OpenSSF Vulnerability Disclosures WG, 24 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: OpenSSF Vulnerability Disclosures SIG Autofix (May 24, 2023)

Description

Meeting minutes: https://docs.google.com/document/d/1mZEi6EvbH2mvn-gHOUIaysAjHlwJXjJdJ7gMlelSkVU/edit#heading=h.u5im5d90xac4

Repo: https://github.com/ossf/wg-vulnerability-disclosures

A

B

C

All right, how's everybody doing today.

B

Pretty good I figured out the postgres and now I'm just trying to figure out the uh this HTTP pain on Port uh failed to start error from the triage portal.

A

B

How are you doing I.

C

I just met with my lawyer, the first time um where uh I got told that uh congratulations. You have to go back to 2019 and take every single thing that you, whenever every single time you talk about zoom and turn it into a you know thing that you submit.

D

B

Yeah, it doesn't sound like fun, yeah.

C

Okay, I am looking for the meeting notes um or the just vulnerably disclosure working group curious. If we're gonna have anybody else join us Chris. Have we chatted before I? Don't know if we've met.

E

No I, don't think so. um I'm, mostly just uh checking out all the different working groups, so just kind of learning. What's going on.

B

Perfect welcome thanks.

A

All right I am going to um what's today's date. The 24th.

A

Okay, cool Docs.

C

I'm gonna Mark everybody's, not here, and then, if you can mark yourself as as having attended that would be lovely.

A

D

A

A

D

Me just send something to the.

B

Do we have a in the notes? I don't see the one for today or is that uh the 17th now.

C

What oh did I not change the date. I didn't change the date. It's not bad.

B

You guys didn't want to like update the wrong one. No, no I just fixed.

A

B

All right cool, I love when I'm ready on there just gotta make myself different color.

A

Copy the meeting.

C

Okay, all right, let's get into it, then um all right. Okay, so.

C

um Do we have any new.

A

C

That we're you know Chris you're new and we can introduce ourselves uh yeah. Do you wanna? Do you don't have to introduce yourself, but you, if you want to introduce yourself, that'd, be lovely. Thank.

E

You yeah so um yeah my name's Chris um I until about a month and a half ago, worked at Microsoft uh and was laid off, but uh I'm actually hoping to be uh your colleague at some point so um interviewing currently for the technical project manager role so um for open ssf. um So I'm, just kind of checking out.

E

What's going on um history, wise I used to work for the LF I was actually the director for the well jQuery Foundation, then JS foundation, and then, uh when we merge with node.js to form openjs handed that off to uh Robin and then uh went over to Microsoft. So cool.

A

C

C

A

C

um Cool, so my name is Jonathan. Let you uh yeah I'll just add you.

C

um My name is Jonathan lichu, I'm senior software security researcher for the alpha Mega project, um and my schtick has been finding fixing vulnerabilities at scale across open source and uh doing more of that now here at uh this project. So we're discussing this yeah I continuous work, so you send me, you wanna, give your spiel.

B

Yeah I understand I'm on the alpha Vega project. It's a senior software security engineer. uh My goal is to uh operationalize the Omega tool chain, components and essentially automate and scale Jonathan. hmm If I had a tldr, it's automate him.

A

C

um I've been working on a document, hey Noah.

C

Hey no I have to have you hello,.

F

C

We're here we're doing a thing.

C

um All right, uh no, if you want to add your attendance to the attendance that would be like you know, let you attend attend to us. Do you need the land all right, so I spent a lot of time chewing on this document.

C

I will say, share this in the chat and then also um in particular, this page um that we're on um got a license for lucidchart I'm a screen share, so this is proposed an alternative to the disclosure flow we had originally, which was this one over here where I deleted a bunch of stuff.

C

um Let's see this one had a I think it's like something like this.

A

A

uh Something something like this: that we had.

A

C

So um uh the problem that Michael raised with this is that um we first open an issue and then we wait for that issue to get processed for at least 35 days and then, if it wait, if it's been at least 35 days without the maintainer responding, then we go to this email part and he was like why don't we send the email and open an issue at the same time?

C

So this is the flow that I came up with that, so the flow here is a little different. So the problem here is like this draws out the disclosure timeline by making these steps or this this process depending upon this process occurring which can slow down the disclosure overall. That makes sense.

C

Okay. So let's go what.

B

No I'm just saying yes, okay,.

C

So Michael scovato's proposal was we do something like this. Where we start, we ask if the maintain, if the repository host supports PDR, if it does, then you use private pmpdr. Sorry so uh for those who don't uh yeah PM PVR is a pragmatic means of private vulnerability reporting. So for GitHub. This is using GitHub security advisories to report the vulnerability um get lab apparently lets you like publish uh vulnerabilities or you can create a private pull request with gitlab and, like that's just a thing, you can do natively um so whatever that is.

C

uh We do that if you don't, if the if the repository doesn't have pmpvr enabled, um then we go through this flow, where we have this left branch, which is just continuously looping, and it says if the vulnerability is fixed, uh if it's not fixed and 90 days is not a lap. Since the uh the the process began and the public PR security effects hasn't been opened and the broad repository doesn't have pmpvr enabled, then we just Loop. If we have pmpvr enabled you just you know, report it and then you're done.

C

um If the public pull request has been opened, then we end. If 90 days have elapsed since the process began, then we open a public pool request. Then we have this flow over here, um so this happens concurrently. So this is this. Is this is two two branching, so this Loop is occurring whenever an on some basis.

C

At the same time, uh we look for emails, uh looking for emails with the disclosed check and then, if, uh if the the repository is issues enabled um and we found an email address, then we go down this route where we, where we do both of these processes. At the same time, however, the issues if issues are enabled but emails are not found, then we only do this side or if issues are enabled and emails are sorry if issues are not enabled and emails are found. We only do this side.

C

Does that make sense so far.

B

A

B

I think that confuses me is that both of them say Emos found.

C

Correct because you have the conditions on either side of the.

F

C

um This repository is enabled, because you have one of three conditions or one of three three entry points into this. This flow on the right so.

B

It's technically the same step, but it flows differently depending on it correct it's enabled or not. Okay, correct.

F

Oh yeah, uh my thought was the same. Why are there two emails found if it's like we're going there either way, but it's because there's three outputs. There's.

C

Three outputs from these these from these three conditions, there are three possible outputs or sorry from these two conditions right, because these are the same. There's three possible outputs yeah.

C

So if if emails are found in repository issues are enabled, then we go down both of these. These are ORS just to clarify these are ORS, um and as long as one of these flows reaches these ores, they are satisfied and you proceed to the blocking point where you're waiting for the other flow.

C

That makes sense. So if we have any it in the case where issues are enabled, um if an existing issue has been opened create to request enabling pmpdr, you use the existing issue. If it's not, then you create a new one.

C

If the issue was closed or deleted without a response, then we just go to this or and then we're blocking on the other side.

C

um If the issue has been open for at least 35 days, then we go to this or and then we're blocking on the other side over here. If emails have, if we have detected an email address so either of these either. This is yes or this is yes, then we send an email with vulnerability, details and requests that they enable pmpvr, and then we also add the attack. We attach the fix with the patch file.

C

If all of the emails bounce, then we just go to this four. Otherwise we wait 90 days after both of these flows have been satisfied. Then we check at the end it has the repository enabled pmpvr. If they've enabled pmpvr, then this will will cause the private pull request to get opened.

C

Otherwise we create a public polar crust.

C

So what this does, is it it um if the emails are like, let's say, for example, the emails are not found, then we have this Branch here that satisfies the constraint of this or over here, unblocking the other side. So it's just it's just um flow. It's like just you know, condition or um flowchart flows that unblock the other FL. You know you're on you're undeadlocking, the other deadlock that you're waiting on.

C

Does that make sense, even though it's slightly convoluted? Basically, both of these things are happening in parallel. That's the high level sort of.

B

It makes sense to me um just visually I had to zoom in on one of my bigger screens, but.

D

B

We can do something on this little area, just to reduce confusion of, like maybe color it with, like some words. Let them know like this is which condition.

A

B

Then notifying that it's or just from an outsider viewer coming in and you know trying to identify where the lines go, um I think that could that could help at least visually direct it. But as far as the process goes, I see why why I was done. The way.

B

And nothing major pops out of me right now, besides that little, but it could be my my focus is there for some reason.

C

We do contains I can only I can't do equals. I can only do contains. So if I have the word no, but not not. Oh.

A

C

Of them freaking, it does not. Okay does not contain if it contains the value. Yes, oh For, Heaven's Sake.

C

D

If I do this, isn't.

C

Just don't want it to be red.

C

Isn't found so email Isn't found in this case um issues.

C

B

Yes and then um maybe these other intersections I, don't know if you see my yeah well.

C

These are, these are if these are the both are true. So, yes and yes,.

B

Okay, maybe just like a text file just saying true or something because that's the only thing that I get lost, I was trying to figure out which line goes where and which conditions have been met and.

A

A note that text to Sarah like a it's like a box or.

B

A

That's a that's, you know.

B

Yeah, that's more visually I'm, like I, said: I, don't know about anything else. As far as it flows, I, don't know if um Chris or Noah have any feedback on that or if it makes sense to them.

F

uh I agree with you: that's not that that that midsection does look very complicated hearing your description. It sounds like it's necessary complication, but yeah, oh right there that looks better like some sort of way to distinguish which lines are going where because having them all at the same level,.

C

Open it up a little bit more.

F

Yeah, especially because they cross over in more than one place on on the way to the um the end point.

B

Maybe these two spread them out a little bit.

B

D

B

More of helping see where they go, because it does like intersect with those three so I keep staring at that one. There you go.

D

F

Yeah, so now you can see that if the email is found it's going. So if the repository issues enabled and the emails found yes goes to the same place as emails found, no after repository enabled am I seeing that right that the yes and the no both end up with exist.

C

F

They both go to the same place.

D

C

The top, but they but one of the branches, goes to satisfying this ore. Yeah right.

B

So, each of these trigger kind of like a three response- oh no! This would trigger these two.

C

So on for this black bar, that's a fork, so it means that these two things are happening concurrently, right, okay, you don't necessarily need to implement the logic. This way right, you could theoretically implement this with, like you know, all concurrent, not not multi-threaded, you know sort of stuff, it's just for visually, representing the steps separately. It kind of I just think that it's it's easier to show these two things happening separately.

B

D

I, like it I like how you represented.

B

D

F

Oh I was just wanting to double check my understanding that each one of those thick black bars represents like a concurrent process.

C

uh So this is a fork join block, so uh uh vertical Fork join and so sorry yeah.

A

C

Vertical Fork join and then this is a vertical Fork join. So if you see it leaving a fork join then it's then it's forking and if you see it coming into a fork join then it's joining good.

C

So, as a result of this, the minimum amount of time for an automated public disclosure.

A

C

I have a problem: I just found a problem in this flow, so, okay, we found, we didn't find an email address. We, the repositories, enable if you didn't find an email address we go into here. We find that there's an existing issue, so we use that the existing issue was closed without a response, so we satisfy here.

C

The um emails weren't found so we've gone down here and we satisfied this or so we're. Now here we come down here. Repository doesn't have pmpvr enabled.

C

Oh now we create the public pool request here. Okay, that's fine, I was going to say this thing is going to keep looping, but then because we have a no right and the pmpvr is not enabled, then we just go to public pull request.

C

So, theoretically, you could get down to this, create a public pull request immediately if they closed the issue without response and.

D

There were no emails found.

F

Is that to say that someone sees the issue and they close it, but.

C

They don't they don't respond, they don't leave any messages as a response. They just close. It.

F

So it's like, if someone so we're just gonna, interpret their action on one side in action on the other, because they're not replying, they don't have a way to be contacted. Yeah.

C

Yeah, we don't have a way to contact them and they've just closed the issue.

F

A

C

Or they had an issue that was open previously and they just closed it without response.

B

But they could have an issue, but it may be less than 35 days since it was last opened. That's.

A

What this one is right, yeah.

D

C

That does this seem reasonable and yet nobody- nobody does in disagreement here.

B

No, no disagreement.

F

Yeah I, um you know, gave us some thought about him. She is disagreeable.

A

B

And at that point we don't care about issues that have been open less than 35 days, because that's the only condition I can think of.

B

So the issues open, but it's been open less than 35 days.

D

C

Everything is a vision that, in order to turn this into a proper specification, somebody I'm gonna have to turn this into an actual paragraph or multiple paragraphs. It's gonna be kind of annoying.

B

D

B

Steps go ahead.

F

uh I was when I was first going over this and looking at it. I thought this is so it's like. It takes some doing to analyze it, but it is so clear in in ways that the human prose would not be no.

C

Yeah exactly right, it's like especially this BS I was like okay. How the hell do I represent this stupid freaking thing yeah.

F

It's gonna have to be paragraphs, and then paragraphs like well, but the comma means something, and you know whatever.

A

F

So yeah it's unfortunate that it's got to be written out instead of just everyone coming back to this and saying well, let's just revise this.

C

Right and I, don't I, don't mind like including this in the thing um but yeah, yes, I yeah wait. Do we not have a vulnerable exposure working group meeting tomorrow, or was it no? It's normally okay. So we're not actually going to run this by the open, vulnerable, open, open sort? Okay, so we can't run this by them until next week, tragically um yeah Michael scovato likes this, are we I mean? Are we in agreement about moving forward with? This? Is the proposed flow.

B

Yeah I'm good with it. um When you write out the paragraphs you know, I'm always open to to review and help.

A

C

I feel like I, should try to grab a time and meet with Bob Callaway and Brian bellendorf or somebody from Google and Somebody from Microsoft. uh You know like hey.

D

This is what we're thinking you.

C

Okay with this before we like try to because I don't want to turn this into a paragraph, multiple paragraphs and be like man.

A

B

Yeah just shoot them. um Excuse me, maybe shoot them an email with um yeah I'm about to say his name. Brian Brown Thunder.

C

Yeah Brian Bell, north and um okay.

C

um The other thing that's not covered here that we do need to do that. I was going to discuss, so we don't have this. This report via pmpvr, is completely blank. The um the thing about reporting via pmpdr um that we were thinking about was so that so the problem that we currently have with pmpvr is for githubs, which the github's feature is called private vulnerability, reporting or PBR hi Brian.

C

Have you seen this document before this one, the the new one that I did with Michael scovetta the the scoetta flow? Okay, great? We.

A

Just went through.

D

A

C

um The so all right, so what's the official name now yeah, let's go about a flow I.

F

Like that, one.

C

um So, okay, so the original flow that I designed for uh this was we, you know open open, a PM PVR, which is a pragmatic means of private vulnerability reporting.

C

um But if so, we first go through like opening an issue, you know waiting for them to respond. If they don't respond within 35 days, then we report via email or we fall back to email. But the problem with this is that we're waiting 35 days and then waiting 90 days for to send an email and Michael scavetta's proposal was why don't we just send the email and open the issue at the same time, so the proposal was switched to. We have a flow over here. That's continuously monitoring four of PM pvrs enabled if.

A

C

Is we use it, but in the meantime, we check for emails with Michael scovetta's disclosure check which he wrote We. If the repository has issues enabled and they have emails enabled, then we do both of these sides, but otherwise we if emails, are not if, if emails are not found or repositories, are not enabled, depending on that, we go down one of these two sides exclusively, but we consider the other side to have been satisfied.

C

We do them both in parallel right. So this is the issue side, and this is the email side, but if the, if the emails are not found, then it's automatically satisfied. Emails are not found. This is satisfied and if issues are not enabled, then this site is satisfied and then we just assume we move forward down the flow and then, like you know, if the repository at the end of this flow has not enabled pmpvr, then we open a public pull request. Is that making sense or have I lost you somewhere in here you're?

C

Giving me a look of like I'm confused, or this doesn't quite make sense? No.

G

No, you just gone very fast and usually before before I say. Yes, it makes sense. I I want a more depth. You know more closely. Read it I mean I, can't even read the labels on the screen I'm looking at here, because it's.

C

Let me send you the link, yeah I'm, sorry, because this is stupid.

G

Assume nor do I feel like I need. You need my approval right now: okay, um I care, much more about the vetting of this by our community, um I, I and uh and knowing that you and Steve have worked on it. I'm just really gonna give it a blank check, um but uh but but knowing it's been aired here with Noah and Chris, um and uh uh maybe even posting it to a list and sharing it if you're comfortable with it. But like that's gonna matter a lot more than my personal opinion.

C

G

I want to understand is where what I will care about is: where does it have implications for the budget in Alpha Omega and the parts that we are able to automate or make manual um uh and and that sort of thing, um and but if it aligns with the policy of not wanting to draw too many zero days on unsuspecting people you know and that we're operating in good faith? You know I'm gonna, look for validation from others here. Well,.

C

Okay, so the one thing that may be of contention here right, there's a couple things that may be contentious: um we send them emails and we don't look at the responses, but we have this ticking clock of 90 days and we're just going to disclose it 90 days. So if they don't have it fixed, you know in that time or they haven't enabled pmpvr over here. In that time it will just become public after 90 days.

G

Right and we don't monitor the responses because.

C

Automation I mean you're, probably coming from my personal email account with a Google like with it with its own automation, but I, don't necessarily like.

G

I mean if they respond back. This is not a bug. We should respond back great we're going public today, yeah.

C

You know I'll create a public pull request.

G

I think we should look I feel like we need to look at those responses and maybe over time develop an efficient way to Route them, but.

C

Yeah, um that's kind of encoded in the yeah I'm wondering. Is there a way to like.

C

You're, so so, if they respond with it's a bug, then we just open a public pool request.

A

C

I'm I'm, the thing that I'm thinking about here is great that works in small scale, but when you're dealing with like you know the scale of um what trellix did where they generated 65 000 pull requests right at that point, there's you're dealing with a scale at which this is impractical.

G

I think the approach is to not over over engineer over optimize the beginning, for the use case of you know thousands per week of uh CVS right, I. Think the I think what we throttle up. We see what's automatable, we see really do we get 50 response rates or one percent response rates and adjust with eventually the goal of cranking up the number of uh scans.

G

We're able to do, and the number of you know you know, consume more and more about that pipeline right um as we but I think to some degree automation, you don't really know what parts to optimize until that flow starts.

A

G

Pair or you make unfair guesses about where it optimized or uninformed guesses,.

B

D

B

On to what Brian mentioned earlier is that we would have to consider the different types of messages we would get in a different languages too, um because you might actually get responses like from reviewing and our discussion earlier. I. Don't think we took into consideration of them, responding to us and then analyzing the language that they're using, so that we know what next steps to do.

B

That would probably be a more manual process, but if we scale this like, if we get thousands of responses in a day, it's going to be hard to to properly track that so I I do like the approach of let's scale where we can but consider what the operational costs or like usage is going to be. Yes,.

C

I'm trying to encode that into Apollo error to a process document, that's like.

B

Yeah, we probably just have to be like a very generic, like monitoring results or monitoring like issues um where, if it doesn't fall in those two cases, maybe we get kind of like an alert to like hey check out this pull request or something.

G

um You know some degree steps in this process that involve humans. What your hope is that, eventually, you can replace that human with automation, with a rule with a signal um that yeah with a rule right uh data that you can automate around.

C

Put like an optional like you can, like you know, you can optionally if the person like if they respond with it's, not a bug. It's a you know: it's not a vulnerability. It's a bug we can put like optionally, you are, will you know you can you can taught? You know, drop this forward, you know, and then you don't, but you don't have to implement that you can just wait 90 days like that's still within spec, okay, all right. Let's do that then.

C

The other thing that um crossed my mind that that maybe um controversial is let's say that we can't find any emails to report with they have issues enabled um uh so emails are not found. It repositories are enabled, so we go we're only going to do it. We're going to found this flow um so and we let's say: we've already opened an existing issue requesting that PM PVR be enabled.

C

Then we use the existing issue, which was created previously from a previous run.

C

um Let's assume that that issue was closed without a response or closed by a stalebot.

C

Right then, as as stated this, if this, if this issue that we requested pmpvr be enabled from a previous report is, is um it's still either was just closed or you know closed by stalebot? Then we go down here and we just jump immediately to creating a public pool request.

C

So we go directly from pmpvr is enabled to is not enabled to creating a public polar press because they closed the last issue that we had um are requesting that you know requesting a disclosure channels be open to us and because we can't find an email to disclose to.

G

I think it is very defensible that if a project closes an issue that you've reported, whether as as one fix or not and there's no other communication from them, then you can go straight to publishing uh the publishing the book.

D

C

Yeah and it's not from Josh hi Josh,.

C

Oh, don't forget to put your um your uh your what's. It called in the in the Google Doc the.

G

um The uh uh okay, what are some other potential edge cases or contentious issues or where we're being are we dialing up the aggressiveness? uh The right way.

A

G

Building up the ambition without being too aggressive, yeah.

C

um So the shortest time Beyond no response would be 35 days here where we can't find an email. They don't respond to the issue. That'd be 35 days.

C

And they have enabled pvmp and PBR. So that's the next most aggressive time frame.

C

Okay, um the third most aggressive time frame is 90 days where we've sent the E the issue or we sent the email and there's there's um there's 90 days um simultaneously. This whole flow over here is continuously running. That.

A

C

The vulnerability is fixed, then we're done if the vulnerability, if 90 days, have elapsed since the process began, um then we open a public pool request um if the public PR, uh if a public pull request, has been open, then we're done because it happened from this other flow that occurred.

C

um If the repository enables pmpvr, then we use it so.

D

A

C

Continuous loop, going on over on the other side.

C

So the maximum we'd be waiting is 90 days. The minimum that we'd be waiting is not no time at all because they've closed the issue previously from us. Having run this campaign, a campaign against this Repository.

G

I still think that's right.

A

A

G

You know what, as you're as we're, because I think there's a bit of selling of this plan that we'll need to do publicly at least explaining it and um uh in Lay terms, for people to find following a flowchart card which isn't any of us almost call, but but would be. You know, people getting thrust with one of these things out of the blue or or a journalist, or something would be uh perhaps some sort of prose.

G

That says here are here's some happy paths and here's how we handle the not happy pads right through this through this system. Just just- and this is something we can create after this is finalized, uh but just to help the public understand the duty of care we're taking.

A

C

Yeah some like exam yeah, so so, because I think that this needs to be turn into a paragraph that describes it, but I think that encoding this flow in the documents and also not a bad thing. This.

G

Is a whole white paper's worth of flow um uh I'm saying but dumb it down a little.

C

Bit Yeah provide some example of.

G

We ran this, we found a bug in Fubar uh and um we filed a uh an issue. You know private issue, but it was closed immediately. So we then said great. You know it's it's, okay for us to publish it. Just like a few of these kind of Pathways uh that demonstrate for people how in each case, we are we're balancing these different different priorities appropriately.

H

G

I'm not saying you have to create those Jonathan by the way you understand what's best, but I think this is something that the project will have to own as a as part of the documentation for what we've created right.

C

I'm curious, um uh so one of the things that we're also not capturing here is what happens if issues are enabled our issues are or not enabled right, but we go to this. This volume emails found, but we've we've sent emails to the same set of maintainers in the past and gotten no response.

C

Do we do we want to handle something here where we say like we, we previously received no response, or do we give them the benefit of the doubt? Every time.

G

Yeah, you know, maybe they learned their lesson the first time. Maybe those set of maintainers is slightly different. uh Maybe yeah no I think you give them the benefit of the doubt. I see.

G

C

We're still waiting those 90 days, okay, um okay, so then this this flow will require some sort of State Management around. Like monitoring. You know like how time time frames and stuff like that right, like we sent an email at this date and it's been X period of time right.

G

Yeah and some reporting on that so that internally we're looking and we see okay next week- here's the set of 20 projects that we're going to put some CDs out about unless we hear from them.

C

I'm less inclined so I I know that you Michael scavetta and everybody loves the term cve for I'm less inclined to unless we've done, unless we've explicitly audited and done the done the like the um like, the the vetting of yes, this is truly a vulnerability.

C

um Miter doesn't love cves that are just coming from automated systems. um They uh they want every single cve to have been vetted in some capacity.

C

um We don't have those same constraints for um uh the Global Security database GSD, which is the thing that um Josh pressures is or yeah Josh Berker and those guys are working on so I would.

A

G

Would say enough.

C

Update to the nvd right that doesn't get those those GSD or the Global Security database IDs do not go into the nvd.

G

But but that's kind of an update, I'm saying that's like an x-gen nvd or something.

C

G

My hope would be if we come up with bugs that actually qualify based on their CVSs, so they're on their severity score, that um we decide how how to sufficiently automate and or Mechanical Turk and or find volunteers and or do what whatever is required. Maybe this is a conversation we have with miter. What's the right way for us to turn this bundle of 100 or a thousand High, you know mid severity, qualifyingly severity high enough um bugs to get them into the CD system. Or are you telling us cve consumers?

G

Don't care about these kinds of things right, like I, think there'll be some middle ground and if we have to pick up the phone and talk to miter about the right way to do it, that's an easy thing.

H

Yeah and and I.

G

Think our metric should not necessarily be cdes would be the total.

C

G

The total vulnerabilities found that we were able to move through the process. Yeah.

C

Yeah I agree: yeah I can agree with that. Yes go.

F

H

Yeah so just uh and I think as part of the discussion discussion, we should also consider uh maybe GHSA because I think, because we're talking about open source, it's kind of best entwined into GitHub, and you know you have the security Tab and whenever you have a GHSA for a project it automatically, it will appear there, um and that is also something that can be later pushed through nvd and get a cve I assume easily more like in a more straightforward way than from the GST, uh but maybe I'm wrong. Yeah.

C

So the problem with with GHSA is: is that um so anybody can get a GHSA right. um Github won't issue a cve number as a c as the CNA unless the maintainer requested so researchers. If, if you are a researcher- and you believe that there's a cve there's a vulnerability here, they will not assign you cve number just based upon the researcher's perspective um uh as a corollary to that. If you open a PDR right uh and Report the vulnerability to the maintainer and the maintainer's non-responsive, they will not. They have made the line understand.

C

They do not want to operate as an arbitrator in those cases. So what I've done is a little different I have um uh the way that I've done things is instead of um getting the the security or most of the time when you're doing disclosure you, the the maintainer, is the one that owns the GSD or sorry the GHSA, the GitHub security advisory.

C

um The way that I do things is a little differently. um I have a private, robot or public repository where my I have my security. Research and I have been disclosing here, and so these are not published from where the repository is because I can't force a maintainer to publish something.

C

I do so here, where I put all the details about the vulnerability and publicly disclose it, and then I get a CV number and assign you know put it on here, but that means that I'm owning the disclosure process and it's not tied to the source code anymore. It's timing, my own repository.

H

C

How Google project zero has started doing this for open source for vulnerabilities? um You know it's really not ideal, but it's the same. It's a way to to feed into the GHSA system, even though, even though you're the maintainer is not willing to work with you or whatever reason, yeah.

H

So I agree it's not ideal, uh but from the reasons you just mentioned, maybe we should consider it as well like to have like one project that is for the uh fixed Automation and then all of the ghsas will be open from there and then we'll remain in control of whether we want to pursue um for CV and then it's also all in one place um anyway. I don't know like what's the ideal solution, but I think it's definitely something that we should consider when we have the discussion uh regarding GSD um or alternatives.

C

Yes, so the proposed the The Proposal that I have that I haven't written. No, so the what I'm going to propose is we have this, create private vulnerability thing this create private pull request via pmpvr.

C

um Ideally, um what would happen here? Is um you open the pmpvr right report, the vulnerability, this flows? Not late is not I've not created.

C

The slow I will create this flow, but you create the pmpvr to report the vulnerability, um and then you wait right and if the maintainer is unresponsive, then you take the if they're unresponsive you give them 90 days if they're unresponsive, you take that PM PVR and you create a public pull request from it, and then you also take that pmpvr and you publish your own disclosure for it right and so because you can't force the maintainer GitHub, won't let you force that thing to get disclosed that you opened.

C

You take everything out of that and put it somewhere else and then disclose that.

H

D

G

Probably a foolish question, but are there tools that consume data from cves and try to attach figure out what project they attach to and then those tools would not find that reference, because it's CVS reported against your your personal repo um there's some fix for that. So.

C

Kind of um I that I've talked to Madison Oliver about this. It's a little interesting um uh if you publish, if you publish a GHSA and you have included a link to it in your cve request, right GitHub gets the cve request via then. Instead of coming in from there it's been asked, it's been given by a maintainer.

C

It then comes in through their cve request flow, where they're, seeing it, but they'll see the link to the GHSA and usually for that GHSA I've filled in all the details of like what packages impact stuff like that github's database, the the GitHub security advisory database is one of the few databases I think it's the only database that is Creative Commons licensed that has data in a structured format. Snicks database does not have that characteristic.

C

There's a bunch of other ones that don't so so I try to provide that information to make it easy for whoever is consuming that information to consume in an unstructured format, because there's no one else that does that right!

C

um I, don't know if they treat these reports like what I do any different I, don't know if GitHub like is pulling in as the API or, if they're, just looking at the thing that I wrote up and then copying and pasting the fields over into their own thing, because they have a team of people that is doing, you know doing the stuff.

C

So does that answer your question.

H

Yeah I think it's worth exploring with them, maybe and I think another Advantage was if it does get fed into their. uh uh You know, pool of ghsas, then it will also appear in osv because obviously contains all of the GitHub security advisors as well.

C

Yeah there's another, um the other thing. That's popping so nvd also publishes this CPE, so this CPE is supposed to be it's like, ideally an identifier for a piece of software, and it doesn't map very well to pearls right like there's. No so, but there is an effort to to to to map from, like you know the cve to to what packages or what product. What thing is impacted, it's just very imperfect and nvv. Doesn't it doesn't Supply these in a consistent way.

A

Yeah doodle doodle doodle. There we go.

C

um Yeah, um so yeah I think that my plan next is to go implement this thing, which actually should be pretty straightforward. It's mostly going to be, like you know, wait.

A

90 days, has it been, you know.

C

Has it been open for more than 90 days? You know, no, then make it public. You know like or pull it up all the data out and make it public and then also some collaboration with the maintainer because, like ideally, this will be a collab that that part will be a collaborative effort. Hopefully, if possible,.

A

C

Yeah any questions concerns um other things about this proposal or this this flow this.

C

The one annoying thing that I have about this part is that we may not be able to automate um comments on pmpvrs because I, don't I, don't know if GitHub will support that. So yeah.

G

I, don't have much more to add, or at least not not, that we'll only take two minutes, but I think this is probably mature enough to consider socializing a bit more widely within the open ssf um like to the full, like as an email or to the full vulnerability, working group uh disclosure uh or to uh possibly even attack or general, or something like that, but just like just consider gradually opening it up a bit more and I.

G

Think asking for help from other people by playing out various scenarios and how they run through this process would be a good way to kind of red team it so to speak, appropriate for weaknesses or edge cases where, where it's not doesn't lead to Great outcomes.

G

um It does also feel like this recent conversation about how to report the vulnerability suggests it needs its own unless it's here and I'm not seeing it because again, I can't see the labels um uh part of the workflow. uh That you know is a part of our conversation with folks, like GitHub, around ghsas and and maybe even eventually, miter so I. Oh, you dropped a link too I.

C

Liked doing it earlier, I thought you didn't realize you couldn't see it again. Still you.

G

Give the link I'm just on a laptop and and like being able to see this and see all of you and see the conversation at the same time. I don't have my like. You know uh full immersive, cockpit kind of like set up right now, so apologies for that, but um but I also just want to emphasize again like bring me your edge cases bring me your you know: where are we calibrating too aggressive or not aggressive enough?

G

um uh What I suck at is completeness uh uh and uh so I'm gonna depend upon others to really be helpful there and then. Secondly, where does it create big expense for us or risk for us as the as alpha omega as a project and uh I?

G

Think if we I think that the final comment is if we're okay, with an iterative approach and kind of optimizing the bottlenecks as we go and occasionally maybe we, you know, volunteer, slash mechanical turket, um uh then then I think we'll be able to to fix the hot spots that emerged. uh You know over time.

C

G

C

Agree: um okay, uh Yesenia dropped, thankfully, a link. um We are trying to move this meeting because it doesn't work for a lot of people um if you have not yet filled out the doodle for when meetings work great for you, um that'd be great. I'm gonna try to hopefully go sailing.

C

um You know at five o'clock on Wednesdays moving forward, so I've I've blocked off my four to five so that I can drive to the sailing place that I do so, um but yeah. You know, let's try to find a spot that works for everybody for the summer.

C

um Yeah. Thank.

D

You all for coming.

C

And uh being a part of this, this freaking Mayhem of trying to figure out how to do this right because it's you know it's important and we're going to actually operate operationalize this stuff, but we need to make sure we're doing it in a way that is, you know, thinking about them. Yeah.

A

C

I'm also going to try to shop this to um the uh Apache soccer Foundation. They have an email chain, that's focused on security and I've pissed off a couple of those maintainers with this process in the past, and so I want to invite them to come. Participate in this conversation.

C

um Now that we have something that's cohesive instead of, like a bunch of you, know, stupid bouncing off walls- and you know.

G

If you want David Nalley as the president and um uh and he's also at Amazon and he's a big supporter of Alpha Omega, and what we're doing here might be a good person to start with um I know. Mark Cox has also been very helpful with open ssf early early on, but rather than going too broad I suggest, maybe starting maybe starting with David.

C

um You know, because the people that are going to be experiencing this so the people that are actually like the maintainers, the software maintainers and some of them have been not not so thrilled so I want to. You know: I want to give them the opportunity to um you know, voice their.

H

Customers yeah.

C

Be part of the solution, but not I, didn't want to do that at the beginning, because I wanted to give that I wanted to have something in front of them to show them. Instead,.

G

Of just anything to want to engage the the hardest to win over crowd is admirable um and I'm just thinking, maybe in prep. For that being able to say you know here are some other accolades for it or other kind of about people who understand it about foreign.

C

That political angle, that I hadn't thought of okay- that's fair.

G

And I admire that.

A

Yeah, that's fair. Okay,.

G

Let's talk more later, I got a job all.

A

Right cool talk.

C

To you later also.

A

C