OpenSSF Identifying Security Threats WG, 1 Feb 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: OpenSSF Identifying Security Threats WG (February 1, 2023)

Description

Meeting notes: https://docs.google.com/document/d/1AfI0S6VjBCO0ZkULCYZGHuzzW8TPqO3zYxRjzmKvUB4/edit

A

Morning, everybody.

A

Or afternoon or whatever.

A

You get folks like two minutes or so we'll get started.

B

C

D

I've been called that before.

A

You've never been called David before no.

D

A

Called that, oh.

C

C

D

My little web camera has a shield. It seems to have fallen off. Oh no privacy.

A

D

Privacy is gone well, I could unplug it when I don't want it to use it, but I like having the shield available when I don't want to be viewed by the world.

D

I make a policy not to change clothes in front of webcams anyway, but still.

A

Experiences is a harsh teacher.

D

Oh no, not, thankfully, no I mean it's a true statement in general, but I haven't done that, but.

E

D

The whole idea that people are selling cameras without covers is a mystery to me.

D

That just seems like asking for for trouble. Yeah.

A

Awesome welcome everybody to the February 1st, identifying security threats, working great meeting.

A

um How is everybody doing today.

D

Doing well, where did January go.

A

We're done with January we are spring is fast approaching all righty um cool uh Luigi. Thank you so much for running two weeks ago,.

A

um So, let's see uh is there any? uh Is there anybody here that hasn't been at a previous meeting that would like to introduce themselves.

A

If so, now is your chance, don't feel obligated.

C

uh Yes me it's my first time to join the meeting.

A

Awesome welcome.

C

My name is Rusty and I'm from Jakarta I work as a software engineer. At coin works.

A

Awesome um there is a um meeting notes, doc linked from the meeting invite uh it should be an edit link, so you should be able to go there and you know add yourself and keep notes or whatever you want in there. But it's kind of a shared group group: uh okay,.

A

So, let's see um top level stuff I, don't have anything um kind of ossf wide uh I know David. We don't have anything, we don't have like a town hall or anything coming up scheduled.

D

Right now, no okay.

A

So we can go with project updates or there are other topics you know we can we can as usual. We can do this. Whatever way you all want, um if you want to, if you want to add a topic, just add into the meeting notes or just talk and we'll we'll um discuss anything there, um but the default would be uh let's go through on Project updates, so we have, uh let's see um start with virtual maintainer Summit.

E

Do we have I.

D

Wasn't there so I, don't.

C

C

A

Know what it's just uh Luigi since you're here? How is security insights, going.

A

You're you're Anita.

F

Yeah, um okay from the last from the previous meeting, I have an updates. Unfortunately, but I have a three open pool requests. They are in draft because I need to understand how we want to proceed with some compliance in open ssf. For example. uh Not all the projects have a security uh MD and technically we can enable it easily as organization in GitHub, but at the moment we have a hit, and um another question is for just the most important project.

F

Maybe it is more for the attack and it is a question that I don't know if you Michael- or someone has said that usually is in the tagmit it can ask, but we want to have a sort of bug, Bounty program for the most important project that we have or not, because at the moment for sure um the scorecard is quite popular now, but also some other collateral projects in open, ssf uh RB becoming popular, and maybe we want to have a bounty program.

F

So the pull requests are in draft in three repository and uh I am in cocktail, with the maintainer and um I hope to merge them, but in particular, I cannot merge them if they don't have a security.md, because it is a requirement of the security inside specification having at least a short text file with contact for security.

A

Sorry, it's a requirement for for security insights to have a security MD.

F

Or just a sort of security policy, so uh this project doesn't have I mean at least one of these projects. Don't have a security policy um yeah. Maybe we want to have it at least for the wrapping up in ssf.

A

I would imagine so I can't I can't imagine like I mean, like obviously, there were documentation projects and things like that that, like the.

C

Concept of what.

A

Is a security issue like yeah.

C

I mean very much but.

A

The file can still exist and say this is a documentation project. There is no like I.

F

Mean if you really need somebody like yeah exactly if it is a documentation project is not. uh Maybe you don't need the security insights, but we are talking about uh project where there is a code base. uh I mean I need to double check, but for sure that is called I have a check that give one. Second I can link you um the three project that I have give him a second uh uh or maybe they are in the meeting notes uh yeah in the previous meeting notes.

F

There is a there are a link to Slacker with all the three projects where I opened the pull request, and uh one is a packet analysis.

F

And you can see that sometimes not so easy to identify the security testing, and maybe we will we. We are interested to have some standards also for that. This bomb is not still uh in a lot of open source project in open ssf and another problem is I need to find it security control. Oh this one, it is the first introspector I, don't know if it is a documentation project from but from the code base it it doesn't seem so I have the link. Where is zoom here.

F

This is the pull request, and this is the project. I mean I, don't know if we can Define it popular, but it has more than 200 stars and there is the opens open. Ssf Score, Card 7.5. So if you have the open, SS scorecard I, don't think you are a documentation project. You are definitely a project yeah, a software project, yep.

A

Yeah I mean I, I would I would even go so far say, even if you are just a documentation project having having a security MD it for consistency, especially for ossf. As an organization like you could have a separate organization that says that documentation projects should not get security. Md I would respect that opinion, but for our organization, I think a blanket every every repo gets a security MD I think is, is reasonable um and uh does the default um template that we have so there's.

F

Like this is the other question, I mean checking the project. I have seen three interesting points. One is that uh more than one years ago, if you remember when we implemented the first version of the security dashboard, uh Apache Foundation enabled the security team for all the repo in gitabo using the security tab, um because the in the score cards in the scorecard slash romantic dashboard, um their security policy.

F

That was not the security.md that was a external link, was not classified like a security policy, so they show us that we can enable the security uh policy slash security MD in all rep of the organization. Even if you don't add the file in the repo, because there is the security tab that link every project or less- and maybe we can do this, so maybe some project can have the security.md and other can have just the security tab.

F

That is still a valid security policy, and the other point is that uh yeah we don't have a a standard for the security.md. We have. The scorecard have a security.md that is very short and it points to a Google group. The email address is a Google group. If I remember correctly and I, don't know if we want to have an open, ssf contact and not just a Google group, I, don't know so. Okay, it is a compliance topic. Maybe.

A

Yeah I I would I would defer that question out to the team, I I think I, don't I, don't think we want to like run a central incident response team for reports of anything ossf wide, um I, I think so from what I can tell the GitHub security tab like set up a security policy thing is just a convenience, wrapper to create your own security.md file and commit it into the root of okay of the project.

A

So I think um I think it would be very reasonable to maybe go through all of the ossf projects and for any of them that don't have a security, MD file open up a security issue. Saying hey you should: could you create a security, MD file um and also added to the project template so that new repos as they get created, get One automatically?

A

um And then we can find a reasonable template to start and suggest that if you know so, people don't have to make it up on this. You know from yeah.

F

I think that would that would be super useful, yeah, exactly because I mean at the moment that requests that didn't laugh just for this reason, because I don't want to bypass the security and size requirement at the same time, I think it is a good idea to solve this issue to an organizational level and the same for the Bounty I mean enough. You can say I mean the organization can say just know, and it is acceptable for sure.

F

But if there is budget, at least for some project can be uh from a community perspective, a nice idea, I mean the the the Bounty can be I mean they yeah. uh The Bounty can be some others. Work can be something that is very easy and not expensive, but.

C

F

A

Yeah, okay and yeah: that's all reasonable.

D

A quick, quick note on the security MDF I mean a lot of people, don't like having a lot of directors at their top level. I I understand that. So if we also allow within a Docker docs subdirectory that maybe that's enough yeah.

C

Yeah I mean that's.

D

A I mean that's an easy thing to also check I mean the best practices badge. We often check for things in you know: Docker docs, as well as the top level, because people whine about I got 800 uh screaming capitals, screaming file names.

F

I totally agree, I mean technically um I. Don't ask that the project has a security.md in the main folder they can have in a subfolder also in external website, but I mean I need to be able to find it in the redmi. You can adjust for the security policy and link to an external link. The security insights don't require a security. It requires a link to a security policy. Just this right.

D

Right, but you know, I I think uh you know trying to make it so there's enough flexibility so that people who complain about one can get the other, but you can find it I think that's the key. It's got to be automatically findable exactly.

F

The point is that the security inside can help you to easy, easily easier, find everything that at the moment has no standard or just people don't like in the main folder or they don't like, or they use docs or dock or Point dock. So we don't have standard for this kind of stuff. A scanner can try to improve to find document, but it's not so easy. Yeah, no.

D

But I think Docker docs. uh We we use doc, but I think most people are now using. Docs is pretty common and conventional. At.

A

The end of the day the the the repo owner can, if they want to put it in slash, Foo, that's fine. The link in in the security insights will be slash, Foo, slash security.md. They want to call up something different security, stuff.md, that's fine too. It just needs to be a thing right.

D

So there needs to be a way to find it and the more we can make it just easy and automatic. You know the the better yeah.

A

Randall, you ever hand up.

G

Yeah I wanted to know, did uh Luigi consider the community health files, like the GitHub feature where you could just have one organization with, like you name it like dot whatever and you put like security MD, and they get linked to all your repos I can send you an example. If you'd like.

A

Oh I've never heard of that yeah that.

G

We did that with Astra I just sent a link in the chat.

A

So so this is like yeah.

G

So if you go to the Astro, repos you'll see that they're, like like the security policy, automatically gets linked on the left-hand side.

F

This is great for compliance, I mean whoa.

G

If you actually go to our main repo you'll see that we have license and security policy and we actually don't have a security like we do have one because I put that in there prior, hence yeah, but like it automatically links everything together.

G

C

Therefore, you.

G

You don't have, you only have to maintain it in one place.

F

Yeah, this is great, I mean this was the my main idea, but I didn't know that uh GitHub support this video yeah.

A

We should just totally do this as a organization.

G

A

The a repo level security MD override the order, correct awesome, then, if you do this once for ossf, we need to figure out who to point it to what to say in that one, but um that could be the default. For you know we could we.

G

A

Figure this out, but that is super useful information, I.

G

Can help you guys out too, if you guys need awesome.

F

Christine, what do you mean you know, do you mean or in another organization.

E

Oh I meant in uh at F5. We also have the dog GitHub feature for community health bars and things like issue templates.

C

And things like that, okay,.

F

And yeah I have finished the update, I guess cool, but I want to add questions for the other topic. Just.

B

Just for quickly ask questions some work I'm currently doing with Argo CD, which is around using treasure to threat model um their their ecosystem. um I was just wondering. Would this be a super place to put in the docket at GitHub as well, or um it's first time, I've actually heard of this dot? He GitHub so I'm quite excited about it, but would that maybe happen like PDFs and um PDF of the risks and also the data flow chart? Would that be somewhere where we could put stuff like that? No.

G

I, don't believe so I believe it's.

D

G

Security and like it has to be like specific license in their documentation. What documents you can share: manga, repost, okay,.

B

Good. Thank you thanks, sir, but.

A

The the security insights back does include things for things like threat models and stuff like that right, right, Luigi.

F

uh Yes, technically, there is also space to link it to the attack model yeah. So.

B

F

You have a third model in uh everywhere in S3 bucket in the home page or your website. Another repo you can just link to it.

B

That's great, thank you.

A

Awesome um any anything else on security insights is there anything? Is there any help that you need from us.

F

Yeah the help is that it would be great to have a sort of organization level or at least for the rapper, where I have opened Apple request a security policy or some or linked with something, and probably it is attack, decision, I, guess and I need to help to communicate with attack uh uh group, especially because, for some reason usually when they have the meeting I cannot join the meeting. So if someone can move or escalate, this problem can help me, especially because probably we need an approval by the management at the board and also.

F

And that is also, it will be interesting to know if we want to adopt this bomb for our project, because something that it seems to be important for open, ssf, the SB om file, but the time I mean I would like to see the adoption of our current standard that we proposed to the community. So people can use our repo as an example, and we can continue to improve yeah how we work thanks. Hope.

A

Okay, a question for s-bomb and- and it's just my my own ignorance here- are: are s-bomb files intended to be committed to source code, or are they intended to be the output of a build that gets attached to a release like? Would they be in releases? You know Foo, 1.2.3.zip or actually committed into into Source.

F

uh It is a good question at the moment there is no standard checking online I have seen that someone added in the search code. Someone has a page or a folder in the website of the project where they added the difference, but for every version, so uh I think that at the moment there is no a real stand-up. Okay. Let's say why we need to put it uh hi, David.

D

Hey funny, you should ask this question because in fact, there's people who've been discussing this, so um this turns out to be uh slightly more complicated and for good reasons.

D

um uh It turns out. Less people have been discussing a lot about s-bombs. um There are really different kinds of s-bombs. We're called what law folks are calling s-bomb types: okay, um some s-bombs are generated from the source code. Some are generated during the build environment.

D

Some are generated after the fact by analyzing, a bunch of bits by tools which work very hard to use a lot of heuristics to guess what might be in their baby um so um and then there's other s-bombs that are determined at runtime uh to see what's running now. So uh the uh the short answer is that very, very soon I'm thinking within a two weeks time, so, hopefully, by the next time, we gather uh there's going to be a document out that a number of us have been working on to identify.

D

Well, what are these different types of s-bombs and um a particular s-bomb might be actually a merge of more than one case like you might have a sources bomb and then add build information or whatever, but the answer to that question: where do you store? It depends a lot on? How did you create it? Basically, what type of s-bomb it is yeah um if it's something that is essentially um uh derived from the source code, I, don't think it's insane to make it part of the source code checked in that means.

D

You have to update it when you check in your source code, which usually you want to generate instead of just having this part of the source code. But it's not a crazy thing to do for the build type stuff, though, that really doesn't make much sense, uh which you probably want to do, is have a way to point from the source code.

D

How do I get the build information for the various builds and then say when you download a particular build package, the metadata of that points off to the s-bomb, so um so so I think, there's a reason for your G I'm, not sure and there's a variant, because, as people have gotten into this they're realizing that there's different cases for different circumstances. Okay,.

E

A

Cool, um so I I think it would make sense to to focus on security MD as a something concrete progress on short-term. um We shouldn't forget about s-bomb, but but yeah.

F

Security MD is easier and probably already a sort of standard or just a security policy.

A

Cool um okay, uh going back to uh virtual maintainer Summit, uh any updates.

E

Hey uh this is my number hey Michael, uh so uh we have right now sent the emails uh to the potential participants. We have done it twice. The second round went this uh uh Monday. uh However. uh So far we have only received I think for uh acknowledgments, so it's kind of like we have a raised heartbeat at this point, as in like okay, what's happening, how So the plan is to now personally Reach Out. Many of these participants are people who we know so personally, reach out and kind of coerce them into participating.

E

uh Something like that. So, for example like here, let me do that to Rando uh I think whom, who has received uh probably one of the emails but yeah I mean if you have not acknowledged. Please do that because again, like that, it's not good for our heart to have like five people at this point, so uh so yeah I.

G

Have a very funny story to what happened when I actually thought I brought this to Homebrew with Jay and Michael and David might already know, but but we could talk about it later, but uh I do think that there is some interesting feedback that happened there, that we don't have to talk about on this phone call, but yeah I, it's not like I, didn't pass it along. It's just that yeah there's certain opinions than like things that happened so yeah.

G

Maybe you should be aware, when you're dealing with uh the communities and asking people to attend to this.

E

G

You're not aware.

E

I am not so maybe I will connect with you separately and find out so yeah. It's always interesting. I mean we're doing people engineering here, so that's uh yeah I'll get that feedback uh from you on the side, but yeah. So that's what it is. We have also sent emails to the panelists uh this week. This and this was sent on I, think Tuesday, uh but I mean with the families there's only a few.

E

We have already pre-communicated with them, so uh the only thing that they have to do is to adjust their date, which was January 25 before and now acknowledged to the February 22nd date. So that is not something that we're too much worried about. So the next steps are basically creating structure as in who's doing during the actual event, who's conducting, which part like that we'll figure out among ourselves and then we'll also coordinate with the people. There's there's a round of survey.

E

uh There's a set of survey, there's a survey that we created that to uh try like ask different question about security practices existing in that uh community of that that particular community. So uh that gives us some data point that we can share during the conference. This goes out a week before the conference, that's something that has already been done. It's just like ready to go out to the people who have accepted to participate uh in that event.

E

So that's what we're waiting for other than that yeah I mean so that's the status so right now we're really want to uh praise the like increase, the count of people uh participating and that's that.

A

Awesome yeah I mean I I, think even if it, even if you know for the first experiment of this, if it's relatively small, if it provides value to the people that attended then great, exactly.

E

And, and also like this thing, I I don't know what Randall is talking about, but third, these issues that grew and like, for example, recently there's the slack storm that you have seen like uh that, like there's, of course, that Jonathan created and then there's like 100 uh email like messages back and forth regarding there are these open issues that are coming out of the experimentations that we are doing on the side uh and it's just like it's a community's perspective and it may not be reflective of the entire Community, uh but I mean it's a good start.

E

Nevertheless, that's what we are banking upon. Yes,.

A

More conversation is good. Oh sorry, exactly.

H

Just uh Randall, please Mona were include me in that call, because I'm also interesting to know why we have this reaction in the community, because we do need um to talk to people from the community to invite them. I really have them in this event. So just.

G

H

G

To stay after the call I can fill you guys in I. Don't care perfect.

H

A

Sure awesome um moving on uh security metrics, um anything on that front. Okay,.

I

um Yeah, so we've had a couple of meetings over the last uh over the last a couple of weeks.

I

um At the end of last year, we had a great mock-up that was done uh with the metrics and all, and we went back uh to narav and his team uh to put together a few, um a few additional features and uh to prepare um a nice demo that we wanted to bring to the working group.

I

um Narav had a couple of conflicts, so we were able to touch base with that over the last couple of means, but that's all we're waiting on right now um to to get to get a good sink back with those features and and those additions that we talked about uh at the end of last year, uh once we get those and as a as a Sig uh review them and um and uh opine on them and then agree on them.

I

We can then get something together in terms of a demo and bring before the work and bring that Lodge. That's all I'm waiting on now, okay,.

A

Also, is there anything that you need help from this working group, more help, moralities more anything.

I

We'll be good.

D

To go okay, cool! Thank you. A quick ad, though the next meeting is February 10 noon. So, if you are interested, hey, join the fun.

A

Cool, um oh, wait did I bring up office hours because I was I was pinged on this uh uh earlier uh uh yesterday um and um I was wondering: do we.

D

Which one alpha omega or specifically, oh.

A

Sorry, the the uh the office hours experiment that we tried La uh ah whenever we try to uh November.

B

A

um uh To see do we think that there's.

A

um Like do we want to try it again.

D

I think the question to be asked is: why did no one sign up? I mean we had several people sign up to answer questions, but we didn't have anybody sign up to ask questions so the question to be asked is why not now, maybe it was just bad timing, inadequate warning uh or maybe people are really afraid to um air their dirty laundry questions in public, in which case, maybe we need to take a different tack.

A

I mean I have no data to back up this feeling that I have I feel like foreign I.

B

Feel like it probably wasn't.

A

Advertised like loud enough and for a long enough period of time for enough people to know about it, so that you know if 0.1 percent of maintainers would be even theoretically interested in it.

A

um We just didn't have enough to you know on average it was about zero, but you know that fell into that, um but but I think there's probably a separate thing, which is, if I knew that every okay, so so the maintainer that would have gone to this would have gone to office hours would have been someone that had a security challenge right then that they didn't have a solution to, and then they heard about.

A

So it was like a subset of a subset of subset of a subset um if we advertise at this office, hours was available.

A

um Second Tuesday of every month from you know, whatever X to Y, it's on the calendar just show up and chat.

A

If, on average we get about one person, then we don't really need to do the pre-registration thing you just need to have one or two people like hanging out at office hours.

A

um If we wind up getting so much attention that we do need to like cue it, and then there were sensitive topics, so we need to like pre-register like I, think that's a problem that we can solve once we have the demand for it, um but I'm. My my gut is that perhaps we limited demand by making it a little too hard or.

A

Maybe maybe it would have been more effective, it was just a completely open, we're gonna run it for three months and if nobody shows up after three months and we're talking about it and advertising over time, then we realize that this is a a solution that for which there was no problem um and that's fine. We cancel it and move on, but um I feel like I feel, like folks would show up if they knew. This thing was always available and they're like I, can't make it this week, but I can do it next time.

A

G

um I'm sorry I'm having multiple conversations but I can substantiate what David has said from other Lindy's communities. I'm involved with that many people are not entirely clear what openssf is to start with so much less show up to office hours that.

A

Is terrific feedback we need to? We need to and.

G

You want another observation: it's everything too thin 2018 like prior to 2018. They kind of have no idea so like containers, because I kind of think like the year of Docker, was 2018. so like I, think like everything prior to that kind of feels, very marginalized. By like open ssf in general, like gnome, distros and yeah.

G

Well, I I don't want to get too finger-pointy on like no no yeah but but like basically yeah like like, even like a lot of really big Old-Timers that are in kernel, project and Gen, 2 and gnome, and things like that. I have no real idea. What problem we're trying to solve? They think that we're just a lot of Croft and if you guys want to stay after so we can get into The Homebrew call there's some really interesting feedback that comes out of that call, because the word strong arming came up several times.

A

Okay, yeah and so let's, let's set up a separate call because I I would really like to understand that and if it, even if it means I'd, be happy to join a call with Homebrew and take arrows on behalf of open ssf. But um I I I would.

G

And for the record David, that was my reaction, especially from like Homebrew, because I was like wait a minute. Aren't we kind of like Forward Thinking people here like but yeah there there's there's a there's, some stuff there and there's some drama. That happened because there's.

D

All this drama when there's humans involved, but I'm confused in this particular case I'm I mean let.

G

Me put it to you this way. Let me put it to you this way. My right privilege is at Homebrew have been revoked because because not directly for open ssf, but because, according to people in Homebrew, I cannot stand for both Homebrew and open ssf. At the same time, what yeah, okay.

A

So so, let's have this conversation some other time um understood in general, though I think um um if openness and stuff is doing something wrong, that is pushing against what an open source Community thinks is the right thing to do. That's a that's! The.

G

Point of that intersection cycle that we can get in the phone call on.

E

G

About responsibility licenses all sorts of stuff yeah.

A

Yeah and and I do kind of expect that most most problems are are perception and communication, um but we'll we can. You should not forget about that. Look let's follow up on that um cool, so so the question on on office hours do we think that we should um kind of continue? This change change the approach slightly?

A

Maybe I I'm I'm, not really exactly sure, but I want to throw it out there as a something that we should that we should think about and and either um do it or say we're not going to do it but kind of put in what one of the two buckets.

A

um Okay, Security reviews um I, don't see a mirror, but um uh which is great that um continuing to do security audits. um We do.

A

You know this is this: is great I mean having doing doing more security Audits and getting into into security, because I think would be great um I am we are starting to experiment on the alpha omega side with um kind of end-to-end?

A

um We can do it a lot of different ways, but one of the ways that we can do it is like automated analysis against a piece of Open Source, uh generate assertions based off of that run, policy against those assertions, saying no critical vulnerabilities found by any of these tools or whatever, um and then those things become reviews that get uploaded to the security reviews, um repo and that's kind of like what we did like I, don't know if it was eight months, I think about eight months ago um with a bunch of npm projects.

A

uh So we had fully automated reviews that popped out um and I think that's. While it's fundamentally different than like a a real code, audit or security assessment um I think it provides more visibility or more.

A

It gives consumers of that project some Assurance um as to that something was done um so I think we should continue to talk about this. A little bit early I probably need another couple weeks to talk clearer about what that would look like, but we're thinking.

A

um Could best practice badge link uh automatically into scooters sure yeah the best practice? Badges is just a magic URL that includes the project name. Oh no. It's like the project. Id right, David, yeah,.

D

Yeah, here's here's the challenge that I've got I'd like to actually I I can modify the best practices badge to link to the uh Security reviews um and in fact, um I'd I'd like to uh the challenge I've got is I, have a name like of the get and I have a GitHub repo. What I need is a way to link like the home, page or GitHub repo automatically to a place in the security reviews repo.

D

A

We could need like a service.

D

It could even just be a straight up database, okay,.

C

D

You know I mean basically, if I could download a file that provided me, a mapping from the um oh.

A

Yes, we we can definitely do that so clone the repo Parts each of the reviews find the GitHub ones and then make it a map of GitHub URL to relative path.

D

Right, like, like here's, our homepage, URL that maps to this that.

B

D

Know and basically I mean if we could, you give me a little Json file or CSV file with that with that provides that data, and um you know, I'm fully capable of loading such files and doing stuff with them. Yep yeah, parse.

C

D

I, don't want to do is read all the security.md files.

A

D

A

Side so so we already have most of that in the script that uh I think Dylan wrote to create the home page, um the the next table. um Okay, so.

D

Oh yeah, that's right! That's right! So if it could just separately generate a you know, a a.

C

D

That links just as I said you know from the best practices badge we have. We ask for people's repo URL and the uh homepage URL, which are sometimes the same.

D

um But uh if you know you know, but just the mapping from that boom I can immediately add you know GitHub, URL and or you and or you know and or home page yeah.

B

D

Yep yep, that is actually all I need, that'd, be great, that other folks could and I bet once you have, that other folks could have that too. And then, if we reorg that's okay, if we reorg the uh the markdown files, that's okay, because if you pull off the index, it won't matter yep cool that works. Okay, who do I talk into doing that.

A

Let's, let's try, it should be, it should be a 10 minute thing. um Yeah.

D

Cool yeah, so uh so how's. This I'll commit that. uh If, uh if somebody can give me that I can add a little button or something when that's present dude okay, you know link off to it and, and you know what we you know, I can, if, if uh people are okay with me, loading that file once a day, it means that there could be as much as a 24-hour delay before you link.

A

It off everybody.

D

I I think we'll live um yeah just for those who don't know the best practices batch, it actually restarts every day. It's just simpler that way, so smart.

A

All right uh is there anything else. Anybody would like to talk about.

F

Yes, I have added a link in the well technically other topics. Now is on the top sorry, uh because yeah moving stuffing yeah darkest weird but the first one is a issue that you have a sort of reopen uh before Christmas. Yes, and maybe it is interesting if we want to update the or do a I mean uh document, 1.3, I guess uh for the security threats, and there is a list of new threats, none I mean two or three I, don't remember now. This means that the first version was good enough and I.

F

Don't know um they have the. If you still happen, what is your opinion and how we can.

A

So sorry, it's the so so in looking through. Some of the later uh comments in the thread is the is the question like: do we actually need more more content or have things changed enough that, like what we said in 2019 is like wrong or not complete,.

C

A

Whatever, or is it that, like, we haven't done a good enough job at.

F

I mean the comments in the GitHub issue or I mean. The point is that maybe we can update the document, adding some attack that we have seen in the last two years: uh multi-factor authentication, fatigue, attack or conditional stuff from pie, pies another interesting scenario and similar, and uh the other point is that about it. Is this document good or not, I mean it. It has if the document help other people and projected.

F

My answer is that the document is very good, so uh I continue to use it to press I mean I, continue to present this document to people that have an open source project, usually especially, if they ask me hey what what are the risks and how we can mitigate I say.

F

Okay, if you need something read this document, it is uh at least the first step that you can do to improve the security in your project, uh but my question is I mean according to numbers, we have seen that in the last two years that okay, the last year, were very particular but um they're attacking the open source project in the concept of supply chain. We I mean we can Define. What is supply chain, but uh definitely increases, so uh it's not.

F

It doesn't depend by our how we spread awareness, but for sure, if we spread more awareness about how to ensure that your open source project is safer, we can help. This document is very, very good. It is the first document that I share when I need to share something about uh open, open source security, uh um but yeah. uh Maybe we are not sharing it enough. Maybe we should present in a different way or super bright Blockbuster or something so.

A

With that, do you think it would make sense to put I, don't know two or three months worth of effort into updating the dock with the newer threats tweaking things.

C

A

Know and then doing like a yeah whatever like a V, V2 or v11 launch in I, don't know April.

C

A

Yeah and that way that way, we can point folks to the because it could be probably a little bit awkward to be like hey. Look at this thing that we published in 2019.

F

No, no I, we can do a refresher and add the more data that maybe we have collected I mean that other company collectedly. We can update the data that we have arrived, the in the document and we can add the more data. If we have, we can see what changed in the last two years, uh for example, yeah the scenario: the scenarios that we described in the document are still valid, but maybe some scenario are more validant holders or just more common than others, and this kind of reviews become something that we can start.

F

A

Yeah cool, so um yeah I mean it sounds like um do other folks find this interesting and would like to what would like to kind of join in and participate on. This.

B

Yeah I'll be more happy to see.

A

Perfect, um what might make sense is to just spin this off as a separate um B Team meet a couple times. um Have you know it's it's just marked down. What I would suggest is like as much as I like the pdf version, formatting better than markdown markdown is just easier to it's should just just use the markdown um and then uh I'll just uh I'll create a copy of it in a new directory.

A

Call it the 1.2 or V2, and then just PR into that as as as changes happen, um but that's probably the the easiest way to go about this um yeah and then that and that that'll be good, because it'll give us something to announce in you know whatever April.

D

But okay I've lost the bubble here, but a v 1.2 of the.

A

Identifying security, oh sorry, threats, risks and mitigations in the open source ecosystem.

D

Okay um of you know.

A

So sorry, this is this: is the dock.

D

Okay, um yeah, as far as formatting stuff out, let me I'm going down here. um You know. Markdown is really you. You can always insert arbitrary HTML GitHub doesn't like certain HTML, but you can still insert it and create a nice pretty PDF out of it. Yeah.

A

Yeah I mean we yeah. We can definitely like get booked or whatever and make it make it prettier, um okay, cool, um so Luigi did you want to lead this work or just participate.

F

I mean if we work, if we can do this work using slack in our Channel I, can try also to lead. That's not should be so difficult and.

A

You do it there or do you want me to create another Channel specifically.

F

No, no, no, we have our own.

C

F

Of the project, so uh definitely it is the the source of trust that they need.

H

And so probably.

F

I start from from the issue that we have and I read, the document and I try to I mean ask two people to contribute and.

A

Perfect so we'll do it asynchronously, um but feel free to jump in I'll post a link to the place where PR should come in, because I think we want to keep. You know, keep the historical version and then have a you know, a new version that that we, that we added foreign cool anything else.

A

Awesome. Thank you all very much. It's great great conversation um see everybody again in two weeks and um enjoy.

F

The rest of two weeks or the ten sorry, each week's on 10th February I have written the document, the 10th February, but maybe it's another event.

B

F

A few thematics sorry yeah.

D

The February 10 is for the metrics dashboard, sorry, cool.

A

Thanks everybody.

B

D

Good to see everyone.

C