►
From YouTube: Security Tooling Working Group April (26, 2022)
B
Now
getting
a
cold
like
do
I've
covered,
what's
going
on
and
and
I
don't
well
at
least
tests
are
negative
and
I
don't
have
any
real
symptoms.
Other
than
stuffy
nose
could
just
be
allergies,
but
that
tiny
year
man
there
is
a
particularly
nasty
head
cold
going
around.
That
very
well
might
be
what
I
have
because
it
and
it's
funny,
because
I'm
like
I
used
to
feel
like
this.
All
the
time
like
I
haven't
been
sick
in
two
years.
You
know.
D
C
B
All
right,
it's
five
after
we
can
get
a
move
on
then,
as
I
said
sign
in,
if
you
haven't
in
the
agenda,
I
it's
a
pretty
light
agenda
this
this
week,
which
I'm
okay
with
david
I'll
kind
of
give
you
the
first
one,
so
the
false
positive
suppression
specification,
which
is
a
mouthful
I
I
sent
it
along
to
the
tack-
obviously
loves
it
great.
I
expect
they
would
like
what
what
now.
A
Okay,
so
my
apologies,
but
it
turns
out
there's
only
so
many
hours
in
a
week,
so
I've
been.
I
have
been
really
focused
on
updating
the
course
and
there's
something
called
streams
which
some
of
you
may
already
be
working
on,
where
I've
been
basically
totally
pegged
through
the
end
of
this
week.
I
think.
E
A
A
A
We
need
something
in
a
comment
that
says:
please
ignore
something:
okay,
but
I
would
you
know
I
put
in
a
proposed
text
based
on
what
a
few
tools
that
I
have
used
or
implemented
do,
but
I
think
it's
clear
that
some
tools
do
differently
just
from
a
couple
conversations,
so
I
think
the
next
step
is.
We
need
to
do
a
little
research
on
every
tool
that
has
a
suppression
mechanism
and
what
it
is.
A
I
can
do
some
research
once
I'm
free
next
week
to
do
some
of
that,
but
I
know
people
here
of
implemented
or
used
tools,
so
I
will
appeal
to
everybody:
who's
used
a
tool
and
knows
what
that
mechanism
is.
It
is
just
add
that
to
the
appendix
of
this
probably
should
slip
the
url
of
this
of
it
in
here.
Let
me
do
that,
but
basically
at
the
very
very
bottom
of
the
document
is
a
list
of
tools:
here's
how
they
currently
do
it
today.
A
A
I
don't
think
so.
Let
me
tell
you
how
other
open
ssf
working
groups
have
worked
and
we
don't
have
to
do
it
the
same
way,
but
typically
what
a
lot
of
working
groups
have
done
is
they
start
in
a
google
doc
and
they
because
google
docs
allow
simultaneous
edits.
You
can
see
what
people
are
editing.
It's
super
easy
to
get
started.
A
But
basically
a
lot
of
people
found
that
google
docs
is
a
great
way
to
kind
of
get
the
ideas
flowing,
get
started
and
then,
as
we
want
to
solidify
things,
switch
over
to
something
else,
typically
markdown
on
github
as
it
gets
kind
of
hardened
up.
But
right
now
I
think
we're
still
very
much
in
the
the
research
getting
the
ideas
down
yeah,
I
agree
so
so
the
so
does
anybody
oppose.
I
mean
that's
how
we
typically
have
done
it,
I'm
all
for
that.
A
If
somebody
would
prefer
something
else,
please
say
please
speak
up,
because
that
doesn't
have
to
be
the
way
we
work.
It
just
seems
to
be
a
pretty
loc.
I
mean
the
now.
The
one
problem
is
that
the
conversion
tools
and
jury
can
tell
me
tell
us
about
this,
but
at
least
my
experience
is
that
the
tools
from
google
docs
to
markdown
are
all
varying
degrees
of
of
less
than
good.
So
the
easier
you
make
your
formats
within
google
docs,
the
more
likely
of
success
in
the
transformation.
A
A
C
A
A
A
Okay,
yeah,
if
you
can
find
or
give
hints
that'd
be
great
jory,
did
find
a
more
recent
tool
that
I
have
not
tried
yet
for
converting
google
docs
to
markdown
so
and
and
jury
the
pandoc
holy
grail.
Yes,
yes,
that's
it
now.
Joy
did
actually
point
to
another
tool
and
I've
actually
pointed
to
that
in
the
course
fundamentals
course.
F
B
And
I
I
like
this
model
as
well,
I
think
and
we'll
document
it
at
some
point
for
new
projects
start
with
the
google
doc,
do
some
work
and
then
move
it
to
github,
because
I'm
always
always
hesitant
to
create
a
repo
and
then
have
nothing
happen.
And
now
you
have
a
repo,
that's
just
going
to
rot
in
there.
A
Yeah,
I'll
be
honest,
I
mean
it's
up
to
you,
but
this
is
such
a
relatively
small
document.
I
think
we
can
just
have
it
live
within
the
tools,
working
group,
repo
itself-
I
you
know
it's
I
mean
we
can
make
that
decision
when
we
get
there
because
I'm
expecting
basic
the
next
two
weeks,
we're
going
to
do
more
of
the
research
we'll
talk
about
what
we
find
and
probably
hopefully
wrap
up
the
stock
within
like
a
month
or
two,
but
you're
not
expecting
this
to
be
a
big
dock.
A
Oh
yes,
I
did,
I
didn't
add
that,
but
it
is
the
link.
Is
there
I
did
not
find
that
that
was
actually
somebody
else.
So
my
thanks
here
we
go
it's
near
the
bottom.
Some
reports
never
be
ignorable.
It's
the
disabled
comments,
the
end
mingles.
I
mean
it's
just
a
link.
I
should
have
the
I
don't
know
how
do?
A
Okay,
the
the
it's
it's
a
blog
post,
it's
an
opinion
piece
about
how
disabled
comments
never
make
things
worse,
and
maybe
I
should
we
should
have
a
reference
section
and
you
know
I'll.
I
haven't
worried
about
formatting
so
far
in
this
document,
but
probably
should
do
that.
But
hey
there's
a
reference,
so
I
will.
I
will
tweak
it
right
now
and
add
a
reference
section
and
reference
that
just
to
be
aware,
I
mean
that
that
google,
that
particular
blog
post,
argues
against
doing
this
at
all.
A
I
don't
agree,
but
I
do
agree
with
some
of
the
problems,
and
so
I
I
think
the
solution
there
is.
You
know
I
I
think
there
are
ways
to
try
to
deal
with
that
and
to
be
fair.
I
think
the
argument
that
makes
there
you
know
hey,
you
know
what
kind
of
error
did
the
static
analysis
tool
report
shouldn't.
You
know
you
know
shouldn't
we
disable
the
rules,
but
I
think
really.
This
is
focusing
much
more
on
linting
tools.
A
You
know
where
you've
got
style,
checking
tools.
You
know,
why
are
you
enforcing
a
style
that
you
don't
want
to
use
and
this
isn't
really
exactly
the
same
thing,
but
I
think
we
should
refer.
We
should
mention
it,
and
you
know
explain
why
you
know
the
the
fundamental
problem
is
that
you
can't
these
aren't
style
rules
that
we're
worrying
about
these?
Are
you
know?
Static
analysis
for
vulnerabilities
is
really
the
focus,
at
least
that
I
have
in
mind.
B
A
F
That's
that's
jewelry.
I
popped
that
in
because
a
lot
of
folks
here
had
asked
questions
about
openss
update
and
whether
there
would
be
a
virtual
component
there-
and
I
had
been
saying-
I'm
sorry,
I
don't
know-
and
hot
off
the
presses
just
got
an
email
from
the
events
team
just
a
little
bit
ago
that,
yes,
they
have
a
virtual
platform
selected
for
the
entire
event
and
open
ssf
day.
Content
will
apply
there
too.
F
A
C
C
So
this
may
be
a
level
of
detail
that
you
have
not
yet
received
from
angela's
team,
but
are
there
separate
registrations
for
virtual
and
on-site
or
is
there
simply
on-site
and
then
virtual
comes
along
for
free?
Because
I
know
a
lot
of
our
team
is
based
in
india
and
while
time
zones
might
not
necessarily
work,
traveling
definitely
doesn't
work
yeah.
They
want
to
participate,
but
they
can't
get
there.
F
F
A
E
A
B
Good,
I
put
one
more
thing
on
the
agenda.
I'm
out
the
next
time
we
have
this
meeting
in
two
weeks
I'll,
be,
I
think,
if
I'm,
I
think,
I'm
in
an
airplane.
I
don't
remember
anyway.
I
can't
I
can't
dial
it
so
just
should
we
cancel
it.
Does
someone
else
want
to
run
it?
I
don't.
I
don't
have
a
strong
preference.
C
A
A
Okay
and
and
basically
but
the
next
time
we
gather
I'm
going
to
be
begging.
Everybody
here
at
least
try
to
just
add
the
here's,
how
the
tools,
I
know
you
know,
suppress
warnings,
we
don't
need
the
300
pager,
but
a
link
to
if
it's
complicated
links
to
it
would
be
great
yeah.
But
I
think
that's
that's
basically.
The
key
is
we
want
to.
We
want
to
borrow
the
best
ideas
and
preferably
a
common
approach.
B
F
Have
one
other
thing
and
which
david
just
reminded
me-
and
I
should
have
said
this
in
the
best
practices
call
to
next
week,
open
ssf
staff
will
be
out
at
the
linux
foundation
all
hands,
and
so
we're
likely
to
be
pretty
slow
to
reply
and
because
we'll
be
in
like
team
meetings
and
stuff.
So
just
bear
in
mind.
If
you
need
something
we'll
get
you,
but
we'll
probably
be
a
little
bit
slower
about
it
next
next
week.
The
second
through
the
fifth.