OpenSSF Securing Critical Projects WG, 20 Apr 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Securing Critical Projects WG Bi-Weekly (April 20, 2023)

Description

Agenda: https://docs.google.com/document/d/1MIXxadtWsaROpFcJnBtYnQPoyzTCIDhd0IGV8PIV0mQ/edit?usp=sharing

A

B

Hi Jonathan hello. How are you good? How are you today.

C

B

We're ready to assign more criticality.

C

C

Birds be tweeting behind you David. Where are you actually I.

D

Am in Northern Virginia- and this is my deck I'm.

C

Jealous my deck is currently hanging over a road, and it's also 40 degrees out.

D

Well, I I can't say it's like this all year round, but uh Springs in in Northern. Virginia are really awesome, so try to take advantage of it when it happens.

D

In fact, I'm going to leave you here with my Birds, because I'm gonna go get me a soda and ready myself for this.

E

Hey everyone good morning, good afternoon,.

C

ah Humbug David wheeler and his birds, chirping.

E

So my volume was off, did you say something.

C

I said David wheeler and his birds chirping.

B

And her little dog, Toto too I, know I, know.

D

D

All right did my birds, keep everybody company, yeah.

C

They did I was I was saying: bah, humbug, David wheeler and his Birds. He left the hill, the Michael open just to make us jealous. Didn't you absolutely.

D

um My my wife has an app I've forgotten what his real name is, but uh she calls it uh Shazam for birds, so she'll just put her phone up and it'll tell us. You know which bird is which and you know that's a cardinal. That's a robin! That's uh you know, you know all the all that sort of stuff and specific one species, and so on.

D

uh I mean if everybody's nearby you can come on over visit. My deck I got, I, have power and a Wi-Fi.

D

All right probably ought to actually like sign in in things.

D

Oh thank you for signing in for me all right.

E

All right well I'm, going to get through as much as we can. Maybe we should get started people can trickle in. uh Do we have any volunteers to do the screen share.

E

Please I'll: do it yeah.

D

I've got a tiny screen. I, don't think you wanted me to share mine.

E

All right, um can you see my screen I.

D

Can now were we going to be talking about this uh p-tow to consider soon so.

E

uh Not really I just want to tell everybody as an announcement to go look here so that whenever we're, hopefully by the next meeting, we can, we can have a discussion on this.

F

D

Yeah I think if I recall the the issue there was, it wasn't I think there were people asking. How did this list get created and and Jonathan I, you know, I, don't know if that's already been answered and if not maybe uh link off. You know if there's anything else, if there is a rationale, maybe linked to it, if not maybe write it and link to it.

C

It's um in the uh in the uh document there is a for every single line. There is an explanation of where that line is coming from.

D

I think in this, in the spreadsheet.

C

In the spreadsheet, if you open the spreadsheet I think uh there is uh wait. Where is spreadsheet, this is not spreadsheet. This is a different. Let's go back to this.

D

Yeah: okay yeah, like uh Debian popularity or yeah,.

C

D

C

So the source like Harvard census, two- is you know, so why is this in this list right, like that's, that's right.

D

Yeah, but that's that's just uh okay, like 250 most common GitHub URLs in the cve database, got that but like criticality score, I mean lots of things are on criticality score. There must have been a cut off or something and lots of things are mentioned in the census. Harvard census too I think just just that you have two or three words isn't really enough. You know if, if there could be like a key, you know if you say this in the source. What's that mean.

D

I, don't I, don't I'm, not looking for a 300 page paper, but I don't know yeah but like if it says Harvard census to this means what it's in I mean I doubt you included everything in Harvard census too so I.

C

Didn't I didn't create this list. This is Michael scovato, so I'm trying to get Michael scovetta to come, join the call right now. Okay,.

D

Okay, well, we don't have to answer this today. I I think that was the the question. Is people saw the list and it wasn't clear what the sources meant.

C

Can you is that a uh is there a question that is posed in that has been posed to Michael scovato, either in the issue or in the email thread.

D

uh uh Let's see here, you know what I think it probably belongs in issue 66., okay. So how is this? Why don't I I respond to that and I'll put Michael scavetta as an at and hopefully and that'll at least uh notify him that uh somebody might mentioned his name and whined about it? Yes,.

C

Okay, um do um at a high level. Does this working group want to move forward with adopting and owning this list, or is that, like is that I guess am I completely, like you know, are we coming out of left field with this list.

A

And like no you're not coming out of the field.

D

C

No okay, so is this: is this yes,.

E

Yeah, so let's um I haven't put my comments in there. I was going to wait me in a mirror until other people commented before you know as the as the chairs. I don't want to like set the the tone before anybody else comments, um but yeah I wanna discuss this in a future meeting.

E

um I want to try to push people to leave comments here, so we can do some asynchronous consensus. um That's why I wanted to keep mentioning it in this meeting, so that people can go and look.

C

What is the process by which hang on Michael's hi Michael question for David to ask the question yeah.

D

Yeah yeah, in fact, uh you know what I just posted it in the issue, so I'm gonna, open up, chat, click and uh wow.

G

D

Well, you're shocked at my ability to use chat.

G

Yeah no comment.

D

Oh, that's probably good for me.

G

um Yeah that uh that that is a reasonable request. We're gonna actually find the data yeah. That's fine, yeah.

D

Yeah, it is the top.

G

End but I should say it's the top end right.

D

Right, I, I, I, I I'm, not looking for the uh you know for the 300 page paper. You could probably just stick it in another tab, but just basically for each of those values. You know you know, sentences.

G

Where did I find it yeah yeah exactly.

D

What does that mean and I think would uh I think that would clarify things and- and you know you know in some cases- maybe some comments about what it doesn't doesn't but but do but at least you know where where'd you get that you know, for example, criticality score, I know that really emphasizes um activity.

D

um So so in that case, I already know you know the the risk of that particular measure is hey. If you're not active, that doesn't mean you're, not important, but it won't show up high on the criticality score, but.

G

But that is also precisely why we have you know, like I, don't know eight or ten different sources.

D

Exactly exactly it'll.

G

Get caught in one of the other ones um I'm also so so just to be clear. I am super happy not for this not to be the alpha omega 10 000 list, but this to be the security projects 10 000 list, in which case like evolve it at you, know the whims of of this working group, and we will just take it and say yup, that's that that's I'd rather I'd rather point to something that's up kept rather than um you know, try to upkeep it um right.

D

In that case, I think what we need to do is uh we. We even need it more about what exactly this is yeah, because that way, instead of you trying to figure it out, other people know how to figure it out. Oh and I see David Edelson, I'm, sorry.

B

D

B

I mean one thing is just to point out and so I criticism. I mean there are a number of duplications in that list, I mean which is fine, but I. Think the bigger issue I mean again. We can continue.

B

This isn't you know solve it today, but I think there's still a question of like you know, what's the meaning of life and like, what's the meaning of this group in the sense of there's, still no real clarity about okay, we have our securing critical projects or create this list of critical projects as being part of this is where did it come from and where is it going and part of this 10 000 list is like we just have this week, it's not been very clear for how people can propose projects and how we, you know where our cutoff was and how we created this.

B

It's not really clear and I think this is sort of good with the 10 000 projects from Alpha Omega is that there is sort of a uh recipient for this like okay, we create these critical projects. How what exactly is the pipeline or the flow in the open ssf after you do this? It sort of doesn't make I mean I, don't think it's it's interesting! It's nice, but I'm, hoping that it's not just a matter of. Oh.

B

We created this list and then we'll you know file it in you know a warehouse, New Jersey type of like.

G

Fair enough, yeah um I mean I. I also think that having the list other folks are going to have the question of like I have a thing I can do at scale, but not at the Scale of the Universe. What's the most important stuff that I should be thinking about and just having a list available which is like. Yes, it's not perfect, but it's a list and it's probably approximately correct and I I I think you know if you build it, they will come.

G

Perhaps uh AO will absolutely be a consumer of this, but as far as others, I could also see any of the streams right, yeah then stuff or stream. Six, the um security audits kind of say that top.

B

Of the list yeah exactly I'm, not saying you know again, you know you know, stop what we're doing you know, but it's simply a matter of okay. I mean this is a great list things for me. It it's it's very comprehensive. He said you made all these ways that we produce it. You know, there's some duplication, but long run again not to to belabor this, but you know for for us to discuss after we get through our current. You know, uh scoring mechanism is to figure out. You know how.

B

How are we want to integrate this together? Is this sort of a new starting point of just sort of you know have once we get through this and this our current sort of you know race or or whatever we want to call. This is to then sort of step back and say what really is the purpose of this? This group open this list and how do we want to balance between this ten thousand and the his?

B

You know the the the list that we've inherited or the group has been worked on so far and then- and you know, potentially in contact with the attack of the next time saying. Okay, we've got these different um resolutions or types of information. You know, let's start sort of socializing this amongst the open, ssf What's. The best way you know or are these sort of different purposes?

B

Are we trying to merge the purposes together again, I'm not trying to answer it now, but just to open questions for people to to think about as we evolve this this specific.

A

E

H

A great Point David.

E

um Let's add some of that stuff, it's a future topic ideas. Can you add one or two there? Okay, I'd like to hit some of that stuff after we're done.

E

Okay, so I think we're ready to start the meeting.

H

So yeah attendees um do we have any uh welcome everybody. um Yeah go ahead and look at the notes in Linked.

E

In, the meeting invite um do we have any new faces that are new or you know, redoing after a long absence of like to introduce themselves.

E

E

Everybody for joining um so yeah I wanted to call out, and what we were discussing right now is um there's a proposal for a new project or Sig, not sure which one it would be uh to join this working group. uh So please take a look at the issue or the um email mailing list post and leave your comments or questions there. We want to have a formal. You know discussion uh in the meeting once we finish our um our current iteration of the critical projects set I.

D

I I'm confused: are we talking about this 10 000 list or something different? Okay, all right.

C

This is that a Stig I, don't think, there's a Sig, that's just a it's just a adopt the list. Yeah.

D

I I, don't think it's a separate sync either.

E

I think it's projects are supposed to be uh code, so.

D

Oh okay, all right, you said sing.

E

Well, it's either a cigarette project. Probably oh.

C

E

C

Wouldn't it's: these are special interest groups right and it's not a we're, not creating a separate Sig with separate meetings.

A

This is a this is a.

C

A an item that would be owned and and- uh and uh you know, deliverable from this working group- that's not a Sig or a project. Maybe it is a project, I mean maybe it's a code. Maybe it's it's.

G

Just a larger version of the list of of the.

E

Voters consider like a project yeah.

D

There's a terminology weirdness here um we call stuff that aren't mostly code sigs, but they, but at least in the openness and stuff we have other cigs that don't have separate meetings either so I I first thought you meant asig with a separate meeting, but you don't have that so. Okay, yeah.

E

Yeah something that's on the list of our uh things that we we can produce anyways, um so yeah! Look at that, but let's get busy with our working meeting um and and start looking at our list uh voting discussion, consensus building on the set, um so we had a small meeting last time uh the Apec time isn't as popular. So there were some that we passed on, but we left comments um and then some that we didn't get to so let's go ahead and I guess just go down the list um all right up.

A

For discussion.

F

E

With a high doctoral count.

E

Anybody know this.

D

Okay, so we're on Kong yeah.

D

I'm, sorry I, don't see this on this list. K-O-N-G.

E

Six, but it's time.

D

Okay, sorry I was on the wrong tab.

D

126., you know just.

E

D

F

D

I am not familiar with this.

C

Marketing is good, their logo is flashing.

E

um All right, I think uh if it's just Dr pull count and nobody knows it, um and it wasn't a particular suggestion with consider considerations. We should just go: go ahead and vote no, since we don't have any any reason to say yes.

B

Is it on the list of 10 000 projects.

C

I mean uh uh it's reused by the websites used by GSK Wayfarer NASDAQ verifone moderna app Dynamics, which is part of Cisco.

B

It was used by moderna will definitely know.

G

C

D

C

Used by not yeah.

D

It's it's on the 10 000 list four times. Interestingly enough uh with a little unusual yeah.

G

For criticality score, yep.

F

G

I know the other ones are other projects within the Kong GitHub, repo insomnia and another one.

C

It must be critical. It's used by Papa John's.

B

Okay, we got Papa John's on the positive side, the modern on the negative side. Okay,.

D

I I realize you're being silly, but in all honesty, um having making it very clear that there are non-trivial companies who are using, it um is clearly a plus um I'm not familiar with it, but that Docker counts High. The critical score is high.

D

um These are not irrational reasons to select something. um You know what you know used by by uh people who care PayPal.

C

Samsung Honeywell NASDAQ yeah.

D

Yeah I, you know I'm only using metrics and this and the the quick list of of what they're claiming on their site, but these are actually pretty I. I would find this com uh uh reasonable.

G

D

Though the question is.

G

Like it's important, but is it top hundred.

E

G

um I'm trying to look to see what I I don't know how high okay. So if I look at like like Alpine, it's, you know eight million. In the past week, nginx is 32 million. In the past week, um I'm trying to I'm trying to like sort the whole thing by like is is uh 200 million total, like is that, like everybody.

F

G

200 million, uh just because of how you know you pull it, you know.

C

D

Whoops, sorry, uh can everybody hear me I can't remember if I turned off my mic, okay, um yeah I mean if you look at um elastics, Cabana they've only got um you know approximately half the poll count um now they're not open source, so they're, not that's, not an open source. So that's not um within our scope, but that is I do know. That's widely used, so just from the um from the poll count, that is a new I believe that is unusually high, yeah, so I I think this is.

D

This is definitely I would put on the kind of that margin of you know. It's how's this, no matter what it's important. The question is: is it important enough to put on that list on this list? That's I, think that's the uh the question here and I can see an argument either way. Yeah a super question is open source right. Let's uh I I hate to do a lot of a lot of more.

C

Now it's dispatching.

D

Apache, okay! Well, that makes things easy.

D

uh Sure's got a lot of commits, oh my gosh, so we looked at any of these commits.

B

I I propose that we say that this is critical with a um rationalization or you know a question of the um that it.

B

Was some sort of a clarification? I, don't know what we want to say, but you know that that were that were I mean it definitely, it seems to be sort of a niche, but it's a very specific Market I mean it's not widely used, but it seems to be critical for the people for whom that who are using it.

D

Yeah, if you look at it I mean it basically puts itself as a Central Gateway for all sorts of other things. So this thing, so if this thing goes down anybody who's, depending on it they're not just losing a part of a service they're losing the whole service.

B

Things because.

D

If you look look at look at the their little designed uh description, you know basically it's the thing that that uh then calls all the other ipis and it's an arc, and it basically is an orchestrator of API functionality as opposed to uh containers right.

E

H

I think if API.

E

Gateways are usually for author and I'll, see probably again.

B

Is an nginx putting I mean placing itself in some what the similar roles, routing load balance I mean. So it's Yeah, but I I'm, not saying no I'm, no I'm just saying that I'm just trying to.

E

Clear this thing might be using nginx as the proxy in front of each API. You know what I mean.

B

But yeah yeah yeah, so I mean it's like I mean nginx is definitely critical. So great.

G

So doesn't I I should know the answer to this I'm sorry doesn't kubernetes include like an API Gateway like isn't that, like no.

D

Not not not, this kind I mean. Obviously there is an API to access uh kubernetes uh services, but uh kubernetes is an orchestrator of containers. This is an orchestrator of incoming requests, which is different, got.

G

It okay, so so you wouldn't so if you're going to run like.

D

If you might use.

G

D

Fact you're like right, you.

G

Might use both but like there isn't like a more native solution that Kong kind of duplicates that.

E

G

Mean I mean who like like what, if the ultra is, is like istio like like.

E

Api Gateway is typically just on the external layer where something like istio would be. This API gateways and service Industries are very similar but service, not just more for all your services versus the the kind of a layer where external requests come into your your system got it. um Yeah I mean I, think we just either have to say like yeah, like all the stats put it really high. It's not just one stat. So, let's just say yes or um you know, it seems like it's a critical piece.

E

It's in the main, you know, request flow, it handles stuff, like authentication authorization um or we can just say no, because we don't have any and actually you know, anecdotal experience. I.

C

Mean maybe that that's a great reason it's not critical, because we don't know you know it's like yeah.

A

D

A

C

Many people, eight people in a.

D

Call yeah yeah I I I'm, not very satisfied with that. I I think um you know, I do know about a whole lot of projects. I am sadly not omniscient.

D

um I'll tell you if I don't know about something but I I think that we would have to have. We would have to pull a lot of people to truly represent all the different uses of Open Source, so yeah I.

E

Mean I completely agree with you there but like when we say no here we're not saying it's no forever right it next round. Somebody comes in and says yeah. This is important. Then we would. We would believe them.

G

We we do accept kind of recommendations right from the.

A

Community yeah yeah.

F

G

Is totally critical, it should be on your list and here's why you read it and you're like.

A

D

Absolutely so sure yeah and wasn't this one of those in fact, I, don't remember where this.

E

Is this was not recommended? This is simply from the doctor pull count. We pulled the list and we threw it on here. I.

D

See: okay I mean that Docker pull Count's pretty impressive.

C

I would have all.

E

C

Agree, I also seems like it's being used by a lot of organizations. I I, don't like the like. We don't know it because so it's not critical right like um I.

C

Also don't love the it it's not on the list, because there's nobody right now so I, don't know what the Cadence plan is for getting this list updated on a regular basis, but I can imagine that similar to the oasp top 10 critical lists it takes a couple years for them to get those out every you know like yeah.

D

It takes three years: yeah, yeah, yeah, I I would say: let's I, you know, even though I'm not personally familiar with this, the data that we have that we're presenting suggests to me that this this should be a yes simply because of the massive pull count, the critical, the massively high security score and the um clear centrality of its use by its by its users- and there are many of them agreed.

D

Yes all right. So why don't I write I just said that I will try to write that down in our sheet. Since then,.

B

I mean we, we spent like 10 minutes on this I I, don't think we're sort of getting anywhere I mean other than you know. We're not getting any more. Clarity shall I, say right. I'd, say that you know we say yes and we say that that we're you know have qualms or where you know we we don't uh you know are- are uncertain about the um about this, but that, based on exactly what David said, we it seems to be the critical use of Open Source software yeah. It sounds good.

E

Declare Victory and move on Libre SSL.

G

I need to drop for another meeting um thanks everybody.

B

D

All righty and I just dropped the uh the summary of the analysis, discussion on com, okay, so Libra SSL.

D

D

Now, which one is this exactly yeah? Okay, you have to I have to be careful here. This.

B

Is boring, SSL.

D

No, this is Libra SSL.

B

This is the open, BSD Fork.

D

All right I have to be careful here, because uh foreign.

D

This is the open, BSD Fork yeah, not the Google, Fork, correct, boring, SSL, correct all right, I mean I. I knew that but I wanted to make sure because there's a whole lot of uh there's a whole lot of uh of forks. There.

B

So yeah this isn't the Google go away. You know, don't use this. This is the stick his finger in this too.

D

um Right and and the thing is you.

F

D

So so the question really here I would say, comes down to usage, um you know, do they have when they just released something a few days ago. So um there's at least there's at least some activity here.

B

D

All right um I mean whether or not I mean clearly it's been. uh They have enough activity to uh make a release. So I would say that that's a good thing.

A

D

So it's not so it's active, develop so active development. It was released. Then.

D

Okay, I guess. The real question here is how many people are you? How many folks are depending on this and I? Don't have good data on that? Does anyone have data on that.

E

Well, so it says here that it's just the fork: that's the open, BSD Fork. They also just publish the code from openvsd so that it could be compiled and used in other operating systems. No evidence that, that's being that's being that happens.

B

E

Projects, Liz yeah at least. We know this is the the SSL that's used in openvsd.

A

B

I mean that was one of the broader questions. Is you know? How much is our critical projects list? Linux Focus, because there are these I mean there's the whole Alpine ecosystem is the open. Bsd ecosystem is a FreeBSD and it's sort of so.

D

Yeah, let's see here, there's an older um review here. Let me buy water hold up. Let me let me stick this in you know, I mean basically right now I'm under the model of uh we look for. We look at the statistics and other data that we can get to quickly make reasonable determinations.

F

I can't I just yeah.

D

All right, there's a URL that I don't know has some has one person's opinion.

A

A

D

Well, Sam Waters up mentions me. That must be good.

E

Or production deployments.

D

um Open BSD is certainly nowhere near as widely deployed as Linux is, but certainly open. Bsd itself does have a non-trivial number of deployments. Yeah.

A

um I think I think FreeBSD is actually bigger. I'm trying to remember I.

F

B

Was I was running a.

A

Psd enabling group for.

B

A little while it's definitely bigger I mean but I think the issue is more that if we're talking about critical projects or again, the criticality that openbsd targets itself as being a high security solution, so it may be so it often is used for the people who care about BSD or in in more um security, critical uh deployments and and situations. So, even though it's a it's a low number, the multiplication factor for the places it is deployed is is rather High.

D

Yeah and the thing is just because it's from The Steve folks does not mean it's limited to that use. I mean SSH, open SSH is also from exactly the same group yeah and that's all over so um yeah.

F

D

I would look the other direction where who is deploying um uh Libre SSL, but not you know, but but not in open BSD, because.

B

And I don't see a lot of exactly I, don't see Libre SSL having the uptake equivalent to open SSH the the broad uptake outside the BSD.

B

But also there have been some issues with open, BSD security where they've had to make changes to software, especially with whatever they call it, whatever um Theo's latest announcement at cansec West. So this this may also be a a place. I mean because um live SSL is is is is, is is known for its maintenance complexity. Shall we say um this may have been a uh a place to um to maintain their additional um memory. Layout changes necessary for the library that that were too slow for adoption, with SSL.

D

D

So in fact, I just found I I found another article which I uh remember reading earlier now.

D

um Basically saying that uh you know, SSA open SSH, obviously is pick up all over, but basically um you know the uh that leave the Libra Libras itself just has not had the pickup, um it's being, it is being used in open BSD, but not widely elsewhere.

F

Yeah, just as a slight information looking at Red Hat package for a row, it seems no one, uh none of them as well. I can imagine a lot of that is not a lot of Linux related projects that use that.

D

Yes, I I would say no, and you know you know, and unless somebody has other better data it just you know, I think what happened is open SSL.

D

um You know. A lot of people got very, very worried about it after heart bleed, but uh they cleaned up their act. A lot there's still some issues in openssl, but a lot of folks have just decided not to pick up these Ultra uh that at least that alternative.

E

Yeah I'm good with that uh any concerns.

E

Okay, lib web suck, it's.

D

Okay, this is a user suggestion right, yeah.

B

F

D

I mean he has some technical advantages. The question here is: what kind of of widespread use are we talking about.

E

This is another one from the embedded embedded.

H

E

That's recommended.

B

This is iot okay,.

D

Yeah, it's not really limited to iot, but I see it's it specifically designed to be small for iot right.

B

So I had any is limited. There. I just meant that this is sort of in in terms of judging the criticality got. It.

D

Thanks, okay, so let's see here um God frequently used and embedded products all right! That's really! The question is: how widespread is this use in embedded products.

F

I have a feeling openstack uses Libre circuits as well brother.

D

Okay, uh interestingly enough now you have to be careful. This is them them using themselves as a source, uh but they are claiming um tens of millions of devices and thousands of Developers.

D

Although tens of millions of devices actually isn't that many but I mean that is a non-trivial number.

D

B

uh What do they say.

B

H

B

Graph is interesting: all contributions versus Andy I'm, sorry that that graph, just above yeah there I mean all contributors, 404 Andy at wormcat.com, and you can see that how much this is a single person project.

D

You know, and and that's fine frankly, that uh single person project uh increase my risk meter. Frankly, yeah.

D

I know they're common. In fact, all the numbers I have is the majority, but.

G

D

I wish I had more data, I, don't I, don't know either way. I'm a little and tens of millions of devices does say something.

D

You know I could ask the yakto and Zephyr folks if this is widely used. uh They they run. You know they're doing a lot of the supporting stuff and they might have a sense of that.

A

I was trying to remember uh from the Octo project. um It seems like it sort of rings, a bell that I, um you know, probably probably Richard Purdy- would have a better. You know idea whether that's you know, because they cook various packages into different uh uh different recipe profiles. So right anyway, I can I can ping Richard. If.

D

Yeah, if you wouldn't mind pinging, Richard and I was thinking about asking uh Kate Stewart uh for Zephyr. Do you know Kate yeah.

A

Okay, I also know the engineering manager for that one I haven't talked to her lately, but uh I could I could check with her.

D

Okay, yeah: let's, uh uh let's ask Zephyr and yakdo.

B

It's also on the 10 000 projects list, because it's criticality score. Sorry.

D

You know what why don't we come back to this one? We have a plan for getting more data about it. The higher criticality score does suggest it, but um you know criticality store, says busyness yeah, except for the doctor. Folks might have a better sense of widespread use.

E

I mean I mean we do have the suggestion already via the GitHub issue, that it's widely used, I would be. I would be okay with saying yes now, if we want to so. If we want to wait, that's fine too. This.

A

Is our might hear pretty quick but anyway,.

D

Yeah, when we wait I mean you know this. This is one where we have a plan for getting more data, as opposed to. Let's.

H

Kick it yeah man.

D

If the only plan is no plan, I'm not impressed, but we actually have a plan so.

E

Okay, lightning Network Damon.

E

E

This was a survey response, I, don't know if we have the actual classroom survey.

D

A blockchain transactions.

D

I'm not so sure how critical blockchain is, but okay.

D

Okay, where are we going here.

D

Bitcoin block slash blockchain, is it I presume it's not just Bitcoin, then.

D

Keep the millions of billions of transactions per second.

D

Oh okay, it's transacting, settling off blockchain.

D

It seems kind of missed the point if you could have a centralized service. Why use a blockchain well I mean there are other ways. In fact, we've got a whole Foundation regard on that, um but.

B

The payment protocol on top of Bitcoin I think this may be at least the implementation may be Bitcoin specific to that Network.

A

B

I mean it's a layer, two protocol in Bitcoin, it's not on ethereum or other networks, I mean that's making good or bad, but it's not it's not a general blockchain solution. I.

D

Mean yeah I I, you know, I will I will gladly note. Yes, Bitcoin the primary implementation people run billions of dollars on it same for ethereum. This is not either of those things. This is we're now down to a much lower use compared to say the main, Bitcoin or ethereum I'd say we. We shouldn't accept this unless we first accept uh the main Bitcoin and ethereum uh implementations, which we have not.

E

I agree: yep I, agree all right.

B

Yeah this is, this is back to that same embedded, I mean it's embedded, TLS, so I mean it's I mean I. Think this is this sort of is back to the question about you know, live web sockets and other I mean I. Think it'd be asked. The same group is this: yeah I mean the Octo and others is this.

D

How's, this I think no matter what we need to accept the Bitcoin and ethereum components. First, this is much less commonly used.

B

Yeah we're off of L D. This is a new.

B

They're just typing it in embed TLS has nothing to do with Bitcoin directly.

D

Right but and and this is yeah but I I- think just it's Lots that's commonly used, we don't I mean that's. Is it we're not saying it's not important to somebody? It's just we're trying to identify what's most common across a very, very wide spectrum, and this doesn't seem to make it at least that would be my opinion.

D

And we probably just need to constantly repeat on this recorded line: hey we're not telling you your baby's ugly, everything every software is important to somebody or you wouldn't write it. It's that how broad is it used that we're trying to measure in some sense.

D

Oh, if we moved on to embed TLS, yes yeah, oh okay, sorry yeah.

E

um This is part of lunaro looks like or um anyways looks like it's part of this larger project, Ed firmware.

D

It's a preview version for evaluation. Only, although is this the usual text, you say, even though there's millions or billions of users.

A

B

Yeah, it seems very arm ledaro specific, not that it has to be, but that is.

D

Is it yeah mirror is saying it's widely used, so that's the.

H

D

I don't know either way.

B

Well, it's the design, contradictory! Oh yeah, well, fair.

D

Enough is it really arm specific I, don't see any anything that says that.

A

Yeah but it's a lunaro project, so probably yeah.

D

Okay, all right hmm I'm, not sure that's disqualifying I mean not.

A

At all, not at all.

E

Lean towards yes, we have multiple people saying this is widely used. Okay,.

D

Yeah it's low level. Nature looks like if it if things go bad with it, if things go very, very bad. If you're, a user of this thing.

E

D

Yeah, here's a weirdness, it doesn't Implement all the algorithms. It's a reference implementation weird! So you it's kind of you get most of the parts, but then you have to self-assemble I! Guess that's more common in the embedded World anyway. Okay, I'm good with it saying. Yes, it's uh it's different, but that doesn't make it bad. This just makes it different.

E

uh So metasplate framework, David, Amir and I discussed this in the last meeting, letting no uh anybody have any concerns with just saying no here uh reasoning is here, and here.

B

I agree with no.

A

I agree with no okay.

D

All right, yeah yeah, it's widely used, but if, if it breaks nothing, you know nothing in production, breaks.

E

um Okay, gnats uh another one we discussed um it looks like an important. You know uh message passing for you know: Cloud native Greenfield applications, but the uh the current usage doesn't show that it's that you know as ubiquitous as a lot of the other things that we're saying yes to it is a cncf project.

D

I'm, sorry, which one are we talking about again? Yes,.

B

Number 38., okay,.

E

Maybe it's an up-and-comer we'll be there next time.

B

I'm, okay, with saying no for now.

D

I guess the question is: how widely is it used right, I.

E

Mean I mean it's a high doctor pull account, but not one of the highest um and yeah Dr Polk County, that's skew towards you know container, like I think this is used in like Greenfield kubernetes Cloud native space, okay, but that's not solely like gonna make it critical I. Think right.

E

um Okay, next cloud, it's popular.

E

um I think an argument I had against this one is it's more like for individual user, home user type usage, not running critical systems. Anybody have any.

D

I'm actually typing on the previous one, to try to capture what we just said. I was saying for the previous one, not clarified as wide enough use, we'll need to re-evaluate if its usage uh significantly increases. Is that fair, yeah all right all right now, which one we on uh next clown? Next Cloud? Oh, my goodness, yeah I mean this one I'm, actually yeah I I put on popular and on the fence. The thing is this: you know if you want to have something you controlled yourself. This is a pretty common thing to pull out.

D

You know it's your own little server, so.

E

I think the question is like: is it powering critical systems in the world and I would lean towards? No? There.

D

Yeah I remember how many organizations use this.

D

Because if an organization um you know uses it, for example, for all of their data and editing and everything else, it suddenly does come become pretty critical.

E

D

So, as I said I'm on the fence on this one, certainly the docker counts: High Enough, oh yeah,.

B

Well, there is next Cloud Enterprise there.

D

E

Is that open source.

D

B

Well, I mean the next Cloud itself is all variants of GPL, but yeah I, don't know whether the Enterprise version specifically the base, is.

D

Right yeah I mean I, don't know how how often the these things get used, but uh um I mean they. You know, at least for the Enterprise version, they're talking about HIPAA and so on. So.

D

I wish I had more data either way. As I said, I can I think you can make a decent case either way.

D

I, just don't have the usage data. uh Let's see here. Maybe I can find that.

E

I think we we see it's highly used and the question is who's using it. Yes,.

F

B

And all those Docker pull account I mean at that high. It I mean maybe I'm making the wrong inference, but I wouldn't expect that personal usage would be Docker specific and have that I mean there. It seems.

E

Rather, everybody's like home Naz, is like Docker based: okay yeah, you just like load in a compose file, and it just sets up your next cloud or something for you, foreign.

D

Yeah, here's a market share analysis I mean you know relatively now to be fair, I think the num the company size are based on their Enterprise product which is based on, but not I, don't think is exactly the same as right.

E

Yeah, like there's all the they have all these case studies here on their website for the Enterprise product as well. Yeah.

D

E

Yeah I was looking towards no and just say, like um Enterprise may be used by critical systems, but it's also not clear it's how much the open core part of it is.

E

You know part of the Enterprise offering right, I, guess yeah.

D

Okay, popular but unclear how much of the OSS version is widely dependent on.

E

D

As opposed to its Enterprise version,.

E

Thank you capture.

D

The it's always hard to capture the sense of a group, so I, you know tell me if I got it wrong, please I think we need to try to capture that, even though it's imperfect yeah I mean if.

B

You look at any of the those case, studies or white papers. You need to give them an email. I mean it's very corporate yeah, so yeah this I.

D

Yeah and corporate's not wrong, it's just it's. You know it's a relatively small percentage of the overall Market. It's in um that's, not necessarily a killer. If it's where it's used is really really critical, but just.

B

D

F

B

But they also have a corporate sponsor to right deal with any criticality. It's not like.

D

This right right now we have not used that as a Criterion one way or the other yeah, but but yes, that would be the next step. Is uh you know which ones need investment and probably not.

B

Okay, open EBS, yeah.

E

Is this one easy or do we need to if we have one minute left.

E

D

Doubt this is gonna, be easy, yeah, it's a storage solution for kubernetes.

F

E

Okay, well I, guess till next time: okay,.

D

Well, we made some progress. It's hard. It's logging through.

E

uh Thanks everybody for joining yeah see you next time. Next time will be APAC friendly time again.

D

Take care everybody.

F