OpenSSF SIRT Best Practices WG, 7 Apr 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: BEST Working Group’s SCM Guide collaboration (March 28, 2023)

Description

Meeting notes: https://docs.google.com/document/d/1ttqkcYPmYZyqvtkaHs92bx2UeVUiXDhuzP-0WbP11Fw/edit#heading=h.7o2ubzl5z39r

A

Happy March, 28th everybody we'll get started in just a few minutes, got a link to the agenda in the chat. Please mark your attendance and, if you have anything you want to chat about today, please add that I ask any uh sub project leads to put an update on their initiative if possible and flag. If you'd like us to talk about it,.

A

Started at three minutes after the hour or so.

A

David wheeler was this: the group you wanted to talk about a couple things.

B

B

As far as vulnerabilities disclosures, no, that actually would be the vulnerability disclosures working group- okay, um but.

A

I get a lot of GitHub email, I, don't remember where at all comes from and goes to.

B

It all goes to you a.

A

Lot of it does.

C

Come to me it does sound like a personal problem too. It.

A

Does and I need to get off of the uh I need to get off a couple. Security mailing lists.

B

How else can you stay informed.

A

I signed up for the great MFA distribution and then never left.

B

Now, I'm on that list, too I haven't seen any emails. Have there been a whole bunch of females.

A

To uh be able to ask projects if they wanted tokens.

B

Right: okay, yeah I, never.

A

I have a folder in my mailbox that has like a couple thousand messages sitting on red got. It got it. Okay, all right! Everybody I, put a link to the agenda in the zoom chat, please sign in on the March 28th edition of our call, because we're not talking about C and C, plus plus compiler, hardening options today unless we wanted to. But that is a future meeting.

A

Do we have anybody on the call today that is interested? Well, you could talk about if you really wanted to Randall uh I'm not going to stop you, that's just not the sole topic of the call.

A

um We have anyone. That's interested in helping us take notes today.

B

I'll help you out. Thank you appreciate that.

D

I will have to.

A

Awesome, thank you. Marta. Welcome back. We haven't seen you in a while.

D

That's the time zone. We are back to Summertime.

A

Well, we always could find a new time if the group The majority of the group wanted to move so keep that in the back of your head. It's.

E

Not really that it's the the uh us moving time zones and then we're left behind and then we're moving catching up and everything's. uh You know, I, don't know where I am anymore.

A

Oh dear well, you're on the best Call of the week is where you are Robert. Absolutely all right. Do we have any new friends that wanted to introduce themselves and say hello today.

A

All right, as you have any items you'd like to discuss, please add those in the open section uh of our sub projects, which I have listed all of them below. Do we have any of those uh leaders around that wanted to share an update on any of our sub projects or cigs.

F

um Maybe a small update, so um we actually are busy with the new stack like I said in the previous meeting. So we have now uh the whole thing working at this can deploy lab the leap, labs and all that good stuff, automation of cert management and all that cool stuff.

F

um Myself and Randall also had a meeting with the cre project and they promised to come back and join a meeting as well. Probably this one uh slipped their agenda, um but the idea was that they will join a meeting as well and they will show up show up again.

B

F

Awesome Glenn.

A

B

This again cre, who is this.

F

We're also looking into how we can maybe uh collaborate and get also that data set and the theory into the uh Knowledge Graph that we use in skier.

A

Excellent, that's great any questions for Glenn about SKF updates.

A

Doesn't look like it Dan all right, so an update about the education Sig that effort is still being a massage to be to present to the governing board. We have a couple folks from the governing board tax governance committee that are reviewing it, but I'm, working with folks from LF legal on a pretty awesome, little uh presentation, an executive kind of summary for the effort. So we anticipate we'll get some forward progress on that soon and hopefully get word on what people think about the awesome education plan.

A

Any questions about that.

A

All right do either our source code management folks or our C and C, plus plus folks, want to give any brief updates.

C

Hasn't really been much progress in the source code management, thing, I'm, hoping to add some energy into that of the coming days. So yeah.

F

A

I've seen a lot of activity around our compiler options guide, which is awesome.

A

So I would encourage everyone to check it out.

A

uh Last little bit of a ministerivia before we move on to opens uh the vote closed for the adoption of the memory, safety, Sig and 11 eligible folks voted in favor of it. There were no dissenting opinions. So therefore we will be adopting the memory safety group under uh Nell, so welcome now on the crew to the family. They meet every other Thursday. If you would like to participate or learn more Thursdays at 1 pm Eastern uh every other Thursday is their calls. I recognize Dave Rousseau.

G

Hey scrub: uh is there a landing page that we can share as we try and drum up some support for people who might want to join that Sig.

A

Well, it's funny. You mentioned that Dave I spent the morning monkeying around with our uh Repository, and uh so the long answer is uh short answer is yes, the long answer is uh it's in flight. So if anyone is interested, I have uh compiled all of the sub projects and sigs into a table provided relevant links to their git repos, their slack channels, their mailing lists so that everyone can kind of see who what and where and how and with them just being adopted.

A

I got the note from the operations team I think yesterday that they had completed it. So I will begin working with Nell and that group in getting their landing page, set up and kind of bringing over any existing work, because they've been uh toiling away for a while now almost a year, maybe about about as long as some of the other groups, uh some of the other cigs, so they might have some additional artifacts. They want to add into that repo did I answer your question, sir. You.

G

Did this is great? Thank you very much for sharing.

A

Sharing is caring glad to do it all right, please add any additional items in the open section and I will yield to the human Jonathan. Let's talk about URL parsers, oh a question before David yeah.

B

Just real quick, uh we uh we're doing the updates or everything else. I thought I'd do quick updates on uh for for Best Practices badge uh we've been having this rail 7 update for a while, we think we're getting close and for the security fundamentals course.

B

um The course has talked about something involving HTML targets for a while um and there have been Rumblings about, hey browsers, have changed, and this is no longer an issue, but it turns out verifying that it's actually not a problem or not has been rather complicated.

B

um We think we finally nailed down what the thing, what the actual truth is and therefore what we can put in the course which is it's mostly but not completely gone, and therefore it's more complicated to talk about. So if you've got any last minute uh comments love to hear it, but we heard back from Mozilla folks so from our friends in Mozilla. Thank you um who kind of helped us get the uh the the the details uh straightened out So. The plan is to merge this very very soon, unless uh somebody says something soon.

B

A

Cool any questions or comments for David on the course or the badges I've paid.

A

If you'll be in Vancouver for the open source, North America Summit check out Mr, Wheeler and I's amazing presentation, where we will tell developers on how they can earn a best practices badge and also get integrated into the scorecard project.

A

It'll be great.

A

All right now, I yield the floor to Jonathan. Take it away, sir.

H

um I don't know this is the right group for this I, don't even know where the right commonplace for this conversation is, but this.

A

H

The best problems, yeah I know I, was talking to Luigi uh about this topic. He brought it up and then this is an area that I have particular experience with.

H

um So uh there is, uh there are two standards for parsing URLs in the industry, there's the old RFC spec and then there's the second spec, which is the current living specification that is uh under what wig and it defines a newer standard for parsing urls and um the the news that, if you're, using a URL parser to um allow list or deny list a certain set of subdomains to be resolved, and the thing that is doing the resolving of the URL is different from the thing that is doing the allow listing you can allow list domains or deny list domains that, given a specific, a specially crafted domain can resolve to something else and uh yeah so yeah great great times.

H

Great security, vulnerabilities, uh orange Psy did a black hat talk about this and it covered like how he changed. Four four vulnerabilities: to achieve remote code execution on GitHub um that because of github's filtering um yeah, I, think and like he did other research. He found that like, for example, um uh a lot of PHP libraries will use php's, URL parser, but then make requests with curl and the PHP par server.

H

Urls are different from the one that uh is different from the one that curl uses um and uh I spoke to Badger, who uh or Daniel who run who runs curl, and there was a discussion about hey this. You know, doesn't uh your parser doesn't fan, it uh doesn't support the current working. You know living standard and he's like her curl implements the uh the old RFC spec and not the current spec, and so what you'll find is that, because of this, a lot of Old Lang like older languages, for example?

H

Java, you know curl some of the stuff will support the old RFC spec for URL parsing and um the newer, like you, know anything web-based so JavaScript libraries, the what the browsers all that stuff implement the new standard for ulr URL parsing, and so we have this um uh ambiguity in the industry about certain URLs and whether or not they are a certain host or another. A different host- and uh uh you know I, was thinking like maybe somebody in the open, ssf or somewhere. We should like decide that that the industry should be doing.

H

You know one of two of these things and I. Don't know what the right answer to that one of these two of these things is, but uh it does lead to vulnerabilities and- and there are probably more than we have currently found, because it's kind of an obscure bit of knowledge, anyways.

E

H

My like I, don't have an answer, but a lot of questions. Dan, you had a hand up.

C

Yeah um welcome to my life. No, uh the uh uh the uh thing that I've got to say is this sounds like something that the w3c tag might want to get involved with with which is a group that I happen to co-chair, um and it's a group that often gets in between w3c ITF and what WG things that have uh efforts. This is something that we've covered before: how there's this ambiguity between the the living URLs back and the uh RFC URL spec and um I'd be happy to help.

C

Basically, uh even though I can't I can't imagine that those words just came out of my mouth um I'd be happy to oh for this, um because it's yeah there's some scars. Yes exactly um and uh uh but it it is something that you know you know it.

C

It takes getting some people in the room together to facilitate having that discussion and those people are people like Mark Nottingham, who, like co-chairs the HTTP working group in in ITF, and um maybe some folks like Anna van kestron who's, currently at Apple who's, very active in the in the lot WG, and uh both those people used to be tag. Members as well. So um there's something that, like maybe I can help is what I'm saying. uh Maybe we can.

C

Maybe we can have an off Channel discussion if, if you're saying that it's something that open ssf as well is is like bringing concern to the table on this, then that is that it that could prompt a deeper discussion on this topic and maybe get some people talking to each other. I haven't who haven't resolved this issue yet.

H

Thank you. So, um let's chat more yeah David.

B

Yeah I would not assume there's only two um okay, uh you I mean you've got the RFC you've got. um You know the what wig you've got the uh there's the older w3c spec, it was kind of implied and frankly, the what we you know is feels free to change specs at any time. I wouldn't assume that the current spec has oh, is what has always been from them. So there's probably multiple versions, and they don't make versions very obvious.

B

C

Wg doesn't what WG doesn't do versions right, yeah.

B

That's their whole thing.

C

F

H

Spoke to the guy I spoke to Dan uh Dan, who writes curl and he's like yeah. So we implement the RFC spec, but also with some changes because they're stupid decisions that were made and like.

E

H

E

Like you know,.

H

There is like what the spec is and what is like reality.

B

Right and and you you keep saying URLs but there's also uri's and Iris and other glorious things, so um I I don't have a solution. I just want to observe that the problem is even worse, so I don't have a solution, um but it does seem like there's a need for one and probably Step. One is collect the different specs I'm, trying to identify the differences and at least some of the ways that they've already been exploited or could be exploited.

C

I really suggest focusing the discussion around threats. Existing threats like this bad thing is happening out there. Let's try to fix it, because the problem with this is, as David pointed out there, all their Iris. There are Uris their urns. There are all these different things, some of which are being used in various places in the world. uh You know like academic uh Publications and this kind of thing and and there's there's a lot of um so putting the focus on concrete threats.

C

I think will help to focus that discussion, because otherwise it could completely go off the rails into La La Land, which is what I've found before when I try and have a discussion about URLs and Uris and stuff like that, yeah.

H

The um the best resource that I found so far is from um Daniel on uh he's, got a I think he put a blog post up. That's like my like something like my URL is not isn't your URL and it's like the list of like here all the differences, and these are all the vulnerabilities that occur because of that um I can't.

C

I think this is awesome. He is, he is yeah yeah.

B

Yeah, absolutely: where is this I'm.

H

Trying to find the article but I mean.

B

H

Of the there's, like a bunch of log links, this hacker.

B

A

I might suggest if we find if this group finds this topic of Interest, we either could uh and continue the conversation in slack or uh GitHub discussion, um and then we can kind of uh maybe collect some of the state of the art, as some of the links are being shared here and then potentially see who's interested and maybe uh excited to try to help solve a problem.

H

hmm I will um also uh message Daniel and see if he wants to get well because, like he, you know of the people that are most most experienced with this topic.

H

um I don't feel at all like I know enough to to engage in this topic. Just I can recognize, there's a problem here and uh know that something should be done even though I don't necessarily have the solutions.

A

Any other questions or feedback for Jonathan on this topic.

B

uh I guess one real quick, um which is I, don't think you know if it turns out the tags, the better group to resolve this. That's awesome, um I think. Basically at least though trying to collect what the problems threats issues are um is the no matter what that's the first step. So if we.

F

B

To capture that, and then, if it turns out that it's this group, it's the tag, it's something else, that's great! We just want it solved. Yeah.

C

I'm not I was not suggesting like this. Is the tags thing don't touch it.

E

C

We can help with some tag: energy, that's all yeah,.

B

Right I got it got it that and that's very much what I mean I I'm, basically trying to make sure that you know the goal isn't to try to capture ownership. The goal is to solve problems, foreign.

A

And then we could document a good practice and talk about it.

B

Could we could, um by the way, if there's Inc, there's inconsistencies? The long-term solution, which is rough, is convincing different projects and libraries.

C

B

Agree but there's no chance of that until there's agreement on what it is right.

A

Any additional thoughts on URL parsing.

B

I'll make a quick note for the best practices uh badge uh we're ridiculously picky about URLs for repos.

B

um You know forget the spec hack stack most of that stuff's not allowed. So you know, oh you want to you, want the URL it's going to be HTTP or https. You know. Yes, you could use FTP, but we're not going to allow that only these characters. Only these this. Only these that and remarkably I've only gotten one proposed change in the last year. I think where hey at symbols are allowed and we actually use them. Okay, fine, but basically, we've started by being ridiculously picky and slowly expand.

B

And yes, that means that there's a lot of fully compliant URLs that we don't allow, but until somebody actually shows a need, it's much easier when you just forbid a whole bunch of stuff and then slowly I, don't know which what what makes sense, because then we don't have to worry about a whole bunch of weird cases that are possibly misinterpreted because well that wasn't allowed either.

A

All right folks, so look for some continued cut, Dialogue on this and Jonathan. Just let us know where you'd like to have that and slack or a discussion or yeah.

H

A

All right, I see Daniel, have I'd like to talk about scorecards.

C

Yes, it's just briefly: uh I had a discussion. Last week, um Brian Russell and Lauren Simon uh from Google uh are talking to different people about scorecards and uh so I uh sat on a call with them and answered questions that they had about scorecards and one of the things that they're talking about is introducing more content into scorecards itself right, so um where the uh it would, instead of just giving you a number- uh or you know, would say these things.

C

These specific things are misconfigured, um and here is the remediation right and that's when my year is pricked up, because I was like okay, well, that now you're talking about content, which is very similar to content, that's being developed or has been developed and the best practices working group and gosh, maybe it'd, be good to synchronize.

C

That content and I was thinking specifically because some of these issues are are already being talked, are already, there's an overlap between these uh topics and the stuff that we're talking about in the SCM discussion that are coming out of legitify in terms of like um uh SCM configuration options and uh be good if they're at least saying the same thing, maybe even synchronized or maybe the scorecard output should be linking to some material which is being curated by by the best brand anyway. There needs to be some coordination, so I just thought.

C

I'd kind of raise it um to your to your attention, probe.

A

uh I was a participant in one of laurent's conversations. uh They Laurent and azim actually are uh working group members. They haven't popped in a while in a while.

C

Because yeah, so that's that's yeah that led to some discussion about because they they actually told me that exactly that they hadn't popped in in a while. Yet so yeah. But.

A

They meet every other Thursday at 4 pm Eastern, which would be 1800 UTC, which would be super late for our European friends, but uh yeah I think it's a worthwhile effort. uh I've. We have a great long-running relationship with that team. They are officially part of this group, so yeah. Let's uh is anyone interested in trying to help Wrangle a uh a meet and greet and kind of a sink between uh our groups? Efficient.

C

I feel like there should be like a one-off half hour. You know shortened short and sharp kind of like meeting of the minds about it and I'd be happy to be a part of that I'd like to be a part of it, because we're contributing into scorecard so yeah, as is Intel.

A

So yeah uh does anyone interested in trying to set up some time with Laurent and azim and crew, and uh members of this group.

I

Yeah I can make it.

A

Thank you, sir I appreciate it. um I have all the relevant links to scorecard. If anyone, if uh and they're they have their own slack and they're, also in our slack and everything so I just reach out to them, they're pretty pretty Speedy in response, so I think we should be able to get something set up in the next week or so, and we would like to try to make it uh probably around this time. uh Maybe uh a half hour further, so it'd be early morning.

A

California and that's Doug gives us some overlap with our European friends.

A

Thank you appreciate it.

A

All right and next up uh abishay wanted to talk about the uh C and C plus plus hardening guide.

I

Right so this update is, uh as you said, the relevant for the CNC plus hardening guide, uh basically um robe reached out to uh to. Let us know that the Microsoft C plus plus compiler, is currently not represented in the guide that is being worked on. uh So we have a new team member who is joining the course now, where Gabriel dos Royce um and additionally, we have the Bim scheme uh Tool, uh which is a compiler, slash, Linker, uh checking tool that is open source uh by Michael Fanning's team at Microsoft.

I

um They are also currently working on sanitizing uh their rules, which are built into Bim scheme uh into a format that can be worked on and by the CNC plus plus a hardening guide that will complement what's already there, the GCC and the C line. uh So we are expecting that it's still work in progress. uh So it's hard to commit on a time but uh safely saying that uh in the next three four weeks we should have that document, sanitized and ready to be digested by the same group.

I

So hopefully Gabriel will lead this effort into the into that working project and we're excited about that.

A

Awesome any uh questions or comments for abishay about that I'll. Note that I'm doing something similar with um Diana as part of the Intel compiler, so that we can have a representation of any all the major popular compilers for developers to lean into whatever path they pick. um David.

B

Yeah um those have been deeply involved in the compiler options. Stuff already know about this, but uh there's actually rationale for this. um The GCC sea, Lang and Intel compilers all take the same Syntax for options, and if the options are the same, they generally are exactly the same. Names of a Microsoft, C compiler is is quite different. Options begin with Slash. All the names are different. Everything else is different, and so it makes more sense to have them as separate documents.

B

uh It's more like two different programming languages, more than anything else, so there's there's! No just you know so. um I I welcome it I think just for um simplicity's sake. It makes sense for them to be in two different documents, uh because there may be out there almost certainly options than one that are not the other. They don't always do the same thing. So you know, if you have this situation go here. If you have that situation, go there thanks and.

A

We have the amazing power of the internet and GitHub to be able to have two similar files in a same folder and referenced each other Randall.

D

I was gonna check if we ever got to reach out to AMD I I forget who was going to reach out to the members that were here that.

A

Was probably me so many action items um not.

D

Pointing fingers bro, oh.

A

You're pointing that finger I, see.

A

A gentleman's name from AMD Nathan menhorn is part of the vulnerability disclosure working group and he probably would be at least a point of contact to ask inside.

A

uh So you could either wait for me to get around to doing that or if somebody was particularly uh uh motivated, they could reach out to Nathan. I can get you his contact information.

D

Cool I'll, send you a slack message and I could do that if you're cool.

A

He's been part of that group for a while he might not be the guy himself, but he might know the person inside AMD to get us uh that that feedback.

D

Sure, thank you. Yeah.

A

Very excited about this compiler project. I think this is, will be a very useful resource for developers and kind of help clear up uh some foundational security. Things very excited all right. Do we have any additional any more feedback on uh the compiler guide.

A

Do we have any other topics? The group would like to discuss today.

A

All right, I'm gonna sit down, hopefully in the next couple weeks and do a backlog, scrub, uh Dan, David and I. Maybe can sit down and just slack something to kind of get some of these things uh dispositioned, so that we can have a clean set of issues to be working off of.

A

And barring any additional topics, I think we can adjourn for the day.

A

Thank you, everybody for your time, attention and participation. We will see you all very soon. The Deni subcommittee will be having a call in just about 20 minutes or so so, if you're curious about the education Sig and our Deni subcommittee pop on that call, we'll talk to everybody later have a great day.