OpenSSF Security Tooling WG, 25 Apr 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Security Tooling Working Group (April 25, 2023)

Description

Github: https://github.com/ossf/wg-security-tooling
Notes: https://docs.google.com/document/d/1DoB7zgtLsP-JGF77ASkHV7UMofTE2wseniexaa6Q4M8/edit#

A

Oh hello, Chris.

B

Hey good morning.

A

This morning, not for Dan.

C

A

Made it back from Japan, huh yes,.

C

I'm a little jet lagged.

A

A

I was what are you there for ww3c I.

C

Think you said yeah, it was a tag um meeting like it's the group that I co-chair and um we have one member who is based in Japan, and uh we also have a member in in Beijing who was supposed to come, but I unfortunately wasn't able to come. But but the like, we are we're always asking the who lives in Japan to you know, travel to London and travel to Reykjavik and travel to Boston and all these places. So every once in a while a meeting in in Japan and he can host us.

C

He works for Google he's a so uh USS at Google, uh Google's offices in Japan and Tokyo. Well,.

A

I mean there's a lot worse places you could go for a meeting. That's.

C

True, that is very true.

A

C

So yeah it was, it was I I'm not gonna lie. I spent I took a couple of days to do some to bookend the trip with some some Japan uh tourism in uh you know both sides, but nice yeah.

A

I would definitely do the same.

A

I think it's going to be.

C

Pretty light today, yeah we're going to focus on um on the use case, talk yeah.

D

A

Gonna spend the hour going through it like whether anyone showed up or not was my assumptions. So all right, I can I know we'll just get cracking I'm gonna share the doc once I find it yeah.

A

uh Let's see the screen here will avoid the formalities of starting a meeting, because no one's here, which is lovely just, do me a favor in a site. Actually, I can just sign you in Dan. Oh wait. We got. We got someone else, Saba hello,.

A

How do I spell your name.

B

I think I gotta transpose the E and the L and apple can.

A

I get it backwards, app yep, you're right, it's a v-p-e-l! Thank you.

E

I'm from Nokia.

A

If I was smart, I would have just copy and pasted Dan's name from down here, but I'm not.

B

Just sounds like more work.

A

I am not a smart person, it's all right. Let's just work on this doc, then um I think yeah. We've all been around all right. All right, so I spent some time holy cow where'd. All these people coming from like this can be a real meaning. That's fine, all right! So anyway, I spent some time. I was on the road. Last week, so I went I looked through this a bit and made some changes.

A

Nothing major, but I thought I wanted to just go through it again with some people to make sure this still makes sense. Well, I'm gonna suggest I'll put a link to this in the chat.

A

I, don't know if I can find the chat. I, don't know my chat is there, it is Zoom is hard, but so my thought was just to go through it and if people have thoughts or ideas, we'll write them down, we'll we'll Wordsmith it a little bit and then, when we're done, we're done I'm, not looking to kill a ton of time here.

A

So I, don't remember who was here last week, so I'll just go over this again. What we did last week is Kate Steward started putting this document together like a really long time ago, and we basically are the top, is notes. So we're going to ignore all that, and the bottom is just identifying some of the use cases this group sees for s-bombs I mean it sounds simple, but it's unfortunately not, and so, let's just like, let's start at the top and and go through and see what makes sense uh if.

C

Anyone has any comments, let's just say sorry when you say bottom, you mean everything that starts at use. Cases yeah right right, okay,.

A

Yes, thank you, and if anyone has any questions or comments, just jump in, we don't need to worry about hand raising or anything, there's not enough. People to matter today, which is great I, enjoy small working groups like this, and you can get a lot done because we aren't going to argue for 25 minutes over some detail.

A

Oh anyway, all right cool, um all right user needs. Okay, so the first one we should probably do. We need to clarify that.

A

Yes, I think we do so we're.

C

Talking about I mean yeah.

A

The consumers of s-bombs.

A

Is the user in this context right are we does that? Make sense?

A

Is that right? Yes,.

C

I think so, and I think that that Maps does that map into the or uh into the actors list, which is basically what's below, where it says producers of software consumers of software or do we need a separate list of who we're talking about here?.

A

We need to, we need a list you're right. um This is wrong, so we actually want. Is actors I, think there is user? What's that? Well,.

C

I, the re there's a reason: I was pushing for the term user need, which is that it maps onto some. You know kind of like some of the other stuff that I've been talking about in uh in terms of thinking about things as a user need as a but but I'm, not I'm, not uh well. Let's.

A

Particularly I'm.

C

Not I'm not particular about it. It's it's just a matter of like like, like the problem with the term use cases is that sometimes use cases can be really super granular, and sometimes they could be like very high level and like well like thinking about things in terms of a user need tends to put people tends to focus people's mind, but I wasn't involved in the meeting last week. So uh you know, don't don't let me hijack things no.

A

This is good, Dan I mean we didn't really Define user I think we let it flop around, and you have a good point. There's these personas exist kind of in the context of the use cases, but at the same time the use cases are kind of all over because we've got producers of software and they obviously create these s-bombs in certain places and we have the consumers of it, which theoretically are taking s-bombs from somewhere else or potentially generating them themselves, and so I think user isn't very clear in this context.

A

Because a user is a consumer in some instances and it's going to be like a developer or a producer. In other instances,.

A

Right, someone is typing.

E

May I ask a dumb question: yes, uh how's this distinct from the key s-bomb users and personas.

A

Where are those it's probably not right below it? Oh this yeah! That's what I'm thinking I, don't I, don't know if user is important, no, it is, it is, um and the reason it is is because when we Define the use cases, we want very solution. Focused use cases like. Why are you doing this?

A

Where I think you can end up in a situation where someone will say our use cases generating s-bombs and, like that's, not a use case? That's something you're doing like. Why are you making these s-bombs? What is the purpose and goal of that? So I think the user needs perspective, puts a focus and I I, don't know I'm suggesting I.

E

Mean maybe we could think of as like what are you doing with the s-bomb.

F

E

F

Would say well, no I would I. Would it's not? What are you doing it's? Why are you doing it.

E

F

What you're doing presumably follows from why.

C

I I mean I'm trying to write something that would uh sorry they uh so I'm trying to write something that kind of like to me scans, like a user need. You know it's a little bit more like not necessarily a story, because the story is All is, is you know a longer thing, but it's like they've run it. You know that this a person working in an Xbox in an aspa which is one of the key user personas um you know, wants to evaluate security characteristics of a software Library they utilize a tool.

C

uh You know a tool that evaluates uh Ms bomb associated with a specific build of that library. In order to you know, evaluate these characteristics, something like that right to me. That's a user need, and it's like it's. Yes, it's instructive about not only what the s-bomb has in it, but what the tool, what the tools? Why.

A

Isn't that just a use case, though Dan sorry? How is this not a use case? I.

C

Guess only because sometimes people might say use case is something quite quite more granular like uh and and it's and it's it's it's articulated from the perspective of a of the user right. That's the other thing. It's uh like a use case could be a system use case.

C

It could be like a um uh you know, written the system must do this or the or you know written more like requirements, uh um and but if we think about it from the perspective of the people that are using it, then it then it puts everything in focus into the into making sure that it's useful to people.

A

A

D

C

A way to to formulate the use cases- that's I, think was the point of putting this in here, as user needs perspective that we, when we're. When we're writing these use cases, we should be trying to think about them from the perspective of the person.

A

Yeah yeah I like that I like that a lot.

C

Yes, the license. Yes,.

C

Who's, the anonymous hippo.

E

That would be me.

E

So I mean licenses and vulnerabilities are pretty obvious. What are some of the ones that are less obvious.

E

A

That's hard to explain in a sentence the the use cases I mean: do you. This is the use cases right. I think this is where we start getting the use case, territory and I think maybe some of these use cases need to be tightened up a little bit if we think about it in that context, because like for example, obviously we say what are the licenses in my dependencies, I mean why? Why do you care right?

A

That's a use case, though I think and it's pretty specific vulnerabilities gets a little more squishy, because I think vulnerability is a feature of s-bomb that is used by multiple use cases, um but then you've got like, for example, IC customers. They just want to know what they have, because when the next log for J event happens, they want to type log for J in a search box, and then they know exactly what they have where they have it.

A

You see people worried about runtime stuff like what is actually running in my infrastructure, which is one that comes up a lot and it's always amusing, because if you scan all of your containers, you might have like millions of containers, but you might only have 30 that are actually running.

A

You know and that's like another instance where the s-bomb can drive a feature like that I think one of the other pieces to this I just had this conversation the other day we talk about s-bombs a lot like there's some like singular entity, but s-bomb is just really a tool in a larger ecosystem. S-Bombs will never Exist by themselves and if they do like you've done something terribly wrong.

A

F

If, if you have something that is all by itself and as a file with an s-bomb in it, that's not a mistake now. Clearly, if an s-bomb is just random uh bits, that's a problem.

A

No, no David, you misunderstand I'm, saying there's often discussion saying things like you need an s-bomb but like. Why do you need an S1? What are you going to do with that? S-Bomb just having an s-bomb for the sake of having an s-bomb is silly they're, saying I have an s-bomb and I'm going to use it for license compliance or understanding my vulnerabilities or doing something with it is even if customers are asking for it. That's a reason, but I think just saying like in s-bomb is not a tautology. Oh.

F

Absolutely absolutely all right we're really drilling down and I'm wondering if we're. Let me step back and when people ask me, why do you want an s-bomb I say there are many reasons, but for security they're, exactly two one I'm, estimating security risk of a program either one I already have or when I'm thinking about adding and number two I uh is the log for shell problem. I hear that there's a big vulnerability. Tell me everything that has it you know.

F

So, if I, estimating security risk was one and I'm looking for it everywhere too I mean there are many others, but I think if we don't include those two that that's a problem but.

A

We have those two down here right. Those are use cases I think we're putting too much content up here right now,.

A

I think this just needs to explain. We want a focus on.

F

C

A

Of the the why and the perspective yeah.

E

Would would the attempt be better spent going through the personas that we currently have and just making sure that each of them has this y component? Yes,.

A

I think so I think I think we're putting too much content in this section that belongs beneath it. So let's keep going um personas all right. There are more. These are the initial set all right Developers, so we list developers as creating open source building on open source and Enterprises building on open source in the Enterprise. Just like a an Enterprise developer. Do we.

A

Because our use cases I feel like don't Focus entirely on open source, but the developer for Sonos seems to focus on open source.

C

Do we want us is creating open source, actually multiple things, because there's like evaluating libraries that I might want to use in my in my open source application like say, I'm, building an application um or or a web app or anything right evaluating what what I want to use evaluating libraries or um other dependencies and then there's also generating builds in which case you're you're. So there are two but.

C

So it feels to me, like developers, also have this this you know they're. They have this dual they're going to be using a tool to evaluate the s-bombs that other people are are are generating with their builds and they're, also going to be creating builds with which they generate an s-bomb.

A

Yes and I can even think that, if you're a developer of an open source project, that's not the same as a developer, at sneak necessarily right, like sneak product as developers, working on open source and Developers, incorporating open source into the product and developers working on product features. And do we want to split developers apart in that context, or we just want to leave developers squishy and hand wave it away. I.

C

Think we want to I think we want to leave developers squishy, but I think we want to be specific in the cases where we are talking about open source. Okay, I'm, okay, with.

A

That so I'm going to get rid of this and I'm going to say that we are leaving the definition of.

A

Developer squishy on purpose there are many I can't spell.

A

Oh, my goodness,.

C

Outside bag, instead of squishy, but.

A

What's that oh squish, fine, fine! Your word.

A

Many different developers personas these.

A

ah Anonymous hippo, you have to move I can't see the word I'm typing.

A

Terry, no, that's pretty good it'll be clarified in the use cases, all right cool that makes sense to me I like that, all right, all right, so we're gonna leave developer squishy I'm. Okay with that, so then we said application. Product, Architects, product management generating are detecting us bomb generation, integrating from content security champions.

A

uh I do think all of these need better descriptions. I'm just going to add a note. All of these need better Persona descriptions.

A

Like okay uh sure didn't have any comments or questions on that I feel again. It's kind of squishy but I think it gets the point across.

C

A

B

Your question was uh which I'm asking? Which part gets the point across which oh.

A

Application product, Architects product management, so I feel like the intent here is. This is someone who is planning how s-bombs enter and exit your I I guess just development universe.

B

I would add what you just said under that yeah. That's probably that's actually a quite helpful context. If that's the.

A

All right, cool all right.

D

Just to comment about the first noun there application should this refer to a role as opposed to.

A

It's meant to be like an application architect.

D

A

I'll add that we actually discussed that last week. Also, okay of.

C

A

We didn't write it down because that would be easy all right. uh Last week, two weeks ago, whatever um open source program office manage s bombs, S1 product manager. So this one was interesting. Sarah Evans uh said last week that at Dell they have actual s-bomb product managers whose job is like wrangling s-bombs around the organization, which is amazing to me.

A

um So that's my product manager, dependency, apparently yeah, like that's the focus I mean I, would assume they do other things as well, because I feel, like that's, probably not a full-time job. It.

C

Feels to me like that, would go hand in hand with understanding what tooling you're using IBS I.

A

Would not disagree with that statement? I, yeah, yeah, um okay,.

D

A

D

We maybe also want to call out compliance here, um I think.

B

In some organizations.

D

This will be wrapped into.

B

Yeah compliance- that was one that was on my mind as well. It can fit in and I feel like a few of these different places so like, for example, at the downstream customers government organization level, um as well as in the security engineering sections. These are just two below um uh auditing is another word that I would like to see in here somewhere.

A

And I suppose so we want compliance and auditing compliance.

B

Auditing and then the third one that it's kind of the also kind of spread across all these spaces, as would would be legal um for licensing and for IP.

A

So we have so compliance and auditing are those focused on the open source, specifically as part of the ospo or do they do? Are they expect to do other parts of that or work with someone else? I? Don't I guess it depends? Doesn't it.

B

um I'm not sure I, understand your question. Well,.

A

Let me so compliance means many things to different people right. If you talk to an infosec team, compliance is going to mean something like sock 2.. If you talk to your federal team, it's going to mean 853. If you talk to your open source team, it's probably going to mean license license compliance.

B

Right so yeah, it's definitely an overloaded term um and one of the reasons why it kind of stretches across these different uh several different um of these. uh What are we calling these personas yeah yeah, um so I think you're right.

A

B

Auditing is the same thing. Obviously Matt.

G

A

Can just talk, you don't raise your hand yeah.

G

A

G

I I bound the ospo to to the general term of corporate security and legal compliance because they set the rules and that's all-encompassing. But it's relative to the corporation. So.

G

I can type type that chat.

A

I, don't understand what you mean I, don't. Can you clarify that I'm not following I.

B

Think uh might be saying that that in the large companies this is kind of all orchestrated uh in some level of parallelism and.

G

Yeah they set the corporate guidelines that all the you know, the oversight for all the all the divisions and projects and products for the whole Corporation. Basically, so.

E

G

Are setting the rules and guidelines and policies that you must work within and.

B

The compliance can mean different things to the different teams, but they're all sort of acting uh in concert. The left hand knows what the right hand is doing.

B

Hopefully, foreign.

D

I think one thing we're struggling with here is um different organizations are going to divide up these functions into different divisions or different different roles, and you know the Enterprise organization is going to look different than small and medium Enterprise.

G

I was going to say, you know, and you know all these all the specific security compliance programs reporting things are assumed to be part of that. But you know typically um corporations don't talk in terms of specifics. They don't adhere to one. Typically, they create their own policies and guidelines, and things like that that map to one or more external Frameworks, basically.

A

That makes sense and and yeah and I I remember that now you're shaking cobwebs loose from some past things, I've done.

A

Yes, all right all right, I, don't wanna I, don't want to dwell on this one too much either um I, don't think we're going to get out of personas today, which is good uh uh security, engineering.

A

This one feels fine to me: does anyone have any additional comments or questions I.

G

Was wondering if we should call out, since it has direct alignment with work being done in honored, Billy work groups? um Cert teams are here because there I know that one of my largest consumers in IBM for OS, Pro and first ESO teams is the is the our pcert team, our cert team, um because they're they're interested in what tools they need to employ to s-bomb or whatever, to do reverse lookups and vulnerabilities, and how to analyze. Things like that. So I.

A

Mean does this not cover that I I, I, yeah.

G

So yeah I mean I, see peace right there. So yeah I'm just wondering what yeah.

A

Right all right, uh procurement.

A

See like procurement is procurement or persona Maybe.

F

A

Does procurement not fall, I mean man, you probably have more insight into this than the rest of us. Like is procurement separate from the ospo. In this context, like does.

C

Oh sorry, go ahead, oh go ahead, I was just gonna say that they might have their. You might have an organization which has a procurement Department which really um wants to. They might have us. They might have us bomb related requirements that that.

C

Yeah that are so.

G

So there's so when I see procurement, three things come to mind, whereas we have the ciao office. Who basically has you know canonical toolingly procure that support security and compliance, so they procure and host tools for us, the Cisco team actually has their own subset of tools they host that are not covered by the CIO office and then a a separate context, but related is that a lot of that tooling is augmented by mergers and Acquisitions. So we actually have emergency acquisition.

G

Teams have separate tooling to analyze third-party software before we make them a partner or whatever.

G

Those are three teams, I I, answer to and get asked questions of every other day, but.

A

Those don't strike me as that's like vendor procurement, and now that I read this feels like vendor procurement, not open source procurement.

G

Well, they so yeah, it's it's third party vendor procurement yeah, but the the uh the elephants yeah. So the CSO teams to see those team. If they have involves open source, um they go through the same procurement processes as a third party vendor as well. They go through the same clearance pipelines. If you want.

A

But you don't have a vendor it. How does.

G

That well from the difference is for third-party vendors. We can't expose our tool chains to them for evaluation, but we have to set up rules and guidelines for them to follow externally to produce standardized output that we can evaluate.

G

Whereas if it's a, if it's an existing partner, an open source project, we can actually bring that code in and run through our canonical tool, chains or pipelines to evaluate I.

A

See right, but it's the same I guess in the case of a vendor, you're saying the vendor would do the diligence. But if it's open source you do the diligence.

A

All right, I'm, gonna, I'm comfortable calling this third party vendor procurement, I, think that clears it up, because it's not open source. Okay, I'm gonna even put not open this bookmarks in the title, um because I do think this is an important persona for us to consider, because if we want to Encompass more than just open source in the context of use cases, we need it's a it's a thing.

A

And then we also have this Downstream customer consumers of products with s-bomb and the intent behind this one was to focus on like if I'm an organization and I make an s-bomb that goes to the next place and that next place isn't always thought about in any meaningful way, and so that's kind of what the idea was here.

A

Yes, I think listing: where are you saying Acquisitions there I am going to write that down, because I think that's an interesting use case that we don't talk about very often, but obviously, at this point, if I was acquired.

G

All right, I already have the Acquisitions comment, but wait: where did you put it? What like two comments above where yours.

A

No I know I, see I see you're may want to list out. Oh sorry, I I put it here. I think I think that's a good use case because, like for example, if I was acquiring a company today, I would totally ask for an s-bomb of their product.

G

Absolutely we're in that train we're in that training mode now.

A

Yeah I believe it and and I can only imagine the look of horror some companies would have. If you ask that and.

G

I think that this last bullet should be elevated to below developers, because I think that's the most. Actually, they might be the top one of the top most things, because that's what we're lacking is the downstream consumers of Open Source they're, the ones asking for the information they're, the number one customer. So that should that well, that Persona should be elevated, I think.

A

So you think you want to move this up to here. Yeah.

G

Because everything in open source has a consumer, you talk about consuming the upstream and what are my liabilities? You know um yeah, it's it's from a weighting, Factor, yeah,.

A

Yes, I agree with that, not that the order should matter, but yes,.

A

All right, we've only got a few minutes left, so I, don't I, don't want to dwell on this too much I want to talk about this section here for a few minutes, because we argued over this for a long time two weeks ago, and these are a strange laundry list of kind of things that we know are coming, but we don't quite know what to do with them yet and.

G

I think the machine learning RFC is out for cyclone DX, no.

A

I was just about to say that Cyclone DX is kind of ahead of many in this space, but sometimes that's good, and sometimes that's bad, because if you I'm I'm going I I have no opinion of the work cycle and DX is doing because I haven't even looked at most of it, but the point is, and the reason I wanted to clarify what's happening here is just explaining that these are things we know we need to do, but we don't quite know how they will fit into this group or use.

A

Cases specifically is what I'm I tried to push there and I don't know. Does that does does that come across for people who aren't me reading it.

F

Certainly, our our topics that people are working on so.

A

G

And we know in terms of I mean a lot of the stuff we kicked off. All of openness and stuff was kicked off by an executive order and there is an executive order. I can find and annotate.

F

Quick clarification, not true. Opennesses have pre-exist the executive order by years, so.

G

True, okay, the the end. The interest was spiked by.

F

Okay, yes, Fair! Yes, totally agree with that.

G

All right, um but there was an equally um an equally interesting executive order, around being able to record um cryptographic, information and Quantum Cipher information that has come out so I can annotate that can.

A

You just drop a link to that map somewhere.

G

That's what I meant by that's what I meant by annotate sorry.

C

Also Quantum Cipher would be a great name for a band.

G

B

Can't use the ban joke without specifying what the genre would be.

A

Yeah once in Cipher, it's all genres, I.

C

Think it would have to be prog rock. Unfortunately,.

F

Yes, Electronica, it would be perfectly.

A

Reasonable no I I maintain it's Quantum with a name like Quantum. It can be all styles.

B

Superposition everything.

A

Until you listen to it and then it picks one gotcha.

C

I'm really sorry.

D

Serious comment: sorry.

F

D

I would maybe so this first sentence under future s-bomb considerations where it says these use cases and considerations are not important today, I would I would maybe soften that, like yes for some folks, these might actually be important use, casing considerations, but I think maybe the point here is like this. These areas that are highlighted are very um nebulous, and you know not not a lot of definition of how they fit into s-bomb.

F

Formats, heck I think you don't even need that first sentence, you know the the following areas: are future work they're being considered for us balls period boom? You don't need most of this intro.

A

Yes, I think you're right. So would you say that again, David basically.

F

The the following areas are being considered for future s-bomb work period or column, actually.

F

A

F

Of that I mean you, don't need it for the intro and Susie jump into the list. It'll become quickly apparent. What you're talking about.

A

A

Okay and I guess we can also use this to just add things as they might come up and we realize we don't want to do them yet.

A

All right good, thank you. How are we doing a few more minutes, all right.

A

So the next part of this did I fix this heading to heading 3s.

A

So the next part of this we split the use cases into a couple groups that it's not super easy to understand, but, like producers of software is one heading, consumers of software is another heading, and that's all we have right now and so do we think we we also don't do a very good job of using our personas in these descriptions, which is fine because the personas aren't very well defined, but we obviously need to define the personas better and then slot personas into use cases in the future.

A

But do we I guess just from a high level, our producer and consumer kind of the two big buckets that makes sense, or can we think of something else? We should worry about.

D

I'm just wondering about the case of um where you're producing a software application, but you're also consuming open source software as part of that production process. So with which of these two buckets. Both.

A

D

That fit into is.

A

Absolutely both- and we kind of had this listed with software integration right where you've got someone taking in something else as part of their application, but then you also definitely have uh like. Well, we don't. We don't do a very good job of describing like making an s-bomb and giving it to someone else.

A

I guess it's kind of build time as Mom generation, because we talk about Downstream but I, don't I, think keeping those two use cases separate makes sense, because, even though it's the same thing, I think the activities on each end of the elephant will be pretty different or do you disagree? You can disagree like I would I'm glad to listen.

D

um I mean if, if you think about the software supply chain, I would argue that it's the default, rather than the exception that you're actually both consuming and producing.

D

um It's only going to be at one end of the spectrum, where you're only a producer or only a consumer, but everything in between you're actually both consuming and producing. If you think about the software supply chain,.

A

I would agree with that. I think that makes sense, but do we from this perspective?

A

Do we treat that different than being a producer and a consumer, or do we want to create a third thing? That's both because I think from the context you're talking about the only producers of software are going to be that aren't also. Consumers are going to be extremely low level things right like in insanely low level. In fact, even then I don't think you could talk about that. Oh, what is do I Matt? It's not a YouTube link, I'm, definitely not clicking.

G

That, right now, when I was talking remind me of an old movie that would probably be lost in on younger people, but anyways I think that producing consumer are good Concepts to have, but I think we need in terms of use case, we need to talk into specifics of roles we defined above that's more more clear, I. Don't think that you know conceptually it's beneficial to say, like I said Rob, said: I think it's mixed up, so I think we need to discreetly reference the personas. You know detailed above yeah.

A

Yes, I think you're, absolutely correct.

G

So that the movie is I, think, is it say anything and it's Lloyd dobbler, okay,.

A

Oh man, that's holy cow, I. Think I was in college when that came out.

A

um Okay, we shouldn't use these buckets, which makes use cases on the above. Personas they're will be a huge amount of overlap.

A

All right, I'm, just gonna, leave it there. Yes, I I, okay, that makes sense so we'll yank those. So that means we need to rework. Probably all of these use cases and I. Don't think these use cases are very use. Casey either um like I, don't think generating an s-bond is a use case. Is it no? It's not Distributing an Ask bomb is a use case.

C

uh Why isn't generating an um sorry, I think it's a newscast I mean you build.

A

Time s-bomb generation is.

C

Just generating any use case, though we want to build, you want to make sure that whenever you build your library or whatever you're generating a an art, one of the artifacts you generate is an ESL. So why?

C

Because somebody asked you to do it, but that's the use.

A

Case now, right: okay,.

A

But that gets squishy and hard because now you've got you have just distribution to customers. You could have regulation.

C

You could have yeah yeah, the the use cases should be linked to the use of the s-bomb rather than to the right. Okay, I.

A

Get it right, but but here's my point, though, like saying build time: s-bomb generation that isn't a use case, but it encompasses many use cases. So how do we Define like, for example, the the needs of a regulator and your internal security team and your customers and all those might say we want s-bombs, which is functionally the same use case just with different personas.

G

Well, I think I think that uh we should we should reference. We should reference life cycle, artists and life cycle that I know. Kate has shown many times as far as L Foundation the life cycle of an s-bomb, so I think that the Persona is acting relative to the life cycle is how you want to probably go about it. First, against a specific use case. All.

C

E

I guess my question would be: what is our use case for what we're doing here so is this for features that we need to support with s-bomb. Is this for guidance for folks looking to use s-bomb.

A

Guidance focused.

E

G

I think it's super important for us to and I think that's one of the most valuable things that is, that life cycle chart of the nest bomb that we should use as a guiding guiding thing.

G

A

Not convinced because I think the life cycle is the how and we want to ask the why.

G

So if my use case is finding a vulnerability relative to an s-bomb so where so, we have a Persona we're in the life cycle. Does that fall and then what information in the s-bomb is is relevant to answering to provide information they need to answer their or to perform their job. I.

A

Understand what you're, saying and I think that what you just described makes sense to me: that's not what I heard the first time, though so yes I, think defining a use case, then defining a Persona and defining life cycle I'm just going to write this down.

G

Relative to the information that the life cycle you know is revolves around. You can highlight different aspects of life cycle where it was where that, where that data was created, uh where it was sourced, where it was added to the s-bomb and how it's how it's used after the fact how's it, how is it reposited.

A

Yeah yeah yeah I.

G

D

A

Makes sense, um gosh Bucher just asked.

A

E

Don't know is this yeah? Is this the one we're talking about, or are we talking about a different life cycle.

A

I, this I, don't I've, never I.

G

Don't know I'm not I'm, not seeing that document. I was thinking about the one. That's that often appears and the Olaf presentations for for spdx that's bomb. Yes,.

A

Kate has a document somewhere.

E

E

D

E

We grab that and stick it in the document. So it's easy to find. Yeah.

A

I'll say um here.

G

But but I I think that that document you land give is coming from Seaside I, think C says where they're hashing out the normative nomenclature and semantics, and things like that so over time. We might want to reference that the the graphic from historical graphic, but we might want to make sure we we follow what cesa is doing in.

E

G

Of semantics and nomenclature.

A

I agree: I, don't know what is oh, this is from the DOE. Is this a this? Is a sysa doc, but the department of energy wrote it I have no idea I'm going to read this later, though I've never seen this April 23 that's going to be pretty new I, don't know when this came out.

A

E

Just 23 days, I just Googled s-bomb life cycle, and that was the top result. Interesting.

A

All right all right, well we're about out of time and I've got another meeting a little bit, so I want to go to use the restroom, but this has been oh, my goodness. This was drinking from the fire hose I thought this would be an easy, simple meeting.

A

This is good, though this is really good. I feel like this is why I like having a smaller group, because I think it's a more candid discussion, so all right, I'm gonna, send us on our way. I would say if anyone has time. Look through all this stuff add more comments or questions. I think we need to rework all of these use cases, though I don't think many of these are actually use cases in the context of what we just talked about. I.

C

Think a lot I think this document needs some reorganization too and I'm reluctant to do that without um to move things around and without more eyes on it. So yeah.

A

So you've got two options: Dan you could either just make a copy and butcher it and then show everyone else or just do it. It Josh gave you permission.

C

um I'll I'll think about it.

A

Yeah all right all right, I I have no issue with you like gutting. It I think. That's fine, I think we can go back in time. There's history like if, if someone's completely opposed, which no one will be because, let's face it like this is totally. If you do the work you get to make the decisions like I'm, a huge proponent of that. So uh is this H document you just linked.

G

Yes, there is a picture well that that's not the canonical place, that's presented, but that was copied there. Oh sorry, okay, but.

A

G

Put the link in the comment in the chat as well, so it's in the doc. It says a comment too: oh, did you good, perfect.

A

All right all right, I'm gonna bail, it's like you're ready for my next meeting. I'll talk to you all soon. All.

E

Right, bye, everyone. Thank you see it. It's.