OpenSSF Vulnerability Disclosures WG, 31 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: OpenSSF Vulnerability Disclosures (May 31, 2023)

Description

Meeting minutes: https://docs.google.com/document/d/1mZEi6EvbH2mvn-gHOUIaysAjHlwJXjJdJ7gMlelSkVU/edit#heading=h.u5im5d90xac4

Repo: https://github.com/ossf/wg-vulnerability-disclosures

A

Is not loading.

A

B

To reload Zoom give me a.

A

A

Hello, all can you hear me, can you see me yep good morning morning.

A

I am off probe and taking control of the working group meeting.

C

um What evil plans do you have for us today? Hey.

A

uh World domination, uh uh ambitious, I.

C

A

Mass disclosure of vulnerabilities without without any um any controlled uh you know, disclosure timelines. Just watch the world burn how to make Madison's job really painful, really fast.

D

Sounds like a good day. It's not for medicine, though.

E

Just it's the use, you know it's fun.

D

Isn't the world always on fire anyway, yeah.

E

The world's always on fire, then nothing's on fire yeah.

B

A

Someone sent me this uh this GIF um or this or not not GIF, this meme with respects to um uh a vulnerability that keeps rearing its ugly head. um Let's pull it up uh here, screen share.

B

A

um Snake ban at yaml's been the bane of the inexistence of the Java ecosystem. Recently it just yeah every time you suppress it, it just pops up on a with another one. um Yep uh anyways welcome to the yeah I, just I thought that was funny and we're sharing with the working group so yep all right. Let me pull up my calendar, pull up my uh so starting off um just to just to get everybody rolling.

A

um If you could go into the working group meeting notes and add your attendance, it helps validate that we are indeed a functioning working group that uh is worth notice in the open SF. Your your attendance validates our existence.

A

No pressure, though,.

A

Yeah, so we would love uh a scribe to ascribe what we chat about today. So if anybody wants to take that one on we'd love to have you.

A

Anybody anybody prescribed.

D

I can try my best.

A

Perfect. Thank you so much.

A

Thank you, okay, um new friends, do we have anybody who's? This is their first time or they've, never piped up before at the uh the working group, this working groups before and I'll say hello and introduce themselves.

A

Michael has to scoot No New Friends, okay, um and he opens anything that anybody wants to talk about and specifically was not in the meeting notes about um uh anything.

B

A

Right um go for it. Go.

C

For it, um there was a document that folks were working on I think there were like a couple of meetings like scheduled out of band for it for like um kit, Hub or sem best practices.

A

uh Tell us more.

C

I'm sorry wrong working group, never mind I, get it mixed up.

B

C

um Take a look if you want it's it's from the it's in the best practices working group.

A

Okay, um any other opens or anything else that anybody wants to bring out. In you know, topics vulnerabilities that were interesting um pains with vulnerabilities closure. Anything.

A

uh Can I T um updates from the sub uh sub projects? Do we have anybody here from the OSS cert uh worker group.

F

uh Hi I am, although um I believe we went as far as canceling or temporarily canceling the weekly meetings um unless I'm mistaken. The proposal has been written for quite some time and the decision-making process is somewhere in process for weather and or how to actually operate the open source, sirt search.

F

If anyone knows better than me, please speak up, but that's the last information I have in my head.

A

So the proposal is written, has it been presented with attack, or has it been where, where has it been presented to.

F

uh The details, my impression it has been done, the working group has done everything in its power to present pitch, uh seek approvals and again I'm. Pretty sure krobe asked the calendar maintainers to pause the pause, the weekly meetings until something happens, Madison.

E

F

E

Yeah right yeah, we have it uh somewhere a couple Pages down and everything notes for this meeting. um Basically, this is paused until the governing board gives them more direction. To makes a decision is the last update we have.

A

um Just my naive self, um the governing board is, is going to be directing deciding whether or not to direct funds to this or not.

F

I think so I mean right. This doesn't happen without you know, either effort or dollars, or some combination right, um The Proposal talks about right. It is open to the idea of volunteers, uh so you definitely get volunteer. Contributions are, hopefully you know expected or planned, but right there's the difference between Community volunteer and right, open, ssf member.

F

uh You know direct or allows one of their employees to spend 10 hours a week on this versus LF or open ssf. You know paid one full-time person to make sure the thing keeps running. There were some combination of things like that in The Proposal.

F

um There are lots of effort, estimates so uh I think it. Finally, at this point is really a air quotes around it fund or not, or how much funding.

A

Does it have I guess? um Is there a champion for it to the governing board.

B

A

F

He's the one I think I mean he used the the head of the you know, working group chair, he have did a lot of the editing you know was running the whole thing and I believe he presented when present when pitching was a thing, I think he did it, um but again, I may have missed something there.

A

Okay, so Crow was the one with the knowledge in his head about that. One: okay, yeah.

F

If crop says something different than what I said, then you go with probe yeah.

A

Okay, um do you have any other points or comments, or uh anything else that you want to discuss on this topic.

F

um I, don't really I will you know personal opinion? There are parts of the OSS search that I think could be executed pretty quickly and would be generally helpful. um Other parts would sort of take more upfront work. There was sort of an education training component in there that we debated right. Does this? Does this live in the open, SS assert? Does it ossr? Does it live elsewhere and there are other I believe there are a number of other sort of education, training security advice, pieces of openssf?

F

So there's some, you know discussion about where these things should or shouldn't live uh or if it does live in the cert right, how to coordinate or how to you know, cooperate across across pieces of openssf um I will say, though: I have no I, have no sense of right, open, ssf's, sort of resources, priorities, uh I, don't know if and how to make this a priority or not I don't know if they have 10 other things, they're much more important um and also I come from a background of this sort of thing.

F

So of course, I'm biased in favor of in favor of doing some parts of it, but I have no I have no sense of where it is in the either you know formally or back Channel where it is in the um decision making process.

F

I I am taking the fact that it's been languishing for a while to mean it is not too too high of a priority. But again, that's a very naive observation.

A

um Given that Crow seems to be heavily subscribed to a lot of different things in a lot of different initiatives, does anybody from this working group or the Sig want to allocate some time to become a champion of this proposal to the um uh to the um uh board end of the attack and try to seek out funding and funding Avenues on this.

F

I would I talked to Pro briefly about this I put in a talk somewhere to it was stupidly titled right, let's, let's do open OSS cert now already, um uh but um yeah I hard to say if a different person or a different you know, different Champion or a different voice would make a difference.

F

Okay, yeah so will willing to discuss it, but it you know, cost benefit trade-off.

F

You know it's pushing a dead horse up the hill, then no thanks right can.

A

You pose a question either in the email thread or in the slack channel to probe asking what the current status is just so we can get that you.

F

A

Will go yeah I.

F

Will go check in.

A

With him, yep, okay and then and then take whatever that is and try to toss it back into the working group meeting notes. Thank you will do perfect all right um that good for this. That topic all right. um Cbd guide for consumers um issue 115, who wants to lead that topic.

A

Put it in the dock, oh it's Groves! Okay! We might want to wait on that one if krobe is not here.

E

I I think his ass. There is just uh who would love contributors to work on the document he made the document an issue, um there's not a lot in it, uh so I suspect is just asking for more contributors here.

E

A

um So if anybody is interested in contributing to the open source security, Foundation vulnerable disclosures working group, CBD guide for OS open source consumers, um that would be lovely.

A

But anybody else want to have any comments or questions or concerns about that. One.

A

Alrighty then I will take over what the the projects that I've been leading on this uh charge. um So there's two documents that I've been working with the autofix Sig um first, um so for the autofix Sig. Just a heads up the meeting time has changed. We're now meeting new meeting time, um uh Wednesdays.

A

At two o'clock, P.M EST, so we're meeting every Tuesday at 2 pm EST um uh discussing the work that Alpha Omega will be doing bulk, generating security fixes that have scale across open source. I would love to have you involved in the conversation um on that topic, um the uh that Sig is seeking uh a discussion on this document which we created, um which describes a proposed disclosure flow for automated vulnerability, fixing um I'm happy to dive through this real quickly with everybody here um at a high level.

A

um So let me just go through the key um Fork joins Fork joins are where uh you'll have multiple possible processes breaking off and running in parallel and then joining back together.

A

um This is an or ores are any of these things that are coming into. It have to have finished before we move forward, um and then the topic piano. The word PM PVR is uh pragmatic, means of pro no programmatic means of private vulnerability, reporting, which is basically like for GitHub um uh uh private pbrs private vulnerability. Reports for gitlab um gitlab has an option that on any polar price you can make it private.

A

So um uh at least that's what I've heard so um when you're trying to bulk automate security fixing at scale we'd start reposit, we check if the repository host supports pmpdr, um uh which, like GitHub and gitlab, because the answer is yes bitbucket and the answer. Maybe you know, um and then we check if the repository is enabled pmpvr. If the repository is enabled pmpvr, then we just use that to create the private pull request to fix the vulnerability.

A

If that's not the case, um then we go to this Fork join um where we run two porosities in parallel, where we constantly look to see is the vulnerability fixed if it's not have 90 days of lapse since the process began? If no has the public PR uh has a public.

B

A

Request security fix to fix the vulnerability being open. If no has the repository enabled pmpvr, so we just Loop. We run this continuous loop. If the vulnerability has been fixed or public pool request has been open, then we're finished. Otherwise, if 90 days is a lap since the process has begun, then we create a public polar here simultaneously.

A

We try to communicate with the maintainers about the vulnerability, so we used um Michael scavetta's, open ssf, disclose check thing that uh code that he wrote to try to find contact emails on the repository that we're trying to report the vulnerability to, um and then we use that we check to see if the repository has issues enabled some GitHub repositories, for example, have disabled issues and they use jira only for their issues.

A

um If, if issues and emails are found, then we go down both of these flows, but if we only find email, sorry, if we only find that issues are enabled but not emails, or if we only find the emails but not issues, we go down. One of these two exclusive flows- the top one up here is- is uh following issue based private vulnerability, reporting, um where we attempt to reach out to the maintainer Via a public issue where we say um create a new issue requesting that they enable pmpvr.

A

um Otherwise, if there's an existing issue, that's been created, we use that issue. If the issue is closed or deleted without a response, then we immediately go to assuming that just the vulnerability we immediately complete the step or if the issue has been open for at least 35 days. We just complete this this phase.

A

Meanwhile, um assuming that we can find an email to communicate with, we send automated emails with the vulnerability details, a request to enable pmpvr, and then the fix is a patch file. If all the emails bounce or we receive automated, please fill out this form on this website responses.

A

um Then this is completed. Otherwise we wait 90 days, but, alternatively, there's two different flows: there's either either you wait 90 days or you can engage in this flow. um This is up to the implementation, like the decision.

B

A

The person implementing the specification can follow. They can either just wait 90 days or if they get a response, that this is not a vulnerability, um then they can immediately help create a public pull request. Otherwise you wait 90 days uh since the email is sent and then this site is completed. So if both of these completed right, if the issue flow is completed and the email flow is completed, if the repository at this time is not enabled PM PBR, then you create a public pull request.

A

Otherwise, you end, and this will trigger the um the public disclosure, because 90 days have, since the processes began, a public pool request will get opened so either flow on this, a public pool request gets opened if, if they're, they're unresponsive, um this is a high level flow proposed flow for for automated disclosure um would love to hear any feedback. Questions concerns about this proposed flow from the Sig.

G

So essentially, there are two things: one is a private uh private, uh like pmpvr or or a public pool request right right, um so the public pool request. It is like they're just shown differently. So is there a reason like this has like a rectangle, whereas that that's like a pentagon.

A

uh You're saying this one versus yeah yeah.

G

That one yes so.

A

This is going to link out to another document which I haven't done anything with. Yet this will be another flow. um This one is a predefined process, that'll be described in the document.

G

I, see, okay and and uh and there's the the loop that's just underneath that pmpvr. What's the frequency of executing that loop with.

A

This one here: yes, um your choice, okay, yeah, it's just you can throw whatever delay you want in there. Just you know this.

B

Is the loop? This is the set of set.

A

Of conditions, you should iterate over before making a step.

D

Yeah, just one thing: I noticed that I didn't notice the other day. um What happens right at the beginning? If, if the host doesn't support pmpvr.

A

Oh huh good question.

D

uh I would imagine maybe we go into that, that Loop below uh uh just waiting and let it wait 90 days and well.

A

So if the host doesn't support pmpvr, huh that's a good question. um If the host doesn't support, pmpvr I think that we um go immediately into this flow over here.

D

um Okay, yeah I, think that makes.

A

Sense start start starting here, I think the only thing that's missing, though, out of that flow is the 90s elapsed, um creating a public pull request right. So that's a.

G

A

That is a conditional that has no no option. Thank you. That's a good! That's a good uh good spot. I'll fix that we're meeting in in at 2PM and so I'll fix that between now and the next meeting uh sounds good yeah. um You just add a comment.

A

Don't I have upgraded I own this, the Lord uh I hone I own a license with this thing. Why is it telling me I need to upgrade all right. I don't know, uh needs a.

B

A

All right, um yeah anybody.

B

A

Okay, um any uh I'll put you on the spot, but um anybody from a repository host that uh will be the target of this sort of work. Wanna have any comments that bucket gitlab. Anybody like that GitHub.

A

Nope: okay, perfect! uh That's totally.

E

Fine yeah, nothing, you don't already know about people. Containers have lots of opinions about getting uh what they consider to be drive by PRS and issues. So that is the only thing. I would caution. Yeah.

A

That's that's very fair. um It's very fair!

A

um Okay, um other update, uh okay! Let me go back to here: um uh autofix, um oh yeah. We are looking for someone to assist with taking this document and turning this into um actual use cases, like example, walkthroughs of this flow. So if anybody um is interested in in collaborating in taking this um this flow and walking through an example and writing that out into the specification that would be greatly appreciated, um we would love your assistance with that.

A

um Does anybody have any interest in doing so immediately? That wants to wants to offer their time to assist with that.

A

Okay, um all right uh what else um and then from there once we have this we're going to start working back on the original specification document describing uh vulnerability uh disclosure flow.

B

Perfect, okay,.

A

um Next topic: does anybody else have any other things they want to talk about for the autofix Sig before we move on.

B

Okay, um is there anybody here.

A

From the autofix Sig that wants to speak about where that's at.

H

Nothing you haven't covered I, think right.

A

Is the auto fact is, the is, is open Vex. Is that what is the current status of that thing?.

H

ah So from the open, Vex um I thought you said the autofix no.

A

No I'll open, Vex yeah. Does anybody know what the current status of open Vex is.

H

um So I did attend, I, think not the last meeting, but the one before that um it's kind of um starting to to to get like on-ramp's status. uh um uh The first couple of meetings they just kind of presented, the the schema and the project, and um um there was a discussion about um possible like directions to take the group.

H

um So that's that as far as I can remember, that was the status. The last time I attended.

A

Did that stick have regular meetings currently? Are they still kind of ad hoc.

H

B

H

On Monday uh evening, like Europe time um but I, think it kind of it dropped from my schedule, at least from the calendar, so I'm not sure where it's like. What's the current status, um because uh oh yeah, no, so it's still there. So it's 10 P.M on my clock, which is probably like three no I, don't know Eastern Time.

H

H

Yeah my calendar I, don't know like one or two o'clock, maybe eastern time, yeah, okay,.

B

But with so that's all right, that's on Mondays.

H

Yeah, it is a regular uh uh bi-weekly, meaning, okay,.

A

H

A

Was yeah Monday was a holiday for us or people in the US, so, okay, that makes sense all right. So.

B

Bi-Weekly all right, perfect, okay,.

A

um Good to hear that that is.

A

B

A

uh On Mondays at three o'clock: P.M, perfect, okay, um anybody else for any topics regarding openvex that they want to discuss before we move on.

A

Okay, um anybody from open, uh osv the open source, vulnerability, project- I- guess that's right! That's osv- is that: how is that? What it stands for open source, vulnerability.

F

I think so: okay.

A

um Does this does that project have a regular Sig meeting or a regular project.

F

I, don't think it's a Sig in openssf, it's a product I could be wrong. It's a project. Okay,.

A

Okay, who uh who's running that or who's in charge of osv.

F

E

It's uh Oliver, Chang and I cannot remember these yeah.

F

It says Russ Cox here, Russ yeah.

E

A

That might okay, that might be, we may be having updates from them in the EMA meeting. That's yeah. Okay is.

E

A

Where that's coming from okay, but.

E

Yeah it's coming from. Okay,.

A

All right, so that that explains why we're not having them here, I'm like where, where where are we, the people running this project? Okay, great um perfect, um anybody have any comments. Questions concerns yeah, Australia, yes, it's there. It makes sense to why they're not I had a manager in my previous job that was in Australia um and I'm on the east coast of Boston. uh My day would be like I'd, be done finishing my day at five. Six pm and he'd be waking up really early to meet with me and it was terrible.

A

I loved working with him as a manager, but good Lord having man having your manager be in Australia is a hard when you're on the East Coast um yeah. um Okay, uh uh all right! No, it's a not EMA! This is Ema it's. What is it a?

A

What's the other meeting slot College APAC APAC? Thank you all right, perfect! um Okay! Are there any other sub-projects that I'm missing here that are not listed.

A

um I have an open, then, if we have time um uh I just want to kind of give an update on this is not um under the. um This is not under the this working group. It's under the securing uh software reposit for his working group, um but just an update um from last did I I, don't know I, don't think I presented this in this working group I presented in the in the APAC call.

A

Is that correct the great artifacts, uh the great artifact repository security audit did I present that at this meeting last week, but I don't think so.

A

Okay, um nobody's saying yes, uh okay, so high level. um This is a proposal that I've put together to try to fund so okay. So the postulate that I'm I'm basing this upon is. um We have a lot of artifact servers in the industry right, uh npm, rubygems, Pi, Pi uh or Pi Pi I'm, saying that wrong. I'm! Sorry, please don't hate me!

A

um uh Maven Central um Gradle plug-in portal, uh nuke it right all these artifact servers um I pause it that, because these artifact servers are predominantly not sold to corporations, um they are available for free for open source and for anybody to consume. Because of that, um these things uh that are fundamental to supply chain um are um uh yes.

A

I can share a PDF, I, think uh art I think I've posted it a pdf version of it in the email in the vulnerability exposure working group I'll go look first, thanks: okay, if not it's either in the slack or in the in the email. So harass me if it's not okay,.

A

um Yeah we'll do perfect. Okay, um so I pause it that all these major artifact servers that you know because their software is given a road for free most of the time, a the forcing function on requiring a pen test. Is the software being purchased right from a company um and so I'm not sharing my screen? That's uh that's, probably, okay. So the the idea behind this is because these things have never been purchased because there's never been a pen test done. We have this critical infrastructure out there.

A

That's that's likely not been thoroughly security tested um and I would like to change that, um and so the proposal for this this proposal is: let's actually get the money together um and and pay for pen tests and Red Team engagements against the organizations that run the this critical infrastructure.

A

um So um it's based upon a couple of postulates.

G

Central artifact.

A

Repositories are freely available, operate as both a public service and as a significant cost center for the organizations that run them I.E. They do not generate revenue and are often expensive, expensive to run um and there's a cost sensor there are are likely under-resourced and under maintained.

A

um Also dependency, resolvers and Publishers are available for free they're, open source and they're development and maintenance is a cost center um and there's likely never been sufficient. Market forces justify spending additional money, commissioning a pen test against this infrastructure for community-run artifact servers um the uh it's likely that they've never had enough money to actually pay for a pen test, and so and also pen tests are expensive, require dedicating time and resources to actually addressing the vulnerabilities identified.

A

So it's a pain point that you know nobody's willing to be a champion for I have been signed out great.

A

There we go- um uh hopefully I wasn't just kicked out of my company I, don't think that's something um so um anyways, so uh the the idea behind this is: let's actually get these audits done. um The thing that's relevant to uh this working group is the proposal around leveraging the vulnerability, closure working groups uh and and the open source security foundations, um model vulnerability disclosure policy as the policy for disclosing the vulnerabilities found under this audit.

A

um The way that that would work is um if the um if the repository is run by a community I.E, a non-for-profit, um then the uh the audit will be performed for free and the open, ssf or whoever's running. This project would also um pay for uh the a contractor to come in, or you know, some resource to help fix these vulnerabilities that are identified as part of this audit.

A

If the um artifact server is Corporate run um run by company and it's not open source, um then we give two options: either you pay for it right use the corporation you pay for the audit. As long as your audit um is within the scope of what we you know, it matches the scope that we would like, um otherwise, we'll pay for it. If you pay for it, we want to hear we just want to see your results and a retest result within 180 days.

A

um If we do it, our disclosure deadline will be the 90-day disclosure policy that the open SF has for this work, um so that you know, there's there's a financial incentive for or there's there's a a rat there's an incentive for these organizations to not just you know, um just take our money for it like. If they want to control the disclosure on it, they can pay for it um and then um the site. This proposal also comes with a concept of uh repeat testing.

A

So we'd like to do this every you know two years for the red team for the pen test and then hopefully, a red team. Maybe every three.

B

A

The funding for each one of these is that each each we assume that each artifact server would cost about a hundred um 150 000 for the um the the pen test, and you know, uh between 10 and 85, for the red team engagement um for each each artifact server um for public disclosure parts of this. The the vulnerabilities that are found as a part of the audit would be publicly disclosed the red for the red team engagement.

A

However, the because red team engagements include an aspect of social engineering and attacking the actual infrastructure, we wouldn't be um uh disclosing the full report from that. We would disclose, however, um that that the red team engagement incurred and the impact they were able to achieve um you know uh and currently um The Who as to who you would involve.

A

In this um we we would like to involve GitHub for npm Gradle for the Gradle plug-in portal, um jfrog for the Conan Center sonotype for Maven Central Ruby for rubygems uh Pi, Pi for uh and the uh or python uh what python software Foundation, golang Drupal cargo, Docker nougat, um there's some questions about alari, actually, there's Drupal and Hilaria too, that we were considering, maybe not including immediately and then packages for PHP, um so I've actually taken this proposal and sent it sent an email out to um all of the security teams for all these different artifact servers, except for GitHub and um uh nougat, because their contact is security at Microsoft and that's a very large um black box.

A

That I don't want to try to shuffle this email into because I'm I'm just gonna get. This is not a security report go away, um uh but all the other part packaging ecosystems have been reached out to directly to try to uh propose this and say. Would you like to be involved um and the meetings for this will be happening both in the securing software repositories working group meeting and the um uh the there's a cig?

A

Now that is meeting in that same time slot every Thursday where the working group meeting is not so the meetings are um at 9 00 a.m on Thursdays. So if you are interested in this topic, would love to see you and yes, Madison I would love the contact information for the PM or the security lead specifically directly to for npm, so that I don't have to go through the security at and also if you have contacts with the nougat team. That would also be helpful because nougat is also Microsoft.

A

I, don't know if that's too far afield, of where you're working in no.

E

I I can reach them. Okay,.

A

Perfect yeah, if you could, if you could toss me, their email addresses uh I will uh I have a can or not a can. I have an email that I sent to all the other artifact servers and I'll I'll just continue sending that to them as well.

A

um And the only other thing is I just follow on work proposal of potentially at the end of this um funding after the first wave of audits is done, um potentially funding a bug, value program to encourage future Research into the area of securing software repositories. um It's not necessarily in the scope of this immediately but yeah.

A

um That was a lot any questions about this topic.

F

I've got a brief comment uh that fits right in the follow-on work section. um Yeah critical critical component may be underserved security, wise auditing, it funding an audit for it great. Yes, that's a point in time thing um so bug Bounty is an option. um Repeat the audit, every So yeah. Thank you rolling basis. You don't have a like a time frame. Yet I saw a two-year upfront, yep, okay, foreign.

F

Audit's any cheaper, or is it still just a full like clean audit every time? Basically, um these things really work. I.

A

Guess I don't know yeah.

F

A

That's a really good question. It probably depends upon whether or not we hiring the same firms yeah and um yes. So this is a proposal that is also collaboration with ostiff I just had a chat with Amir and Amir was the one that came up with the cost of he's like when we've done audits, they've run about 150, 000 yeah, so that's yeah, I'm logged out, so I can't even add them. I can't even approve my own. My own proposed.

F

Change I can here yeah, okay, no got it. Yeah you've already thought of this. um uh The last I looked at this like for real, then that I might have spent money on it. I came across uh at least one firm with a paradigm of more of a continuous thing. As opposed and it's you know, it's a reasonable response to We did an audit great okay. Now what time went by right?

F

So there are, you know it's probably a subscription-ish business model which has its own issues, but um um there are, you know something something more continuous or repeatable might be a an engagement option we could consider. But yes, the fact that it repeat testing is in here handles it so never mind.

A

F

A

The um just in terms of managing this um continuously occurring right, um I believe that I I I work for the open, SF I work for the Linux Foundation, but I don't think that I'm the right resource to run this long term, um The Proposal, does call for at least one staff member to be assigned from the open SF to manage this on a continuous basis. It's probably not a full-time uh resource right.

A

This is not something they need to be doing full-time, but it is going to be some chunk of time that will require a full-time person managing and making sure it's occurring. So um uh yes, that that that's another, that's another aspect of this that, because I don't think that a working group of a bunch of volunteers is the necessarily the right way to night right place to make sure that something like this reoccurs on a regular basis.

A

A

Any other questions comments concerns um on this topic.

A

I

It's Crow, welcome back, hey! um Is there anything specific? You need this group to do for you to move this forward. Do you need us to review? What would you like us to do.

A

um Just read through it I mean at a high level, and then, if you'd like to excuse me um if you'd like to participate, um uh we are again we're meeting um every Thursday um at 9am. So that's the place to have this conversation. I think that the um Eastern yes 9am, Eastern, the biggest I, think the biggest thing that we're going to run into is.

A

um This hasn't been an issue so far, that's been raised by the majority of the organizations we reach out to, um but um we would I think that the the carrot stick model of this is like you know. We love to do the audit they're willing to collaborate, but if we're paying for it at least against the corporate artifact servers um trying, including in that that we're going to be leveraging the 90-day disclosure deadline, the one caveat that I pull out in the um in the uh technology audit.

A

Is that caveat here we go um the one caveat that I have called out here: um all vulnerabilities disclosed during the course the technology audit for against corporate run, if they're not paying for it themselves, um we'll be bound by the open, ssf, outbound vulnerability, disclosure policy with one change, while the pen test firm, May, disclose vulnerabilities immediately upon Discovery to the Target, the open, SF, outbound, vulnerability, closure policy notice date will be one business day after the scheduled pen test concludes not including the retest, so that gives them 90 days from the pen test finishing but they'll have been receiving.

A

The record I mean usually when a pen test occurs, you get like here's a vulnerability we found like do you, you know, and people are actively able to work on those as the as the pen test is occurring, um but the the start date of the 90-day disclosure deadline will occur as soon as one day post the disclosure, the the the um the pen test occurring.

A

um So uh that's that's um a tie-in to additional or existing work from this working group.

I

Great. Thank you perfect.

A

um Yeah any other questions comments on this.

A

Okay, uh Chrome, going back to you, um uh there's two topics that I wanted to ask you about, because uh you were not here um or.

B

This amazing group I.

A

Know do you want to uh dive into anything about this? The CBD guide for consumers.

I

I would love to get people expressing interest to assist in starting to write that.

A

Perfect um uh anything else on that one nope perfect, um open vexig. um Do you know what the status of this is.

I

uh Status is green.

I

uh There we're splitting the meetings up that uh every other one is going to be technical, focused on the spec and the software, and then the alternate meetings will be focused on evangelism and uh ecosystem and Tool engagement.

I

So things are going well got a pretty excited group of folks participating there.

A

B, so every other meeting technical alternate meetings will be what you said: Community.

I

Oriented evangelism.

A

I'm, probably butchering this did I spell that right, nope I did not evangelism microscopic.

I

For me, I can't see. Thank you.

A

um Okay, um that's helpful. um The OSS sir Sig yep.

I

um Art, that's three things, not two yeah.

A

Sorry you're right um the awesome there was a question here about um what is its current status.

I

Beige and uh it's currently under review by uh assorted funding parties, so it's kind of on hold for now.

A

Okay, um are you the champion for this initiative, or do you need someone else to Champion it? Do you have the resources to adequately champion this? If you are the champion for it,.

I

Anyone that's interested in helping is welcome, but I have been handling it myself. So far, we had an interview with the new executive director of the foundation, omkar kind of explaining uh what that and the education Sig were about, and we are planning on how we want to move forward as we both update and rewrite the mobilization plan, but also Circle back to the people that had put funding pledges together to see if those were topics that inspired them to throw money at us.

B

I

um If there's anything that anyone is interested in collaborating on the certsig that costs zero dollars, they are welcome to participate, but anything that needs money. We have to kind of wait.

A

um What are the current largest blockers and the current your current per like uh perspective on chance of success of this initiative? Yeah.

I

It's been six months since we submitted the revised plan and we've gotten zero feedback, so we have lost uh most of the volunteers interest.

I

So if it is indeed picked up for funding, it'll be uh a little bit challenging to re-engage with the people that were there and to try to get new folks engaged.

A

A

Okay, all right, that's good to know! Do you um I I, don't think I can allocate any of my time but uh yeah. If anybody else is interested in uh making this a reality, um you know art. You seem like one of the few people. That's like you know, really got you. You and Madison both seem pretty well. Pretty um would like to see this occur um uh yeah.

A

If, uh if there's anything that anybody is there anything that anybody can do to help push this forward or or evangelize it to the uh the right, the right people that you think would help anybody.

I

That's interested is welcome to read the plan. There are many items there that don't require funding that could be worked on by volunteers and just people talking and working out process, and we would like to go interview like upstream maintainers and security teams. So we have a. We had an idea of assert putting together a survey, so there's a lot of things that could be done uh and if anyone's welcome, I can uh get operations to turn the meeting back on.

I

But after six months of me showing up saying, there's no update uh people stopped showing up and I got tired of hanging out for 15-20 minutes each time.

A

That's very fair, very, very fair, um okay is it that was the one that um Emily from Apple was also involved in right.

I

uh Yeah she was involved, she's also involved in the education again. So there were a lot of folks involved in art, myself, I uh Randall, Emily, okay,.

A

Okay, all right, um uh we have six minutes, uh seven minutes left. um Does anybody else have anything else that was not covered in this meeting that they want to address before we adjourn.

A

Going once going twice sold to the silence the Doctor Who Silence, um all right, he goes yay there we go. um Thank you for whoever's writing on my screen. I appreciate it um all right. I want to thank you guys, all for coming or you all for coming um uh and uh I hope to see some of you at two o'clock at the um vulnerable disclosure autofix working group, Sig, meeting um yeah uh catch you real soon and um keep keep the internet secure.

I

With us, thank you thank.

B