OpenSSF SIRT Best Practices WG, 25 Apr 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: BEST Working Group’s SCM Guide collaboration (April 20, 2023)

Description

Meeting notes: https://docs.google.com/document/d/1ttqkcYPmYZyqvtkaHs92bx2UeVUiXDhuzP-0WbP11Fw/edit#heading=h.7o2ubzl5z39r

A

Good morning,.

B

Hey David, how are you doing.

A

ah I'm doing all right, I think your thing.

A

Hopefully, no one will come and arrive and tell me I'm not having a good morning.

C

C

On the West Coast.

A

Well, if, if you like, I'll, leave my microphone on for a moment longer, you can hear the birds chirping in the background, because it's a beautiful day and I'm going to work from the deck of my house, which is an advantage of working from home.

B

I actually wasn't sure if it's a little big hunt or not.

A

Is the real thing this is what's surrounding me.

C

Wow, what part of the country are you in Northern.

A

Virginia, so it's supposed to get up to about 80 degrees, Fahrenheit, it's Fahrenheit, not Celsius. So it's supposed to be a a lovely day to uh you know. If I you know, working well listening to the birds is really not a bad thing.

C

What uh what are some of the most common visitors you have.

A

Oh now, you actually need to ask my wife, uh because she's got an app. uh She calls it Shazam for Birds, uh uh where it will actually tell you. I mean we've got morning. Doves, uh Cardinals, Robins but I mean there's quite a cacophony here.

C

Yeah for a second I thought it was someone's app or something when you were on a call a couple of days ago, as.

B

C

That's David's neighbors.

A

Noisy neighbors um yeah, there's.

C

Questions on your uh work anniversary by the way, oh.

A

Thank you. Thank you. It's uh you know what it don't blink and the years go by um three years with the LF.

C

A

Yeah, absolutely so uh um yeah and it's been, it's been a fun ride so far, so I'm trying to do good things and no one's uh kicked me out yet so we'll try to keep doing good things.

C

Now this is a little the security of the open source ecosystem.

C

For some is job security.

C

Well, although I don't look at your job of insecurity depending upon how you look.

A

Yeah, you know what um I mean in one sense, I think. That's probably true that the sad thing is that attackers, you know as soon as you close one gate. The attackers will go to the next gate. They will always look for the easiest easiest path to enter and do that, uh but I don't I.

A

um Some people get really down on that, but I actually don't feel that way um as you remove the easy paths the roads get harder and harder and I do believe that at some point not that there can't be attacks, but it will be increasingly difficult and fewer will bother because it won't be worth the the uh it won't be worth. The attempt uh we're not there yet, but I I do see a path to getting there and.

C

I build an interesting metaphor in that early in my career, I worked in the early days of cellular. Okay. If you ask your you look back at the early days of cell phones, yep when it first emerged in North America, you basically had sort of islands of coverage that were largely Regional, and so it all it immediately became an attractive communication options for bad guys. They wanted on the network, uh they didn't want to pay and they wanted to freely use Communications. Discreetly, uh to do you know, nefarious things right, just like pots.

C

They were largely tolerated because the metaphor was sort of like a water utility and as long as you had significant infrastructure footprint and could generate Revenue off 90 percent of your users, the fact that you were leaking water into the ground I.E losing minutes to bad guys was sort of just more of a cost of doing business, but as consumers demanded interoperability as they traveled uh carriers started to strike these agreements to basically make roaming more automatic, yeah and yeah.

C

As that happened suddenly, uh if you were one of the leading carriers kind of pushing the envelope on that, you started to realize holy heck. uh I'm writing large checks to the other utility.

C

When my bad bad guys are, you know, on their Network and that sort of spurred a real big push towards trying to provide more secure uh users and eliminate fraud. So this is sort of a an echo of that type of phenomenon, not not at all the same, not a perfect metaphor but interesting enough right.

A

Well, I have to admit I'm a little confused, uh usually the best practices working group is absolutely full of people um and today we're really uh it's it's pretty quiet.

B

So this one is the SCM best practices. Oh.

A

Is that the problem? Okay,.

B

A

B

A

I, don't see um it's not separately noted as a date uh on the meeting notes so.

A

All right, maybe what I should do it? Okay, so here's what I propose Let's. uh Let me quickly well I I guess: maybe I should uh I'm, assuming we're actually going to have a meeting of some kind, but I don't have an agenda.

B

Very empty for this group as well, and we are missing the group lead then, which is not here so.

A

All right um so how's this. Why don't I quickly note.

A

All right so I'm going to modify the best practices meeting notes real, quick here. um Let's see here, this is instead of 25. This is 20th and this is SCM right.

B

A

A

uh Well, I'm here I'll mark myself.

A

huh Where's Texas ah there's text color, yeah how's. This.

A

Okay, so issue uh uh lead was not available.

A

If we don't have any any new project, what I would propose is Let's. uh You know we have. No, you know you know. No No, Agenda set I mean unless there's some strong reason. We should meet I think we should stop right here. I, don't you know.

B

A

To agree and guys.

D

A

D

Doing is um looking at Christine had provided a kind of text version of gnomes work, so we.

B

D

About that, okay I, don't know if that got put into GitHub yet or not, but that's the last couple calls what we had been doing, but since neither Christine or Dan's here, I agree. It's probably we're not gonna make a lot of progress with a couple of us here.

D

A

Let me scroll back and.

D

See if she posted a link.

A

Okay, yeah I mean yeah sorry to get you up early there uh Jeff.

A

I realize on West Coast is a pain, no problem, yeah I.

C

Don't know when you work for a East coast-based company, a 7 A.M call doesn't seem too early.

A

Well, I I will say: um I I salute Jay White, who gets up at uh pre-crack of dawn to to exercise and I, and he has some people. He uh he's saying no he's a trainer for and then he does his real job and he's just like. Oh man, so.

D

So it looks like a stub has been put into GitHub, but um Christine actually had a doc with some text that I'm going to look for to see. If we uh see if she has, it noted there, but that was what we were looking at, how to incorporate the The Narrative with uh some more of the uh technical application of the controls.

A

Okay, what do we propose, so we can continue doing that work when they're available I mean so.

A

In probe, I started on our slides that we're supposed to be presenting at ossna I will, uh after this looks like that's what I'm doing next.

C

D

C

A

um uh Deliver on time and on a minute earlier laughs Oh, you mean the actual slide contents.

C

um No, it's that's well. That sounds like a great topic, too perfect sneeze to cover it.

A

um No, it's about uh best practices. Imagine scorecards.

D

C

D

I'll see if I can find Christine's text and if anyone had, if anyone's really motivated, you want to try to do a PR to blend it into the GitHub. That would be delightful, but uh yeah I think we can adjourn.

A

Yeah and and to answer your question uh scorecards best practices- and my view is that this is like chocolate and peanut butter. So we're trying to explain each a little bit about yes, they can. They can and do work together so and.

C

Cry before you arrived, we were celebrating David's third anniversary at blf.

D

Yeah, just three um forever.

A

uh No, no I've worked with the LF for years before and, of course, I I. You know I've known a lot of these uh crazy people for a long time. So uh uh it's been, it's been, it's been good. It's been really good. It's kind.

C

Of like a a a a past, inmate joins the asylum.

B

D

All right, so there I got Christine's guide. I have the GitHub repo. So if anyone could take a look at that, uh if you have any feedback, PR is welcome and uh I owe David a piece of cake in Vancouver or a.

A

Plate of poutine, you know what no no, no I, probably instead of cake, just we'll go out and find something to eat together. How's that love it all right. In fact, I'm hoping to see lots of you folks in Vancouver, so.

D

All right take care have a great day. Everybody. Thank you.