still interesting from a consumer perspective.

B

Right and I will note that, for example, the best practices badge we rigged the goal you have to get to the goal badge before you get to anything that requires more than one person.

C

B

Such a common situation that it made no sense to there's so many things that a project could do that were within its control.

D

F

D

A

And honestly, like even I I, don't know how maintainers are captured in like scorecards and whatnot like I, don't know if it's just like someone who had a commit merged, like distinct number of individuals, with a commit that they authored merged in the past time frame um but like if there's only one person that actually owns the merge button, then there's only one actual like I, don't know, call them a maintainer or an owner, but like there's only one controller there and oftentimes, you know they go away or stop caring or whatever like.

A

But if they're not there, to hit the merge button, it doesn't matter how many contributors you have they're just going to pile up those pull requests that never go merged.

B

Okay, so it seems to me- uh and it's Jay so I'm- trying to figure out how to turn this into an action. uh I I think Jay. What this suggests and I bet there's a whole lot of little points like this. There probably should be a link on like the metrics dashboard of the caveats and stick this on the caveats. Page.

E

I mean we talked about that some time ago about making sure that there were clear definitions, clear um you know, understanding of what each piece of data represented and then and then, of course, what was there? What wasn't there? Why it wasn't there all that kind of stuff? And we talked about that about that some time ago, yeah.

D

E

Page that that just talks about real, quick, hey- this is what it is. This is what it isn't. This is what you'll find here. This is what you won't find here, and um you know if you have a suggestion on how we can include things that that that should be found here that are not here. Please send message to boom right and probably probably do do that I mean that'll help solve that problem. Because caveats is like you can add those, but you know.

E

Like I said, all I mean all that spawns from what what uh that's that's. That survey is great and David's right. There were a couple of Revelations that came out of it, um that that lends itself to say well wait a minute. What exactly are we showing here? How does this differentiate from? What's already out there.

C

A

Cool um speaking of dashboards, do we think so the Cur, the current metric metrics, that openness after work hasn't been updated in a long time? Does that make sense just to redirect that link someplace else, um I'll.

F

A

Through it tonight to see like, if anybody's actually hitting it I doubt it.

E

I think I think we can I mean once we get the uh I want to say. Once we get a front end situated.

B

I, wouldn't do it yet because we don't have anything to replace it with.

C

B

At least for me, I I think we've been using it as a an example of you know, a comparison of example.

C

B

So, basically, yes, but not yet I'm I'm good with that yeah, because I think we're at least I've been looking at it as a hey. This is the first prototype. We want to make sure we we use this as a. We want this kind of better.

A

Totally totally good uh awesome, um let's see, what's next uh anything else on dashboard.

A

Cool um Security reviews, uh Amir, are we all the bugs have been fixed right. All the build nonsense, stuff.

D

um So that's my update uh earlier in the meeting. I was messing around a little bit um on the repo and it looks like the that little hyphen in front of organization um when you go to the markdown generator process. uh For some reason it's just not it's not getting that in there still so I think this.

E

D

The automated test, um due to the same problem we had with with the other one.

B

Is this a yaml file, that's being used anywhere here.

A

D

A

The top of the animal file um looks like they were so so um sorry, there's a so PR 88 uh right. Yes,.

D

So this this uh right here, the python.

A

uh Pr88 should fix that okay I, just need I mean I, should have you approve it before I push it, um but I think that that that's the thing that will.

B

We'll fix this thing: okay,.

D

B

Okay, yeah it just as soon as you start talking about weirdness, with certain characters and and there's yaml involved. I have learned. I mean yaml is very easy to read, but you do have to be careful about quoting rules.

D

A

D

A

You do that it should generate it or you can obviously modify yourself and um if you want me to review and approve or merge or whatever like we can, we can get some of these um updated. Okay, uh 88 the pr was 88. The bug is 87.

D

Cool um yeah, okay, um so yeah. This should hopefully fix that then, and then I'll continue to kind of clean up the repo a little bit um I do still plan on kind of going through it a little better and um uh cleaning it up some more, especially as uh the dashboard develops more because I know that the content will be feeding into it. So we'll definitely want to make sure everything is looking good. There we're capturing everything that we want in a way that works.

D

um So um so yeah um I'll finish getting this repo updated and then, as uh as we talk more about the dashboard in the coming meetings, we can see if there's better ways to align um the data we capture with what the what the output is intending to look like at the end, um but yeah, hopefully yeah once we get these other ones in there and I think yeah. The I still really want to go in and clean up that core infrastructure initiative, stuff and.

E

D

It out and or parse it out, rather so yeah overall so far, so good and uh yeah I'll retest it with the now with the new uh code to Auto, generate it correctly and test it out again and.

A

D

Should work this time so yeah all looking good awesome.

A

Cool um Luigi threats paper: you want to chat about that. A little bit.

F

Yeah I have some updates: um okay about the security side and the version 1.6 or true point something. We need to Define this uh in short, I've merged the trooper requests made with Jonathan in for the in the executing sites. Now the security size is definitely more oriented to help well, the maintainers and the researcher to have more information about automated tool and how the researcher can open pull, request or issue or how they maintaining one to be involved in this kind of brushes.

F

um It is quite basic. You can also Define the sub path and you can add comment for human that want to read the file, so the scanner can scan and but also look in. The maintainer cannot comment. uh There is just one open issue that is important at the moment. How we want to handle a reference for the daytime of the security insights. I need to talk. I would like to talk. I mean I want to talk with Jonathan about this uh because honestly I understand his point.

F

I want just to be convinced by him to change the fight um about the document. I am slow, I'm, sorry, but I am on calling this period. So I am just adapting my my time in my calendar, but I started to add the new paragraph into the document.

F

It I am working still on my version, I mean on my Google Drive, but it is public the link it is in the channel and um uh uh now I'm writing about the process where I have seen how we have um previously um brought that document and we uh explained thread but also suggest, uh or try to suggest some improvement, especially for the packet management maintainer.

F

But, for example, for the process, where uh I mean reading blog post and especially one bike, video I guess um it's hard to uh have suggestions just for the packet manager system. We I mean there are some security suggestions, also for the maintainer or for the company that want to download the third party packages and so for now. I am not writing I'm.

F

Just at the draft paragraph for the mitigation on the proposal solution or just because it is easier to communicate with the packages managed system, it can be more difficult to communicate with the community that need to maintain something that can be a company, but also an organization or an open source project just download the packages. So for that part, probably I will ask help and tag people.

F

One of the problem to have a document in my own personal Google Drive, is that I cannot easily find people that I would like to tag them because I don't have uh all the Linux Foundation contact information. All the open sesame in my in my contacts and yeah. So.

A

What you could do is you could create one of the magic links with edit access and then DM that privately to the folks that you would like edit access to on slack yeah.

F

Yeah, not everyone has the email to in slack, but I can do this. Probably I will create a octite to download the list of our meeting and uh just forward. You.

A

Know if you create the magic link Whoever has the link has added access to it, so you can just share that link privately through a DM with the people, whether or not there.

F

But in this way, I cannot have the people in the contact if I share just the magic link without invite the person I cannot tag the person- oh good job, yes, yes, this is my problem, but just a minor problem and it is so I am presenting to write it. There are some new suggestion: I did I am editing the document not directly on the document, but just using the suggestion. So, if you don't find the edit is because our in this suggestion, editor I hope that people can see them.

F

The document is public with editor privilege for everyone, because I know that I can revert everything yeah um and the link is in the channel. uh Other updates, uh no new updates about the security policy, but I need to write to the attack this week. I hope that they finish down call uh I, uh yeah I filled out at least the security insight um partially or the security side. While they choose light in the presentation that someone asked me to fill out.

F

Probably you I was on vacation that day, yup yeah for the security insights, I written that one of the blockers that we have is the security policy. I mean it was the the the square where we asked to the attack for help, and one of the help that we need is to have a way to approve a security policy that bought up an ssf like and Linux Foundation like, and this is not easy agreed.

A

Yeah um on the dock, so so the the um the the link to the draft update dot. um It looks like I, don't know, I, don't know how this this works doesn't make any sense to me, but all of the images have all of the words gone.

F

Yeah I know I, don't know why yeah I know I want to fix this, but now I'm, focusing on just on the text for the images.

C

F

Yeah, how to do this yeah I.

D

B

Like probably because.

F

We have written nothing Google doc, the first time I, don't know why? Yeah, because.

D

F

I, don't have Microsoft I, don't well I'm, Linux user, so I don't have Microsoft Word. It hurts.

A

I can send you a copy.

B

um Michael I don't want to tell you the last time I've opened Microsoft Word.

E

A

But I do have it that's good! That's good! Yeah, I'm gonna! Stop there.

B

A

D

Are not we, we.

A

B

This is, this is toying in love.

A

The AI is gonna find this this. This video on YouTube and yeah.

F

Yeah about the topic um I asked or I dreamed to ask I don't know uh about if we have a channel for AI topic. Machine learning in Linux for in um okay I am not able to find it.

F

So if someone can invite me or tag me in the channel, because I would like to introduce this document to the AE slash machine, Learning, Channel I think that today, topics totally different I have I start to read some documents, and now we are seeing the first research about this, for example, that sometimes the open, AI trageddp can suggest you um type of squats the package or something similar. So I think that introduce the AI in the document is a good idea, but I think that it can be good enough to be discussing another Channel.

F

A

I post a link to the channel, we meet every Wednesday, uh so we met earlier earlier. This morning uh we are as a working group planning, both a Blog and a white paper. um The white paper I. My understanding is that it will focus on like Ai and ml risks, unique to uh either open source.

A

You know maintainers or consumers or somehow personas associated with that um it wouldn't be insane to like actually have that content be part of the threats paper, because if it is about threat, risk and mitigation within the open source ecosystem, that's exactly what the white paper is talking about. uh So I I mean it. It may be better published Standalone now, because AI is such a Hot Topic and visibility, and all that stuff, but conceptually it.

A

Could also go in the in the Northwest Paper.

F

Yeah I still I, don't know if we should have or not. We can have just a short paragraph where we do a short uh summary and link to the other one uh we can I mean because we are not interested just to all the threat related to machine learning, for example, open source machine learning projects are a topic. Machine learning used by developer to develop uh open source is another topic with different threats, probably uh so no opinion at the moment. I was just to say: hey.

F

We have this document where we want, where we have uh uh listed all the possible uh threats that we have identified in the open source ecosystem and we want to know. We would like to understand how the machine learning slash I can impact this kind of ecosystem, but just this kind of ecosystem, so I just wanted to launch this topic in the channel. Let's see what happened uh in the meanwhile I continue to write uh the the editing.

F

The document to I mean following the issue that we have I should write in the document that I am following the tissue and um in July I have more time personally to write so awesome. Yeah and no other updates.

A

Cool is there anything else anyone would like to talk about.

F

uh I have a question: if I can the presentation that uh I mean it was made one week ago, two weeks ago, not sure yeah, it was for what and what is the outcome from well? The meeting so.

A

Tack asks for a an update from every working group.

A

Whatever I I'll on a big, they usually do like two per session, so I think we get it about twice a year. Ish uh so last week was identifying security threats, just update on like uh where we are, what we've been up to what we have coming up. Next, um it's not yeah it. It's um it's more of an inform um than anything else to give them some visibility into what we're up to so that's what we did.

A

It isn't a good place for big asks or complex conversations, or things like that, um so so for the for the security policy thing, those are better. Those conversations are better at Standalone, like agenda topics for for Tech news.

F

Okay, thank you. Yeah.

D

I was just going to chime in uh real quickly that I commented on your draft Luigi but I'd be happy to add some sections or some um data to the security audit section just based on some of our research and output over the last couple years, um especially some of the the stuff that has been um essentially funded by open, SSS, open, SS, um so yeah.

D

If that sounds good to the group, I can start putting some things and then, um if the group likes it, I can I can continue, adding in uh more uh more data and research and writing.

A

That sounds great yeah I would say, like uh you know, for now: throw everything in the dock like that. That's great I think the having having data to back up. Like you know, a stat like um projects that have undergone a security audit or X percent. Less likely to have a critical vulnerability in the next 10 years would be like an amazing statistic to see.

A

Having like the list of projects that Austin has like reviewed, it's probably less relevant within that that topic, perhaps as an appendix of like you know, pursuant to like the the recommendations in this paper like here, are some activities that open ssf undergone I'm not sold on whether that really belongs in the paper or just as a.

D

A

Yearly update from openssf, but um it's a draft throw everything in okay, cool.

A

All right, if there is nothing else, we can leave a bit early, hello, manwar.

C

um I'm joining off from another meeting, so okay yeah, it's.

A

All good we're just finishing up unless there was anything that you wanted to add or or chat about so.

C

I, don't know like whether this is relevant, but just a little bit on so I had meetings with Yesenia and uh and the interns they were showing the the dashboard, as it is right now uh the pH portal, as it is right now what we are seeing is or what we have found out so so right now the data is not populated there and we still have not created the mechanism of uh so so the when we are updating the serif.

C

The the dashboard is still not like populating the data from that, but that's probably going to be done pretty soon yeah. What will probably not be done in time is the complex, coordinated disclosure uh workflow. uh The idea is that will be done so the work that we'll be starting to do from April, one uh from July 1. What we were thinking of then go back to our triage portal, which has done this to some extent and then use that for now we still need to do some work so that.

A

Yeah, so a a thousand percent. Yes, um sorry.

A

um This is more of an AO conversation, but uh uh through this opener Factory is we'll be doing a security analysis of I think we said 500 a month or like.

C

Yeah, a lot of.

A

A lot of Open Source projects, charging results and kind of owning the the disclosure from you know from from Discovery, through fix, um as an experiment to see like how well does this stuff scale out. So that's what we were talking about on where we, while we would, we would like you, know eventually the uh Omega triage portal to be a consumable resource for lots of security researchers. Doing these kind of bulk scale analysis. It's still, you know the the the the the train has like two wheels. So, um let's um you.

C

Know just yeah, and since this is like oh, this is the parent organization of the AO in English. So that's why I was bringing this conversation and we don't have any any conversation before July 1 so just wanted to so the expectation would be that we'll be doing some extension on the on our Triad portal uh and uh making sure that we follow a subset of the coordinated disclosure. So we won't automate all of that stuff. Jonathan is already working on that. Once that is available is going to be integrated.

C

We are going to use that, but we'll be just doing just enough so that it's workable. We are working on the PM, PBR way of of reporting bugs and then we'll be using that so the the work or the active reporting is probably going to start near the end of July or early August, as opposed to like from July 1, because the infrastructure is not ready are.

A

You using uh the disclosure check tool for projects, we don't have pmpvr. We.

C

Are using that? Yes, so so I I have access to that. It's not integrated yet, but that's not a problem that we will.

A

Be there perfect, um then I will I will accelerate and make sure that I actually deliver my promise to get the python Library updated and the package on GitHub packages updated with the latest bit so that it works as good as it can.

A

But obviously, if you, if you run into places where it's spitting out nonsense, um just ping me your final bug or whatever and we'll improve it, um I think right now, it's probably in the probably in the low 90s percent um good and the places where it fails or places where humans can't find it either. So, yes, yes, uh yeah.

C

So yeah I, we I, think one of our guys tried it out. It looked pretty like useful at that particular point, but actively we'll be looking at it from July one onwards. Awesome! Okay, thank you. Thank you.

A

All right anything else, no, you guys got six 17 minutes back going once going twice. Thank you all see you in two weeks uh wait hold on wait, wait! Wait before we do! This two weeks is July 4th. We're gonna uh no show like fifth, so we are okay, um I'm gonna be off for the following two weeks: the 19th of July and the second. So um maybe we'll just do this now. Is there anybody that will be around on either July 19th and the second who would just be willing to run this uh run?

A

E

Always around always.

A

Around awesome, okay, they're, yours, thank you.

A

um Cool have a great day. Everybody appreciate it. Adios.

C