►
From YouTube: OSS-SIRT SIG - Part of BEST WG (March 7, 2023)
B
B
B
Hell
of
a
drive:
well,
you
know
it's
one
of
those
things
that
I
like
when
I
give
instructions
like
I
specifically
made
it
so
that
it
all
wouldn't
fall
back
on
one
person
and
guess
what
happened.
Everyone
went
back
and
reassigned
it
all
to
fuzzy.
So
now
it
all
falls
back
on
one
person
and
then
I'm
like
bro.
Why
do
you
accept
and
he's
like
I
can
do
it?
I
can
do
it?
I'm,
like
you're
gonna,
pull
off
two
presentations
in
eight
hours,
we'll
see
what
happens
heart.
B
B
A
A
A
C
A
So
spread
the
word
have
folks
if
they
want
to
participate
in
voting
either
for
the
attack
or
for
the
community.
Individual
representative,
please
fill
out
that
short
form
and
if
either
of
you
are
interested
in
running
for
the
tack,
there
is
a
nomination
process
for
that.
That's
a
little
bit
longer
than
30
seconds.
A
A
To
be
on
the
tech
yeah,
it
is
a
I
feel
a
lot
of
responsibility.
It
is
not
a
ton
of
extra
work,
I
would
say
like
an
hour
or
two
a
week.
Okay,
so
not
too
too
much
is
the
voting
form
easy
to
find?
Well,
if
you
look
at
the
agenda,
art
there's
a
link
right
to
it,
so
you
register,
and
then
they
will
send
you
a
mail
with
the
they're
using
some
kind
of
tool
for
the
actual
voting.
B
For
what
it's
worth,
I
I
was
so
something
I
was
interested
in,
but
we,
then
we
kind
of
as
a
team
agreed
that
it
would
just
be
better
for
me
to
show
up
to
tax
meetings,
because
my
superiors
feel
like
it
would
be
too
much
responsibility
and
too
much
work
and
it's
like.
But
someone
has
to
do
it
and
yeah.
B
A
So
everyone's
welcome
to
show
up
to
the
tack
and
express
your
opinion
as
we
have
our
conversations,
so
it
when
you
get
to
a
computer
art
or
even
if
you
can
look
at
the
agenda
on
your
phone
there,
there
is
a
link
to
a
Google
form.
The
voter
registration
is
like
30
seconds.
You
have
to
put
your
GitHub
ID
in
basically
the
self-nomination
for
either
the
individual
representative
or
the
TAC
is
a
little
longer.
A
couple
minutes
can.
A
So
right
now
the
representative
is
Ian
Coldwater
and
they
help
speak
on
behalf
of
maintainers
and
Upstream.
So
that's
that's
kind
of
the
perspective
we
want
to
have
in
the
room
as
often
as
possible,
Fair,
okay
and
that
job
is
a
little
more
work
because
you
actually
have
to
go
to
governing
board
meetings
and
stuff
and
Tack
meetings.
Well,.
A
Right
well,
you're,
not
an
independent
representative,
so
like
back
in
days
of
your
that
could
have
been
something
that
Jonathan
might
have
been
able
to
do,
because
he
was
a
security
researcher
kind
of
out
there
in
the
wild,
no
Jonathan's
here,
but
now
Jonathan's
also
an
employee.
So
he
is
no
longer
an
independent
representative.
So
I
have
been
asked
not
or.
B
A
A
Well
speaking
about
the
plan,
since
we
don't
have
any
tangible
Direction
at
this
time,
would
we
like
to
actually
start
working
on
some
of
the
things
we
can
do
that
are
low-cost
and
low
risk?
If
we
don't
get
funded,
it's
still,
I
think
valuable
information
to
have
around
and
share
so
I
put
a
suggestion
for
three
possible
areas.
We
could
collaborate
on
first
off,
we
have.
We
were
thinking
about
making
two
questionnaires.
The
first
questionnaire
would
be
to
kind
of
upstream
maintainers
and
security
teams.
What
do
you
want?
A
A
We
could
make
our
walking
around
deck
at
some
point.
If
we
get
funded,
we
will
need
to
be
able
to
articulate
to
people
in
two
slides
or
less
what
the
hell
we're
doing
and
what
we
want
to
what
services
are
going
to
provide.
So
we
could
work
on
that
recruiting
deck
or
we
could
work
on
processes
and
workflow.
A
B
B
C
I
know
a
little
bit
about
the
initial
report
and
then
without
my
out
of
my
view
at
that
point,
there
was
a
small
personal
amount
of
personal
contact
to
get
that
to
a
good
place
which
I
may
have
had
something
to
do
with,
but
I
didn't
have
the
details.
I
was
just
sort
of
making
introductions
yeah.
That's
a
doozy,
though
I
think
it's
in
the
spec.
If
I
read
that
correctly,
yeah.
C
Yeah
I
I
get
it
I
read
pretty
carefully,
but
I
I'm,
still
a
little
bit
struggling
with
the
the
spec
was
detailed
enough
that
the
buffer,
the
memory
corruption
issues
were
in
the
spec
I'm
gonna
have
to
read
that
part
again
but
yeah
anyway.
It's
great
when
we
have
I,
don't
know,
crub
knows
stuff
about
your
boot
and
UEFI
and
it's
an
interesting
environment.
C
C
B
B
C
C
A
C
A
C
B
A
I
agree,
and
that's
also,
we
want
to
try
to
schedule.
Potentially
internet
go
talk
to
the
kubernetes
security
team.
You
know
what
works
well
for
you
all.
Where
would
you
yeah,
like
assistance,
talk
to
solar
designer
a
lot
of
different
opportunities
there
to
to
interview
people
that
are
doing
the
work
today
and
kind
of
absorb
those
best
practices.
A
A
A
B
B
A
A
C
B
A
Yeah
I
think
there's
great
potential
for
collaboration
on
that
and
I
think
if
we
were
able
to
figure
out
a
solution
to
automatically
generate
those
advisories
part
of
a
GitHub
action
or
something
similar,
yeah
yep
I
think
there
could
be
a
substantial
amount
of
value
to.
Oh,
you
know,
give
that
to
Upstream
developers
and
then
Downstream
could
start
to
benefit
from
that
analysis.
C
It
does
not
tell
you
what
your
status
is.
You
got
to
go
figure
that
out.
You
might
be
able
to
automate
that
you
might
not.
That
does
not
bex's
job.
So
we,
if
we
can
at
least
just
standardize
on
this
thing,
has
affected.
That
thing
is
not
this
thing.
Is
this
part
of
this
thing?
Is
that's
not
a
bad
idea
and
I'm
trying
to
head
off
a
discussion
about?
C
When,
should
you
issue
one?
The
answer
is
anytime
you're
talking
about
the
vulnerability
and
you're
going
to
publish
whatever
on
osv
a
cve
csaf,
your
own
personal
advisory
flavor?
If
you
have
a
mind
towards
automation,
please
put
this:
please
provide
the
status
index
format
the
end
of
story.
We
don't
need
to
write
a
paper,
for
instance.
That's
it
so
sorry,
other
other
work,
work
stream
issues
open
Vex
can
do
this
two
thumbs
up
great
I'm
sold
so
yeah.