►
From YouTube: OSS-SIRT SIG - Part of BEST WG (March 21, 2023)
D
A
A
B
C
B
E
F
C
E
B
D
B
B
All
right,
well
I,
had
posted
a
link
in
many
of
the
slack
channels.
Last
week
there
is
the
open
source
security
Summit
in
Europe
coming
up
there.
The
call
for
papers
is
open.
If
anyone
is
interested
in
submitting
the
talks
there
I
know
we
haven't
even
gotten
to
North
America
yet
but
got
a
plan.
I'll
I'll
toss
a
couple
things
over
there
and
see
what
happens.
F
B
B
We
had
two
types
of
constituents
we
wanted
to
approach
in
the
plan.
The
first
was
Upstream
projects
and
maintainers
hey
what
types
of
services
would
you
enjoy
if
from
the
cert,
and
then
there
was
another
set
of
constituents,
actual
active
security
teams
kind
of
going
out
and
talking
to
them
to
try
to
learn
from
them.
What
has
worked?
What
hasn't
worked
so
that
we
can
potentially
refine
our
tactics.
F
F
B
F
I,
don't
know
that
we
need
the
experience
with
open
source
necessarily
I
think
we
can
certainly
ask
for
it,
but
I
think
highly
mature
and
robust
organizations
that
have
a
sock
or
a
security
incident
response
team.
That's
been
operational
for
a
while
there's,
probably
some
value
in
understanding
how
some
of
that
affects
large-scale
organizations
and
even
small
businesses,
particularly
where
you
have
communication
breakdowns
or
organizational
silos.
Some
of
the
challenges
that
they
experienced
in
getting
information
out.
F
F
B
A
A
D
A
B
A
A
A
F
A
F
A
A
A
B
E
E
A
F
C
C
F
F
E
F
F
If
we're
talking
about
software
specific
incidents
that
is
probably
going
to
look
entirely
different
than
internal
facing
incidents
such
as
like
Insider
threat
kind
of
activities
and
how
they
manage
those
kinds
of
things,
but
that's
all
valuable
information
for
us
to
consider,
because,
if
there's
an
account
Takeover
in
an
open
source
project
that
you
can
basically
apply
an
Insider
threat
kind
of
mentality
to
what
they
would
be
able
to
have
access
to.
And
how
do
you
shake
that
turnover?
So
there's
a
lot
of
different
pieces
there
and.
A
A
A
You
want
to
know
something:
it
was
even
difficult
to
get
an
answer
for
David
Wheeler's
question.
That's
kind
of
why
I
wanted
that
question
in
here
about
like
how
many
people
legitimately
know
about
the
security
of
the
project,
because
even
huge
projects,
just
a
huge
project,
does
not
name
any
specific
projects
but,
like
you,
would
get
well,
there
might
be
this
one
guy
that
I
would
consider
him
pretty
prepped
up.
A
B
A
A
It's
true,
but
I
mean
some
of
those
Frameworks
probe.
I
would
say
our
kubernetes
level
because
we're
talking
like
the
react
realm
of
like
JavaScript
Frameworks,
they're,
they're,
big
boys,
they're
and
it's
not
I,
thought
it
was
a
very
inappropriate
answer
that
when
I
went
around
to
some
of
these
projects
last
year
offering
to
help
them
with
their
Badges
and
whatnot
they're
like
oh
we're,
not
interested
because
they're
not
doing
it,
so
we're
not
going
to
do
it.
So
we
don't
need
best
practices.
B
A
I
mean
they're
not
wrong,
but,
as
I
said,
I
was
offering
to
help
because
I
was
helping
one
of
the
Frameworks,
but,
as
I
said,
it
was
difficult
when
it
wouldn't
be
considered
simply
because
another
project
that
was
bigger
than
them
doesn't
do
secure
a
cert
team
or
does
it
have
the
security
team?
Even
then,
basically,
it's
just
a
non-starter
for
a
lot
of
projects.
It
doesn't
really
matter
what
the
reasoning
is.
It's
just
that
our
bigger
brother
doesn't
do
it,
so
we're
not
gonna.
Do
it.
F
Okay,
so
main
challenges
you
have
in
managing
whatever
the
security
of
the
thing
is
I
broke
out
some
options.
There
is
an
intake
communication
prioritization.
Is
it
the
fix
remediation
mitigation?
Is
it
notifying
impacted
users
of
to
upgrade
or
is
it
conducting
a
postmortem
I
bet
you
most
people?
Don't
even
do
the
post-mortem
part
of
it.
C
F
All
right
so
I
threw
in
early
mid
and
Senior
career
and
then
expert
in
the
specific
technology,
a
generalized
expert
in
infrastructure
or
a
language
specific
expert,
depending
on
what
it
is
that
they're
looking
for
I'm
sure
there's
other
categories
of
things
we
can
lump
in
there,
but
that
one
should
be
a
check
box
question.
If
you're
gonna
ask
it
so
they
can
select
multiple.
F
What
are
your
expectations
for
an
external
cert
team
in
respect
to
support
communication
and
response
time?
This
one
I
think
we
need
to
be
more
specific
and
probably
break
down
more
because
there
have
been
a
wide
variety
of
ways
in
which
various
Nations
have
attempted
to
provide
centralized
response
reporting
for
incidents,
and
there
is
a
lot
of
legislation
currently
and
in
Flight
around
when
you
report
incidents
as
they
occur.
F
So
this
one
I
think
is
is
a
very
complex
question
to
be
asking,
because
there
are
some
organizations
and
projects
that
are
not
interested
in
an
external
search
at
all,
and
then
there
are
some
of
them.
That
definitely
are,
and
some
of
them
have
an
expectation,
probably
that
an
external
security
incident
response
team
is
going
to
do
more
coordination
activities
with
federal
or
even
state
level
institutions.
F
F
B
D
F
B
A
B
The
way
I
just
imagine
in
my
experiences
a
lot
of
Enterprises,
don't
get
information.
They
don't
have
an
information
feed.
They
rely
on
their
commercial
tooling,
like
a
sonotype
or
a
sneak
or
coverity,
to
try
to
identify
some
of
these
problems
so
they're
getting
it
very
late
in
their
life
cycles,
as
opposed
to
potentially
going
upstream
and
getting
things
from
the
source.
Yeah.
F
E
A
Quick
that
that
I
read
a
report
that
apparently
this
year,
a
lot
of
people
have
been
exploiting
the
time
between
the
disclosure
of
a
vulnerability
and
patching
vulnerabilities.
Yeah,
not
till
I,
be
throwing
fingers
I'm
just
saying
gender
from
a
generalization
standpoint,
I
think
the
usage
has
doubled
from
2022
already.
B
D
D
B
D
B
F
I
was
gonna,
say
we
have
some
of
that.
There's
like
the
general
stuff
in
their
listing
here
and
then
there's
the
more
specific
things.
I,
don't
know,
necessarily
that
we
need
to
know
a
particular
product
or
vendor
commercial,
tooling,
that
they're
leveraging
or
an
open
source
equivalent,
but
at
least
getting
the.
C
F
F
Specific
volumes
are
risk
you're
concerned
about
in
your
project
your
project.
If
we're
asking
a
bunch
of
Open
Source
projects
or
contributors
that
don't
have
any
previous
exposure
to
security,
this
will
be
very
difficult
for
them
to
answer,
because
they
may
not
know
what
risks
they
should
be
concerned
with.
F
Precede
answers
to
that
one,
however,
if
we
do
that,
we're
going
to
be
shooting
ourselves
in
the
foot
for
like
what
kinds
of
responses
we
could
potentially
get
there
like
there's
the
balance
between
are
you
concerned
about
somebody
taking
over
your
GitHub
account?
Like
that's
one
thing:
are
you
concerned
about
not
being
available
to
respond
to
security
incidents
because
you're
the
only
person
on
your
alias
and
then
you
have
the
more
common
things
of
like?
Oh
somebody
finds
a
memory
leak
or
somebody
has
a
remote
code,
execution.
F
F
What
concerns
do
you
have
about
a
security
risk
coming
to
you
or
being
presented,
and
we
asked
that
question
in
the
maintainer
workshop
not
too
long
ago
yeah.
We
have
some
good
kind
of
key
indicators
there,
but
so
maybe
flipping
it
a
little
bit
more
on
the
vulnerability
side
and
spoke
focusing
a
little
bit
more
intently.
There
would
be
beneficial.
B
C
B
F
F
F
F
Because
there's
categorization
of
vulnerabilities
and
the
criticality
of
vulnerabilities
and
then
there's
the
prioritization
of
fixing
specific
vulnerabilities,
which
may
vary
some
people,
don't
like
CVSs
scores
they
like
other
kind
of
scoring
mechanisms
and
then
there's
actually
categorizing
security
incidents
into
different.
Like
constructs,
whether
or
not
it's
a
design
flaw
that
caused
a
particular
compromise
to
occur,
it
may
not
necessarily
be
a
vulnerability.
It
could
be
a
misconfiguration
of
the
project
or
a
GitHub
setting
misconfiguration.
So
there's
a
lot
of
different
things
there.
B
F
B
F
F
So
I
think
this
is.
This
is
an
interesting
one
to
ask,
because
there
are
some
projects
that
are
very
responsive
to
adopters
that
come
to
them
with
questions
about
like
hey
I
found
the
security
flaw
or
I
found
this
issue,
can
you
fix
it,
and
some
projects
will
ask
for
long
information
from
their
adopters
to
be
able
to
help
diagnose
it
I
think
this
one
could
probably
be
expanded
with
what
kinds
of
information
do
you
request
from
somebody?
That's
reporting
an
incident.
What.
E
B
F
F
C
F
F
The
only
thing
that
I
can
see
that
we're
missing
is
if
we
are
planning
on
sharing
this
with
existing
company
certs
and
trying
to
get
some
of
this
information
out
of
them,
maybe
asking
them
for
a
timeline.
An
incident
did
not
go
well
from
a
resolution.
That's
really
tricky
to
get
out
of
teams,
particularly
given
the
sensitive
nature
of
most
incidents.
E
D
A
F
That
goes
down
to
prioritization
and
categorization
on.
How
do
you
currently
prioritize
or
categorize
security
incidents?
Would
you
be
open
to
adopting
an
approach
a
very
much
so
that
one
should
be
broken
out
into
two
questions?
How
do
you
currently
prioritize
them
and
then
would
you
be
willing
to
opt
to
adopt
something.
C
F
C
A
E
C
I'm
curiosity
is
the
original
plan
of
this
cert
to
be
available
for
all
open
source
projects
or
targeted,
originally
at
like
the
top
10
or
top
100
critical,
open
source
projects
and
like
reach
out
to
them
and
say
hey,
we
are
assert.
We
are
here
for
you
because
you
are
critical
like
what
is
who
is
the
target
initially.
F
So
I
I
was
gonna
say
so.
Originally
the
list
of
services
that
were
going
to
be
provided
would
be
lightweight,
introductory
Services,
primarily
focused
around
coordination
and
communication,
and
that's
open
to
everyone,
as
well
as
some
educational
aspects
of
it
so
trying
to
teach
everyone
to
fish
where
we
can,
instead
of
just
doing
the
fishing
for
them.
B
And
historically,
this
community
is
super
distrustful
and
does
not
invite
Outsiders
in
so
it's
going
to
take
us
time
to
earn
trust
so
I
think
initially
we
probably
wouldn't
turn
many
people
away,
but
at
some
point
we
will
need
to,
and
we
have
it
in
the
plan
that
we
need
to
decide
kind
of
what
the
the
bug
bar
so
to
speak,
is
affect
how
we
can
how
and
who
we
can
help
yeah.
It's
definitely
something
we
need
to
solve
at
some
point.
Jeffrey.
A
F
A
C
C
C
F
C
F
F
What
that
looks
like
we
didn't
want
to
immediately
exclude
the
ability
to
provide
responses
to
teams
that
need
help
but
focus
on
it
from
the
perspective
of
people
are
not
likely
to
going
to
come
to
us
first
without
establishing
that
level
of
trust.
So
the
primary
focus,
at
least
initially,
is
on
doing
that
Outreach
and
advocacy,
and
explaining
to
folks
hey
we're
here:
hey
we
have
these
resources
that
would
be
beneficial
to
you.
F
If
you're
responding
to
an
incident,
let
us
know
and
we
can
come
and
help
and
issuing
it
more
in
a
guidance
fashion,
initially
partnering
with
those
projects.
Some
of
them
may
already
have
a
security
incident
response
team
or
they
might
have
a
security
focused
individual
on
their
maintainer
team,
that
this
could
help
augment
some
of
that.
But
we
didn't
want
to
exclude
that
activity.
F
C
If
I
understand
this
is
It's,
sorry
Randall,
what
I'm
understanding
you
saying
is,
like
all
for
the
services
say
here
or
assert,
but
then
also
demonstrate
proof
of
like
we're,
not
like.
You
know
some
Rando
from
nowhere
like
we
actually
know
what
we're
talking
about,
with
resources
being
provided
to
back
up
the
identity,
sort
of
yep.
E
B
B
A
F
I
want
to
make
sure
that
I'm
understanding
it
correctly
is
the
expectation
that
a
project
who
has
just
undergone
under
once
a
major
incident.
Do
they
contact
us
after
the
fact
and
say:
hey.
We
just
dealt
with
this.
How
could
we
make
it
better
and
we
review
with
them
how
they
conducted
their
activity
and
provide
indicators
for
improvement
areas
yep.
C
Something
that
would
actually
be
like
even
more
potentially
useful
is
just
like
I
mean
when,
when
I
first
ran,
we
ran
into
an
incident
a
former
employer
and
we
hired
an
instant
responder
and
we
were
like
okay.
How
do
we
handle
this
in
the
future
and
like
the
guy,
as
one
of
the
things
that
he
delivered
to
us,
was
a
run
book
for,
if
you
run
into
this
incident
in
the
future,
here
are
the
things
that
you
should
do
like
it
was
Doctor
related.
C
So
it
like
he's
like
here's,
how
you
preserve
a
doctor,
container's
memory,
so
that
if
it
needs
to
get
run,
you
know
if
we
need
to
dump
this
information
by
or
if
we
need
to
dump
memory
out
of
a
doctor
container
like
this
is
how
you
preserve
it,
so
that,
like
you,
can
do
so
in
the
future.
You
know
stuff
stuff
like
that
like
this
is
the
kind
of
like
run
book
sort
of
information
that
was
that
was
really
helpful
for
future
cases.
B
B
A
C
I'm
going
to
answer
that
immediately
because
I
have
an
opinion.
I
feel
like
assert
is
supposed
to
be
reactive
as
a
primary
goal,
but
then
also
be
you
know.
I
feel
like
the
open
ssf
in
general
is
designed
to
be
a
proactive
effect,
whereas
the
cert
is
intended
to
be
reactive.
So,
like
everything
else
at
EPL
ssf
is,
is
the
proactive
part
of
it.
F
F
And
that's
not
something
we
have
written
into
the
scope
of
the
cert,
but
I
would
suspect
that
having
a
report
of
some
kind
from
the
cert
to
the
technical
advisory
Council
of
like
here's,
the
common
requests
and
things
that
we're
finding
and
then
have
the
attack.
Take
action
on
those
would
be
a
good
feedback
loop
that
could
be
Amplified.
C
B
F
B
B
And,
depending
on
who's
answering
the
survey,
I
think
you're
going
to
get
different
results.
Yeah
I
think
the
maintainers
will
talk
about
I,
don't
have
resources,
I
need
help.
How
can
you
help
me
so
I
think
that'll
be
reactive,
but
commercial
Enterprises
are
going
to
say
I.
Need
you
to
tell
me
all
about
all
this.
Tell
me
tell
me,
tell
me
tell
me
so
they're
going
to
want
the
proactivity
yep,
so
it's
just
we'll
have
to
walk
that
tightrope.
C
F
So,
there's
always
stuff
that
we
don't
know
there
are
blogs
and
Publications
about
incidents
that
we
could
potentially
leverage
I.
Think
it's
a
matter
of
discovery
of
what
those
are
and
which
blog
posts
are
good.
Exemplars
I
also
believe
that
there
are
organizations
that
do
an
excellent
job,
writing
postmortems
about
incidents
that
break
down.
Actually
what
happened,
however,
I
haven't
really
seen
a
lot
of
discussion
around
the
process
and
execution
portion
of
performing
a
security
response.
B
So
we
did
account
for
this
generally
in
section
1.1,
Milestone
five,
where
we're
going
to
re
review
the
existing
coordinated
vulnerability
disclosure
media
art.
So
we
can
definitely
add
into
that.
If
we
had
specific
examples
or
have
a
note,
Google
open
source
ir
and
spend
a
day
reading,
so
we
can
definitely
add
a
task
to
the
plan
specifically
to
that.
A
B
F
B
F
B
B
A
C
A
B
B
C
I
make
a
just
an
action
item
for
someone
to
do.
I
I
may
I
do
sometimes
make
these
meetings,
sometimes
don't
at
the
end
of
when
this
thing
is
created.
Can
you
ping
me
the
list
and
I
will
send
this
or
ping
me.
The
questionnaire
and
I
will
send
it
to
the
gitup
stars,
because
I
have
slot
Channel.
I
am
part
of
the
slack
Channel
there,
and
so
I
can
share
it
to
those
people
as
well
yeah.