OpenSSF Identifying Security Threats WG, 24 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: OpenSSF Identifying Security Threats WG (May 24 2023)

Description

Meeting notes: https://docs.google.com/document/d/1AfI0S6VjBCO0ZkULCYZGHuzzW8TPqO3zYxRjzmKvUB4/edit

A

B

B

The uh LF family lawyer and he's paying for it. We.

A

We are recording this.

B

A

No I I, I I did ask.

B

Mike Dolan, if I could talk about it, he said it's.

C

B

Say that publicly so, okay cool.

B

So yeah I spent two days trying to track down a lawyer. I mean yeah and it's it's yeah. The LF has a an insurance plan for um uh legal support and um it's not not. It was not.

C

A

Oh, it's like a parking tickets and um well yeah, but it's supposed to have all leases and stuff like that and it's yeah.

B

Yeah I had the one of the Reps come back and say we don't cover Federal things and I sent them the blurb back of says and then I bolded, Federal and responded with that this morning. So um we'll see what they say to that.

B

um But at this point I'm good, but I am going to make their lives a little more difficult because they uh made my life difficult. There you go yeah I'm spiteful like that. Just a little bit.

B

B

Repository for the ossf wait what we have a document repository for the open ssf we didn't have one before so now. We have one.

A

Sorry GitHub repository a.

B

Dot GitHub repository for the Open Access.

A

Oh, oh, oh sorry,.

B

Cool, that's awesome. We didn't have one, that's a new one as of this morning, I think or yesterday, nice.

A

Okay, perfect, so we should consider things like security, MD and security, insights and security insights. Maybe not because I don't know it could cover an organization super awesome, but that's.

B

Good I have to drop off at a um half pass for our meeting with another lawyer. This is the plaintiff's lawyer I'm, trying to get them to extend the deadline by 20 days, foreign.

D

Lawyer for the policy for the outbound security policy.

B

Oh for the outbound one um I worked on Mike Dolan directly, who is a PM at Linux Foundation, but also a lawyer um he's very nice he's very uh I. Actually he's um he's not your average lawyer um he's fairly well informed about technology topics, and um uh you know he's an advocate for open source.

B

You know: I I negotiated my contract when I came into the Outlast and I had a contract I had my lawyer looking over this and he's like this is the first time that I ever had a lawyer argue that you're, that the IP that an employee generates needs to be open source during the time that they're.

C

Like he's like.

B

E

B

E

um This is not an argument you're unhappy to have no.

B

No, it's not it's just that my lawyer was like I'm surprised, I've, never had a lawyer. That's argued for your. You know all of the stuff you develop. While you work for this company should be open. It's like.

E

So you know I I, take that as a very positive thing. Oh.

B

Yeah Mike Nolan's good Mike, Dolan's good he's, like he's he's with it he's he's like he knows what a CNA is for the CV numbering Authority, like he's he's very he's very like in the know. So yes, I, like Mike Nolan um Louisa, was asking what the what the, what my experience was like going through trying to get the outbound disclosure policy signed off by LF legal.

E

Yeah I mean I I love, Mike, Dolan, I've loved him before I mean he's actually now my boss, but I liked him before so, but uh but.

A

um You won't hold that against.

E

Him I would hold that against him, uh really the the big challenge with Mike and and is that he is oh insanely busy I do my best to not Badger him when he's when I don't need his time, because he has precious little of it, but uh it's always a joy to chat with him. So uh yeah excuse me. So what are we? What are we up to here? I'm, we're.

A

Just getting started, it's we're getting started a little late, it's all good okay, um so it probably will just be us so well, I! Think Jonathan! You said you need to drop it. Half past I could certainly use time back so yeah we can. We can make this one on the short side. um I know Luigi. If you got any updates on uh on security, insights.

D

Start updates I mean about the security inside honestly. In the last week, I was a bit busy, I'm blocked uh and so um I haven't had time to dedicate enough time to review the uh jonatella uh pull requests, but I need just to match them more or less all and just Claus issue now I hope to do this week and I'm sorry for the delay, my fault and about the security policy.

D

um Well, technically, security policies, reading I, guess uh I'm quite sure that we don't want to go public with the security policy that don't have the Safe Harbor and for this reason I was asking about Linux Foundation lawyer. We need to have an approval by the legal team. The policy is ready. Honestly, I use the template by the disclosure.io. That is the same template used by at least one Unity State governative website.

D

So we need just to have an approval, a formal approved by the legal team, but yeah I. Don't think that we need to add so much the template we just we need just to agree um if we want to have this safe, fiber or not, but I think it is a requirement for us, uh and uh I have been to the message in the vulnerability disclosure Channel to try to move uh this. uh This topic um yeah, because now we need just to have a formal approval.

D

The policies was has been reviewed, I guess from a lot of people from for sure that this vulnerability disclosure group, but also from the tag group I shared it at least two times, and um so now it is. uh We need to wait for the Linux Foundation David if you have any contact that can help us to move on to go going public with this. Please.

E

Okay or we're talking about a safe harbor for um those are reporting vulnerabilities to say, open, ssf,.

D

E

Yeah and Jonathan and I have talked about this and then I decided to get uh pretty sick at the conference. I'm still uh recovering so I've I have not done anything on that Jonathan. Have you done anything along the Safe Harbor stuff? We talked once and then I disappeared off the face of the planet. So, okay, um we talked about Michael Mike, Dolan uh Mike, and you know by the way, as this as we said no, like Mike, um he had a lot of concerns about that.

E

um uh Safe Harbor um I have to be careful here because I think some of that was under a um uh uh you know: ECP well no uh illegal privilege here, but basically the the problem is that there are. There are attackers who exploit safe harbors who are not uh working with the best interests of anybody except evildoers. Frankly, um and and while the intent is clear, uh we unfortunately have had some pretty awful experiences.

D

And if we are the line that we can always take our decision according our own blah blah blah and say that hey, we can change the rule where we want and we.

E

Can decide? No? No, no! No, because if you say something and they do something depending on it, you can't just pull the rug out from under them. So you've got to say what you actually mean and really you don't want to say anything else. That's that you don't mean anyway, but I've forgotten. There's a weird legal term, I think it's a stoppel that may not be the right legal term, not a lawyer, uh but you know.

E

Basically, if you make a decision based on what someone else says, uh there are certain protections to you, because you trusted what someone else said and my apologies to me. If a lawyer ever sees this they'll go. ah What do you mean? It's obviously I'm.

A

Sorry, I don't remember, because where everything starts going down down the drain, yeah.

E

I I I I do not try to pretend to be a lawyer and there's good reasons for that. But but I do know that you can't just make a promise and then just nah, never mind um yeah right right, so I I think the problem is I. Think uh I think he I think it was Mike. It was a lawyer, I think it was Mike looked at and they said no, no, no, no! No! No! No! No. We've actually had some terrible experiences with people who exploit those kinds of statements.

E

um I think they would rather just not have a safe harbor statement period, because then that, then that's not a problem for that. For for us, if you want a uh a safe harbor, if you think it's critical and vital to have a safe harbor statement, then it's going to have to be my much more fine-tuned than what was their originally because their their suggestion was actually quite simple. Great, let's delete all that stuff go on so.

B

E

Not gonna they're they're, absolutely not going to sign off on the Safe Harbor statement originally stated. If it's critically important, then it needs to be written in such a way that uh those with malicious intent can't just write it through.

D

Okay, so this means that at the moment we don't have a security policy, but we want to have a security policy.

E

uh You you have us, you have a draft security policy. If you don't have a safe, harbor statement, you can post it today. No.

D

No yeah, but at the moment open ssf has now a security policy for all the projects we want to have at least the genetics.

E

As long as you don't have a safe harbor statement,.

E

I thought the talk didn't approve. It.

B

No, no, the attack approved of mine, they did not approve the other one.

E

Oh okay, that's right! I'm, sorry, you're, right, you're, right, you're! Talking about the other direction!.

B

Evil is Ava was pretty staunch when we chatted with about this that you know they wanted to see uh Safe Harbor policy put into that. Okay.

E

That's fine all right, so we have a disagreement here. The the LF legal fake folks say basically we're not going to sign off on the Safe Harbor statement. You originally stated as far as legal is concerned. If you don't have a safe, harbor statement, you're fine, the attack has to approve if attack members of the tax, say, You Gotta Have, a safe, harbor statement. Then what needs to be created that both sides can agree on I, I, I'm.

B

Sorry, I will jump in front of that that training.

E

Too, like oh excellent,.

B

I think I think it needs a safer policy statement. Yeah.

D

E

Sorry yeah I was gonna, say I'm, not sure it needs one, but I certainly see the value of it. uh The the problem here is that one needs to be crafted uh because as soon as the lawyers started looking they went. Oh, we.

B

E

We have, we have seen reasons you do not want to.

B

Accept, that's, that's a matter of Education I. Think.

E

No, no, no, no, they I cannot go into it here, but they have specific experiences that make them say no.

B

Heck no way I mean have they. We've not had a safe harbor policy. No.

E

Open ssf hasn't LF has had experiences not within openssf, so.

B

The open SF had an open and had a safe harbor policy. No.

E

No, no, no, no LF has received claims from people.

B

E

To be security, researchers has nothing to do with open ssf, because.

B

We've developed.

E

Lots of software.

B

That's not right, but but sorry the LF has never had a safe harbor policy.

E

No, but if they had, they would have been strung up to dry.

E

Because they they have had experience I can't go frankly, you need to go to talk to the.

B

Legal I mean sure again, I yeah I'm I'm more than happy to have this. This conversation slash debate with Mike Dolan directly, because it's like I think that I think that there's context that needs to be shared here from the security researcher's point of view that uh yeah.

E

So yeah I I I, don't think that I don't think the objection is. Oh, we can't have a safe harbor policy. I think the objection was as written to Lucy goosey. We there's been some some pretty bad experiences from people who claim to be security, researchers, but their goal is, is to harm others not to be helpful, so I mean.

B

Yeah, okay, so.

E

I think that I think it's a matter of crafting text no.

B

No I think well yeah, but I I I, don't know what specific pitfalls they are concerned about without having the conversation right. Are they concerned about like if they're, if their risk adverseness is around pii right or it's around customer like if it's something specific like.

A

B

A

This entire I'm, sorry, this entire conversation should really be held with LF legal in a non-public yeah.

E

Right exactly yeah, let's yeah how's this so so let me shift this a little bit and really this is outside this working group thing anyway. This is a vulnerability disclosures working group thing, so here's what I would say: uh Jonathan I, you know you, you have both the background background and passion once you talk with Mike I would be happy to uh be there too. Although it seems to me that the issue is one of legal crafting and I'm, not a lawyer can.

B

You arrange that meeting because, like I I I've already I'm I'm I already owned Mike some things so I can you can you drive that? um Can you drive that um uh meeting to occur and I'm more than happy to attend.

E

I mean I'm fully capable of using calendars. Yes, so, okay, all right so um excuse me all right. uh I will try. I I will then pick up the ball to uh create a meeting and you and I and Mike, uh discuss and uh and go, but this is yeah. This is the wrong meeting for that, because.

B

E

To grab some text and I think whatever you know, if legal signs off on it, um my guess is I.

B

Mean I even before we write me words right, I want to have a meeting with Mike to understand where his risk adverseness is coming from.

C

Right because like because we can right, that's right, but.

B

We want we want to know what they're trying to be con. What.

E

They're concerned about got it got it got it got it: okay, let's not waste everybody else's time, uh so Jonathan, Michael, Mike, I and I will uh we'll try to work with Mike Dolan and we can move on to another topic.

D

Okay, so action item. This means that uh Jonathan David, you are following now: the Safe Harbor for the inbounder security policies. So we can find us.

E

There isn't there's um Church went to the tack approved it was the outbound, the outbound yeah, okay, tacos approved outbound, neither the TAC nor Ella. uh Neither the attack nor alif legal have approved the inbound. So nothing is nothing is uh nothing is approved. Yet on that nothing.

D

E

D

No, it's not approved the inbound, but we need to solve the Safe Harbor. So the question is for me: the next action item for me is uh in the tag group. We have seen that people want to have the Safe Harbor for the Linux Foundation legal team. The SI fiber is a problem, so I want to find or a different cells algorithm write it to have a better Safe Harbor for the inbound security policy or we need to remove it. I, don't see all the solution. You.

A

Know if I can make a suggestion here to solve that problem, get Mike, Dolan, us and Tack all together, and that way we have all parties that are interested in an outcome just right and we can just argue for an hour and then hopefully, at the end of the hour, we have a solution that.

E

We want okay, but let's do two stages: let's Jonathan and I talk with Mike work step, that's step, one step two once we've further understood the issues and started crafting something, then uh do it more widely, but yeah I I, think some of the concerns that they're con raised about are involving past events that were unpleasant and um are not desirable to go public. So we want to get the Lessons Learned, but we I'm not sure that they can share everything publicly.

E

So, let's, let's get the issues? Small group, larger group and resolve okay, all right next topic, because I think we're wasting everybody else's time. I.

A

Don't know this is all good um okay, so that was um that was on that Luigi. Do you have anything else, okay, cool by the way, I thought that was a pizza icon thing on, uh and why does like that? That's party.

B

Right, oh I, get it yeah. Oh.

E

No, that's Pizza I'm certain uh no.

A

I mean I've seen people before the.

E

Bottom, it's got, pepperoni I mean it's obviously Pizza.

A

Cool um okay uh disclosure track, Jonathan I, know you what we were trading things back and forth. um We're gonna chat with vulnerability. Disclosures tomorrow or I am at least um I'd like that working group to adopt the project officially uh and and all that um we already have a repo in openssf. We just need to move the content over so Jonathan.

C

A

Have Cycles to do that great? If not I can.

B

Like you know, great a working group owns it, but who owns the who's? Actually like the maintainer of the code? Is that you still no.

A

That's that's what we need, no I I, don't want to own it um uh going forward. um I would like someone invulnerability disclosures to step up and say sweet. This is this is a good opportunity. I want to do this. Put my name down. I will own it.

B

You're not I guarantee you you're not going to find that like I, don't mind it living like.

A

Then the question is well what what does adopting mean if it doesn't mean doing anything with it? um I like I, I and I. Think we need to push on like just as like in this working group like Luigi, clearly owns security. Insights and, like is point uh Amir, clearly owned, Security reviews.

A

um Someone needs to clearly own this and.

B

I mean yeah sure.

C

A

We don't have enough people to own. This I'll put a note out on on this on the slack Channel. Someone will step up, I, think I.

B

Yeah I mean the writing code and then throwing it over a wall for someone else to own is not not the way that I do open source I just I mean generally I. Like you know, you write it, you publish it you kind of own. It.

A

uh That that would be great, but then uh nothing I I would have stopped years and years ago because, like um I.

B

Mean well you also, you also have staff under you.

A

If you would like to own it I would that.

B

Would yeah well I, don't I, don't I, don't mind owning it, but am I owning it as Al or am I owning it as vulnerable disclosure working group.

A

I, it's all open up like whatever how about this. Let's ask Will there be the disclosures if someone would like to own it because it clearly is in their Charter. If they say yes, well, you don't have anybody and you say well I'm a part of this working group. You'd like to own you know drunk, would like to own it whatever that's great. Let's do it.

A

Okay, um and if they say nope, not our thing, then maybe you own it as part of AO and if, like we'll just kind of go down the line of like options and it'll.

B

A

I realize it's musical chairs if at worst case, yes I'll own it but send.

B

Me, the code and I'll tell you whether or not I want to own I, get to review your code and tell you if I want it and.

A

It's dangerous, you know I, just I just um popped it in uh in the thread back to you and I'll post. It here.

B

Do you have unit tests all.

A

Right well, that's.

C

A

We're not doing public critiquing of my code. This is why I'm I'm just warning you I, am a PM by title um anyway. um Make.

B

File for pit for a python project.

A

No because I gotta build uh uh a doctorate, Mission stuff.

B

A

And actually do the python build thing and uh sure not all of my days are terrible.

A

um Security reviews, I, know Amir, isn't here, but I noticed uh yesterday that uh maybe it was today uh that Google open sourced their rust crates audit, which it looks like they just they. They dumped a big file worth of um cargo crev audit things um for a whole bunch of projects that, at least from a first glance, looks like they had someone like actually go through and are thumbs upping.

A

um You know a whole bunch of uh cargo projects um would have been awesome to have that be part of Security reviews, because that's kind of the exact same purpose, but whatever I think it's good to have that out there. That may be an interesting place for the dashboard. The I'm sorry risk dashboard to pull and pulling data from um I would love a resource like this, where lots of organizations contribute to.

A

Last uh two: two less things: um the the threats paper, so threats paper is now like two years old, two and a half years old. Something like that. um It's missing some emerging things, I I think it came out shortly before um dependency, confusion. So all of those types of attacks- I, don't believe ever mentioned.

A

um Although we do talk about.

D

Right I started to work also on that I guess: I have a draft. My driver, yeah I mean we are talking about the our first document returned.

A

Yeah, what I was thinking is is like, would it make sense to like, in addition to those so kind of take what whatever you've done and like solicit like hell, yeah everybody take a section and, like you know, see where it is, and then you know if you wanted to take the overall like revamping process.

A

um Is that something that we that we want to do that? We think, has enough value.

D

The document is quite good: uh I am trying to understand where I should add the new thing or if I would want to adjust an additional page, I, don't know, um but I. We have a GitHub issue where there are two or three good comments with missing topic. One is dependency confusion and one is uh maybe multi-factor fatigue, attack and similar, and um so the document is already still good, though we need just to a smaller bump. We don't need the probably air back from 2.0 um I should just to share the updates.

D

Maybe- and thank you for remembering me about this- because I totally forgot about the document. I am in my drive and it is silent. I started to work and I will share it. Please remember in two days bring me on slack so I'm, okay, so that I can share something. Okay, oh.

A

Yeah, that's right! Yeah! We do have some good uh some good docs here. um We probably also want to include.

A

uh I'll add this as a comment here, but um about including AI ml specific threats as they relate um for the rest of the topics.

A

um I, don't really know what what exactly that means, but I'm I'm off time. I had like you know, attackers, um if AI or if AI systems are used to make decisions, and then things like prompt injection and whatnot can be used to undermine that. The the Integrity of those decisions um that, if there's.

D

A security decision.

A

That's that's interesting and I know that the AIML group is.

A

There is a threat here that, like you.

D

Know and probably we can have a new section for AI, because the document uh yeah we didn't write nothing about the AI in the first version.

A

C

A

You editing, are you gonna, pull request back into the markdown and we'll use the markdown as the authoritative, or are you going to do.

D

I haven't downloaded honestly a document in uh I mean I downloaded that word version and uploaded on my my Google Drive I would prefer to use GitHub, maybe but so weeks ago um you suggested, if I remember, corrected to use the word document. So I just moved to drive because you can add comment easily and so and so, but no no strong opinion I can move on Google on GitHub, honestly I think it is I.

A

I, don't have a strong opinion either um like I think the the PDF looks nicer than a printed markdown file um and I know that, like in theory, there's a way to like make a markdown file. Look pretty when, as a published document.

D

um No, no I agree that, like that.

C

D

So I'll probably have a version. Inward that we can expect in PDF is a good idea. The only reason why I like GitHub is that it's public, so everyone can see everything yeah, but we came writing it up and then we can just add it to the word the documents or we can create the word document and we and then we can move to to GitHub.

A

um Anyway, just just make a decision: yeah I'm saying this is going to be the the how we're.

D

Going to do this, I have only one concern about the word document and it is related also to the all the other document that I have like the security policy. uh Now I am the owner of my Google Drive I would like to move to open ssf something and drive that I don't know. If we have oh.

A

I gotcha: uh here's where openssf does not have a Google workspace, so each of the like the the meeting notes for this are on my personal Drive um and the silly thing is like you can't even tell from the URL like where this thing is hosted or or things like that, um the word doc.

A

The official like final, like the one one word doc, uh what is physically uploaded, but you can't like collaboratively edit that in GitHub you can download the docx file and do whatever you want locally, but there's no, there's no collaboration. So so how about this? um Oh I, see what you mean.

A

Yeah right How would. How would I comment on your word doc you'd have to send it to me and I comment and email it back to you. Oh.

D

I sent you an invitation by email, but I need to ask the email to everyone is in in this lock or I need to put it public with editor privilege or comment, privilege, I, don't remember now and yeah. This is the reason why I would like to have a sort of open ssf space uh and why I prefer Gita, because in Gita, but we have an organization.

D

The only reason why uh I mean it's not because we are working on the security policy and we see that no one edited, but uh we have no spam or similar, but yeah. It is on my Google Drive. Even if something happened to my Google Drive will lose all the work that we have made. So, let's.

C

Do that sorry, sister here, um just uh hello, everybody! It's my first time joining sorry I I joined eight minutes late, but as I feel like in this topic, what I have seen in other um you know: Community Driven, effective foundation, for example, something that we used.

C

That we currently do is that um you know the meeting notes from each uh call uh are approve at the next meeting and that is converted into a PDF and is uploaded in the in the official Foundation website, with whatever tool they have, um and so in that case it never gets lost and it's officially approved every every next meeting and in the meantime the live meeting is just running as we currently have, and in that case you know the best scenario as I agree with Luigi is to have you know that the foundation uh drive, but if that is not possible at least having the fight of approving meeting notes from previous call and upload that to a official website, make things more yeah.

A

Yeah I would really prefer is just to have a um if I I'll um David. Do you know if conversations have ever happened with with Brian or around car about like? Should we just have like a Google workspace or or something where, like, because I think that the preference has always been like? Let's just do this in in GitHub, um but like.

A

Like it still requires you to have like the personal unofficial thing, and then you got to print it, you gotta remember to do the like. It's it's just. It's kind of a klugy uh cluji workflow.

E

I'm not sure I, understand the issues and to be.

A

E

Trying to share two things at once, because I'm trying to start this meeting with.

A

Mike we would like.

E

A

We do a lot of collaborative work, there's no collaborative workspace that we have everybody uses.

E

A

No, it's personal Google Docs and then you share it out or you send out Global edit links or whatever there's no open, ssf Google workspace. The other is.

A

That's a Linux Foundation workspace. You guys definitely have it. I happen to have one for Alpha Omega, because we're that's a separate thing but like Luigi, does not have access to the only Google Docs that um Luigi has access to are under his personal okay.

E

Well, we have not been insistent about putting uh all documents underneath the open, ssf scope of the of Google docs uh now I mean prop, maybe that's something that should be done, but yeah there's a uh there's, an open, ssf, uh drive and and so on, I believe it's separate. Could you could you.

A

E

Anybody else drives so, let's see here.

E

No, let's see your my drive share it with me. I, don't know how you find it so.

E

Storage, that's okay, I think there is I, have not fussed with trying to keep track of what is what, uh but that sounds like a quick email to operations and uh okay. So so would would a shared driver area or something that's Google, Docs but specific to open ssf. Would that resolve the issue.

A

Well, that would actually solve lots of issues because things like the meeting notes. The past three years of meeting notes for this are dependent upon like me, retaining my Gmail account uh personal Gmail account, which, which ain't great so if we can throw that into something openssf owned and I'm, just a collaborator contributor, then that that's better for that that solves one set of reasons.

A

The other thing that Luigi was talking about is collaborative editing of a word doc, which, as I, if I recall correctly, like there's that that's great, if you're on SharePoint there's, no, it doesn't like I, don't think Google Drive is uh uh maybe it is I'm, not sure I I doubt that it's um aware enough to support collaborative editing in a in a.

E

Good way, no yeah I've used uh word on SharePoint um before many times. uh You know government lives on that stuff. Yeah.

A

um It it works in some cases, it doesn't work in other.

E

Cases I mean fundamentally it what it does is paragraph locking and and such so.

E

um If you're editing completely different parts of a document, it can work sort of um I think if, if your goal is collaborative editing of a document um how's this I'm gonna say try to save this in the nicest way, because we have Microsoft people here and we love our Microsoft folks. But there is a challenge: that's trying to support multiple tools. I, don't see a big advantage of supporting both SharePoint and Google.

E

A

How about this I've got the perfect solution here so David, if you could help us figure out, if we have, if we like, can use an open, ssf.

E

I'm gonna go further I'm going to create an email and say you know, moving Google Docs into uh uh related to open ssf into an open, ssf controlled space.

E

Okay, uh uh let's see Google Docs space, all right so how's. This I'm gonna I have a crazy idea. This is actually I know exactly share. My screen go for it all right. Here's.

A

E

Public it's getting recorded, hopefully I have covered all the secrets, uh all right, all right. So basically, let's, let's try to figure out quick group discussion. What are we looking for? Okay, currently mini uh many open, ssf, uh uh Google doc, Google Docs, oops docs, including working group meeting notes, are owned, uh are owned by individuals with either their individual accounts, uh personal accounts yep or their work accounts if they leave their job or stop being involved in openssf right.

E

That could cause trouble right, yep. Okay, perhaps we should move all open, ssf related Google Docs, and that includes including slides Etc into a an open, ssf, Google Docs area. Yep I think we have one but I don't know how to how to access it.

B

So two couple of problems: permissions are wacky right who, how do you like add a new document as an outside collaborator? That's you know how do you uh you know that that means that, like for Google like, if we want to have outside collaborators, then we've got to pay for workspaces accounts for them um is also already I.

B

Can I've I've heard people pitch fits to Brian bellendorf about hey, like you know, because the other stuff is so Google Docs heavy that people who are in regular, highly regulated Industries can't access Google Docs such they can't collaborate in the open, SF again regularly or easily, because they their companies block access to these things. The.

E

The problem- that's a fair point, but I think there's multiple different issues. There's the companies uh limited and I believe China, actually just straight up, forbids a lot of these.

B

C

E

A country, the challenge is it's not clear that alternatives are going to be any better. um I can I can't speak for all regulated Industries, but at least the company I used to work for Google Document access required a special exception, exactly the same, applied to SharePoint or GitHub, or anything else where there was shared access. So switching to a different tool helps you zero percent, because what they want to do is scan every email and, if you're sending data out in a way that doesn't involve an email, then they don't like it so I.

E

Don't you know, for example, social new SharePoint wouldn't help anyone I, don't think because they'll block back just as quickly and.

C

E

Same is, and and I and uh and for for China I think the challenge there is uh they're blocking those services but I think I think they allow other services but I think other countries block those services. So again we there's a in that case. There is an alternative, but then we lose a lot of other folks, so I I think we've I think we lose I'm, not an expert in this.

E

There may be a better solution, uh happy to I'd be delighted to hear that better solution, but uh at least my personal experiences was that there wasn't necessarily a better um and the challenge with I think the other one is using GitHub more people allow accesses to GitHub, but then the challenge is that GitHub is great when you want to do small changes to a document, but simul editing is not something that Sports well.

A

So great, let's do this um I think this also solves a problem where, um let's just convert the word doc to a Google, doc, I think Google Docs is practically the same level of expressivity as as word, um and then we get it's in it's in Google Docs. You can get moved over to the open, ssf thing you can do collaborative editing, it looks nice uh and what, if you want to publish it as a PDF at the end, we just hit PDF and then we're done.

A

um Is that sound reasonable as a as a pet forward.

A

Is that not sound reasonable to anybody.

E

All right, uh biggie, all right, everybody good with this email that I'm proposing here.

C

Yep sounds good. Yes,.

E

Okay, uh what what what.

C

E

That openness is f, Google, Docs area, and how do we see it.

E

E

Foreign, something like that, so where is it I'm pretty sure it exists all right, good, I'm, gonna, stop sharing cool.

C

E

Right so it turns out I have uh the infinite cosmic power of writing emails.

A

um And I'm trying to figure out if you can import a word doc into oh yeah,.

A

Try, oh you do a few drawings.

E

C

E

The way when I say you know uh certain kinds of you know, although um Jonathan I, you know you described, you know, saying different or different regulated organizations have different regulations, which makes things even harder to say generalizations about, like I, think I think my company wouldn't be considered. My previous company wouldn't have been considered a regulated industry, but for various reasons they uh were very very concerned about a lot of stuff in part because they always they were always getting attacked by by sophisticated State actors. So uh they were they.

E

They quickly became anal retentive about things that were you know. Yes, we are technically allowed to do this, but we're we have good reasons not to allow Ed.

A

Okay, it uh it looks like a converted, uh messed up all the pictures, but yeah yeah.

A

It's just like all the all. The pictures have white text on white background. Now, um I'll figure it out. um Is there anything else that folks want to talk about um David we talked about reproducibility, so we can have that conversation real quick. If you want not, if anybody else has things I want to talk about, that can take precedence.

E

I'm always happy to talk about reproducibility cool.

C

A

So what do you want to talk about? This was the the the hallway conversation we had in Vancouver about um how reliably could we rebuild a package um and how oh right right? We do that in in an automated fashion, yeah.

E

I would love for you to write down your experiences, so I can share them because that's uh I, I I thought your experiences were uh better than I'd hoped, but uh you know the only way you know the result of something is to run. The experiment and I was delighted to hear the result of the experiment. It was even better than expected.

A

So so here's what I'm actually thinking about doing, because I'd rather not like like um if I, can kill two birds with one stone like let's. Let's do that um as we ramp up assurance assertions, one of the things that I want to be able to provide is a snapshot uh report. Whatever you want to call dashboard thing of.

A

And I'm not sure what but like some something like like you should be able to go somewhere and say either. Show me all the packages that are show me: a breakdown of reproducibility for packages like pass or fail and there'll be some pie. Chart and it'll. Look like that, and you click on it and you get the list of packages that are reproducible in the list of packages that are not reproducible. And you do that for like each policy type, because we have all the data, so that's kind of trivial to generate.

A

uh And then it's just a matter of like running more things through the uh through the analyzer, which does everything, including reproducibility, uh and so you just kind of get that all for free. um Once you pay the analysis, cost.

A

It sounds like if you had that you would be happy. I mean you're, probably I,.

E

Would be delighted you'd be happier well, I mean I'm.

C

E

But but I would be delighted to uh you know to see that so I guess maybe the first so I mean the first step might be to do the random sample. You know pick pick: a hundred out of sale grab the score card list of whatever it is. A million.

E

Then just run it against that particular ecosystem and- and uh you know, pick a hundred and see how many reproduced to certain levels, we probably need a uh a a name like quasi reproducibility, because you're not you're, not requiring bit for bit.

E

um But frankly, if you get bit for a bit I'm sure we, you know fully reproducible, um you know, if not hey, quasi reproducible with a little effort. We got everything except eight times or whatever. The measure is right.

A

Right exactly um and then actually as the tool, and so as we do that and we find bugs we improve the tool and then future runs will have more accurate um will be less likely to false, positive or false negative on well it'll, never false positive on a is it reproducible, it'll false negative and call something not when it actually is.

E

um In some additional way, right right, but I mean indeed the uh and I think that was the challenge with it is that it could tell you in certain cases when things were okay, but if it didn't, if it wasn't, reproducible that wasn't necessarily a strong indicator of maliciousness of a malicious build. It was just well I, can't reproduce it, which is a.

A

Different statement.

E

Absolutely yeah.

A

And that's why you know so so what I'm looking at here, I'll just.

B

B

E

So so, of course, what I'd love to do is convince somebody else to do this like say: Michael scaffeta. Well, that's.

A

That's that's how you get things done um so for this one for so left pad 1.2 um is.

A

um Left pad 1.3 really.

A

Can you guys still hear me.

E

Yeah we can say I can still hear you can still.

A

See your shirt screen nice so so I get a thing Zoom, quick unexpectedly, but apparently it didn't so wow, okay, we'll just we're just gonna go with it. um So you know you'll have this and if you click on it like we'll, we can have better text here. That.

E

Says yeah, you know a package can be at least quasi is at least quasi-reproducible or something like that. Yeah.

A

I mean so so already in the in the output here, like oh you're, already doing this oh yeah yeah. This is already I mean it's, and um this will be more readable, yeah.

E

When you say like here, it's saying.

A

That, like left pad 1.2, there's a file added um which is get ignore so in um there's a I I forgot, which way it goes but like there's, probably a git ignore in the repo that doesn't appear in the package.

A

E

Something, oh okay, so we all right! So it's much more than date, time all right! So, oh.

A

Yeah yeah yeah, so we need.

E

We basically here's what we need. We need to use a new term instead of reproducible I like quasi reproducible, you pick your term okay and then basically somewhere Define. It.

A

Yeah, oh yeah yeah, and we have that.

E

uh And you've already and you're already doing that, I didn't realize that that was actually currently in the Alpha Omega set.

A

Yeah we've been.

E

That's cool. We.

A

Have these are our strategies I'll push that in there and I'll post that in the meeting notes um for like like how we actually implement the? Are these thing like the? Can you get? Can you get there from here? um um You know the most basic one is like: are they exactly the same text um and then.

E

All right, I don't want to file a quick issue on OSS, Gadget and just say rename from reproducible to quasi-reproducible and explain it somewhere.

A

Sure I mean I mean at the end of the day it is about. Can you can you semantically reproduce? Maybe maybe that's maybe called semantic the OSF, semantically reproducible or something like but like it's?

A

um Is it for all intents and purposes, the same thing.

E

Yeah I, just I I, think I think the problem is, the reproducible builds folks have been around for a long time have kind of owned. This word I've tried to convince them to uh be more flexible, but but they don't I understand why, frankly, um so, let's just pick a different term and that way, there's no confusion that works I will create a an issue on it. Right now,.

A

Cool all right, we are a bit out of time. Is there anything else that anyone would like to talk about.

A

Awesome. Thank you. All very much uh conversation uh see you all again in two weeks and if you haven't seen the open ssf day, uh videos just got posted to the uh YouTube channel enjoy bye. All thank you. Bye.

C

Take care bye-bye.