OpenSSF Vulnerability Disclosures WG, 29 Mar 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: OpenSSF Vulnerability Disclosures SIG Autofix (March 29, 2023)

Description

Meeting minutes: https://docs.google.com/document/d/1mZEi6EvbH2mvn-gHOUIaysAjHlwJXjJdJ7gMlelSkVU/edit#heading=h.u5im5d90xac4

Repo: https://github.com/ossf/wg-vulnerability-disclosures

A

B

C

I have impersonated breastsers I am as unlikely clown clarification.

C

I, like the galactic background, though thank.

A

You I don't know.

A

Hang on a second I've got a phone call coming in.

C

All good hi Michael.

D

B

You doing good.

C

B

D

Just enjoying some popcorn, which is perfect right now,.

B

C

Yeah, it gives me a bit of downtime I just got off a different meeting.

D

Back to back is tough.

C

I um speaking repressors, he made one of the other working group meetings, five minutes after and five minutes before.

E

C

Really tempted to do that for all.

E

D

Weeks, yeah, it's funny. We just got kind of guidance internally that, like that's how we should do it so so it.

C

Makes a lot of sense because then, like you, give yourself a little breather rooms to get some popcorn or use a bathroom or whatever so yeah.

D

Yeah until all meetings just end five minutes late, because they know that yeah gosh well, one.

E

Problem at a time, yeah.

C

Well, that's the funny thing right is, like everyone always shows up five minutes late, so you're like oh we'll bump it back five minutes, then oh wow, now they're 10 minutes late.

B

C

Any fun over the weekend.

E

I do over the weekend.

D

I don't know I've I've, two kids, so even when we do nothing, it's still bad.

C

Definitely takes a lot of time. It.

E

Does it does no.

D

I did something fun.

E

D

'll come to me eventually.

E

C

uh I started pre-thinking about that, because I knew that was coming up.

C

Yeah I, my mom's birthday was last week, so we celebrated on Sunday, so Sunday was mostly hanging out with family and it's kind of relaxing um I'll be honest, I'm really bad. At remembering.

E

C

Saturday is a big old blank slot and I can't remember what I did.

D

Yeah, maybe it happened on my calendar right.

A

All right, landlady called sorry about that um we're trying to we're having some electrical stuff done, including doorbell, wires snapped and oh I'm having my office um for some reason. um I've had my office circuit prep uh three times in the past three days, so I've been on meetings and like Boom. The whole thing goes dead and.

C

A

Oh no and thankfully it's it's I I, the first time I did it. I was the I thought it was the basement panel, but it's actually a panel in it's a sub panel in the apartment. So I can go flip it on real, like real, like immediately, but it's still like kills everything so.

C

If you disappear, we know what happens yeah.

A

And last time it happened, I had to my my depth: desk lost its positioning, um so I had to um uh I had to take my monitor or my desktop out from underneath the thing and put it over there and then unscrew something. So the whole desk could go all the way down to its full depth and then come back up because.

F

C

A

Needed to re-home what what like ground was yeah, it's a whole nightmare um anywho. um We seem to be having a very small turnout for this. um This particular Sig, um but in order for us to become an official Sig, all we need is to have at least two companies uh showing up to every single meeting, and we have three. If we count the Linux Foundation.

A

Meiji was in a customer call um so we'll see what happens there.

A

C

A

Let me ping one more and see if he's joining.

A

Okay for attendance, because this will help us become a legitimate Sig Let's. Do let's do that right now,.

C

I'll be honest, I'm trying to find the meeting notes and I am super lost. They.

A

Are in this, they are in the invite manoir said he will be joining shortly.

A

um Okay, let me do the Sig autofix.

F

A

A

Okay, um let me do the rest of these mark them as non-present.

A

uh If you can mark yourself as present, if you're here, let me make this a little bit darker, so you can actually see your own name. If you are here, okay um and you.

B

D

For that Michael I just copied it from from earlier.

B

A

um All right meeting agenda uh first things first, uh or do we have any new friends who want to introduce themselves to this particular working group.

C

Hi I'm Josh.

A

B

Michael you've not attended this for this uh sick.

A

Meeting before so.

D

My name is Mike scavenum I lead an open source security team at Microsoft and uh coleed Alpha Omega um super interested in getting vulnerabilities fixed at scale, so.

B

A

um Okay, um we uh does anybody want to subscribe for the meeting notes.

A

Do we have any opens.

C

C

I made one comment um before: where was this section? Oh yeah, for the opt out we we talked about last time um if somebody does opt out still assigning an ID.

C

um Yes, I, guess feedback from your perspective on generating the Volk PR is what would be useful for like an API endpoint or how you actually want to request those kind of IDs.

A

um Good question um a problem currently well: okay, it's a couple different things. We could do um modern.

A

The way that modern supports, generating plural grass is you can give it a commit job and say: hey like for this job or for these, for these projects generate commits and here's the pull request body, the um uh the gpg key. You want to use to sign it and all that jazz right.

A

You can provide all that information all at once um and the problem with that is that, like each repository can't get like a unique message or a unique sort of thing, um but because that was driven that was originally driven by the API, where you wanted a bulk, an operation via the Sorry by the UI. There's, no reason why we can't send like 4, 30, 30, 40 50 pull requests we're going to generate generate.

A

You know, X number of unique commit jobs where each one has its own unique message, and then we can, theoretically, as we're generating the pull request, say hey. This has been assigned this um uh by the way this has been assigned this particular.

A

um What's it called.

C

What identifier.

A

Identifier, yeah, um yes, um good news, GitHub has an API for creating or sorry yeah GitHub has an API for um ghsas. Now um I've used it. It is not available until tomorrow, um uh I got Early. Access I have permission from Kate to talk about it, um ik Catelyn, so yeah, so she she gave us. She gave me permission to talk about it. Specifically, um uh we um so the functionality that supports upfront is.

C

A

Sometimes, what.

C

Oh sorry, I was just gonna say that it sounds like that can probably take care of the need there. Yeah.

A

So it has support for listing all advisories in a repository that are um that are uh the repo maintainer can get all the triage drafting published and then get your GitHub user can only get the publish, advisories, hello, Azeem he's not joining.

A

A

There it is okay, um if you could toss your attendance on the uh uh uh meeting notes, it will help us get uh chords. Are requisite yeah? It's fine! You can. um You can add.

A

If you add yourself to the meeting notes, then it'll go towards our requisite requirement of how many meetings we need to have multiple vendors at in order for this to become an official, Sig, um perfect, um so list all advisors in a repository uh get a list of security advisory list, a single advisory in a repository, updated security, single security advisory in a repository with a patch um call, which will um uh let you update the information um and then uh oh, no, this post, which is create an advisory in a repository, uh and then you can also specify credits and there are web hooks for on a publisher security advisory and then, if a new private vulnerability is is submitted, you can see there's web hooks for those things.

A

um There will be support for um adding comments, and it was um indicated to me that there would not be support for adding collaborators initially in the first pass. It would only support you opening it. um The reason that I was thinking about my beautiful is every one of these API calls goes against your API rate limit.

A

So if you could have one user create the GHSA and another user, fill it in right, you'd be you'd, be using two user. You you'd go against that API limit a little slower. um We.

D

Could just have multiple accounts and pull it. You.

A

Know whatever whatever yeah well yeah, but but you can't add another collaborator, so basically the the person that opens the GHSA, the only person that can modify it. Currently, um comments are coming. um The ability to create a fork is coming um as well.

A

um So one of the problems that I also ran into that I mentioned to Kate is um so. Let me read this to you so I'm running an autofix campaign at scale across open source as long as I use the same exact Branch name across all Forks, when I force update, then an open pool uh and then open a polar request. You know, pull request is already open. It will just operate uh as an update instead of creating another duplicate. Pr.

A

Does that make sense? So basically it operates as a because you're using the same Branch as the key. um The reason this works is because a duplication, key is a branch name. Thus, as long as the branch remains exactly the same, no duplicate PRS are created, except for there is a race condition bug in GitHub, where I have actually had ended up with two polar requests for one branch.

A

um It's happened like three times in the past thousand polar price I've generated um uh uh uh as such. No State needs to be remembered between campaign reruns, but now with ghsas needing to be created, and these keys are non-deterministically random values as such. If you want to update the pull request, every two weeks you need to persist. A mapping of repository GHSA externally across run campaign runs.

A

um This might be a yeah just deal with it problem, but it's kind of annoying, unless perhaps there's some way to shove. It I mean the other thought that I had was because you can list all ghsas against a repository.

A

um Theoretically, you could shove a like GitHub supports like comments in the pull request, header and or you can sorry, you can put comments in in markdown that are not rendered, and so theoretically, in the in the description, you could put a markdown comment that says: do not remove use for tracking and then throw an ID in there that that that's the campaign ID, and that will be the thing that you look up per repository to do the correlation, and so you end up like faking a branch, but with it with a comment in the pull request.

A

D

Problem is there you'd have to list every uh you have to lift everything and then look to see which one that, like there's no search by right.

A

But there's very there's very few ghsas per repository, so you're, but you are doing an extra get request. Her submission, instead of being able to just modify an existing campaign, you already know is present it's it's a trade-off between the overhead and complication of persisting versus the downside of hitting the GitHub rate limiter again.

A

A

I cannot hear you if you're speaking.

A

A

You are muted still on the Noir.

C

It's probably a physical meaning.

E

Sorry I told you that I'm actually outside so I'm picking up my son, which was kind of I'm just created so anyway, I'm just listening right now. So all right.

A

um Now that manoir is here azim, do you want to introduce yourself real fast? Oh he's reconnecting he's forked himself. He forked yourself, nazim.

F

No I I had to rejoin because my mic wasn't working so I I hope you guys can hear me now. I had a quick question on the GitHub API limits thing. um Did you did you ever consider like having a like a GitHub app specifically for this, like a alpha, omega, app or anything of the site, because that's also a way for projects to show that they are actively um you know signing in for getting these PRS and it'll also help you get away with the API limits.

A

That is a thought. um The problem with using a GitHub app is that we're integrating with modern and modern has its own API, GitHub, app and I. Don't know if you can re I, don't know if I can use. That token is an API like you basically you hand, modern, an API token and say here, use this API token to do things for you and I, don't know if you can give it another apps API token to do that.

A

The other thing is that only projects that have agreed to use that app can then use it and we're trying to generate pull requests at every for everybody.

F

Right I mean we could also have the fallback option of like hey like if you you know specifically or come in you. You probably have some extra features and if you don't, we can fall back on the default uh rate. Limiting um my interactions with GitHub API I I know that it's not too difficult to move between a regular app token, and uh you know GitHub app token. So if we have someone on mode and might be worth considering asking them like, you know, if they're compatible with app tokens.

A

So I know from my conversations with modern that at some point they plan to support campaigns as a native feature, but for now because they don't and we don't need need them to like we, we might want to customize our user experience a little differently.

A

um We, you know, as as so I think that if people want to use particular modern campaigns right, they could potentially sign in and and register an account there and set up what campaigns they want to run. When that supported.

A

um That's a thought, um yeah that that is but I hear I hear what you're saying where maybe some sort of opt-in mechanism where you, where I, mean we're not a company, so we're not offering a service, but most most of the time. You see this like code, cuff right, you sign you, you accept your organization into it or whatever right like those. That's that's how this thing operates. Normally,.

D

I mean the the good up rate limits. 5 000 requests an hour like that's a hundred thousand requests a day like if I I get it that each thing requires multiple heads, but.

A

um It's not the rate limit in particular that you run into so um so you're saying get up, get up. That's the GitHub app rate limit.

D

A

D

That should be the authenticated. uh I think apps is higher than that. Yes,.

A

So for every pull request it requires three API calls. It requires an API Call to um Fork. Sorry I have this. In my in my documentation, it's um the first one is to uh Fork the Repository.

A

Then you need to rename the repository. That's two API calls and the 30 API calls to generate the pull request.

A

Okay, so it's three three API it's three API calls per um and then additionally, if we're adding ghsas into the flow, it's one to get if the G, if the repository is so, then you've got one to say, is there an existing GHSA? That's already there if it is grab it? The second one is to create it. If it's not and then um the F. So then you got the fork and the push.

B

Then you got do.

A

You still got you've got five there.

D

Yeah, even if we double that we say it's going to take 10 10 credits per you can so that's still 500 pull requests an hour. No.

A

No, it's not because GitHub has a secondary rate limit that they put in place. That's not documented that says. Basically, if you're doing too many write-based requests too fast back off and they'd give an indeterminate amount of time where you have to back off, and that can be upwards of an hour.

F

So I think the question is I mean I. Think the secondary rate limits are something we hit with scorecard to and there's no way around it. So the question is: how quickly do we want to roll out these campaigns right like? Is there a requirement? Could we roll it out for a few days? uh Maybe um right like do we lose anything by slowing this down.

A

Well, I'm using GitHub actions to run these campaigns and the runtime of a GitHub actions. Maximum is six hours, so if we can run one campaign in six hours, that would be great.

A

Like you know from start to end, if it can take, let you know if we can get it under six hours or per run, that's ideal. Otherwise, I gotta start bringing it up into you know. So my current plan right um is to run these campaigns um at six pm every weekday week weekend. Every weekday.

A

The problem is that as soon as I use, my GitHub account to do this um I actually essentially stopped being able to use my GitHub account because it runs against my rate limit and so I I. You know.

D

The better solution: you should have a special account.

B

D

This, like it shouldn't, be your personal account well.

A

That's another conversation. That's in this document right, that's another! That's another! One part, so part of this specification and part of one of the documentation points is that um there's an expectation that you use a real person account, but it's actually an accurate like an actual GitHub account, that's being used and maintained um for this work like it has to represent a true person because of the social impact of it.

F

A

F

I mean this is a side comment in terms of the social impact. I I think might be worth considering talking to Dustin Ingram uh on on the um like he's he's on the ghost team at Google, so they actually did something similar where they, you know they went out at to try and fix some of these vulnerities I think we should be cautious of how badly people respond. If, like there is a bot, uh you know making PRS because they'll they'll be like this is Spam uh right, so yeah I mean I I.

F

Think that's a side note, uh but in terms of the API rate limits I I'm curious to know like is there a reason we want to use GitHub actions? Is it because it's easy? Is that something we can just quickly spin up gke cluster for um I.

A

Mean yeah we could run, we can run the script somewhere else, I, just the the best place for me to launch this thing, where I had a a something that would run on a scheduled basis is, is you know, get of actions? I, don't I, don't particularly kit where it runs. I just I just want to be able to configure it from a repository.

A

Yeah I mean eventually this all run within the um Omega triage portal.

E

A

Yep, um and also and again, another another high level even beyond all this is the the working. The the goal of this working group has come out with a set of recommendations for how to do this work so that anybody else can implement it, even if they're not working within the alpha omega ecosystem.

F

Like they can help, if.

A

They want to contribute directly to Alpha Omega. They can and use our tooling and infrastructure, but we want to come up with a set of standards for so the specification document.

A

I, don't know if you've seen this yet um azim, um there's a document that I've been working on um as a part of this sig called the open, ssf compliant automated vulnerability fix Campaign, which defines what it means to be a campaign that is compliant with this specification, which is the goal, is to basically say this is a set of constraints under which anyone wanting to do this work, no matter what technology stack they're doing, they are compliant with what the open ssf suggests.

A

If they do these things.

F

Yeah I just saw the link for it now. um I've just had a brief look at it, but I'll take a look at it.

B

A

um Did you see um Michael? Did you see Xavier's suggestion um under two mandatory private disclosure um right now he said so. I had to scratch out the whole thing about the top 10 000 critical, open source projects, because I said this before, but for those people that didn't catch this before I didn't realize the top 10 000 critical projects list was first off unordered and second off not owned by the critical projects working group.

A

It's an alpha omega list, um and so the primary thing is because it's unordered there is no top 10 within the top ten thousand. There is just it's on the list or off the list, um and so my proposal was that we can that and come up with something different Xavier's perspective or suggestion. Was um this the policy being before going public with this camp? With this campaign you must disclose privately a coordinated uh disclosure to set to the set of projects for which exploitation in the wild could be a significa could have significant consequences.

A

You should assess what this set is on a case-by-case basis um and use your judgment to find the right balance between manual work and your automation, automated campaign.

A

It leaves it ambiguous, ambiguous enough, but also a judgment, call on behalf of the organization involved in this campaign like it, it I, don't I, yeah, yeah, I.

D

Mean I I guess.

D

If it is inevitable that.

D

I mean so we've talked about this before I. My my goal is that that the only disclosure that happens is private disclosure and that that being via get a private issues where they exist or the nudge to enable them or some magical other solution that kind of goes in and then, when all of those fail.

D

The last step on the in the on the latter is um is, is you know, full disclosure um through a public pull request uh and I'm I'm, hoping to minimize that, to the smallest degree possible, but I recognize that that will exist.

D

D

So I mean I'm I'm. Okay, with with this at a like policy level, I guess.

A

Anybody else reading this being like no bad or you know, that's good or any other emotions or thoughts. People are having immediately.

F

Say maybe I uh most, do you mind giving me a summary of what savior said? Is it that we need to reach out to them to say hey? Do you agree to be part of the campaign? Is that what.

A

It is no, no, so the exact wording uh for the press for the protocol step of mandatory private disclosure. The exact wording he's proposing is before going public. With with um uh this campaign, you must disclose privately by coordinator disclosure to the set of projects for which the which exploitation in the wild would have significant consequences.

A

You should assess um what this set is on a case-by-case basis and use your judgment to find the right balance between this manual work and your automated campaign. That's the wording he's proposing for man for the requirement of mandatory private disclosure.

F

It seems okay to me.

C

My initial thoughts, not being super involved in this directly is just it seems kind of squishy as to what qualifies.

A

C

A

It's intentionally that way, it means that it becomes a yes I mean, and then I also suggested to savvier that, like we can offer the AO project as a resource to help in determining this as well.

E

C

Yeah, it seems reasonable and if it's squishy enough, where it's up to each researcher then looks good to me.

D

But we're also okay, so so so here's the the negative scenario of this is um somebody dropped something on Twitter and says: Hey, look z-lib or pick a popular Library, um so easy to crash or exploit or rce or whatever um people got guys like. Did you disclose this and they're like I, didn't think it was a big deal?

D

um Did the guy do anything wrong person, the the the finder did the finder do anything wrong in that case, if he uses best judgment and he really didn't think that some big important project was actually bigger important and they dropped it as a as.

F

D

Day um like do, we need more of a guard rail there and I guess what I'm you know. It's so I think I'm sure. If it was you Jonathan or you send me put together um that that kind of flow chart which I really really liked I'm. Looking for um as.

A

The long-term like ideal but github's API, doesn't support it and also like it's a large flow to policize and require that everybody follow.

D

Well, but but if it's a the way I would describe, it is so so the premise is this: isn't one vulnerability? It's like you have a thousand of these and a thousand different repositories and you're you're not familiar with any of them. There's no like shortcuts for you, so for each of these, thousands, um if they support private vulnerability disclosure, disclose it that way. If they don't. uh Let me talk about this. You know open up an issue saying: hey I found a secure, a serious security issue.

D

I would like to disclose it to you privately. Please enable private vulnerability, reporting and I will report it. That way.

D

If I don't hear from you in 35 days or 25, whatever, then I will open up a public pull request and that way it's uh minimal uh minimal work for the maintainer, because that's that's a one-time kind of workflow config, um but also gives the maintainer two opportunities to receive it privately and if they ignore the issue and don't have private vulnerability, reporting enabled then like there's, no other I mean other than like parsing out like security, MD files for contacts, and do you know- and now now it's manual at that point.

A

A

What do you do if so.

A

I think the thing that I still struggle with is that there's this goal of what will exist and what currently exists and those two things have not met each other in.

F

The middle yet, and so it's hard.

A

To determine what that world will look like it's.

C

A

Hard to write policy around things that don't exist yet, even though we hope that they do in a certain way, um the.

A

um Okay, so what if we.

A

So there's two concerns that I have the first one is things don't exist yet? Second concern that I have is by expecting a flow of. You must open an issue. Then you must wait for a response. Then you must write your your taking a campaign that could be a one-off run for an individual right and turning it into a something that, in order to automate, you must have long running automation that is observed. That is, that is not just single cut point in time.

A

It must then operate with some sort of transient recorded history, which makes any campaign's implementation significantly harder.

A

So I I see what you're saying as a as a as a value, but are we by requiring additional steps like that, raising the bar to the point where it is almost impossible for someone else to duplicate these efforts unless they use our tooling or, and if that is the case, is that okay, like? Is that something we want? Or do we do?

A

We do we want to have a lower barrier to entry for certain researchers to engage in this space like we can have a standard that is above the spec, and we can follow something above the spec. But what we want to have the specs base be.

D

I would love if you could just share a Google doc with a GitHub account, and then you post a link, a private link to that the the maintainer um can. Click on the link gets offed in can view the doc, but nobody else can, like that's kind of you- want Hunter Dev I want Hunter, Dev yeah. Obviously, I think that that that, in a lot of ways solves this particular issue.

E

D

I, don't think we need to so so you do something I, don't I, don't know that we need to solve this for the world, for every researcher.

A

No, but we what we, what you're, what we're proposing is setting a set of policies and we need to set those policies when you set a baseline at least, and we can do it better than that. But but this is what we Define as the open source, security, Foundation, best practice policy, or actually it's a specification. So it's Gru compliant with the specification or not.

C

And so just kind of recap my perspective on this, so the idea is: if you follow this policy, you can put the ossf name on it so that you have more backing or um looks more legit coming in for maintainers. Yes, so the requirement should be the Baseline to not cause problems for the ossf. If somebody uses their name to do a polk campaign like this correct.

C

A

Do we want to make it so first off if we require a private vulnerability disclosure as a step as a part of this flow?

A

We are preventing this specification from being applicable to bitbucket and gitlab unless we make a carve out for vendor specific, unless we say for these vendors, you must do it this way and for these vendors, you must do it this way or.

C

With the copy of, if supported yeah,.

A

If supported, do it this way, if not supported, do it this way yeah, so it could be vendor agnostic, but be very heavily hinted towards.

E

In the top 10 000 lists, it's almost all of them are GitHub by the way.

A

Yes, I agree. Yes,.

D

And also I think as a policy, you know I I, the policy versus process, so so the the underlying, like great I, need to report privately to GitHub. What does that mean in GitHub? It means it means you know. Actually it means this little sub workflow I had I bitbuck, it I have just a website and an email address I like everything else. There could be different and we could actually say that you know what we can't automate. The random person's website uh with you know just.

F

D

To a tar file on there as the as.

F

B

D

We can't we, we don't know how to automate that that for those types of projects, so we they're not included in this in in these campaigns, or we can only do that manually if we have the Cycles or whatever you know we want to do it.

D

But I agree I agree with that. The the one more yeah.

F

If this is all GitHub.

D

Let's, let's solve, for, let's keep the policy solving generally, knowing that we're only going to really Implement GitHub and then, if everybody moves to bitbucket well, obviously like Implement and support bitbucket or you know over time, it will take a pull request.

A

uh One final wrench is, if we so so are we is, is the group leaning towards stating that the Baseline is to require an attempt at private vulnerability, splitter Michael? That seems to be what you are flat you're aiming for is: does anybody have any other opinions.

C

A

Just think I just think it adds an additional amount of I think that it adds an additional hurdle to being Val being being compliant.

A

Is that do we want to be for? Do we want do? Is there value? Do we think in in having this requirement, given the additional overhead that it'll acquire for any campaign operator to to to to to to do.

C

I think the value would probably come from not having maintainers complained very loudly about having a public disclosure.

A

I have another question: how upset will be? How will how upset will maintainers be if, as a part of this, they find out that what we've disclosed in an automated way is not a vulnerability, but it's just a bone. It's just a security hardening now you've falsely flagged into something that they needed to be more serious about or because it looks like it's getting merged from a GHSA looks like a security issue, but is now they determine not a security issue.

D

But wouldn't they simply not publish it, they.

A

Would probably they wouldn't publish it, but it still merges and when the merge comes in the commit, has the GHSA name on it. So it looks like it came from.

D

I mean if we're submitting, if we or anybody else are submitting kind of garbage vulnerabilities um I, would expect that they would push back on that.

B

And rightfully.

D

So, um and we can say you know sorry, you know we're not perfect. Thanks for you know, helping us get better um I. Think that's I, think that's okay, I mean. If all of our stuff is garbage, then that's that's a completely different story. We shouldn't be doing it, but.

B

D

A

Okay, um final question: what do we do if there are projects that, for example, the there are certain Apache software Foundation projects that don't use GitHub issues for issue tracking they use jira? How do we handle this flow for projects that have intentionally disabled issues for a repository.

A

Single line, change, pull request just to just to do it by the GitHub way and tell them that it's not a pull request, but that we wanted them to enable that's.

D

Can you have pull requests enabled but issues not I thought? Yes, you can oh interesting.

D

It's a terrible solution. Yeah um I, I, I Apache, is is uh special in some way. Are there lots of others like Apache, though, or can we just solve for Apache as a one-off.

C

I think having issues disabled is not an uncommon scenario. Okay,.

D

Yeah, how about this? um Let's try to handle those manually for the first three months, see how it is if it. If we, if we have to do those you know three times in three months, then it's probably not a big deal. If we have to do them 200 times in three months, then it's not sustainable, and we need to thank.

A

B

D

A

The Paul I, like sure great AO, can do that. What's the policy, though,.

D

uh For for projects that have issues uh disabled, the finder should exercise reasonable care in finding other way to disclose.

A

Like where are already trying to convince them to turn on ghsas or like right, like right, we're trying to convince them to turn on turn on this feature,.

E

Manually is the like is the like. Can you file an issue in jira I mean it's you're doing it manually so.

A

Well, no we're trying to avoid as much manual stuff as possible. No.

E

But as Michael said, it's an empirical evidence of like in the three months, do you encounter it three times or 200 times? If you encountered 200 times, then eventually you'll automate it, but for now, uh since the idea is to do do it manually for or see like how it goes, how it pans out, then, if you have access to the like, if you have the capability of filing jira issues uh issue tickets, then you can just go ahead and do that. How.

A

About how about this, how about, um if.

B

They don't have issues.

A

Enabled- and you can reasonably determine that this project is not um uh so like this ties in a two right: mandatory private disclosure- if it, if widespread it would exploitation of that project is not relevant, then just do a pull request and saying hey in the future. If you don't want to get this viable request, turn on private vulnerability, disclosure.

A

F

F

So I'm curious, are we looking I mean kind of echoing what Jonathan said some time back right like maybe we are plugging in things that, like features that don't exist today and making them required?

F

um Do you folks feel like that's happening like are some of these policies written assuming that these features will be available in the future, and we have made that it's a requirement from today? um You know it seems pretty.

D

I I think as of well some private vulnerability reporting is available today. The.

A

D

Be public tomorrow so.

A

um Tomorrow, okay.

D

Got it um so there's no there's, no technical reason why any GitHub repository could not enable it, but because it is opt in like it like. We all know what that. What that that that that does, but over time, like I, expect that number to only increase, and we should have a kind of a I think. An open, ssf campaign to hey turn on private vulnerable reporting would be would be great from uh you know, using our kind of Pulpit.

F

To right to do that, yeah so good! You know please like I guess my point is since I'm assuming we are writing this. uh You know policy for the person who's actually going to be disclosing the vulnerability right. So should we be writing the policy to say you know if you have means to, you know, disclose this or message this in an automated way. Then it is a requirement on you um else.

F

I mean it's more of a recommendation and it's basically optional, um because we yeah I mean I I, think we it's still pretty new, so I, don't know how difficult it's going to be for somebody to you know, go and do this manually if they have to even do it. Yeah.

A

E

um So uh I I just had a quick question. The apis are going to be available tomorrow, as in tomorrow in future or tomorrow, as in tomorrow. Tomorrow,.

A

Is in tomorrow, uh Kate Catlin. The reason that they're not up today is because github's um github's merge queue, got backed up.

E

Okay, interesting, okay,.

A

So they're they're, the API, will support the following functionality: it on release. It will support the.

B

A

Get all security advisories against a repository um for repo maintainers triage draft and published for anybody else, only published security advisories, um and then you can get uh a security advisory, uh get a specific security advisory from the ID. You can patch a security advisory by putting a patch request against that API um and then posts will create an advisory in a repository, um uh uh uh and then um uh you can set credits and then there's also web hooks.

A

So the web hooks that it'll support are on publish of a security advisory and if a new private vulnerability uh report is submitted, um so it enters the triage State. um That's for maintainers.

E

Okay, cool, yes,.

D

I I, just I, just I, just had a random thought um going back to like how you like your kind of traditional way of of doing this, where you create the GS GHSA in your account, give the maintainer access to that. Would it is there like.

A

There's no API currently to give you a list of all of the maintainers for a repository because it creates a channel by which maintainers can get spammed. You can tell whether or not a pro a maintainer is a maintainer of a project by looking at the GitHub issues and seeing the tag that shows up on their name but I, don't know if that's available by by the API or not so the the way that I I don't know what heuristic Hunter Dev is using to determine which projects are um uh maintain or what?

A

What who is a maintainer and who's not. But there is no like these are the people that are on the maintainers for this project. Api call for repositories.

B

F

I think there is such an API, but it probably needs much higher Scopes, like maybe uh admin scope or something like an org admin should be able to. Oh.

A

Yeah no org admins can definitely figure that out, but not riffraff.

B

A

A

A

B

A

It's not enabled on a repository.

A

A

An issue must be.

A

A

If the maintainer does not respond, not.

A

Within 35 days.

A

The a public request for me.

E

Would be open things, the vulnerability.

D

Okay, so so come back to this, um so so this URL here uh and I I now were I'm. Sorry to take us down the rabbit hole but like so api.github repos madler, um the full name of it is madler's elib the owner, login is madler and the type of that owner is a user.

B

Correct that's.

D

Wonderful can I can I infer that madler if you you're granting access to madler is the right thing there as different than like. If I do this for Apache, the type is going to be organization and the Apache user is probably not the.

A

One you want, yes, you can. Yes, you.

B

A

The user is not the patchy that Apache is an organization right.

D

But but I'm thinking for open source projects.

B

D

80 of them, the owner is a user, and you can tell the owner from the repo then does that solve it for 80 percent.

A

I think it's 80.

F

Yeah I'm curious, where that keep us in numbers coming from.

A

I, don't I mean uh if I, let me look at this real fast.

A

um So there's something like thirty thousand um okay, so Apache there are 1011 Apache software Foundation repositories, but Foundation is 208. Okay, Google has 181 cradle, has 53. uh Microsoft 131 Spring 103.

A

These are, let's see, 21 US Government, wildfly 15. um out of 31 000.

A

A

I, don't I, don't know whether or not.

D

You know what we could do, how about this take the list of our 10th, our top ten thousand, because we have a lot of GitHub repos there and just look them all up and see what the what the percentage of them that has a where the owner is a user, not an organization.

D

And if that's, if that number is compelling, then we investigate further and if it's not, then we say oops.

A

um But you're saying so what what your proposal I presume is we Fork the repository. We enable private vulnerability reporting. We use our Fork as the source of the private vulnerability report and put the report there and invite the the Upstream maintainers account to it.

D

Either that or use the uh I don't know if this is even possible, but you use the GHSA, like you have your own, your own, your own repo. You create a new GS GHSA as a way to make a private message, so you say: hey folks.

D

Here's here are the details of the thing um grant: grant the owner of the other one access to it, they'll get the notification and, with the assumption that they will publish their own advisory, but now you've communicated with them with them privately.

D

A

You want to generate the fix too, because otherwise you're spamming them.

D

Yeah and I guess you can't have a private Fork of a public repository and yeah hey.

A

Hey you ever pause for a you can create a product, you can create a public fork and then from the public, Fork create a GHSA and invite someone to you can create ghsas against Forks.

D

Oh, the the branch is private. In that case.

A

No, the branch is public, the branch is public, but the branch of the branch is private. Got it right. Sorry, the fork of the no, not the branch of the branch before the forecast private, yes,.

D

The vessel with the pestle um yeah I.

A

Have actually so one of the things that I ran into is a real issue? Is that you can't, um if you have two repositories, that um both originate from the same Fork? So you have a fork, you have a and a uh depends upon B.

A

um You can't fork in an organization you can't Fork, both A and B,.

B

A

You uh GitHub doesn't let you Fork Fork, A and B, so what it can. So, basically, you can't generate if you've got two main projects like one of them that might be slightly ahead or behind, and you want to generate a security effects against both of them. You've either got to normalize that Central repository against both of them and do do two different pull requests from that Central repository and that seems like a nightmare or generate the second pull request from another organization.

D

A

Oh also, uh one of the things that I've told people in this is something that I cover in I. Don't know if I cover this in my job, all the forks that I've been generating for pull requests come from an organization instead of a repository um problem with that that I just found out as a recent thing, apparently pull requests originating from organizations.

A

Don't support enabling um uh allow allow edits from maintainers hmm I heard somewhere that that was disabled, because if a maintainer is if a maintainer can make a change to an organization, account I presume that they can push a change to a repository or to that branch and then Force credentials out of that organization via a custom. Get of action.

D

Oh right, yeah, because when a maintainer edits the.

A

D

Editing editing somebody else's Branch yeah that I.

A

Think so, supposedly.

B

A

So supposedly they disabled support for that yep.

C

Cool like it's completely gone or you have to do. The approve then run.

A

uh No, like I, think that checkbox doesn't work when the pull request originates from an organization which means that either you generate the pull request from your personal account, which means your personal account gets bloated with a billion Forks which I have done. I have almost a thousand Forks against my I, have a thousand repositories plus against my GitHub organ, my GitHub account and then I stopped doing that and started generating the forks against an organization instead, so they go away and or somewhere else, yeah.

C

It seems to conflict with having the human facing side.

A

Well, yeah it it it's I'm, not doing so I mean this whole group is about doing something that GitHub has not seen before and, like you know, it's okay, it's just yeah manoir. Are you generating the forks against an organization or are you generating them against the GitHub account.

E

Check on that I I, don't remember it's probably because we were doing it only for a small I mean compared to the scale that you are doing it. It's it's on a much smaller scale, and that goes for the POC. So that's that's. Why I think it was mostly done like yeah, not on the organizations, but I I have to check okay.

A

um Okay, we are at three minutes past I. Think the only other thing that I want to talk about is opting out real, fast. There's a discussion, that's going on with Michael. What's the current status of the the spec that Luigi is working on that Json spec.

D

I think it's ready for like broader use and comment. uh I mean it's not widely used yet, um but I think that's just there's just new. You know elbow grease to get the the word out and get organizations to start adopting it. I'm, certainly going to start advocating for.

A

It there is so two things one, we want to add it. We wanted to add a specification field on that thing to determine like, and so so. The current way that I've been allowing people to opt out is via a DOT or gh.robots.txt file. They drop in their dot, get a repository, and if we can instead encourage opting in opting out primarily opting out via requiring that file to be present, then it'll Force some level of adoption, even if they're opting out, which would be kind of sad but also positive. At the same time, I.

D

Yep I think I think that would be great and having that um it was just accepts, pull requests true or false. Yeah.

A

I, don't like that, quite because it's too granular it needs to be. It needs to be more. It needs to be named like you need to be able to enable or disable like I'm.

F

Getting it yeah.

A

Yeah I'm thinking it needs to be more granular and to be name supported.

D

So, like accepts poll, work accepts, pull requests from Ao.

A

No One everyone.

D

Or list of yeah.

A

D

A

Ever no one everyone or list of and then the list of, is either wildcard list or something that's so you know it's like you know it's like a it's like a robust.txt file right, it's something more! You know.

D

um I'm: okay, with that I'll I'll, take a look at the um uh the pr in security inside spec. Please.

A

Do can you post that in the um in the uh autofix yeah I'll post it there too yep all right all right? Thank you all for coming. Thank you see you in two weeks, yeah, hey.