►
From YouTube: OSS-SIRT SIG - Part of BEST WG (January 10, 2023)
B
A
A
B
B
B
B
A
A
A
A
D
B
B
A
B
A
B
C
B
B
A
A
B
The
researcher
yes,
because
I
kind
of
I
kind
of
like
what
he
was
doing
and
I
know
that
at
Gen
2
we
kind
of
have
initiatives
like
that.
So
I've
been
trying
to
see
how
we
can
like
connect
efforts
there
about
like
scanning,
like
the
open
source
world
as
a
whole
and
I.
Don't
know
how
that
I
mean
that
could
possibly
like
have
things
to
do
with
the
cert,
but
yeah.
B
B
But
yeah,
but
I
thought
that
was
interesting
because
I
know
that
there's
a
lot
of
stuff
happening.
I
know
that
there's
a
lot
of
like
I've,
been
reading
a
lot
about
use
of
Linux
like
in
the
wild
and
how
that's
evolving.
I
know
that
we
don't
talk
about
that
much
here,
but
I'd
like
to
start
talking
more
about
it.
Things
like
initiatives
like
flat
pack,
because
apparently
a
lot
of
companies
are
investing
a
lot
of
money
in
flagpac.
B
C
A
A
B
And-
and
let
me
say
this
Crow,
my
intent
of
bringing
this
up
is
I
actually
did
look
in
a
flat
pack,
quite
a
bit
yeah
and
it's
actually
pretty
interesting
technology.
However,
they
do
a
lot
of
things
in
the
name
of
like
security
and
it
makes
you
ask
like
but
like
who
told
you
to
do
this
like,
and
why
are
you
saying
that
this
is
like
the
way
it
needs
to
be
done,
because.
A
B
Feel
like
they
walk
that
line
of
like
well
we're
free
desktops,
so
we're
just
gonna
Implement,
a
bunch
of
stuff
and
y'all
just
have
to
kind
of
deal
with
it
and
that's
one
of
those
attitudes.
That's
always
bothered
me,
but
I
feel
like
with
time
I
mean
it's
a
good
technology.
I.
Just
think
that,
like
first
of
all,
we
got
a
call.
You
know:
cows,
cows,
apples,
apples,
oranges,
oranges
and,
second
of
all,
I.
Just
don't
think
that,
like
they,
they
have.
B
Then,
and
then
they
have
this
idea
of
a
universal
Linux,
which
is
very,
very
interesting
because
essentially
flat
packs
run
on
what
they
call
run
times,
which
are
shared
across
all
of
the
flat
packs.
So
it
gets
rid
of
a
lot
of
like
a
lot
of
problems,
and
even
if
you
were
to
secure
something-
and
if
you
were
to
talk
about
security,
then
the
run
times
could
be
very
useful
from
that
regard,
but
how
they
get
done
like
the
build
process
in
which
they
get
produced.
B
There's
really
no
security
like
in
terms
of
like
supply
chain
security,
like
they
really
don't
do
anything
like
that,
but
they
still
tout
that
it
is
the
most
secure
option
for
running
Linux
and
now
that
steam
deck
runs
flat
packs
and
their
entire
ecosystem
is
flat.
Packs
then,
like
now,
everyone's
talking
about
how,
like
flat
packs,
are
the
future.
Okay
to
the
point
to
the
point
where
they're
calling
them
next-gen
packaging.
It's
like
the
next
generation
of
Packaging.
D
B
B
D
I
have
a
small
topic,
I,
wouldn't
mind,
introducing
it
won't
take
long.
We
don't
have
to
spend
a
lot
of
time
on
it.
If
that's
all
right
sure
it
came
up
in
a
side
thing.
I
was
typing.
While
we
were
talking
here
so
Linux
kernel,
devs,
I've
heard
this
is
a
handful
of
people
and
Greg
Crow
Hartman's,
the
most
I
think
vocal
about
this.
D
D
We
are
we're
at
a
layer
of
abstraction
in
computer
science,
which
is
totally
fine
right.
You
can
see
that
these
are
bugs.
We
are
maintaining
the
kernel.
We
have
a
good
process.
That's
working,
everybody
cares.
It's
like
an
important
piece
of
software
that
sounds
like
crazy.
Yeah
bugs
are
bugs
are
bugs
shut.
The
f
up,
basically
right
bugs
are
bugs,
are.
D
No,
it
is,
and
he
tells
really
very
first-hand
stories
of
like
hey
there's
this
thing
and
I
woke
up
one
morning
and
five
years
ago,
I
realized
it
was
the
most
terrible
Linux
security
bug
ever
on
the
planet
and
some
other
thing
we
accidentally
fixed
and
it
was
like
there
so
yeah
he's
a
colonel
Dev
I.
Believe
him
like.
A
D
So
yeah
they
have
a
process
that
works
for
them.
It
works
great
and,
and
there
is
there
is
truth
in
that
perspective
and
I
I
see
it
and
I
don't
deny
it
and
all
good
yeah.
So
just
about
everybody.
Downstream
of
them
starts
to
care
about.
You
know,
security,
bug
or
non-security
bug
very
quickly
and
then
I
think.
Basically,
the
plan
is
the
current
plan
is
hopefully
one
of
the
larger
distros
Susie
was
the
last
one
who
caught
one
caught.
D
And
the
distros
will
go,
go
to
town
and
do
stuff
and
fixes
will
get
distributed
to
all
of
the
poor
Downstream
folks
who
are
not
Linux,
kernel
devs,
who
can't
tell
what's
going
on
so
right
that
is
sort
of
relying
on
as
usual,
like
some
random
person
who
cares
and
understands
the
problem
or
some
distro?
Who
does
a
lot
of
support
and
it's
their
job
and
like
notice
and
catch
these
things
right.
A
D
A
D
A
D
Yeah
so
and
I
I,
so
it
occurs
to
me
and
I.
Don't
know
if
this
anybody
wants
this
or
not
a
organization.
Who's
full
one
of
their
full-time
sort
of
tasks
was
tag
Vol,
IDs
to
Kernel.
Things
sounds
like
it
could
maybe
be
I
want
to
personally.
Do
it
too
much,
but
a
person
could
be
a
an
open
source
search
type
of
thing
right.
The
Linux
kernel,
CNA
and
you
know
Greg
would
yell
at
us,
but
we
would
still
assign
or
G
and
honestly
I
don't
it
could
be.
D
B
I
actually
have
something
to
add
to
this,
because
I
am
a
frequent
kernel,
contributor
and
I've
been
told
on
good
authority
that
since
2008,
there
is
really
a
lack
of
a
security
Steward
in
the
Linux
kernel,
because
that
that
security
Steward
was
gr
security
and
the
guy
that
ran
gr
security,
retired
and
his
kids
didn't
want
to
do
anything
with
like
open
source.
They
went
full
on
private
now.
B
I
have
a
lot
of
contacts
in
gr
security
because
they're
in
Irvine,
which
is
where
I
live
and
I
go
there
often
so
I
actually
have
access
to
all
of
the
repositories,
but
they
just
physically
don't
want
to
do
this.
They
don't
want
to
like
do
free
work
anymore
and
according
to
like
a
lot
of
people,
not
to
Greg.
That,
like
there
needs
to
be
a
security
Steward,
because
all
security-
and
he
told
me
I-
could
quote
him
on
this.
All
Security
in
the
Linux
kernel
is
bolt-on
foreign.
C
C
So
for
quite
many
of
them,
you're
just
simply
stuck,
and
you
are
looking
at
the
comments
on
the
when
you
are
lucky,
you
can
identify
the
exact
module
when
the
when
the
problem
was
expected
to
be.
You
look
at
the
comment
list
and
you
start
wondering
which
one
it
could
be
and
you
will
never
be
sure.
Basically.
A
So,
but
if
the
group
is
interested
in
trying
to
commit
some
time
and
effort
on
this,
I
would
suggest
we
reach
out
to
you,
know:
Red
Hat,
Susan,
canonical
first
kind
of
get
some
of
their
thoughts
on
what
they
feel
is
working.
What
isn't
working
and
then
try
to
broker
some
conversation
with
the
colonel
security
team
to
see
if
they
would
be.
B
A
Private
and
secret,
and
if
we
are
interested
in
trying
to
make
adjustments
or
try
to
add
some
assistance,
it'll
take
some
time
and
energy
to
kind
of
work
through
the
communications
of
that
to
make
to
not
inadvertently
offend
anybody,
because
there
are
a
lot
of
personalities
and
we
want
to
add
value.
We
don't
want
to
get
into
like
a
flame
War.
Well,.
B
B
D
Randall
the
distinction,
the
distinction
that
may
apply
here-
I'm
yeah
I'm
passionately
familiar
with
all
the
pack
stuff
I
watched
some
of
that
stuff
go
by,
but
I
don't
have
details,
but
I
was
more
sort
of
focused
on
the
very
simple
sounding
but
I
know
it's
not
cripp's
Point
yeah,
the
hey,
not
we're,
not
we're
not
going
to
argue
with
the
Kernel
Security
people
Linux
about
what
security
sure
shouldn't
be
in
there.
This
was
a
security
bug.
It
gets
an
ID,
it
gets
managed
to
Marta's
point.
D
D
D
And
if
it's
a
value
yeah,
if
it's
being
done,
we
don't
need
to
do
it
a
second
time
and
if
no
one
wants
us
to
do
it,
that's
all
fine,
and
if
we
don't
want
to
do
it,
that's
also
fine,
but
there's
a
little
spot
there
and
I
feel
like
somebody
paid
to
do.
It
regularly
would
be
efficient
for
everyone
else,
as
opposed
to
like
who's
getting
this
one
who's
getting
that
one
anyway
yeah.
Okay,
that
was
my
idea
thanks
over
and
actually
one.
D
B
C
B
A
A
B
Know,
but
what
I
was
trying
to
get
at
is
a
lot
of
them
that
ones
that
I
have
from
gr.
Security
are
just
simply
that
they
were
not
submitted.
Yeah,
yeah,
I
I,
don't
know
what
bad
blood
there
is
there,
but
all
I
was
told
is
that
the
guy
wanted
to
hand
off
the
torch
to
someone
and
he's
been
sitting
there
with
the
torch
since
2008.
C
A
A
Yeah,
so
if
that's
again,
if
the
group
wants
to
apply
some
time
to
this,
I
think
we
definitely
could
add
value
to
Downstream
by
applying
some
people's
time
to
help
with
the
documentation
but
yeah.
But
let's,
let's
see
what
exists
today.
What's
working
what
isn't
working
and
then
start
to
talk
to
the
players
to
ask
if
we
would
be
if
we
can
go
ahead
and
do
that.
B
A
D
A
B
On
on
the
flip
side,
probe
could
could
I
know
that
these
are
really
a
cert
problem,
but
could
I
bring
this
to
open
ssf,
because
here's
kind
of
what
happened?
How
I
know
about
this
is
that
they
were
trying
to
get
us
to
do
it,
and
then
we
were
trying
to
do
it.
But
it
turned
out
to
be
like
a
lot
of
work
for
two
people,
so
I
kind
of
feel
like
someone
should
do.