OpenSSF Vulnerability Disclosures WG, 17 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: OpenSSF Vulnerability Disclosures SIG Autofix (May 17, 2023)

Description

Meeting minutes: https://docs.google.com/document/d/1mZEi6EvbH2mvn-gHOUIaysAjHlwJXjJdJ7gMlelSkVU/edit#heading=h.u5im5d90xac4

Repo: https://github.com/ossf/wg-vulnerability-disclosures

A

B

C

A

Know thank you for thank you for saving us to.

C

A

C

A

So I mentioned I messaged, uh kahil I love it. If we could like Institute a policy of like before a zoom meeting gets put into a meeting, it has to get tested with an anonymous account before.

C

It's I think the moderator open it is the default setting. I don't know if anyone has changed that.

A

C

It's it's. This.

B

Is the second time.

A

I've run into this issue, but this this meeting or this working group.

C

So it's just like the 100th time, I run into it over the last three years.

A

Yeah, okay, so this yeah I I, actually I had a conversation with Ankara about meeting chaos and meeting problems as when he joined so he's it's on his right. This is not this particular issue is not around radar, but meetings in general, being kind of a pain to to run from the organized organizer's perspective is something that he's aware of so yeah.

C

And typically I have so the back door in, but uh today they two-factored me.

A

um That's fun, so you have to use a burnt. Do you burn a code to get in yeah.

C

I'd use a burner phone man they're onto me.

A

Well, yeah, you do not feel obligated to hang out, but if you'd like to hang out love to have you I.

C

Was going to anyway, perfect I was just doing laundry and I ran down when I saw your text perfect.

A

I appreciate it so I guess: let's just for John I, don't know if we, since we're working on a an uh a document. I, don't know if we need uh meeting notes.

A

C

If there's any decisions yeah, we should write those down uh or any kind of action items. We should do that, but I think you're fine, if we're just editing just uh for good for that right. That piece yeah.

A

um So Josh you, you and chrome- do not have not seen this. um This is well Chrome. You've seen a form of this, but not the most up-to-date version of this. This is the. This is uh something like the document in the chat, so everybody can find it real, fast uh chat, I think there we go all right, so eating chat um and there's also this copy link.

C

Yay lucidchart mm-hmm.

A

um So, at a high level, this describes the flow for um how we would do PVR.

A

um uh So let's can I assume here.

B

A

Yeah, why is this look weird? Well, there's two of them on there. No wonder it looks weird.

A

um Okay, um so um so to refresh everybody, uh Yoda Mew and I worked on this together, but Josh you missed. You were not here in the last one and neither were crop. So, let's start at the beginning, and let's just go through what we have for this flow. So our post flow as it stands is that we would start here um at uh if the repository host supports PM PBR right, which is PBM. Pvr stands for private means of private means of private vulnerability, reporting.

A

No sorry pragmatic means of private vulnerability, reporting, so pragmatic, pragmatic meaning like a programmatic or I guess. Programmatic is a better term than pragmatic, but programmatic programmatic means of private vulnerability reporting. If they do support that, then, if the repository itself has PM PVR enabled, then you just generate the pull request.

A

If it's not, then you, um if you check to see if the repository has issues enabled you know, some organizations and repositories do not have issues enabled, um and so only if we have them enabled, then we check to see if there's been an existing issue requesting I spelled requesting wrong requesting that pmpvr be enabled. If there is not an existing issue requesting pmpvr be enabled, um then we create the issue. Otherwise you use the existing issue uh and the the we use the existing issue for later steps in this flow um regardless.

A

uh So you, if you, if they don't, have an issue created, um then you, uh if you don't, have an issue credit. Then you request you open an issue saying: hey, please open pmpvr. This is the flow we're going to use yada yada um if they've enabled P. If they enable pmpvr, then you create the private pull request via p and PBR if they don't um or if the issue is closed or without you don't get no response right, they close or delete it.

A

Without without a response, then you jump immediately to creating a public poll request. If they respond with, we can't or won't enable pmpvr. Then you uh follow this flow down here, which we haven't discussed yet or if the issue has been open for at least 35 days, if any of those three are Decay so for for this flow, this loops around until one of these cases is true and at that point for these two they can't open, pmpvr or the issue has been open for at least 35 days.

A

We look for an email to send an email via uh the disclose check that um uh Michael scovetta wrote and then from there we send automated emails with the vulnerability details and Patch file. If all the emails bounced, then you just create a public pull request. If it doesn't bounce, then you wait 90 days and then, if the vulnerability is fixed you, if it's not, then you create a public pull request. Otherwise, you're done foreign.

A

Did I lose anybody anywhere there.

D

um So I'm just looking through this last stage at the process and I'm, not seeing so, let's say this one yeah yeah, so you send the patch files and phone details wait 90 days not fixed. Okay,.

D

Create a public pool request, never mind um I missed the the part where the vulnerability doesn't get fixed. You just create a public PR, because I was thinking. What was missing is informing the public that hey this thing's a thing.

E

D

Been fixed yet, um but that would cover it so um seems insane.

B

C

B

A

B

Something else.

C

A

Yeah I know I, just figured I'd ask the person who's part of the per the the the uh the diagrammer society. What's.

C

A

I'd ask as I I the reason that I'm paying you know was like you know, has this programmers or has the diagrammer society? Do you have an opinion on.

C

On that shot, yeah I hate that dot. It should.

B

C

In the parlance of workflows, the both beginning and end started in a little kind of squared oval thing.

A

You know really I.

C

Thought that I thought the third icon on the top on this under flow chart. This.

A

Is the uml start and the uml end and.

C

A

C

Flowchart, next to the diamond that Terminator that's the beginning and end.

C

Out of the thousands of workflows that I have either made or looked at, that is how it is done now. Uml is a little different. So if you're talking to an Enterprise architect.

C

D

Maybe argue um yeah and the other thing too is it's not super clear that creating the public pull request is a Terminator.

A

It's um it describes so those these this box means um uh process defined in another document or another flow.

A

So it points it's basically a reference to another process that we haven't defined yet.

C

I want to make this. This is.

B

A

F

This- and this is two.

A

B

A

A

um So this is this: is the high level flow? Does anybody have any disagreements about the flow or the proposed ideas in in it? Encoded and, like you know uh in particular like this is uh there's like I mean you can run this as fast as you want right, like you can run this like minute by minute, but, like I, think this is you know this could theoretically run like once a day or whatever you know, I don't care, um but at least it gives you the opportunity like there's no like waiting.

A

It's like you can just cycle this and then, as long as this comes out at 35 days, you can go down here. um The.

A

Do we want I, don't really want to do email monitoring or require email monitoring in here, like I, think that waiting 90 days is perfectly fine.

E

Right, what do you mean by human.

A

Monitorium, like wait like doing some logic based upon the response to the email.

E

B

E

Sounds reasonable so.

A

So this this I I guess the high level question we have here is: is there anything that anybody you think will bite us on or like complain about? If we try to move like, let's assume that we move forward with this flow, we write it down into the policy I. My intention was we'd. Leave this flow in the policy document as a visual description of the flow.

A

Do you see any points in here where people will be like I mean this is the okay. This is the one that um I can see potential conflict with like if somebody closes the issue without response right like either close the issue or delete the issue without response that immediately triggers a public pull request.

A

Does that seem reasonable.

D

Because the two things that I'm seeing that aren't covered, um that does seem reasonable to me um one is there isn't any mention of the like critical project stuff? We talked about which I don't know. If we want that in here or not, but that's one thing I noticed and then the other thing is the bone. Ladies, that isn't mentioned at all in any part of this, which might be fine.

B

D

That's another spot that I noticed isn't in there.

A

um I, don't think so I'm wondering whether or not we want to require vulnerability. Id assignment as a part of anybody implementing this flow I think that the open, SF um I think that the uh the alpha omega project will maybe involve uh us. The the GSD database right, but that's I, don't know if we want to make that a requirement.

C

I would strongly encourage it just so that Downstream customers have that common identifier, and they can all refer to whether it's GSD, osv cve yeah.

D

Whatever we use um the one spot that I would kind of push back, there would be if we're making the public pull request. That's kind of the we're pulling the parachute scenario right where hey the public should be aware of this and I think that's where having an ID, no matter which database it's in um would help Downstream consumers because hey now, this shows up in your scanners. You know: hey, there's something going on here.

A

um Yes, um okay, I think that I think that that um I think that would be part.

B

Of this, just like whatever this flow.

A

Is right because again, this.

C

A

Referencing another another document or another process right so I think that that would be part of here and part of here.

D

A

That makes sense, no I, don't think I. Don't think this document needs to include that information. Yeah.

A

C

Foreign, so this box here Jonathan, yes, you don't have any further actions or termination.

A

It's a predefined process. The references. Do you want a termination yeah.

C

It needs to go somewhere, otherwise, you're stuck in a loop forever.

A

Really I thought that a predefinite process can be the end.

C

Not according to how I've practiced, so you would have I would put a little box down here and say and or even refer to a diamond or whatever down here. hmm um L is a little different than the flow chart right.

A

Yeah I'm just I'm the thing that I'm thinking.

C

A

That, um okay, we could do that. The the only reason that I'm thinking so the and so the FL you you follow that flow and then the the flow would end. Okay, if.

C

That's if that's the end of it, otherwise.

C

um But just because it's a private pull request doesn't mean anything happens. Well,.

A

Right so the private pool request has its own flow, that it has its own Terminator Okay you're, saying that that that that that that process can have its own Terminator as well.

C

B

C

Another diagram you would reference, there's an off page, isn't.

A

That what this is.

B

This is an off page.

D

Is there ever a scenario with a private pull request would end up over at the public pool request, yeah.

A

They don't fix it in time. They don't they don't yeah.

B

So that, yes, a private.

A

Call request can turn into a public pull request if they don't, if they don't like, if they have pmpvr enabled, but they don't like respond within 35 days affirming or they don't um uh they don't fix it within 90 days, hi Michael, you have not seen. This is the first time you're seeing this document right.

G

uh I've seen previous incantations of this, but.

A

I'll, send you the link again, you can review it in. Thank.

C

You so yeah it! So if you have the other workflow, you could drop home plate down there and hyper snooch over to it. Oh.

A

B

C

Then you would you know you put your url there, but you would you title it? You know private pull request process whatever.

A

Let's do that hang on a second, let me um delete you go away. Okay, me.

B

A

This is the: um what is the name of this talking? This is the okay. This is the campaign. This is the um rename report, vulnerability well,.

A

Create another document uh uh we arrive at.

A

uh Great fire I'm going to really or create um your port via PM r.

A

A

ah I change the text.

C

It's been a while, since I've used lucid.

C

I would uh undo.

C

Because you lost your original box, what what.

F

B

A

B

Just need to put a title on it: uh there we go.

C

And then I I had a second question.

A

C

So if you're, following your workflow and the product, the repo doesn't have uh private reporting, there are issues. So that's your first escalation. Your second escalation is uh you're checking with the mail list, and that's it after that you're going through. That said, you're going full full out, there's no other escalation or other checks. This.

A

Is intended to be a fully automated process yeah when it has no humans in the loop, mostly right, like the goal is to try to avoid humans. Now there was the discussion that Michael scaletta had that um we could. Theoretically, um uh you know as a as AO uh engage with.

A

You Brian Michael, you wanted to maybe.

G

Work with and and outside organization, we would pay them money in exchange to do this. Like yucky work of of you know, responding back the back and forth.

C

G

And kind of the The Last Mile reporting right.

C

Or even checking like with cert Cc or somebody that they might have a contact so.

G

So here's the thing so so um and I don't need to hijack that, because it is on point um that that what's the stuff disclosure check is not just finding emails, it is coming out with an ordered list right um of including cert CC, and um get up security, Labs, Nick um tied, lift or whatnot. So every project will have at least three options which is search: CC, GitHub security, lab and snack. Okay. They all have a public like give us your bugs repository. So, um oh sorry give us your bugs, like link.

A

um Email, you mean also so I don't so. The idea is, this is only gonna happen by email right, we're not going to try to do form filling out we're not going to try to do jira issues, rationale being like, for example, right. um The Jenkins team has a uh jira instance right. The Apache software Foundation has their own jira instance there. We we don't want to expect either us or other campaign operators to have to go automate. The account creation process for every single jira instance.

A

That happens to be running that somebody happens to be running because everyone's gonna have their.

B

A

Flow they're, like that's a whole pain that we're we're like we email, is the lime in the sand of like we'll try to paint pmpvr if empvr doesn't work, email.

G

So uh I I agree that it shouldn't that I, don't I, don't think it. It's reasonable to include arbitrary jira instances. um So cert cc is a. uh It is a you need a Vince account.

A

Cc doesn't want this like I. Don't think this I, don't think that sir CC wants this sort of like spam, like.

G

I mean well so as the lowest one on the list, so the idea would be that you would that I I don't option. A would be you. You have the list of seven potential contacts, you take all the email ones, you blast out an email, you wait and if they at some point you decide to go to the fallback ones, which is cert CC and get up security level, one of those um another one would be.

G

You start at the top and you try the top and no response you go to the next go to the next. Go the next with the idea that there's a there's a the ones, the ones closer to the top are more likely to be the right ones.

A

But all that goes by email, right, the the the emails or the ones we care about right, I'm.

G

I'm trying to look so so like the the Snick one, it looks like just a a web page, so you could.

A

Yes, but they I mean we could ask them to to create an API or let us use that via automation,.

G

Yeah and that that should be easy, even if we have to like script a headless browser um and then security lab is just GitHub is just security. Lab at github.com.

B

A

So security lab, doesn't security lab, doesn't handle vulnerability, reports uh for maintaining like they they do their own research. They don't handle coordination for out incoming reports.

G

um Pretty truly do they.

A

Handle certain things in special cases they handle things like, for example, someone comes to them from cert and says: hey this vulnerability is everywhere, help us out or like they do they. Don't they don't do disclosures for you, it's just not their stick.

G

um Oh um okay, um I I'm, pretty sure that I S. All of that, although I could have just completely snake.

A

Does Snick does oops sorry, I've I've violated the you know, I'm breaking the Internet by hitting F12 accidentally.

G

We've also broken the law. Yeah I know.

G

A

Yes, the original intention of this document to answer your original question was yes, that the the Line in the Sand was email for automation. Right, if you, if, if you know we tried pmpvr, we give that a shot. We give email a shot if email doesn't work, we're not We're, not gonna like it's unreasonable to try to um uh report via hacker, one through automation or bug crowd, or all these different channels. Right like what.

C

If the project uses bugzilla or jira.

A

We try to find an email to send the report to in the maintainer, using uh Michael scovato's tool that he wrote to find a disclosure Channel via email.

A

So if the youth bugzilla or they use one of those other things as long as we can track down an email for it, we'll use it to to send the report.

C

No I understand your logic. It's just there are not so many different variations, I, just don't I, don't know if we've accounted or could ever account for all of it right.

A

And that's the that's the big thing right through automation, right when you're dealing with the vulnerability at a scale of tens, hundreds or thousands- well, tens, maybe not hundreds, thousands or tens of thousands right trying to support all of the various different disclosure mechanisms that each one of these vendors has is from.

C

A and yeah roll that back a little bit Jonathan most of these projects are not vendors, they're, an individual contributor maintainers, you know one or one man or one woman, show right.

A

Right and so that I mean PM, PVR will support most of those cases. Hopefully.

A

Right and most of the people that are running bugzilla instances or gr instances are not one-man shows no.

C

But they could be part of affiliated with the foundation that might not have a security team. There's a lot of different permutations.

B

C

Just want to be sensitive to them and not have you get blackballed the first day you roll this out, no.

A

I I mean hey, I've, been.

C

To avoid pitchforks and torches I.

A

Mean I've been using floor, Quest generation and you know the only people that have gotten pissed at me is the uh open source security Foundation uh Michael. You asked for the issue closed deleted without response shouldn't. It go to the disclose check um my uh so this only happens if the issue gets closed or deleted without a response right. So if they just if you say hey, please open pmpvr, we have a vulnerability report for you. We want to work with you. You know help us out.

A

You know if you can't yada yada, like that's fine, and if they just ghost you completely, they close the issue right.

G

To differentiate between that one and the one below it, though, um if they close the issue, or they say no and close, the issue um like.

A

They've actually responded in the in the latter.

G

Case but but I mean it, it feels like it. It's um going right from there to to public pull requests.

A

And we we could put that in the message like hey. If you just closed this issue without a response we will, we will just open.

G

Up more questions, but but why not just what's the downside of just routing it to the disclosure track.

A

um Because it already, it shows a level of hostility towards the process that they just don't want to engage.

G

You're not obligated to engage like.

A

They're not they're not obligated to engage and we're not. You know we're not obligated to report vulnerabilities to them and we're not obligated to report vulnerabilities to them privately I mean no.

G

No, we are, though, so we're obligated to report to we're obligated to to the best effort to reporting it privately um right.

A

Without Alpha Omega is sure I mean maybe Alpha Mega is yeah, I mean sure I again, I think that I think that to be clear, Alpha manga can always do better than this process. But, like this process is a baseline, for you know minimum minimum to achieve.

G

Yeah I would still say like either of those cases like you, you don't lose very much by routing those last two diamonds over to the to disclosure check and then just routing it that way, because then they you know it it avoid. It also avoids things where, like oh I, didn't understand this I closed it by accident. My like my co-maintainers and you know they closed it and they didn't know what they were.

G

They were doing sorry like, but now you've now you've, you know released the zero day, um whereas, if, if you, if you route it to disclosure check, then you always have that 90-day buffer, where it's defensible that you were you, you made every best effort to report it and you waited 90 days and then disclosed like.

F

So Jonathan was mentioning uh the other day when, when we were working is that he has seen that uh the vulnerabilities, like reports are like closed without any response, typically like he has seen that in in when he was reporting to like non-us-speaking countries, uh when maybe they don't understand Etc, but I I see the point and I I think like I.

F

Also, second, what you were saying is, uh which is like it just adds an another 90-day buffer, I guess like what what uh Jonathan- and we also seconded this thing last week uh or the week before, but yeah not last week the week before, uh which was like going to the vulnerability report as soon as we can or like so so.

F

The pull request like instead of waiting 90 days, you just make expedites the whole thing, but in the big picture, I think maybe Expedition is not necessary and rather than like following a process which is uh more favorable for the maintenance. All all the time is uh is a better option.

E

I I think you also Jonathan you also like kind of when you asked us. What do we see as kind of a point where we can get like pushback you flag, this point as well, so this is gonna can uh remediate that that's gonna sentiment. Here's.

A

Here's a here's an example heck take a look at that.

D

If you close it, it doesn't exist.

B

A

So like and and then no I've, you know, I spoke to to uh uh George I.

B

Can't remember how to say: I, don't think. That's.

A

How you say his name, um but he said they never got an email. They never got a response. They never you know they never got it. No. There was no further communication from them. They just got a closed issue like how do you handle that.

G

So for that one I would ghs say it: I wrote public pool requested, and uh here.

B

A

The second one.

G

I'm not saying that these things don't don't occur like and clearly after 90 days like like the way that I see it is like before 90 days. These things are, are um it's it's it's dangerous to push too fast after 90 days. It's all public. Full disclosure go for it. um So my my suggestion here might I think what if you did so uh exist, so wait. Let me move my mouse in the right window, so you can see it so yeah.

A

Okay, guys, if.

G

You start here, exists, uh issue, exists.

G

um I guess uh somewhere somewhere in here somewhere in these three you in parallel. Do this thing to do: do the um disclosure check, so you open up an issue, say: hey I, really, you know we we have. We found a report, we're gonna, send it to you privately um for the future. Please open up private vulnerability reporting, so we don't have to do this.

G

This weird dance thing for the next time and that way it doesn't actually matter how long if they enable it how long it takes them, whether they close the issue or open the issue. It doesn't matter because you've already, the clock is like immediately starts, um which actually means that there's no delay between that initial start condition and running disclosure check, sending the vulnerability or opening up a private vulnerability report. uh So 90 days starts like essentially immediately at that point, um and you actually don't need the 35 day cut off at all.

G

Does that make sense? So so the first issue for a repository that does not have vulnerability reporting, enabled will only get the details via the the disclosure track method.

A

So I I was okay. That was a thought process that I had earlier was like some sort of caching mechanism such that, like you know you, you reuse, the least you know the whatever. Whatever flow you flowed down before, hopefully you can reuse it against, like, for example, pmpvr is enabled just use that, but like it was not enabled. This is where this came in right. This existing issue is requesting. Pmpvr wasn't like so. Let's say you had two different issues right, you've already requested pmpvr be enabled.

A

This flow is cached right so or like if you requested it Beyond 35 days right. This flow would still go this way right, like you're, you're, great, so you're just saying move this up into like if they don't have pmpvr enabled you in parallel. uh You do this at in parallel. You also send the report, via this disclose check.

G

uh Yeah yeah, so so it's and it's actually even simpler than that so start run. Disclosure check is PM, PBR enabled yes send it. That way else.

G

Send it that way and open an issue asking for PVR to be enabled, and then you're done.

G

You still have to at some point that wait 90 days, I, don't know how to automate that because, like what's the signal back, that a thing has been fixed, but you have that problem anyway with anything that doesn't go through PBR, so um it doesn't make it worse, but it does make it better. But at that point then, at 90 days after that initial action, uh 90 days has passed and public disclosure is fine. If, if it hasn't been fixed or public, disclosure is fine period.

A

I mean yeah yeah. Do we um so originally this I? This idea floated so okay coming from wrong one all right so from.

B

A

This is the policy that's approved by the attack. We expect maintainers to respond within 21 days of the notice date to let us know the issues being mitigated to protect impacted, end users if we do not receive engagement from maintainers from 30 to five days of the notice date that affirms their intention to fix this vulnerability. Within the time limit, we reserve the right to fully publicly disclose the vulnerability at that point, so the policy that we have is actually 35 days. If they don't respond at all.

A

Do we want for both of these right if we don't receive either an issue response or an email response within 35 days that we go the PM? We go the public disclosure route, but we, um but we give if they respond at least to the email saying yes like we're, we're going to or like they don't have to like. They just have to respond to the email right. We have to confirm.

A

The email has been responded to or the issues responded to if either of those two cases are true, we give them the full 90 days.

A

um But you're saying so: okay, so then.

A

uh So here what you're saying how much time do I have six minutes before I have an interview with somebody else, but you're proposing that we.

B

A

Nope this this Still Remains, this.

B

Is deleted and then.

A

Off of here, we do this in parallel.

B

G

You know if it would be helpful, I'm happy to to I I um I'm happy to just to sketch out. What's in my brain, because I don't think I described it well,.

A

G

C

A

This perilous, the parallel thing sort.

C

Of suggestion, for next time, Jonathan yeah make a copy of the tab. That way, you don't lose your work before you start deleting stuff. There I'm.

G

C

G

This before right.

C

And do your edits on the copy.

A

I'm out of free shapes for this document, oh.

C

Too many shapes man, your complex. Your process is too complex, hey.

A

Boss can I pay for lucidchart.

C

That's gonna be like eight bucks a month. Man, that's gonna, break your box.

G

A

Thank you, of course, hey do we need do we need to get votes from the uh the other, the.

G

Other bosses ask Brian, tell him I said it was okay.

E

All right, I will, but that's that's a nice uh threshold setting from the lucidchart team or that.

A

I know I know it's very you say you feel the pain yeah.

B

E

It's like you get enough. Gapes.

A

Just to like you know, fix get that fix and then yeah.

C

um In the chat Jonathan I gave you two suggestions, not about the aquarium itself. Yeah.

A

Art, yes, so Art's, always somebody that I ping, but he's not he's not yeah yeah right.

C

Have him look at this just because he's done this a billion times, and he might say: oh you forgot about this or that or what about this scenario so he'll give you some good feedback in addition, yeah and then consider reaching out to the OSS Security folks as a last step, when you're going public ask them if they would be okay, if you said the vulnerability, Auto fix project found blah vulnerabilities in these projects and we're notifying this list, because there are substantial amount of people that monitor that just so, they might not be watching it.

C

Most customers don't watch a GitHub individually for commits.

B

C

To have that wider, wider net of people potentially seeing it.

G

Yeah so so for things.

C

Like that ask him first, because you get these a little cranky.

G

um If things like that should be in the disclosure check like fallbacks um like.

C

Yeah they're not like a that's just they're they're purely uh disclosure Channel. They don't there's another list for coordinating that you're not invited to, but there's a public list that you could say on this date. This thing is public. You know, because.

G

I'm planning to oh that would be okay, so, like a advanced notice, warning no.

C

No there is that, but I don't know that this would qualify for that, but I'm just saying that the OSS Security list on this day this project, our scanning project, found this vulnerable. This vulnerability in these projects and we're notifying this list, so the downstream can see that, because more people will watch that than they would potentially monitor an individual, GitHub or gitlab repo, but ask him first yeah. Oh.

A

Wait, who are we asking again solar.

C

A

Who is so? Who is solar designer.

C

Can you just shut the front door? You don't know who solar designer is.

C

um Solar designer runs the open wall lists that all of traditional Linux use for their pre and public disclosure.

A

Oh, this is that there was that whole thing that, okay, that we were trying to figure out how to okay. There's a discussion about this from Al right, Michael.

C

G

Different very parallel.

C

Things but but those lists are very widely used and I would suggest, hey we're all done. We found a thing Downstream, be aware, because you know we could reach the maintainer or whatever right.

A

um What is the, what is the like, uh diagramming, equivalent of a hey run, these two things in parallel.

C

I, don't remember.

A

Pedantic about the start of the end can't remember how to run two parallel tasks. At the same time,.

G

You just put a little text on it that says these two things run in parallel: yeah.

C

Or you have a little bubble afterwards saying that we know we did this one thing and now we're doing something else before you move on to the next Diamond. The next decision I'm.

B

A

Is there a maybe I can use a merge in reverse.

C

A

Know I don't know if I can get.

B

A

To rotate, though,.

F

um Like the fork and join that you can use where.

A

Do you see, do you see a fork somewhere.

F

A

F

I think it's in the uml state activity and then there's this like uh like solid yeah like that one that one yeah this one: no, no, not the object. There's the solid, like minor Dash, sign.

C

I think the black one yeah.

F

The black one: yes, this one yeah, that's the fourth one. Yes,.

E

All right uh just Jonathan we're at times you said you had an interview, so I do.

A

Oh yeah, we are time I.

C

Hope you get the job, man don't tell Michael I.

A

Meant ease, yeah I, know all right. Let's chew on this next week, uh we're doing I just to remind everybody, we're meeting we're doing this meeting every week, uh uh because at bi-weekly was not enough. All right cool all right thanks.

B

A

You all talk to you later bye.