OpenSSF Identifying Security Threats WG, 4 Aug 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: OpenSSF Identifying Security Threats WG (August 4, 2021)

Description

Weekly meeting of the Identifying Security Threats working group. Our GitHub page is located at https://github.com/ossf/wg-identifying-security-threats and from there you can find meeting minutes and other information.

A

Hello, david, hello, how are you your your definition of running a little late and mine are very different.

B

Well, you know what I it looked like: it was going to go much longer and they said uh time's up we're good we're done so nice um yeah, so yeah it was a different foundation. It's the it's the what it's the movie industry foot, one uh aswf! So they you know the uh the guy who's leading it is uh who's. uh Doing a lot of the who who's covering a lot of the panel was uh from industrial light and magic star wars, stuff behind him that exactly exactly!

B

Oh god, you know uh uh my cool meter is just nowhere near yours.

B

I I I got a cool goose.

A

Nice, that is, nice, um awesome, okay, so uh yeah we're just gonna get started, so they were just commenting. A lot of folks are probably on vacation. So next this this, the next time, we'll probably be super light, um so really just wanted to kind of go through um kind of major projects.

A

um Talk a little bit about hiring. I have a new project idea. I just wanted to kind of throw out there to see what see what sticks and then, obviously, if you guys have any other um anything you'd like to talk about edit in the chat this can be. We have an hour for discussion, so we can um do whatever we want um so. First off um for security reviews, uh amir any um news or anything of interest. To note.

C

On that one, um nothing new, nothing new and exciting. um Just a lot of the cleanup has been done, which is nice and uh yeah. I haven't done too much updating in the last two weeks: okay cool, let's just say, however, I'm actually real, quick, I'm looking at year, one there's one pull request um from february.

A

Oh, the one with all the the things in it.

C

Yeah, like with nougat and npm and stuff like that.

A

C

A

Take I'll take action on that today. I'm thinking of just actually just closing that um the projects, the impacted projects were deleted from npm like.

B

A

Delete like shift delete um so there's actually while interesting. It's not, it will never be actionable. I.

D

A

So I'm thinking.

A

Yeah this was the um the dependency confusion, backdoors that that um that went in.

C

Yeah and then uh regarding the security md, I know we discussed it a little bit in the last session. um I was wondering if you all wanted to discuss a little bit further today.

A

Let's do it yeah um welcome matt, so.

C

All right, nice timing, yeah.

A

Let me bring up the.

A

I think it's here.

A

Yeah, so that was kind of the.

A

Take on it um yeah did you have to let you want to start with.

C

Or or just um well, I thought some of those resources that you uploaded were pretty good. I thought that um that that initiative that trey waters won was definitely a good start because it had you know a lot of the kind of those basic building blocks. You know so that we're not recreating the wheel here um and we can build on something you know to if we wanted to include you know more meta, more yammer, more metadata uh opportunities, but I thought at least as a starting point.

C

I thought it was pretty solid and then, when just thinking about a little bit about how we would, I guess, announce this or advocate for it. um One thought that came to mind was just basically doing a blog post saying you know this is an opinion almost like an opinion piece saying that you know security.md is a good practice. This is what we think should happen. This is some resources we put together in our working group and you know just put it out there. I don't I'm that's just a thought.

C

I'd obviously love to hear everybody else's thoughts and ideas. um Those are just some initial ones um that, from our last discussion.

A

To more like a request for com like not not a formal rfc, but just a hey, what do you guys think like out out to the world or hear our opinions.

C

Well, yeah, it's just a tough line to walk, because um you know I guess we have there's so many different opinions here and whatnot so and things for things to be, I guess formally endorsed. There is quite a long process to it. So I almost wonder if an opinion piece would be better. Just saying you know hey based on some discussions that we've been having and looking at. What's out there.

C

You know we think having a security, md file and all of all the oss repos on github is a good practice. It should contain this. This is a template that we put together um something along those lines. I think if we want to build it out further, maybe into something more formal like this structured security md. um That would obviously involve um probably a little bit more of a coordinated effort um before we really put something out there as an opinion piece. So again, these are all just kind of thoughts that I'm spitballing out there.

B

I guess the question here is what is really needed uh in my mind that the most important thing is: how do I contact if I find a vulnerability? You know in.

D

B

Or email list, or something um that's the most important second most important, maybe is some sort of um you know it's a very different kind of use is the. Why do I think this is secure? You know security information, you know what what you know, what I I would call it an insurance case, but basically it's the. Why do I think it's secure uh sure it's well what's called an assurance case and supposed to yeah there you go. Why do I think it's secure?

B

uh The typical name, for that is a formal name, is an insurance case by the way. So I would put the word insurance case in there yeah insurance case.

C

Okay, yeah, absolutely and.

B

After that, I I I don't want to do a lot of structuring of data if nobody needs the data.

E

How much else do you need? We need the data david.

B

You need all the data.

E

We need we know, we need a. We need, a road map for where we, where people go centrally to disambiguate other other security, related information. So, okay, what is that other information? What I posted? If you want to read my response? That's the start of it. Okay,.

F

Okay, reference back in the mailing list.

E

But I can go through it, I mean it's all. The things are trying to address the executive order. So most most most people uh in cloud native space and again we're supposed to be focused on on on open and cloud is our future. You know no doubt about that. um There's lots of automation already present um and but you know you hit the nail on the head: it's about first access to existing information, so we need a road map.

E

Where do I go definitively to point me to the other artifacts and the other information that may already exist and not cause duplication?

E

So to me it's saying: here's that information we'd like to know from an auditing standpoint from an executive order, security, compliance standpoint um and if, if there's information about both manual or automated processes, include that as well.

E

So I know other work groups here in the open ssf, especially the sig star project and salsa, are working very hard at automation, with cosine to produce all types of application, whether it be jars or any type of package manager and they've integrated that in chex project in tecton, at the cncf, and also the update framework at the cncf.

E

So clearly there's a broad picture that we need to enable and connect with being developed in our sister groups and sibling groups in the open ssf. We should do that. If there are information we can provide definitively, that can be used by that automation to do lookups, to do content information to open up issues, to send notifications to people. You've got to bat you sas scanning gas scanning, whatever notify these people contact, these people produce reports.

E

Here's where I store my evidence all those things there needs to be a road map, a centralized place to do it and it needs structure, so it can be parsed and used in automation, period.

B

My concern is how many people will do that if it's hard, they won't do it.

E

But it's you, can you can create different profiles? You say here's the minimum table stakes but at least have a vision for how it could be used and submit that vision to people and let them decide. You know that's what that's what you do and we should, and if other projects are you know, could use this information. Let's add that and and show how it connects together, connective tissue.

A

Would it would it be helpful to dive deep on this? I mean we can do this right now and come out with like come up with a with a made-up spec yeah. It doesn't matter what what it is and then iterate on it, because I I agree with everybody um but like I. I think it would just be useful to like make it up as we go and and and and for you know, for the next 45 minutes.

E

I mean that's the cloud native way, you know, put, you know, put put the kitchen sink in there, put it out there and for review and comment as an issue in github and that's cloud native. I mean that's it. It's iterative, you know open an issue, you know, create and create your mvp create your mvp and let it you know.

B

All right so, let's see here, um I need to open the. Can you sh. uh Let's see.

C

B

To open up the uh the working group um notes page here.

A

There's there's a link to to the issue, uh but for for collaboration.

B

I've already got the sake.

A

Let's doing the meeting notes might is probably probably more effective, so so.

B

I found that trying to get initial stuff done with the with in google docs, because you can all edit the same time and then once it's a little further along switch it over.

B

Okay, there we go meeting notes yeah.

C

All right um link to the security policy. If, if there is one.

B

Yeah, do we want to be concrete and say if it's a security.md file, that's a markdown file, uh give me the names of the headers and the subheaders and then describe what would go in there. I I'd say.

A

Let's wait on the actual like implementation of this, and let's just go with what do we need and we can? um Okay, all.

B

A

B

Okay: um okay, vulnerability, reporting um how to report a vulnerability, uh email address, okay, address, yeah.

C

And maybe for for critical flaws or sensitive information, I like the idea of like an encryption key for the email address, the pgp key.

B

E

Yeah, I think security practice is broad, we'll probably end up breaking it down into sub topics. I mean there's the um both like the you know. If you look at the cicd processes, you have processes for um contributions, how that works, how those are secure?

E

um Do you require signings with that, so the processes might have multiple, multiple links, I'll just point that out: okay.

C

C

And then would it make sense to just if we're thinking of kind of automation as well, just a simple check, you know: do you have a secure, dmd file? Yes, no something like that.

E

I yeah, I think it's good to you, know, say you know, I think in my mind, they're they're, you know we're going to be providing references to two either pros human, readable things or things that reflect artifacts. That can be used in automation, they're those two kinds, but that will work itself out as we.

E

You know, iterate and dig deeper.

E

And there's also like release. What's my release process, how is my release process secure? um There are and there you know what signing keys are signing keys and the methodology for signing release, artifacts.

E

But the you know, the big thing is: is bills and materials. Where, where can I find my build materials? You know.

E

And you know how do we disambiguate format? You know, I know that spdx has implied format by extension, but sometimes that's not clear in other formats or other cases. So.

B

Yeah one trouble here is that if there's gonna be multiple bills of material, you know you need to identify for that particular one.

E

There are a lot of interesting conversations we had about bills and materials, especially with new versions coming out, but yeah, because a lot of the information can be you know. A lot of the a lot of further on information is actually or can be duplicated in those things.

E

So you know there might be a case where people probably the bombs and these reference their bombs or some um if they use xmls like that, they can use an enter document, link some type to point to the section in the xml document of the bomb and say: here's where you contact me. You know those type of things right, so choosing how you link is important right.

C

And then calling to david's point of the security assurance, um would it make sense to also potentially integrate the um security score cards into something like this into your security.md file?.

B

The only trouble there is that you know it's externally run and you.

D

B

It back I mean at some point: do you just run it and get that instead of trying to bring it in here.

C

Right or maybe just an api to your security score card.

B

Yeah url pointing uh security scorecard result.

A

uh Alternatively, I so I think there was chat last time with time before about being able to kind of override the security. So security scorecard says you're not using sas, but you are so you you make mention of that in this file and therefore the security scorecard picks that up and says uh I don't know how it would know to trust it. But let's just assume a truck, because I guess you could yeah uh and it overrides and says.

A

Yes, you do um so it's kind of like making sure that we can uh provide all the data that security scorecard needs um so that it has to do less guesswork.

B

You know I, I actually think that's its own. That's almost a broader issue. Here, it's almost the current security practices. um I think, if that's return, you know, could provide override data for securities, scorecards, etc. Right.

A

I don't think we should tightly couple this to scorecard, um but but rather okay. So so, if you look at scorecard- and it says, okay, does the project require code reviews before code gets merged?

A

I, the the question I would ask is is: is the fidelity of that check, not nearly a hundred percent, um and I think you could probably just tell just by looking at actual prs to see.

E

If it's better, I'm glad you're showing this because to me this is kind of like uh you know. If the scorecard is our way to assess- and these are the criteria- and instead of you know this to me, the roadmap is to disambiguate, as I said earlier, so anything in here that could not be inferred by the tooling or guessed at by the tooling, I believe, should be in a security md or like file to help the tool to disambiguate. So the granulator you have here is is fabulous. You know, yeah.

E

I think that you know again, you could have profiles to say here's the minimum set of data. We expect you know here's your con vulnerability.

E

You know reporting information minimum, but you know if you want to really work with us and you want your score cards to go up and disambiguate and you'll help our tool out and here's here's the schema. You know here's the links and stuff.

A

um Have you seen the salsa framework? Absolutely okay, so I mean it. It also well this this guy. Here um I mean I mean these are all kind of dancing around the same like like thing so like. I wonder if, like.

E

Yeah, I mean you know: no, no, I'm I'm following you yeah, I'm. I believe I'm with you, I mean the this is these are the guiding things that you know that will need to be needed. What are the processes what's our provenance?

E

How do we prove that yeah, my so here's my belief system, my belief system is, um you know this artifact we're creating is great, because we can we can dictate what goes in it and and um we don't have to mandate it or require it necessarily, but it can be used for our for our. You know for all of the necessary work groups you know to to, like I said, the connective tissue, but over time I believe a lot of information might be duplicative in the bill of materials.

E

So it's interesting. I think the build materials is evolving. If you look at cyclone dx, I think, and if you look at what you get from private scans from a lot of companies like twisted black white source, they have a lot of information in there. They just keep it private. um So I'm just trying to make put this in the public arena and give them a public place to put the same information now. If we can put it in the problem, is the s-bam formats are, are not lossless.

E

We convert between them, so spdx doesn't have a lot of ways to express a lot of this. A lot of this date at all or cyclone ds. May um so you know, you know it's great, that we're creating this stop gap, but so, and so it avoids so if it exists in a bomb reference it if it doesn't put it in our artifact absolutely, and I think- and I always think back to my apache project, so apache has processes. So I can.

E

I can point to the apache process, where applicable and my overriding processes that build on top of that in my project at project level, and then, if I, if I'm asked to do even further to go into my build processes and things like sauces asking for, I can further describe those things. You know it's a tiered system.

B

Or or maybe you if this is the source data, then you can use it to help generate the s-bomb format.

E

Yeah I mean there's been quite there's, been a ask that I reproduced a bit of s-bombs. There's, there's two views: there's the views of the s-bomb, so there's the my my bomb perhaps for automation for and then there might be the public version of it. I know microsoft. uh At the tac last week, uh k presented um some things with these the I forget the name of the secure coalition, where there's a blockchain based methodology, and she was talking about policies, so there's actually policies about.

E

um What's expected uh for the build and the bomb, and things like that, so you know, I think that, like I said being informed by the salsa work being formed by the sig store work and making sure that we consider those, you know the criteria for those things, absolutely um the keys that are used in sig store um how I produce those keys. What which do I use oidc? I used to use my pr, my own private system to generate ephemeral keys.

E

You know those, you know anything, you know we can add you might it might be overwhelming david. I completely understand that, but at least, if you have information- and I will over time more more people will have information. I just want to know where to hang it where to put it. You know.

A

I mean, I think so as a way to um and not not to tangent us too much. um You know if you had a web page that you as a project owner could go to and use like. You know, cr create my security dot, whatever file and it goes and it does the scan and then it it comes in and it templatizes your templated thing with whatever it can fill in filled in and then you fill in what's missing, um like I'm trying to think about how to make this easy for projects to adapt.

B

Right, that's my work and to be fair. Please understand where I'm coming from I've been repeatedly burned by by folks trying to boil the ocean and what was needed was a couple of fields so um having flexibility is good, but focusing on on having a here's, how to get started. That's useful. um I think.

E

Is key, I think that's why you break down by profiles? Here's the basic profile 101, but I think we can produce profiles that you know incrementally add features like scorecard uh requirements likes things that are in this group, things that are supplied by this group that we have answers for you know.

C

E

I mean if I could have a uh 10 minutes to disambiguate a slide. I just presented internally in ibm about an hour or so ago.

E

You know, basically, it shows an end-to-end security and compliance and continuous compliance process for all of ibm service builds, and I would probably go through every output of every task from being complete, uh end-to-end supply chain process and one and one away to to figure out where I'm required by government, eventually to to prove that to my customers to exploit find that data where to find the evidence to find the artifacts and all those things centrally, I'm hoping to put that on an s bomb.

E

But if I can't I'd like to put it in in another file for people to find you know, do you.

A

Also think that that perhaps doing this sooner so, the the um time frames involved in getting formal, specs, uh you know talked about thought about written down or proven is really long.

A

Would it does it make sense, as a kind of experiment to put this out there in the next whatever month um and then kind of use that to have the more productive conversations with spdx.

E

I mean, I think my advice would be to follow the kubernetes cncf paradigm is like you, create a spec quote-unquote for a custom resource and you market alpha. You know you might.

D

E

Yeah create some create some tools around it, but it's marked out by alpha apis alpha, tooling, whatever, and then that that gets people using it, and that invites comment right, yeah, absolutely.

A

A

How does how does this.

A

Without drilling into any specific one, here is the direction that we have with these kind of bullets here under fields.

A

Are you guys does it seem like we're facing at least in the right direction,.

B

Yeah, absolutely yeah, there's no doubt it's it's possible. My my concern has always been the uh the the challenge of making it easy enough to use um you might make. I I think, with a little thinking, you could probably reorganize this to be simpler. At least.

E

B

That would help you know, uh make this uh a lot more palatable if you can take it so that now see um uh if you can make this so that it is easy to extract for the other tools that extract security data and I'm thinking about security, scorecard uh cia best practices, badge and salsa.

B

Now you have a better argument for. Why do I? Why would I bother to do that and s-bombs?

B

D

B

Maybe below this the you know, you know what the argument here is not just creating data sets it's who is going to be used? Who will use this and how? Who would use this and how? Okay, I think.

E

Right, I think that that's that's compatible with the profile concept, so right.

B

We've got to be specific who's going to use it. First of all, the security uh analysis, uh uh measurement, evalu evaluation systems, and here I'm thinking about uh ci, best practices, uh badge security, scorecard, uh salsa, etc, provide data they can directly consume.

B

Right because, probably there's not going to be one measurement system for everybody there isn't now, uh but if everybody can bring okay security, researchers for reporting vulnerabilities right, absolutely, who else is gonna need? Frankly, I would put them first.

E

Well, I mean, I think, I think it's broken down into larger classifications as producers and consumers. I know as a producer of software.

E

There are things I want to produce, so I think that in my mind, things that I need to- and I feel I need to produce in response to the executive order and my customers should be considered as in the basic profile and a lot of it will be handwritten manual.

E

You know, artifacts that I link to so yeah where's, my s-bomb where's, my security promises where you know all those type of things right so it's produces is produced. Producers and consumers.

C

Yeah and then just to build off that you could argue that any consumer of a package would want to know some basic security information about said package. So this would be a good kind of central place for that.

E

Yeah yeah cause, I mean I'll, go back like I'm very proud of our projects that we've thought of these things, and I want to exhibit them in this document to my customers. So when they compare my product to competing products, even in open source, they know I've thought of these things and I have a place to to show them. I've had that a thorough thought process and actionable readable human readable things that can be that can be viewed.

A

Like that, like.

B

I would say, I would say, there's no evidence, but we see new evidence. They do.

A

Well as being different from they state within their security dot, whatever that they do not.

B

Yeah, that's a much stronger statement. I suspect they won't. You won't get that or yeah yeah.

A

That you could fail that operation based off of what's in this file easier than you could. Well, I guess it's similar higher fidelity than running scorecard locally. I guess.

B

C

It would be cool if there we could do some kind of automated um versioning as well. Just like you know, last updated on x date. Just so, people have an idea of how I guess active people are on on on keeping it updated.

A

On keeping the file that we're creating update or the project itself,.

C

I would say: keeping the file updated, yeah yeah.

E

Yep, well maybe that's. I think that that is a good candidate for putting back a scorecard. If we have this file scorecard, could rate rate the file itself.

F

B

I've added it to the bottom.

F

E

Yeah, but you know thinking about ages, maybe no indication of accuracy or security. That's the problem, so maybe maybe maybe completeness of the file. I mean and do some checks to make sure, there's no broken links and stuff like that, but yeah yeah.

B

Yeah and and there's the sandy, I would call it sandy d check. um You know sandy check, slash, lie detector.

A

uh Somewhere up above cpe is there? Is there an alternative to cpe that has any usage.

B

Package, urls, okay,.

A

B

So I I would call this just uh you know a way to identify yeah package identifiers.

E

Yeah I mean I, wouldn't I mean again, I I would avoid. I think these are things are highly considered in bills of materials, and I think that if we can leverage bill's materials for those things, all the better, I think cp is actually deprecated um yeah well,.

B

Okay, nist has deprecated them for six or seven years, they're going to replace it with swins, which don't work, they've been.

E

Saying that they're.

B

Going to replace it with switch for.

E

A year I'm recommending my recommendation is using package urls every place to be honest, but yeah.

D

E

Are not recognized by sbdx necessarily so.

B

uh Yeah they are cps and package urls. Both work.

E

There was a debate yesterday in the technical working group where they're well anyways. I won't go there, but yeah they their belief system. There was a debate about creating external uh links, but all their for for um relationships and they there's there's a staunch group of legacy people there saying that they they're all xml namespace based internal links to the document where we wanted to use full external external references with full uris and things like package urls. But there seem to be a lot. You know.

E

I worry about the movement of spdx being able to adapt to the modern cloud native situation, but yeah.

B

E

Too many xml too many xml wonks there so.

B

Which is funny because xml expression is not a requirement for spdx that doesn't make any sense.

E

Well, even kate stewart returns and said we should be working on tv tag, value format because it's most highly used- and somebody made the point well, it won't be tomorrow so but she's like, but there seems to be a belief system that you know super simple tech value. Does it all? But you know I don't know it doesn't provide a lot of the facilities. It doesn't provide a signing mechanism, that's built in like the xml or json it doesn't provide.

E

You know any schema whatsoever. This is tag values so.

A

Cool um okay, so this one we definitely need some next steps.

E

I I think, focusing on like what of these things can be grouped and what types of profiles we have, what would go in a minimum profile? You know the base or basic profile. Does um I think, I'm seeing that.

B

I was a little skeptical about I'm, throwing the chat, I'm going to link the current spec, which is spdx22, does include pearls. So thank you all right, so I mean I don't I don't know what they're debating on spdx 2.2 includes package url pearl.

B

So I mean that's, that's a that's a that. I don't know what they're discussing that's. That was that's all that's done at least 2.2, and I think that was even before, but I know that that's there now all right anyway,.

F

uh Okay, so going.

C

Along with iterating on the fields, above, I'm not exactly sure how to put this, but essentially making sure that there's one source of all the information, so people won't see something in one place, see it in another and then another and another where it kind of loses some of its value. I guess so where, where like, if something is in the security.md file, and it could easily be found in the s-bomb, for example, you know just making sure kind of everything has one source in a way where things aren't.

B

The single source of truth.

C

Yes, yeah. I like.

E

That yeah, like I said I view this as a road map that there's this be a lot of collection of links.

C

um And I also love the idea of just maybe uh building a template of some kind eventually or something that people can build off of or.

B

Yeah- and I I think, there's a legitimate question: is this a generated file or is this where you get the data from?

B

um We may not need to make that decision in general, but a project better make that decision.

E

I know that if it's, if we have manual artifacts that go in it- and I I only know I I mean it goes like, if scorecat can't do it, you know clearly it's a manual process in my mind.

A

Yeah, I was thinking perhaps uh the first cut of this file gets created automatically somehow, but then, if, if it's good as is, then we don't need to generate it at all, we could just rerun that function. That creates the tool whenever you need the data.

A

um I think the the value of this is that it provides something that only humans know um or the tools are unable to discern right.

E

A

Yeah, um I think I think that that single source of truth, I think, is a good uh good thing. Aspirationally.

A

I don't know how hard we can stick to that without like okay, so I uh you, you have a reference to coverity in your travis ci file,.

A

Is my is the sas section of this file saying.

A

C, you know travis dot, yml.

E

um The implementations are wide and varied and they're gonna change over time. So yeah.

B

But but I think the answer is yes, I mean I, I can tell you that from um so. So let me pull up the ci best practices badge, because uh I I lead it. um So, let's imagine for a moment that this file might be yanked in by various tools like the ci best practices badge. What the ci best practices badge expects is.

B

What is the value of this question and what's the justification, and I would expect that for a lot of these, you know a brief text justification with links to where do I see the evidence so so, for example, in the case of coverity yeah uh point off to the travis or the github uh config that invokes coverity when you do a commit update and that's my.

D

B

That, in fact, oh yeah and and by the way, if you follow that uh and maybe another link that points you to oh and here's, the current version of that output.

E

Yeah, I was doing a quick check against that paradigm. You know basically it's kind of like there's a security practice and I have a reference to that practice, either in automation or in pros or both, and then I have evidence for it. So it's always appearing it's always appearing. You know, process.

E

You know, governance evidence, you know, so each each field might have to have links to those things right.

B

Yeah evidence and I would also say you know, evidence and justification. I guess maybe it's you know for for all things. You know you're. Basically, so I'm adding just you know the actual, the the expectable. I guess it's the field field name. The uh value claimed uh justification text.

E

B

And evidence uh urls.

E

Yeah, this is the corollary. It was referencing earlier when I had I've completely depicted our internal ibm, cicd process um for federal clouds, and I said I wanted the ability to for the customers to have a link to every output from every point in our cicd process. Every artifact, every piece of evidence, so total agreements.

D

Cool I like it.

B

I'll just know it ahead of time. There's always if you have, if you have text, then you have the glories of natural language.

B

Like unnatural language, well, if I don't.

A

E

B

Say natural language they'll think I'm talking about c versus rust.

E

Versus you can obviously I mean they're, you know for pros. Basically, I think just a simple consideration of demarking. Whatever the prose language is right, yeah right.

B

E

Then allow third-party processors to do natural language, translation right.

B

English, french, whatever.

A

Actually, I'm going to add a link to it to a threat model in the above, too, a few projects do throughout modeling, but if they do it'd be good to know.

E

Bam, I didn't think about it either.

A

Contributed value, um okay, so for so so we're gonna meet again in two weeks. Do we want to try to have a a couple examples, or you know I don't want to go, go too far down the rabbit hole without you know iterating, but um it might make sense like it.

A

uh Questions might more naturally appear when you see a you know, whatever pick it like yammel a yamo version of this for a tool uh for for a project um yeah. Would anybody like like to volunteer to come back in two weeks with um something concrete.

B

I mean I I I could do a short something I I think my model, I'm you know my mental model may be different than yours, where and some others, whereas um we've been calling it security md, but I think this is something different. Now, um it's not really. You know it's not necessarily a document. If it's a true database schema, it's basically a telling me the information security information about this project in a way that um other tools can hopefully snag it instead of trying to um guesstimate it is that a fairer statement.

A

Yes, I think so I mean.

B

A

File but it's it's yeah, it's a structured thing.

B

It's probably going to be a file because you're probably going to check it in.

E

Yeah, you know, first of all, I'm all for yaml or json, because it is, you know, easily partial through simple mechanisms. It seems to be a paradigm. That's been adopted for configuration for sig store in many places, so it's very compatible.

E

I would propose that we have an interim working group meeting for those interested and actually start hashing out, like a yamo based minimum profile, piece of content.

A

That sounds good. I can. I can commit to uh okay.

B

I will commit to that also so make.

E

B

That schedule, when do you want to meet again, I'm I'm good with more meetings. If we actually get things done.

B

Let's see here I'll I'll continue to beat my drum on simple as possible.

E

I mean next week at this time day time you know so.

B

uh Let's see here, there's a track. What's um I have a conflict that hour, but if we can start one hour late, basically, this start um the time 10 minutes from now, whatever time zone it is, would work if we can slip it one hour later next wednesday. I could do it. I could do it. I I can't do 11.

A

Next does any day of the week work better for you guys.

B

When's that wednesday seems to uh tuesday or tuesday the same time that we've been meeting will be fine.

A

Tuesday's good for me.

F

E

At what time we're talking about tuesday, um this same slot.

B

Same slot, so 1 p.m; eastern, which is uh what 10 a.m.

E

10, pacific yeah, 10.

B

E

That works I got. I've got a blocker. I didn't plan to attend.

A

Beautiful, I will send out a meeting, invite um I'll do it to everybody on the call today, if you're not interested, feel free to not not attend but okay. That way that that's easy and it'll be for tuesday, the 10th at 10 8 at 10 a.m. Pacific, awesome, cool, okay, awesome, um okay, moving on a little bit um uh so metric dashboard, I don't have any updates. I did see a couple. uh I saw a pr from you dylan.

A

um I think that came in a while ago, but I'll I'll take a look at that right. After this meeting.

D

Yeah, it's just a simple like minimum kind of uh which we call tutorial. I didn't really know what was like what we were looking for. So I just kind of made a basic breakdown like markdown kind of tutorial situation and then made some progress on the on the watchers thing. I submitted that to the uh criticality score project and they're going to integrate it there, so I'm just working with them as well.

A

Nice job awesome um on hiring, uh so it's so it sounds like we are kind of uh approved, except for, like the final, like actual pen to paper approval signature thing from the governing board. uh So as of as of right now, I'm gonna start. uh I reached out to two firms that kind of do this, and um neither of them were interested in the the overhead to start a new thing or like a half a resource.

A

um So I'm gonna keep plugging away at that and trying to find somebody interested um the the contract will be for between now and uh at at worst, the end of the calendar year. It may extend beyond, but I I don't know like how long I have to actually use these funds. So I need to get get some clarity on on what it would actually be. The purpose of this work would, though, to would be, to uh you know, extend improve re.

A

You know actually make the metric dashboard a real production thing, um move it over to a um open, ssf owned, uh azure subscription and do all of that stuff. So so this some of it is just clean up work um because we cut a lot of corners to to get it out um and other parts of it are real, real new stuff. um The other side is, you know we do have uh extra money in there for uh other things.

A

So if we want to hire a contractor to do really anything related to our working group, uh we should have money to to pay. um You know normal rates for um for that kind of work. So that's good. I do need to create a job description, though, for the metric dashboard. I have a um list of tasks, but I need to uplevel that a little bit so we can.

B

Find the right person- I I will say that my experience- and this may be different than yours has al- has always been one of the biggest challenges is finding the right people.

A

Without it, without them, without a doubt, yep, so, um okay cool. So the last thing that I just wanted to kind of touch on quick was an idea that um I've been mulling around, and this is not baked like many of my ideas, um but I just wanted to throw this out there to see what sticks and just get thoughts. So um internally we run lots of tools on lots of open source, generating lots of bugs.

A

Like most teams, we uh have limited resources and what we can do with the output of that the tools themselves tend to be high, false positive. We don't have the context, uh and so it's just it's a painful triage um experience.

A

So what I was thinking was particularly for security researchers, uh but perhaps there are other other groups as well. What if we basically took all the tools, we kind of collectively have run it on all of the open source we can find, and we can do this stuff at scale to to infinity, um get the output of those tools someplace that the security researchers can dive into and do things like, you know, correlations of the same issue between different types of projects and and like really like making it a power user experience for bug.

A

Triage um yeah, wait.

B

Wait are we talking like static analysis tools and fuzzers or when you say what do you mean? Yes,.

A

I mean static analysis fuzzers anything in that kind of general category. So so it's definitely security tools examining open source in uh you put it in a box, and you look at the box.

B

Yeah, okay, okay, um no, there are, there are sensitivities in the past.

B

I don't know that they're still true, uh so this may be only hysterical value, but at least historically, for example, coverity was always very careful to not post the results of security analyses of open source software, even though you can argue and correctly that anyone could get a tool and run the analysis against the open, the software- um and that is absolutely true, and so it's a little bit of um security through obscurity, but their pitch was always we're trying to make it easier for people to secure things.

B

We're not trying to make it easy for the bad guys. Hey look here.

B

So there's a, I think, there's a sensitivity about this that doesn't make it wrong. I think we just ought to think through. Is that the right thing to do? um I actually am sympathetic to the hey. You've had plenty of time, uh but if, if we're gonna do it, we probably ought to give people a warning.

E

I mean I I worry, I mean so I mean that I'm reflecting on a blog that was forwarded to me last thursday about pushback against the bomb about how the bomb could be used for evil. um But.

B

um And it's true, but that doesn't mean it's a bad thing.

E

So so I guess, I guess you know having attending the security tools work group um I worry about you know. I I think in my mind there has to be a critical mass of tools that can be applied to the general space that produce comparable results. So I think the exercise would be to show that at least three tools uh could be a could be applied to produce comparable results against at least two different types of applications.

E

That'd be my minimum um yeah proof proof point basically.

B

E

I'm sorry yeah, sorry david, I worry about what you said david in is that many of these tools are so specialized or work looks for specific things that they don't produce comparable data or a lot of the really cool scanning stuff like uh they keep it private. They want you to pay for it. So I worry about how much you know can be accessed in the open source public domain.

B

Right right that that that's true, too, um and even if you run the open source tools where that's not an issue, um there's that sensitivity of hey wayman, are you helping the bad guys? um I know we're short on time. um One thing that I had toyed with, I had done a little research years ago, but we we don't have time.

B

I can tell you some of the problems we had, but I had toured with the idea of trying to do um vulnerability, densities or at least uh report densities, where you just you count it up.

B

You divide by the lines of code, yeah, okay, there's all sorts of problems like it, but the theory is that if you, even if, uh if you've got a lot of vulnerability reports on a project, even if none of those vulnerability reports are actually correct, uh if there's a huge number of them that suggests a lack of care that suggests you're more likely to have problems in general than without revealing, hey right here is this line this you know.

A

With this kind of theory,.

B

A

Like, like a broken.

B

A

B

A

B

That's right, um I actually did an analysis years ago. I never got the report released. um uh We can talk about that later about the problems of that where I I think there was some indication that vulnerability densities had some value, um although they became uh if your project was very small, it started to become dubious.

B

Basically, if you take a divided by b and b is small.

B

That can be a problematic.

B

Yeah visible, you know the trade-off of shouldn't, make it visible and um uh well I mean, as matt mentioned the the whole problem of uh you know. Can you even make it visible.

A

Well, meaning are we ethically bound to not it.

B

May be legally bound, you know if you run, if you run the coverity tool, you have to have a license. Oh no, no right! Sure, yeah, yeah, you're, right.

A

And that license.

B

May say you can't post it publicly in.

A

Yeah I I would. I would strongly push back on any using any tools that that were at all iffy in terms of what we can.

B

Do with the results yeah? Absolutely we shouldn't. We shouldn't do that, but the problem is there's ethical as well as legal issues.

E

As well as just the.

B

What their implications.

E

I think I think that I mean I think, that what a lot of the barriers that I'm hoping to break down, you can tell my my passion and is that I, I think, there's been too much. I think there's been too much obscurity and too much money being made of the security space and not enough sharing of information and I'd love. I'm very pleased that this group, especially, is trying to break down those boundaries. It's one to say that.

B

You know I'll I'll disagree with you when I, when I disagree but uh amen to that.

A

Awesome, I will continue thinking about this one. Maybe we'll chat about more next time. Can.

C

I bring out a quick idea just before I forget absolutely just throwing it out there, because, when we're talking about you know having this this potential, this data to analyze at scale and stuff- I I I think of instead of making it public if we did some rudimentary analysis among the work group and then if we have some, you know money. For you know potential projects we could potentially hire like an actual security firm or somebody to analyze the data, um but they would obviously they wouldn't do it for free.

C

They would need to be incentivized, but that could potentially be an option too. What.

A

What about and last point if we could end up bug bounty patch bounty, uh triage bounty, you know so we we have. We have five million findings in this thing, um as a security researcher, you're invited to this platform, you get. You know, five bucks, an issue to triage it or or whatever, depending on how long it takes um and fifty dollars or five hundred dollars for uh for a patch and a grand if it gets accepted or something like that where, where we incentivize the crowd, sourcing and pay.

E

Reasonably michael, I mean if I came to mind, I debated verbalizing it, but you know. Is there something something higher order? We could do as an interim step.

B

I think I I think a bug bounty, here's the url, our policy about bug. Bounties done. We can always add more fields later, but uh try I I've already added. I got you complete.

E

B

E

To complete, my thought, though, is as a first order higher thing I would suggest. Maybe we look at analyzing projects for attack vectors and then recommending classes of tooling. That can be run. It's a higher order thing. I think you can look at attack vectors.

E

I think that's more doable achievable and then you can, if you can to go deeper with tooling, then so be it, but I think that different tooling will look at different attack, vectors.

A

In other words, like, oh, I see you're using a website. Therefore you should, uh I see you're implementing a website. Therefore, you should use this tool.

E

You you, your apis are not secure you're using certain database connectivity. You're using you know things you know whatever. What, however, is both about the design construction of your application and what tooling and what attack surfaces? You have basically attack surfaces.

E

A

As a um as a shameless plug, um but that that says you're using databases and blob storage, blah blah, it would be pretty trivial to add in and therefore you should check it with this or.

E

Yeah yeah yeah yeah.

A

Like that, but yeah cool awesome we're way over time. Thank you all very much. I will send out the invite for next tuesday at 10, pacific time and I'll see everybody again in two weeks at minimum.

C

Thanks michael great discussion today.

A

Awesome thanks all.

A