►
From YouTube: ROS 2 Security Working Group (2021-02-09)
Description
Meeting minutes: https://github.com/ros-security/community/tree/master/meetings
A
A
A
C
C
D
E
C
B
D
A
All
right,
so,
the
other
thing
that
I
had
on
the
on
the
agenda
was
just
to
follow
up
on
the
demos
that
we
had
last
two
meetings.
We
went
through,
move
it
and
then
the
robotics
middleware
framework-
and
you
know
all
that-
was
just
to
look
for
a
good
use
case
or
multiple
use
cases
on
implementing
security
on
a
real
world
system.
A
I
think,
to
explore
some
of
the
features
that
we
really
want
to
dig
into
a
little
bit
more.
So
my
curiosity
is
where,
where
do
we
go
from
here
and
one
of
the
options
that
and
one
of
the
options
is
to
look
into
this
a
little
bit
more
into
you
know
and
to
pick
some
work
to
do
with
movement
or
rmf?
We
could
also
look
at
just
exploring
some
other
frameworks.
A
D
D
F
A
A
F
Something
that
so
regarding
regarding
third
parties,
hardware,
one
of
our
concerns
is
if,
if
there's
ways
to
somehow
certify
that
certain
levels
of
security
on
third
party
systems,
once
once
you
get
into
multiple
robot
systems,
it
it
becomes,
and
then
we
we're
also
talking
about
like
multiple
vendors,
so
it
becomes,
I
feel
like
it.
It
becomes
very
tricky.
A
So
this
is
this
is
interesting,
I'll,
throw
this
I'll,
throw
the
same
question
out
to
the
group
in
a
very
different
way
here.
It
feels,
like
the
rmf
use
case,
has
a
lot
to
do
with
implementing
a
solid
certificate
hierarchy,
so
the
idea
of
having
a
ca
or
multiple
cas
intermediate
cas
that
are
trusted
trying
to
revoke
them.
The
idea
of,
maybe
even
you,
know,
seating,
some
of
that
to
a
vendor
or
middlewares,
and
so
on.
A
So
there's
a
lot
to
explore
there
I'll
contrast
that
a
lot
with
what
I,
what
seems
to
be
the
issue
with
move
it
where
they
are
looking
to
do
a
lot
more
of
the
granularity
of
allowing
certain
nodes
to
do
certain
things
have
read,
only
have
permissions
for
debugging
certain
nodes
without
you
know
other.
So
it's
a
lot
more
in
writing
the
actual
policy
files.
A
B
A
A
So
I
know
from
for
for
myself,
you
know
I'm
digging
a
bit
into
movement,
move
it's
pretty
easy.
It
ended
up
pretty
easy
to
set
up
so
now
I
want
to
start
digging
into
applying
some
of
the
security
features
there
and
I
actually
do
have
meaning
potential
meetings
set
up
with
henning,
it's
probably
later
on
next
week.
So.
D
F
A
A
All
right,
so
moving
on
the
only
other
thing
that
I
had
on
the
agenda
is,
we
did
have
our
open
quality
issues.
This
is
a
discussion
we've
had
and
towards
the
last
half
of
last
year
there
I
I
did
capture
them
in
a
kind
of
rough
summary
form
in
our
meeting
minutes
and
I'm
just
gonna
leave
them
there.
Just
to
you
know,
keep
them
in
front
of
us.
We
wanted
to
keep
them
in
front
of
us
to
see
if
we
could
continue
making
some
progress.
B
A
D
A
All
right,
so,
let's
just
keep
that
in
mind.
If
you
have
an
opportunity
to
work
on
that,
that'd
be
great
as
well,
and
then
we
only
had
two
action
items
that
were
still
left
on
the
list.
One
was
had
to
do
with
our
test
failures,
and
one
of
them
was
was
actually
on.
Mine
was
to
draft
guidance
for
vendors
on
creating
a
vulnerability
disclosure
policy
simply
haven't
worked
on
that
because
I
haven't
seen
a
lot
of
I'll
have
a
need
for
it.
A
A
So
it
is
it's
it's
based
on
mitre
and
related
documents,
but
basically
the
the
original
document
was
written
so
that
the
public
anyone
pen,
testing
against
raws
or
anything
like
that
would
actually
have
a
place
where
they
could
find
a
little
bit
of
information
about
how
to
submit
a
vulnerability.
So
it's
written
for
the
non-braz
community,
the
external
community,
to
just
give
guidance
on
how
to
report
a
vulnerability,
yeah
and
kyle
linked
to
that
the
rep,
and
that
was
we
had
worked
on
that
before
you
joined
the
group.
I.