Hyperledger Community: There we go.
Tracy Kuhrt: All right, welcome to the November 18 technical steering committee call.
Tracy Kuhrt: just start with obviously the antitrust policy notice that everybody on this call, has seen many, many times since we don't have any guests.
Tracy Kuhrt: Just know that you should comply without, as well as the code of conduct that is linked to from the agenda.
Tracy Kuhrt: So it started with the announcements, as always, the definitely weekly newsletter that goes out each Friday, so if you have anything that you'd like to add to that please consider doing that today and.
Tracy Kuhrt: get it into the, the next step weekly newsletter also as a reminder, we won't be meeting next week, due to the US thanksgiving holidays so we've canceled next week's meeting and then yeah anybody else have any announcements that they would like to make.
Tracy Kuhrt: resounding Simon says that nobody else has any announcements they'd like to make alright, so we do have the three reports that have been on the agenda for a few weeks now.
Tracy Kuhrt: I haven't seen anything new at it to any of those reports, other than maybe just some discussions that have been kind of back and forth with the.
Tracy Kuhrt: With the submitters so I don't think there's any outstanding questions, but I do want to give people the opportunity that if there is any outstanding questions that they'd like to ask, they bring it up now.
Tracy Kuhrt: Alright again resounding silences that everybody's happy we'll let those three fall off.
Tracy Kuhrt: Next week we will identify has reached out already to silence on the.
Tracy Kuhrt: borough report, so we will hopefully expect to see that, too, we do have expected in the next meeting that we have, we should have hopefully for new reports for the grid transact cello and coke coming up.
Tracy Kuhrt: So.
Tracy Kuhrt: let's move on to the discussion.
Tracy Kuhrt: So the first item that I have on the list here is the security process proposal that right has put out.
Tracy Kuhrt: There has been some discussion on that, but like to open the floor to have further discussion on this particular proposal.
Tracy Kuhrt: Oh no.
Arnaud J Le Hors (IBM): Yes, thank you, so I mean, admittedly, I should have started this before I put a comment earlier today but, given the time difference, you know I don't think anybody really had much chance to look at it, but.
Arnaud J Le Hors (IBM): I mean essentially I, on the proposal itself, I think this is going the right direction, the question I had.
Arnaud J Le Hors (IBM): more to do with the current documentation, we have so right scroll down I put a link where you can you can have it there, too, but.
Arnaud J Le Hors (IBM): In particular, you know, so we have it, and from that point of view, I think you know we we can give ourselves some kudos on the fact that it's not like we've never done anything.
Arnaud J Le Hors (IBM): In this regard, and so we.
Arnaud J Le Hors (IBM): actually have documentation with you know with regard to what how we handled security issues and and even a fairly detailed process on how to respond respond to two winner really reports, but so the proposal doesn't say anything about you know.
Arnaud J Le Hors (IBM): The current documentation, basically, the main change seems to be a we update the security empty file in all the repositories and um I think we also need to.
Arnaud J Le Hors (IBM): Look at the defect response page, so I didn't do a thorough review of it, but I looked at it, to some degree.
Arnaud J Le Hors (IBM): And there are certain things that I noticed that you know where there's like do trip and see differences.
Arnaud J Le Hors (IBM): Between what's being recommended now and what we have and just to name a few that I spotted going through kind of side by side or after rereading the guide.
Arnaud J Le Hors (IBM): And how they suggest to do this, for instance, they say, you should early on, negotiate with the reporter on an embargo period because some may not want to even respect any embargo.
Arnaud J Le Hors (IBM): Some will be more tolerant and negotiate with you agree on, you know, giving you some time to try to address the problem before they make it public, and then there are things like when we when we.
Arnaud J Le Hors (IBM): create a CV.
Arnaud J Le Hors (IBM): The recommendation is to offer the reporter to be named deserve that they can they can be involved in the process, creating the CD and be given credit if they choose to.
Arnaud J Le Hors (IBM): And so I think these are like you know small details that i've seen in passing that I think could we could definitely you know get more lineman to because I think alignment on because I don't think that you know, there is any reason not to follow their commanded way basically so.
Tracy Kuhrt: Thanks rob.
Tracy Kuhrt: So you had your hand up did you want a commenter.
Hyperledger Community: Sure, I did make if you look at the history of the page I did make a couple edits to remove some of the stuff that was juror specific but I agree the rewriting of this page and it's implied it's not stated, I think this needs to be rewritten and but that's up that's all I say.
Tracy Kuhrt: Try.
No.
Danno Ferrin: So, to give some more weeks, the need to rewrite some of this let's say hypothetically a maintainer find a bug that was shipped, and that is.
Danno Ferrin: worthy of a CD he boner ability it doesn't really fit well into this process it's all focused on an external bug report doesn't answer key questions such as who do they have a duty to disclose it to before it goes public.
Danno Ferrin: You know what sort of oversight if you're going to make this would be needed, or is there no oversight if it's found within the maintainer is it kept in the 1800s and fixed.
Danno Ferrin: And I think that's actually a weakness that you know if you find something that you feel it's worthy of the of the designation of a security bug.
Danno Ferrin: Reading through this you could in theory keep it entirely internal and never telling you want to just fix it and hope it goes away.
Danno Ferrin: And I don't think that's a good thing, I think there should be some speaking about.
Danno Ferrin: You know what what level is relevant now you know flip below a certain level yeah it's de minimis it doesn't matter just just fix it.
Danno Ferrin: But above a certain level, I think there needs to be some level of oversight and what is that well it's probably going to be a fairly high level.
Danno Ferrin: You know, not just you know something that you know you could, with the right no compound options, you could break something that's not worth it, but if it's only like the results of chain splits it's definitely worthy.
Danno Ferrin: So I think that's Those are some things as we were right that's me to keep in mind.
Tracy Kuhrt: Nathan.
Nathan George: I think that updating this is a really great idea um it also helps protect the Community in case.
Nathan George: One of the partners in the ecosystem doesn't want something disclosed who wants to delay something being disclosed having a favorite and policy, let us follow the policy and keep away from any controversy.
Nathan George: Especially where you know, like the antitrust policy says we are a collection of competitors that are doing different things um I would also like to ask.
Nathan George: Anyone from fabric has hacker one been working out for you, I mean some of the other projects you've done some hacker one and hadn't really gotten a lot of valuable response, I mean we got a lot of like.
Nathan George: Things logged about you know, on a public domain website, we checked your DNS settings and you know stuff like that not we never really saw much substantive response on him.
Nathan George: yeah.
Tracy Kuhrt: And I had that same question on.
Tracy Kuhrt: hacker one I think right had responded in the notes that.
Tracy Kuhrt: There has been some input from everyone, but maybe not not very detailed as far as.
Tracy Kuhrt: what's out there, so that was a concern that I had as well surrounding that.
Tracy Kuhrt: Proposal number two if you will.
Tracy Kuhrt: Dave.
Dave Enyeart: yeah so we've had probably that's a decent number of hacker one reports, most of them have been pretty minor things like people trying to take over the read the Doc site things like that.
Dave Enyeart: So I think it's mostly people trying to cherry pick and find bounties easily.
Dave Enyeart: We haven't had anything to substantial reported, most of us have been through minor things that we didn't think we needed to do CVs for, but I think the process itself has worked out pretty well.
Tracy Kuhrt: Other other comments or thoughts.
Tracy Kuhrt: On on what's been.
Tracy Kuhrt: proposed by Ryan.
Tracy Kuhrt: If not, I feel like maybe where we're at is that we might need to put together a task force for some of these items for this, you know specifics around what it is that we're trying to accomplish with this.
Tracy Kuhrt: You know I think more than any it boils down to what are we doing with the existing.
Tracy Kuhrt: hacker one, what are we doing with the existing.
Tracy Kuhrt: kind of wiki pages that we have what what is the the right process, and so, while I think all the proposals are good at a high level, and maybe it's a question of how do we get to the specifics in the detail behind it.
Hyperledger Community: I agree, and I just want to show this, as this is a recent report for three days ago that came in to illustrate david's point, but this is this is actually a really good example of a valid report that.
Hyperledger Community: In the end, has no value.
Hyperledger Community: I mean it's valid what they're saying, but there's no change in fabric that's needed to to mitigate this so.
Hyperledger Community: And if anyone on the tlc wants to be added to the hacker one program as an observer, I will invite you just let me know.
Tracy Kuhrt: All right, do we have any volunteers to run a task force.
Aruna S M: um I can have a view on this.
Tracy Kuhrt: Okay.
Tracy Kuhrt: anybody else interested in participating on the task force.
Tracy Kuhrt: Is a room know I guess and.
Tracy Kuhrt: get something set up to to run through and walk through the specifics, are there any any kind of comments or thoughts that people would like to add as a task force kicks off on this.
Tracy Kuhrt: There any concerns with the direction that this is headed.
Tracy Kuhrt: Anything that you know people would like to make sure that the task force really takes a look deeper into.
Arnaud J Le Hors (IBM): So i'll be happy to participate Task Force don't I don't know if I is not said anything.
Arnaud J Le Hors (IBM): Because he's you know he thinks he has his stuff he doesn't need to volunteer, but I think you'd be really good to have rial this because he has probably the most you know bang around them how things have been going so far.
Hyperledger Community: i'll be there, I figured that was that was implied but.
Hyperledger Community: there's there's a ton that's that's not captured here.
Hyperledger Community: that these are issues that have been kicking around the tlc for a long time, like we have, I think, two or three projects that have people on the security mailing list.
Hyperledger Community: I think that number is far too low, right now, we have a valid what appears to me to be a valid report of an issue in a project from hacker one.
Hyperledger Community: hacker one only covers fabric, but i'm not going to just delete the response i've been trying to get someone from that project to engage on hacker one.
Hyperledger Community: And I can't I can't get any response, and then we have another issue on the same project that was filed by a member of the Community directly via email that I forwarded to the security list.
Hyperledger Community: and trying to get people to engage is like pulling teeth by policy that's probably easier, honestly, so I think that is missing is like what does the tlc want in terms of membership of the security.
Hyperledger Community: Security team and what does the tlc expect, I mean our outline on hacker one says we will respond within 72 hours or something I think we've missed every one of those deadlines so Nathan.
Nathan George: I think that all sounds like well within the remit of what needs to be addressed, I think refreshing the security mailing list membership.
Nathan George: is probably something we have to do much more frequently than we have and.
Nathan George: i'm not sure if there's a way we can measure some of our response times it feels like we have a few different places where we tell people response times are important on responding to issues on responding to emails and other things.
Nathan George: i'm not sure the current lf analytics lets us measure that sort of a thing, but that that's something that we might be able to.
Nathan George: Help us know when we need to trigger you know, adding or changing membership on some of these.
Nathan George: committees.
Arnaud J Le Hors (IBM): yeah, so I think in terms of you know engagement from the projects we've got to be able to say, look at least for projects that have graduated.
Arnaud J Le Hors (IBM): You must have one of your maintainer is on this list on point you know ready to respond if this concerned your project, I mean if we can't enforce that we might as well go play something else.
Arnaud J Le Hors (IBM): I mean, I know the tsp doesn't have much power in practice, but this seems to be and for those who are not quite.
Arnaud J Le Hors (IBM): Up to date of this and maybe i'm being more sensitive immediately because i'm not engaging in a peer project to the hyper ledger Linux foundation, called the open ssl, which is where this guy 910 prom and.
Arnaud J Le Hors (IBM): But the issue of you know, security and vulnerabilities regarding open source is becoming a major topic of discussion in the industry and around the world governments are taking a very serious look at this so we've got to do our part.
Tracy Kuhrt: yeah definitely I think you know.
Tracy Kuhrt: As Nathan mentioned having this be a remix of the task force makes some sense right as far as, how do we ensure that we're going to get projects involved in and how do we ensure that we're going to get the response times for the security issues.
Tracy Kuhrt: I think all of those sorts of things fall into kind of the the revamp of the security processes that we have in place for for hyper ledger.
Tracy Kuhrt: Alright, so you brought this up, this is just fyi for us as far as the all time minimum time to respond in time to triage that sort of thing.
Hyperledger Community: Right just the question was like.
Hyperledger Community: We don't have, how do we get these statistics we can get some of them from hacker one.
Hyperledger Community: We could get them out of jira but it's not easily available and, beyond that, I think we have to.
Hyperledger Community: we'd have to manually make some csv s.
Hyperledger Community: will publish.
Kamlesh Nagware: This hey Kevin the port.
Kamlesh Nagware: St to any hyper ledger project will cover all liability projects.
Hyperledger Community: This covers all submissions to the hyper ledger program the only funded projects are fabric, IBM it's been a long time, IBM directed funds to hacker one for this program through hyper ledger so hyper ledger has funded this or.
Hyperledger Community: This Program.
Hyperledger Community: We get reports from everything.
Kamlesh Nagware: We get.
Hyperledger Community: We get reports for every Linux foundation project.
Kamlesh Nagware: So what.
Kamlesh Nagware: Was he had a high end so they have anybody in the truth or it got all the project right.
Hyperledger Community: This covers all submissions the only ones that we pay out on our fabric.
Kamlesh Nagware: Oh OK OK OK, and I know this is publicly available or is a you need some credentials to view these reports.
Hyperledger Community: For this report it's not yet publicly available, I guess, we could export the PDF and make that available.
Hyperledger Community: i'll see what I can do in order to make this I don't want to do is publish stuff that's in progress so give me an hour or so and i'll get a version of this either on the wiki or on github one way or the other.
Hyperledger Community: Okay, and I don't know if this URL.
Hyperledger Community: Is publicly available I don't know if you have to be authenticated to see that or, if you have to I don't I don't know, but I will make it available i'll make the data available anyway.
Kamlesh Nagware: yeah.
Kamlesh Nagware: Thank you.
Tracy Kuhrt: alright.
Tracy Kuhrt: Any further discussion on this before we move on to the next topic.
Tracy Kuhrt: Alright, so I reacted the inclusive meaning proposal to this, I wasn't sure whether or not the DCI was that the day after we last talked and what the update or status of that was so I did include it for us to get.
Tracy Kuhrt: More information to see see the outcome and see where we're at with this particular one so grace if you wouldn't mind.
Tracy Kuhrt: just giving us an update on this.
Tracy Kuhrt: grace English is going to be call them, so this might be looking for her me button.
Tracy Kuhrt: She might be able to kill off you Peter we're at the call, but he he working for Paul.
Daniela Barbosa: I was not at the last one.
Peter Somogyvari: Last DCI to a group called.
Tracy Kuhrt: Okay, did you guys make a progress on this particular proposal from the discussion that we had in the last year or.
Peter Somogyvari: Not.
Peter Somogyvari: We were talking about forming task forces within the DCI work group.
Peter Somogyvari: But we haven't yet gotten to the proposal itself.
Peter Somogyvari: The only the announcement that.
Peter Somogyvari: I had an update is.
Peter Somogyvari: That.
Peter Somogyvari: same one that I gave.
Peter Somogyvari: A couple weeks ago, maybe that I have finished.
Peter Somogyvari: The.
Peter Somogyvari: guide for the DC island to sort of there's now a step by step screen cast to deal where.
Peter Somogyvari: People can.
Peter Somogyvari: configure it on their project and pretty much just a few clicks.
Peter Somogyvari: So we will include all in dad in the proposal as well.
Peter Somogyvari: And that that was my update.
Tracy Kuhrt: So it sounds like we haven't moved in from the discussion that we had last week on this particular item.
Tracy Kuhrt: So if that's the case I guess that was the end of the agenda was it not.
Tracy Kuhrt: So there anything else that anybody would like to talk about or cover.
Arnaud J Le Hors (IBM): So.
Arnaud J Le Hors (IBM): At the risk of sounding a bit obsessed with security, no, I just wanted to raise attention to another to another project that's.
Arnaud J Le Hors (IBM): being led by the OSS have and it's called scorecard and they basically are working on developing a tool that allows that provides a way to scan.
Arnaud J Le Hors (IBM): repositories and with a whole bunch of different Yuri sticks, they are trying to assess the level of fun, I mean the risk is you know.
Arnaud J Le Hors (IBM): For vulnerabilities into a repo and it's an interesting tool that is very much in the works, but I encourage people to have a look and try it out against their repo.
Arnaud J Le Hors (IBM): I started doing that and actually found the bug completely unrelated, but it was interesting Nevertheless, we are the weather Shell script that a.
Arnaud J Le Hors (IBM): syntax error in it and and that the program found out but it's not really designed for this it just it just you know showed up in the report and.
Arnaud J Le Hors (IBM): In any case, I think this is the kind of tool that we will be called to use more and more to again improve the security overall of open source projects.
Arnaud J Le Hors (IBM): And so I encourage people to have a look score score calm it's a small program there are different, it comes in different forms.
Arnaud J Le Hors (IBM): This go projects go Lang so you can just grab the source code and compile it but, so there are different binaries available it comes to the.
Arnaud J Le Hors (IBM): docker container and it's a pretty simple setup just basically you can run it locally in a machine just give it the URL of the github repo and it will just spit out.
Arnaud J Le Hors (IBM): A report fairly quickly and it's again, you know it's by no means perfect nobody claims that the days, but they are working on trying to improve it over time and it's better than nothing, and they felt like well we've got to start somewhere so let's do it.
Arnaud J Le Hors (IBM): So.
Tracy Kuhrt: All right, maybe.
Tracy Kuhrt: Maybe add a link to the TC chat on that particular.
sure.
Tracy Kuhrt: tool, so that people can take a look at it.
Arnaud J Le Hors (IBM): yeah yeah absolutely happy to do that.
Tracy Kuhrt: Alright, thanks, and then was that was.
Artem Barger: yeah I was just curious.
Artem Barger: Which language does this to support so it's only for is it only for the Golan so it could be.
Arnaud J Le Hors (IBM): Think, no, no, no, so they are trying to cover as many languages as possible, it does things like Python and Java c++, and again I mean it's very much a work in progress, so they are hiding as we speak, right more and more suited for all sorts of things.
Arnaud J Le Hors (IBM): Put the put the link to the project in the chat.
Arnaud J Le Hors (IBM): And you can start looking at it and get a sense of what it does.
Arnaud J Le Hors (IBM): And it gives a score that's interesting it's not just black no or you know yay or nay it actually tries to give a score with regard to different tips types of tests that they ran, and so it gives your level of.
Arnaud J Le Hors (IBM): Confidence with regard to how good or bad, you are doing.
Arnaud J Le Hors (IBM): And I i'll be honest and transparent when I ran it against the fabric project, it gives us a score of less than five over 10 it was four point, something which okay hope we can improve because that doesn't look too good.
Tracy Kuhrt: Thanks.
Tracy Kuhrt: yeah and one thing that I thought about was the not related to security, but just an update on the task force for the chat.
Tracy Kuhrt: We did have our first meeting yesterday it was quite.
Tracy Kuhrt: Quite a good meeting, where we talked about kind of.
Tracy Kuhrt: requirements that people have for chat system, we talked about things that we think are currently missing from our chat system, we talked about things that are good with our chat system.
Tracy Kuhrt: So I encourage anyone who has some thoughts on you know things they like about what we currently have things they don't like about what we currently have with rocket chat that let the task force know.
Tracy Kuhrt: There is a wiki page that has been created to start to capture that information, but you know if there's if there's the opportunity that you have to.
Tracy Kuhrt: To be to discuss this with other people in the Community and and get their feedback as well.
Tracy Kuhrt: Please do that, I think that the task force is going to try and come to some of the project meetings and have a conversation with with people around.
Tracy Kuhrt: What it is that they they like what it is they don't like so thanks for bringing the the wiki page up this is the wiki page that.
Tracy Kuhrt: Is kind of the start of the discussion we really focused in on question zero but really a question nine with the requirements.
Tracy Kuhrt: That we think should exist and kind of who the audiences are for the different sorts of people who come to to the chat so again, if you have any thoughts or would like to add to this this task force we're meeting again two weeks from yesterday so two weeks from.
Tracy Kuhrt: Wednesday, which I don't know what the date is sometime in December, I believe, so feel free to check that out, I think the invite went out to the tasc may we were so there should be a.
Tracy Kuhrt: link that you can come to and join that particular task force.
Tracy Kuhrt: Anything else that you would like to bring up or discuss.
Tracy Kuhrt: Before I let you have some.
Tracy Kuhrt: very quiet group today.
Tracy Kuhrt: I if there are no other comments, then I will let you go for those in the US enjoy the holiday next week and for everyone, we will see you in two weeks.
Hyperledger Community: Thank you.
Arnaud J Le Hors (IBM): sounds good, thank you.
Dave Enyeart: bye.