OpenSSF Securing Critical Projects WG, 9 Feb 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Securing Critical Projects WG Bi-Weekly (February 9, 2023)

Description

Agenda: https://docs.google.com/document/d/1MIXxadtWsaROpFcJnBtYnQPoyzTCIDhd0IGV8PIV0mQ/edit?usp=sharing

A

B

A

I just realized that there's a note working session top and break and the time is aipac.

B

A

I on the correct time is the question you.

B

A

Oh good, all right.

B

I, don't know why it says: break.

A

I think the notion was oh.

C

B

C

Oh no he's gonna update that can. Can you guys hear me yeah.

B

G'day Jeff, hey I,.

C

B

You're doing okay after the insanity of the last month, yeah.

C

I, don't see myself am, is my right is the correct camera on for me.

B

um It's in front of your face, so, okay.

B

Can hide myself with you, so I don't have to look at me.

C

Let's break in.

B

A

I'm sad because this is actually scheduled on top of another open ssf meeting and.

C

So, let's just.

A

You can't win sometimes yeah.

C

We we did a survey for the Apec time and it changes a lot because of daylight savings, because we move in opposite directions, and so we did the survey for both before and after daylight savings.

C

And then this one ended up here. Yep.

B

I, don't so I don't mind it being an hour later to be honest, yeah well,.

C

B

It's not as great but.

C

I think all the East Coast people were like trying to vote on this one. You know pushing you earlier Caleb, because.

B

Yeah fair enough.

C

A

On the US east coast and our the problem for me is actually, if you move in an hour earlier or later, then you hit a different meeting right. You can't win I can't win yeah I.

C

Think it would need to be two hours later, yeah.

A

Because one hour later, there's a scorecards meeting and an hour earlier is a uh uh uh government sport uh thing. So uh was it the uh is that governance or is that marketing, I I forget okay, anyway, um all right.

C

A

B

Got a couple of gender items, hopefully in the right places, I think.

A

Yeah so I managed to go off on vacation and I'm still trying to recover if.

C

A

Makes any sense so if, if for nothing else, if I may ask for a brief update of where we are on the uh on the update, um I'm happy to help or needed I'm delighted if things are ongoing and you don't need, because I've got three thousand I'm trying to be helpful in support of the folks. But if you don't need help, uh are there other foods to do so?.

C

Yeah we'll do that.

A

First, okay, so all right, so this is a uh it's an update really on the uh list right, update.

C

A

An update well.

C

Yes, current status, the schedule updated is actually I'll talk about it now. So let's talk about that now no new faces looks like thank you. David and Caleb uh I'm gonna update the table. So uh if you're in the group I don't think I'll present, but um if you're in the doc there's a table further up on work group working session tracking table. So this was our proposed um uh timeline for getting the updated list, updated. I.

A

Guess: where's the uh where I I see the document but I'm looking for the scroll.

C

Up a little bit, there's a section called work group working session tracking table.

A

Oh yeah, all right tracking, I'm, just gonna look for a tracking table. It's.

B

um It's the only table above the.

A

Oh there, it is okay.

A

Okay, so there's a voting and discussion yeah.

C

So we're actually I'm updating this right. Now um we're pushing back one meeting uh so where's.

A

This updated sheet is this something that I or other people who want you want comments on? Is.

B

This thing related to the email that you sent to the mailing list and.

C

Posted into this.

B

Like yeah, okay,.

C

So um after 323 is going to be.

C

um Or six, so let me put that there, it's so d46.

C

I guess this would be an Apec time so as an update.

C

um We did our. We did two working sessions, the last two meetings: okay, um we finished uh polishing our uh updated list or updated list with proposals and everything and Our intention was to get a RFC out last meeting. However, uh we were unable to accomplish that.

C

In a last meeting, there was a little bit of polishing of the um spreadsheet that I needed to do uh before the RFC, and then I wrote up the RFC text and Amir and I met uh earlier this week, just to make sure we were both on the same page um and so what we wanted to have was a four-week time period for people to um uh respond to the RFC. So since I only got that out this week, um we'll then push everything back.

C

One meeting we'll have a normal meeting this week and for the next meeting and begin voting discussion on three nine and um and do that on 3, 9 and 323.

A

Okay, so I have a link uh securing critical projects working group list of projects identified as critical, uh Google doc ending in xtdm. All caps is that the current.

C

A

Like our old one,.

C

Click on this RFC sent out ideas for the reach, so I, so I guess kind of moving on to the next next.

B

Yeah, that's the link at the end yeah.

C

Yeah so I sent out the RFC um only to this working group on the mailing list and to slack that contains the link to the correct sheet.

A

C

So the first two tabs or the RFC should contain the instructions. You know the first two tabs show what uh we're asking people to do.

C

um Comment on any line on the current list to say like if you think it should be removed and comment on any line on the proposed lists for your reasoning, why it should be added or removed.

C

Do you all see that, yes,.

A

I'm, looking at that list right now, it.

C

A

Is it it's one where the name I mean earning the GID? The name ends in xtdm, slash edit and.

C

A

With the amp project and ends with uh log for J, I believe yep.

C

That looks right so um question for you all is I I wanted to send this out more widely um any suggestions there I asked operations. If we could send this to the announce list, I don't know if that's appropriate.

A

It seems like a lot of folks.

C

um But I mean we do want everybody to feel included in the decision making process, even if they can't attend our meetings. When we're doing the consensus discussion.

A

Okay, I see that.

C

Ain't so I don't know what other um channels we should try to use for that.

B

That's a good question: yeah.

A

I mean to be fair: uh it's not that just anybody can edit anyone can make a comment, but that's not the same as an actual edit. So yeah.

C

So we want people to comment then, when the working group meets to do the consensus discussions, we will take people's comments into account with our discussions.

B

Oh, it's only on comment. Only I think that that's much less problematic I was like imagining that.

A

Everyone would be updating it, but you that's why I checked that first yeah.

B

Yeah that definitely makes uh yeah in that, if that's the case, I think, apart from creating work for whoever's going to have to read all the comments um more broadly sharing, it is not a bad idea. um Yeah.

A

I I assume that, basically, this group will walk through the comments and then adjudicate, and you know if they don't agree with the comment. That's okay, but at least it was considered exactly.

C

A

Foreign ette discusses removal addition also.

C

Yeah, so there should be the RFC should say: there's two actions to take. Look at the first tab for removal. Second, tab for additions.

B

And because it's a spreadsheet, the tabs are at the bottom.

A

Of course, okay, all righty, and presumably they can add some more.

C

No we're not accepting uh projects, ah okay, consider it a new new project, consideration so that'll be after we do one one we'll make a call for right um submissions for one two, and then we can repeat the process got.

A

It I am amused that you're, including Debbie and Ubuntu sentos.

A

C

Are things people suggested um so I'm not taking we're, not we're not making any judgments? Now um when we made the last release, we got feedback through issues. We got feedback directly. We've got feedback in this in these meetings, so we try to incorporate all that um all those suggestions in the um candidates.

A

We sent to us in some ways has really changed too so I'm, not sure that that's the right.

C

A

I see what you're doing you're just saying hey: um these are things that people suggested that doesn't mean that they'll be necessarily accepted. It's just. We want to get everybody's feedback on them. Okay, yeah got it. Okay,.

A

Do you think we've got enough people already in terms of feedback, or is that.

C

No I mean we don't have very many comments. I, don't think we have any comments so um yeah we want people to again, you know, I, don't know like I. Would much rather have people show up at the meeting, but um if they can't you know, I don't want anybody to feel excluded.

A

Yeah, what okay? This is my apologies because of course, I've been gone wrong on vacation for a bit. um uh We had talked about adding columns for particular reviewers, so they could quickly make comments asynchronously and then review that, um whereas we, it looks like there's just a single column at this point, um which.

B

A

That people are going to be stomping on each other. Possibly do we want to add columns for individuals or not.

C

I, don't think so. I think anybody can comment on the one column and then we can see all the comments at once. Okay,.

A

uh All right, let me all right. Let me oh oh, this is interesting. You have to click on it. It's just a little shade. There got it. Okay,.

B

Usually, there's a way to view all the comments.

B

And step through them, I cannot see that in this I haven't played with comments in Google Sheets.

A

Yeah I don't know that that's the case for comments and do Google Sheets, that's one of the I think that was one of the reasons why we originally talked about columns. So that would be easier to see in the comments.

C

We did a little test and it looks like there's only one comment thread per cell, so hopefully yeah everybody comment on that same cell.

B

You can you can open up all the comments. uh There's a little button. Oh.

A

There it is yeah and there's a.

B

Link under one comment that says open up all comments, so you can. You can do that, but you should. You can also change it from all shades to current sheet as well and it um okay, how's.

A

This yeah I'm going to add an example reply and then I'm going to open up all the comments.

A

Yeah. Thank you. There's the magic okay yeah I've used I've used Google Sheets I've used comments on other programs. Just this particular comments. uh This particular combination I, haven't. Thank you perfect. All right. Well, I know if it's perfect, but at least it works, adequate, adequate yeah.

C

A

Not so sure I'm excited, but you know what um I think it gets the job done and that's the that's the important thing: yeah. Okay, very good.

A

C

A

Have any comments I'll take it.

C

Yeah, we don't have any.

C

Which is telling me that my current email and slack post isn't enough or people just are lying when they say they care about being considered.

C

They don't actually want to go and look through all these objects.

A

Well, you know what um it was a lot of work to come up with this initial list, so I totally get.

A

um You know some of the questions, some of the issues.

A

I guess one of the challenges here is: you know, what's critical uh for some of these, for the most part, um I would think the biggest concern would be subversion like um it's absolutely true. That bash has been involved in a remote, remote code, execution, vulnerability, um I'm, not sure if you're. If you're aware of that, it's a funny story involving shell shock.

A

Are you familiar with this tale of whoa? No.

C

I well, I probably am but I forgot. Okay,.

A

Shell shock, um basically, uh okay, bash, has supports um shell functions, definitions, okay, which is not unusual. In fact, it's in the positive spec, what's not in the positive spec, is what happens when a shell calls? A shell and Bash store actually passes on functions to other environments, which is cool the way they did use environment variables. However, it basically trusted environment variables, and it turns that there are cases where and when um an attacker shows up on a website, they can control certain variables.

C

A

The combination meant that you had remote code execution through a bash capability.

A

However, most the times if bash is vulnerable, I mean you can have a mistake, but usually bash is a processing untrusted.

A

You know what no I I'm gonna take that back though it certainly can sometimes so yeah never mind so I I think you know. I would certainly worry if bash is subverted, but I'd also worry just if it's, if, if there's a vulnerability- and it's brought some data, so I'm talking myself into just normal inclusion, okay, but this.

B

A

Kind of thinking you know, maybe somebody should try to write down very briefly, include because or don't include because.

C

Yeah yeah I mean yeah I. Think for the wider RFC. You know we can you know people can make their arguments if it for, for whatever reason they see fit, but I think with the working group consensus discussions. You know we're going to have the um our kind of guidance guidelines of you know things that reasons that make something more critical or not, and and try to agree on that.

A

All right so I, I presume what we're going to do is we're going to encourage people to make comments on these two tabs and, let's see version one one set on removal version, one one candidates: these are new ones right right and so those two basically those two, um those two tabs so yeah, okay, that's and indeed what your okay, fantastic.

C

Yeah so I think we just need to further reach um yeah.

B

I I think that, like I was just thinking about the way that I, like I, think that's very true. um Most people have an opinion, maybe about a small subset of the entire list. So um if you have a broader reach, perhaps you'll get an opinion about most things.

A

um Yeah yeah, so you know I guess my one comment would be if you're gonna send this out more broadly Jeff. So you don't um you know you don't have to comment on everything in fact. Just comment on the ones you have. You know a strong uh view upon.

C

Okay, well, let's um in.

A

That way, and and that way people won't feel because I I think when I first looked at me, I've looked at this list many times before and it is, it was a little overwhelming. The first time we looked at it.

C

All right, let's take a look at.

A

But yeah, let's get the broader viewpoints.

C

Let me share the the copy: I have real quick. Can you see my window I.

A

C

Okay, um so this is what I sent out.

A

Okay, who'd, you send this to so.

C

I sent this to our um workout.

A

Group list working.

C

Group list- okay, here um yeah and then I sent it to Slack as well.

A

And you didn't get much response, not.

C

Yet yeah yeah so.

C

A

C

C

C

Should just at the end say you don't need to add It, On, All or yeah.

A

uh Let's see here, yeah I'm only seeing the right edge of it, I'm not sure. What's going on here, I.

C

See how exactly.

A

C

Is that working.

A

uh Not in the way I would like yeah uh there's something I'm. Only getting half the window, um Zoom.

B

A

Yeah, can you expand the right hand Edge.

C

A

It's not cooperating, no.

B

A

C

Yeah now my zoom is totally locked up. I can still hear you, though,.

A

All righty, but you can't see my lovely face, which is just as well, because I didn't turn on my video.

A

um Yeah so since I can't see your screen, but you know what this is a Google doc right, yeah you put in the chat where that Google doc is I, could show up and see it.

C

The only thing is.

C

I, don't think I can get to chat because again, oh yes,.

B

The zoom is locked, my.

C

A

Is totally locked like, okay? Are we stuck with with you telling me the crazy number.

B

He just has to plug it into a URL shortener.

A

This is this is where maybe an email.

C

What's what's your email.

A

D-Wheeler at linuxfoundation.org DB alert d-w-h-e-e-l-a-r at linuxfoundation.org.

C

So I shared with you.

A

All right that is I got it all right technology sort of alrighty. um So let me switch to suggestion I'm going to be put in suggesting mode.

A

Yeah, let's see here.

A

Yeah so I would say something like please comment uh on um projects in either tab you um uh where, where you have where you have information to share, you know, justification one way or the other to to add or remove well um I mean make this a please comment on projects in either tab uh don't feel obligated.

A

To comment on on all of them, something simple like that:.

C

C

um Yeah sounds great.

A

You know I I'm, hoping that that addition will mean people won't well.

C

A

Won't say no just because they.

C

Don't have a comment for every line: yeah really yeah yeah. Frankly,.

A

um I wouldn't expect someone to have a comment.

C

On, of course, yeah, okay um and any ideas for if we should try to send this on another mailing list or.

A

I think you want a broader call, I, don't know what the right way to do. That broader call is, um but um yeah I guess I mean do we want to send it out? Let's see who I mean we could try to send it out to everybody who's working on openssf? That seems a little extreme, um which working groups would be most related.

A

B

Yeah I was gonna just like in some respect. I could just say, like you could send it to everyone in the open, ssf um yeah.

A

Like that's, that's pretty! That's that I I I.

C

A

I don't want to spam, but on the other hand, see the point.

B

The two that I think are somewhat closely related: are the um uh the vulnerabilities group working group yep um and actually maybe that's the only one um uh uh so even end users identifying um I, don't find security. No, it's identifying security threats is one end. Users is probably possibly another. One um I was feeling like securing software. Repos is possibly, but then you.

A

B

A different set of opinions as well so but well.

A

I mean that that's actually the point, though right yeah.

B

Well, that's true.

A

B

Fair Point.

A

I mean the the software repos folks, they're you're only going to get feedback from the folks who are in that group um and I think that it tends at least last I checked. They tend to be dominated more by the language level and not the um uh not the system level and not the um container level.

A

But you'll still get a viewpoint.

B

I think the value of including that is that you may get more breadth across across different language projects um right right.

A

um The only real problem will be that they'll probably complain that wait a minute. Why are we not adding some new ones here.

B

That's probably that that would be my expectation as well um and it will be like top end projects or, like uh some personal opinion, about some from that ecosystem, that they're um responsible for so but that's that's okay, I mean this is the best effort um list, not a comprehensive list. So.

A

Yeah and I guess the reason you've frozen it for the new ones. For the moment is so you can get it done within your lifetime. It is I presume the reason.

B

That's a reason for Jeff I guess that is the case.

C

A

You're back yeah there we go okay, yeah.

C

Yeah people keep suggesting, then they they, uh it just goes on forever. So we have to have iterations and rounds. Okay.

A

All right, so this is this is for this run, and this is for the 1-1. Obviously there will be there will be some opportunity in the future. I don't know if that should be I, don't know if you want that in in that text as well.

C

I did include that yeah. Oh.

A

Yes, you did. You did Fabulous, okay, I'm just done thinking through great.

C

A

Yeah um I mean I, don't see any reason why you can't send that out to those other working groups, um I mean yeah. On the one hand, there's a risk of it. Looking like spam, but I I think an openness is a project asking for help from an open. Ssf project is fair game. Yeah.

B

Yeah I think that's fine.

C

Yeah, do we do we have a decision on the working groups? I I dropped off came back.

A

I, don't know if we have a decision, uh but let's see here um so, let's see here I'm going to go back to the RFC, which working groups are related, okay um and should be and and should be and should be emailed right. Yeah, that's what you want to know everybody's related! Oh wait: I gotta, send an email all right, I heard securing software repositories pick a list because we argued about it. um Okay, yeah, let's see here and I, think the vulnerability disclosures because they know where the vulnerabilities keep you getting reported.

A

Okay, I think I'm gonna list them first, not because not because I mean they're focused more on process, but we're hoping that they know where the bodies keep getting buried.

A

uh uh I mean you've done it to yourself right.

A

Besides their own right.

A

Okay, which open ssf working groups I really should be emailed uh vulnerability. Securing critical projects- oh I'm, sorry, security project- is this um I think we said end users I mean, frankly, that's probably the best one of the best ones.

A

I mean you: can you could certainly make a case for any of these.

C

My only worry is that if people are on a lot of these they're going to get the same mail a bunch of times versus, if we like, if we petition for an ounce but.

A

Well, I, don't know, are you on these groups by the way? No.

C

Not exactly so, okay.

A

Yeah, you know what I would suggest join each of them at least for a bit and then send a single message out with to those multiple lists.

C

A

I think if it's a single I think if it's a single email and sent out to all.

C

Three groups: yeah, okay,.

A

um Then at least there's a chance. It might be smart and.

C

Do it all once yeah.

A

Because it'll all it'll set me sent out with all the same message: IDs.

C

Yeah yeah, okay, that sounds good.

A

At least a chance of reducing it yeah uh best to send out simultaneously so email uh so to reduce this so that duplicates might get removed.

A

I don't know if the uh if the sending software removes, because this go actually goes during our list of work. If it doesn't then email, clients that receive it might be smart enough to figure out the remove. Otherwise, oh well.

C

C

Sounds good um should we move on or you think these three are enough: I guess: yeah, okay, um yeah current status. We did that earlier.

C

um So yeah I want to do some project updates, um so for All-Star, I'm uh I was looking at the tax um documentation. It looks like they have a lot more documentation. They used to have, which is great on processes and- and things like that, so um it looks like for if you click the link there to the tech working group abilities uh under technical infrastructure.

C

It says working groups are free to use whatever resources they can find or solicit help from Member organizations or to request funding from the openssf governing board through the TAC um for All-Star. I would like to request um funding for technical infrastructure uh and so All-Stars part of this working group. So this working group would be requesting that would be positioning the tack on behalf of of the um the project. Okay,.

A

uh Formerly just so you know in my tell me if you already know this because I don't know, if you do uh formally, only the governing board can approve funding, but the reality. Is the government board immediately when somebody says Hey money, they immediately turn around and say: okay, great but pack. What do you think yeah.

C

Yeah, it says it says here you request: funding from the governing board through the tech.

A

Yep, that's yeah. The reason that's worded that way is.

C

A

The governing board is the power of the purse, but they always want to make sure that it makes some sense, and so they ask the tax for for review.

C

Yeah, um so so, there's an example there that um somebody else um I think did so. We wouldn't want to do something similar to that um and I wanted to I. Have some text I wrote up.

A

C

um Just paste it here, instead of doing another doc or something like.

A

That so the update, update, contributor guidance, no.

C

No, this isn't a different thing. Sorry I'm getting all my indentation okay.

A

I, looked at that indentation and I I interpreted it badly.

C

Let's see so look like this.

C

Is the event comes through um so essentially we'd basically say um the secure incredible projects working group is requesting funding on behalf of All-Star. um What what that.

A

Is from issue 132.

C

A

Okay, this is just okay, its own thing, I'm.

C

A

Delete the blank lines just so, it's.

C

Yeah, it's gonna.

A

Straightforward, okay, so.

C

I gave some kind of um background of the project and then it's been working on and that people are using it um and that essentially, that we were just requesting some uh funding there. So the background here is that All-Star has some infrastructure uh currently, but it's not um there's some stipulations attached to it, which make it not very neutral so I'd like to have um infrastructure without those stipulations.

A

um Okay, tell me if you can't really talk about the stipulations now, but I mean sometimes the stipulations are just like things like. Please don't run malware on my on my application and don't run and.

C

A

And do uh you know crypto coin mining.

C

A

So everybody has some stipulations: yeah.

C

That would be fine, the stipulation is the access to the infrastructure, so the the donation we have here is that they must retain access to the yeah to the.

A

To the, what do they mean by access.

C

um Just ability to to to to read the data essentially or to access the the secrets, app stores.

A

I'm sorry, the.

C

Secrets for the app that that allows it to talk to GitHub uh the data, any just basically full access to the infrastructure.

A

Okay, all right and what's the re I mean if it's just Gathering public data, that's not.

C

It's not Gathering public data, it's Gathering, it has private access to people who have installed the app and private data like.

A

Oh yeah, okay, so.

C

When I say when I say instance run by openssf, um that should mean the maintainers of the project, not um also the infrastructure providers.

A

Okay, yeah I mean the reality, is any infrastructure provider if they want to, can obviously get access to whatever you're running you have to trust them to.

C

Sell yeah, that's true, I agree with you there, but um so.

A

What I'm, trying to figure out.

C

A

Special here, oh.

C

Yeah, but this is not yeah. Okay,.

A

I I think the the reason I'm I'm not really trying to push back exactly I'm, trying to anticipate the questions. The tax is going to have right.

C

Yeah absolutely.

A

um Yeah- and you don't want to imply that hey you're, not grateful for the gift, you are yes.

B

But on the other.

A

Hand, the particular stipulation is you're uncomfortable with yes and okay, I I think. Basically, the challenge is um Pro. I mean this amount is not much in the grand scheme of things.

C

A

um If you can make it clear why it's needed, they're, probably going to say great and tackwell governing board, will um in fact uh the governing board actually has approved some funding ahead of time for some infrastructure, so that fits within within a pre-approved amount. It might even be really easy to do this. However, the tax is going to immediately ask the questions that I'm asking iterations.

C

A

I didn't want, what exactly are there stipulations yeah um and why are they a problem, because every account every cloud provider has stipulations and in fact every service has stipulations.

A

um So you know uh your DNS provider will mandate certain kinds of uh content not be allowed whether or not they should that's another question, but they do so it's just. You need to make it clear why or which stipulations are you're uncomfortable with, and why and I bet once you do that you're, basically making basically making an argue for money for money when things are getting paid for right.

C

A

A problem: what's the problem, yeah and I, think you only need a sentence or two to resolve that, if you're not comfortable making that public by the way the details of it um feel free to make that in a private uh communication, we try not to do that. We'd much rather work in the open, but.

C

I think this is um I think this is public yeah, okay,.

A

Great all right, yeah we'd much rather there.

C

A

Sometimes as you when you really can't, particularly if it involves me or bad, but so.

C

So current infrastructure is probably fun with stipulations to retain access infrastructure All-Star. What.

A

Does that mean yeah.

C

A

C

uh I'll start is granted elevated.

A

C

A

Includes including Secrets maintained by it.

C

A

Including Secrets maintained by All-Star.

C

Hey sass um I'll start screening, La permissions and data access.

C

By the users to install it on the organic organizations.

A

When you say a community run app instance: where would it go you do you think it would still go on Google, Cloud platform or somewhere else wherever.

C

The credits or or uh our money works that is granted by the by the funding yeah on flexible here. Okay,.

A

I got it a little bit; I mean let's say that it still ran on Google Cloud platform.

C

A

Moved it to Azure or AWS I mean those are the you know, those are the most likely yeah.

C

A

Although I can see Lenovo or something else, um wouldn't they all have the same privileges, not.

C

The Privileges that not no I mean in your in your suggestion that yeah in the back end, you know they could do. They could still get whatever you want, but like right, Cloud infrastructure providers make some kind of promise that, like we're not going to go in and read your your data right.

A

Okay, so the in um in a way that so it's not just granted All-Star all elevated privileges in ways that aren't typically granted for running. Is that your point? No.

C

No, the point is the stipulation of retaining access is not just the fact that it's running on their Cloud, it's that it's somebody's saying they want. They need administrator privileges on the for the whole infrastructure, for the project.

A

That is, they uh uh must have administrative access. Yes,.

A

To the instance, with the ability to read and use.

A

Okay and we're concerned that, uh and we and we want to their uh and we want to limit.

A

Those who um we don't want um I, don't know, maybe maybe that's obvious yeah.

A

Yeah I guess I would have to look at the.

A

Her this may be an offline conversation, because.

A

I'm just struggling to see if, if the, if they're running out on their Cloud, they already have access David.

C

I mean people they promise like you know what I mean.

A

Like I hear it yeah.

C

I mean I know the skeptic is like yeah, okay people. You know if you're running on a cloud they have access, but that's I'm, not talking about that I'm talking, I'm, saying I'm, taking at face value. You know, there's running it on a private on a project that is you're the only one on the list of of access to it and and not.

A

We okay, we prefer to run in a situation where the provider promises to not access uh this sensitive data.

C

Yeah but I mean that's, that's my default like.

C

A

C

Okay, um yeah I mean I, can Wordsmith this or you know to yeah.

A

C

Like what the tax is going to ask and um like I would also show up to the task attack meeting, but um in general um does this seem correct for the working group to go ahead and request funding.

A

Absolutely absolutely you can always make a real quick. You can always ask they can always say yes or no well,.

C

I'm I mean I, can't I'm I'm the chair, but we're the working group. So I'm asking you all as the working group. Oh.

A

Yes, okay, uh yes sure, yeah, yes, I think that's entirely appropriate. Okay,.

C

A

I it sounds like in the end, this is going to be fine, but I just anticipate the tax gonna ask.

A

Although we do want to be wise about spending money, yeah.

C

A

uh We also just want to make sure that um we set good precidences, so you know before before we spend money. We want to know why the money should be spent yeah.

C

A

Suspect, in the end, once this is well understood, it'll be perfectly reasonable, but we just want to make sure that it is.

C

Thank you. Okay,.

A

And in the end of course, obviously the attacking government board can do whatever they decide to do. Yes,.

C

Yes, okay, so moving on uh another All-Star update, contributor ladder, PR is out and I think you wanted to talk about that also Caleb. If we could I don't know if we have a um a general contributor ladder for the a recommendation for the for the foundation, maybe we can adopt this for that. We.

A

Have a ladder for the we have a ladder for projects, but this is for individuals right, yeah,.

C

So, for in in a in every project, you know you want to have a contributor ladder that shows how you know. Community members are what the the expectations are for who's going to be a maintainer who's, going to be a leader that kind of stuff, um so I think it's always good to have that transparent and written down for these code-based projects, where, where people contribute to.

B

Yeah I'll have a contributor, specifically on criticality school, who has asked and I'd like to have an answer um around. What I should use here, unfortunately like I'm, basically, the only maintainer of that project and so making a uni unilateral uh contribute. A lot of decision didn't seem appropriate.

B

So that's partly why I'm bringing that up here as well, like um I, can uh wait until the All-Star one has been uh agreed upon and um suggest that for the criticality school repo or we may want to more I may want to raise this more broadly across the open ssf of having like a template or like a default contributor ladder um available for pro, like that's for projects um so that we can give contributors who are working on the the code and the repos some sort of sense around how they contributed contributions.

B

May affect their ability to be like a member of the project. I think um it may encourage people who are unsure about how they're um their investment in time would be um rewarded. I suppose, although being a maintainer, is not necessarily reward in that sense, but yeah.

A

You give them more responsibility, but yeah yeah I, don't know of any reason that or you know any one part of the openness instead of can't set those up, I think it's perfectly plausible to say: hey. Maybe we ought to do this more broadly.

C

A

But you can, you can start with it in one place and go on quick note on the uh our code of conduct. The open ssf has its own I would suggest just just linking to that. Instead of trying to I mean it's more or less the same, but.

C

A

Thought I cut and pasted.

C

The open sf1 for mine, oh.

A

You did okay did. Did this one, have the open, ssf, URL uh email address, yeah.

B

I went and changed a bunch of them and I. Hopefully um that landed in.

B

Yeah because there's a.

A

Oh yeah I see it. Okay, oh I see okay, so it is okay, it is from there I thought this was just the uh okay all right, so maybe or maybe just uh maybe add a link, maybe add at the end, a link to the open, ssf, CSD yeah.

A

Okay, got it all right, I thought you just copied it from the original, in which case the email addresses would be. You would be, there would be no proper email addresses. So, okay, pretty good.

B

Yes, I should, in terms of um how I should handle this for criticality score. Is it worth um waiting for Jeff's PR to be accepted or well.

C

um Mine is basically from a proposal that I made months ago when we had some Community discussion on so I would say it's pretty. You know it's given a once over by a couple at least two different communities uh projects in the open ssf, so it's had some some eyes on it. I mostly wanted Cara to kind of work, Smith that or you know, I'm adding her as a maintainer. So I want to try to acknowledge that as well on the on the review before I merge it here, so I'm ready to merge mine.

C

If you want to copy it and merge one I think that's fine and and yeah like as David said I think you know we any any kind of template or recommendation would be just that a recommendation or a starting point that uh any project should be able to tweak this for whatever for the needs of their own project, but having something to copy would be nice yeah.

A

Any project if they've decided that there's a particular way they want to run generally you're fine. As long as it's you know, it's productive, there's not like clear. You know.

A

I can't say literally everything you can do anything because it's not true, but it's hard to imagine you actually proposing something insane yeah so, um but.

C

Would there be a repo that we would check this in is like uh here's, a here's, a template I mean not maybe not the template repo, because people always copy that to start a uh like a working group or something but I don't know if it would be the tack, because maybe they don't have anything to have an interest in this. The.

A

Tech already has guidelines for how to um label projects yeah.

C

A

It wouldn't be insane for them to also declare here's how we expect contribution guidelines to run um I mean I. Would you know I would say hey start with this and say hey tack. This is what we're doing for now. We might want to later on propose this up as guidelines across the open SSM, and you know you can just email them that and then give them a heads up, and then you could say: hey we tried it out. We think it works and we raise it up. Sounds.

C

A

That's how I would do it.

C

Yeah I agree Caleb. What do you think.

B

uh Yeah I think that's a good idea. Sorry I just was distracted and missed that exactly, um but.

C

No you're saying, let's both we'll both merge these you merge one and then once we have both of our projects using it, then we can say hey. This is working for us at a at a later date: yeah yeah, okay,.

B

A

I, don't think that's a great.

B

A

Yeah, in fact I would I would go, merge it in tell the tech. This is what we're doing and later on. You know and presuming that it works for us, we'll tweak it a little bit and then uh we may propose it up. You know for a broader consent and that way, they've you've, you stuck the idea in their ear and.

B

For reference as well, the six door project has a ladder as well. So um yeah pointed me to that: Jeff yeah.

C

A

Yeah I, don't think anybody in the tech would be surprised if you have a ladder, be it formal or informal, but uh uh but yeah I I think I love the idea of trying something out in a particular project. It works, you tweak it and then you raise it up higher and higher I think that's how a lot of good work gets done.

B

And it's a good way to adopt things like from the Grassroots, rather than having it being mandated. Yeah right.

A

Right I think usually the Grassroots is the better I mean there are I'm sure you can find cases where it's not, but yeah I mean the advantage of Grassroots. Is that you then tried it out, and you decided whether or not it worked before you tried it on anybody anywhere else.

A

And you learn so much by doing laughs.

A

Oh we're running out of time.

C

B

Yeah yeah I only have a really short update on package analysis. uh It's just worth some context. uh Oh it's worth providing um uh that our team at Google have been talking to check marks and um that we're collaborating there.

B

um If you've been bothering to look at the issues on the reaper on the GitHub repo, um you might have seen a few coming from them, um so they are looking to contribute.

B

Some analysis features um particularly around https unwrapping um initially, and we're also collaborating collaborating on how to share publicly um uh detections on malicious packages um so that that will, like so part of the package analysis project, we'd like to be consuming that data and producing uh like public detections from it um that sorry, that I say we as in Google um and would like to like and encourage other for profit or the non-profit companies who are doing the same sort of work to be also publishing their work publicly, because that helps um I think in open source world having open source data is kind of a nicer, a good idea.

B

It also means that um people can build tooling around it um and and repos can consume it and all those sorts of things. um So that's another aspect to this work that we're talking to them about. Hopefully um we will see some results from that within the next quarter or so so, and I probably will have to come back and talk to the open ssf about how we make a repo like well considering using osv to do that and how and putting that in a repo.

B

So we'd have to come back and talk about how that might function with the open ssf. So that's yeah! So that's basically the update I've got at the moment. It's all very new news, there's not heaps of investment in that space, um but.

A

B

A

Yep I just heard a presentation from check marks about their uh their. You know: efforts to detect malicious code, so awesome.

C

Yeah well, thank you all for joining um again. We have another regular meeting next time and then we'll begin. The uh consensus in four weeks.

A

Excellent thank.

C

You nice to see you bye.