Aruna S M: hey good morning and good evening everyone, welcome to hyper ledger.
Aruna S M: Security Task Force or security.
Aruna S M: update Task Force security process update Task Force.
Aruna S M: So quick reminders we will be following antitrust policy, all the meetings and the hyper ledger are our public so just make sure that we respect each other and we.
Aruna S M: I guess it all all the things that you know already.
Aruna S M: And I believe.
Aruna S M: All the people on this call, we know each other.
Aruna S M: So we can probably get started directly.
Aruna S M: So had some agenda items where we get started with discussing what happened in the tsa call on 18th of November.
Aruna S M: Quick replay of what happened that quick recap of let's say summary of that call related to this particular topic and then switch over to any comments that you had on this document that was proposed by right.
Aruna S M: And then switch over to should we ask.
Aruna S M: each project teams on.
Aruna S M: What the process that they currently follow versus the the field, the current process that hyper ledger is making them miss out on certain updates or things like that.
Aruna S M: And then we will eventually end the call with discussing what else do we need as part of the task force and we will discuss on the goals and probably set some deadlines for each of those calls from the task force.
Aruna S M: So.
Aruna S M: With that introduction.
Aruna S M: I will probably so in this meeting i'm just a like an anchor I will be asking more questions.
Aruna S M: And please feel free to stop me if i'm talking more than probably something is going bad in the call that, so I would assume.
Aruna S M: So please stop me.
Aruna S M: Like interrupt me all the time.
Aruna S M: So we'll start with replay of what happened on 18 number TC call.
Aruna S M: know.
Hart Montgomery: they're really talking.
Aruna S M: I thought I was talking I.
Hart Montgomery: couldn't hear you for like 30 seconds I mean either.
Aruna S M: Okay, so I actually passed myself to to hear back from all of you on the notes that occurred in this particular call so i'm.
Aruna S M: Just so if anybody missed on 18th number to call, we had a discussion on this particular topic, where the word suggestions given and we actually reviewed the same link that was shared by right and are now also brought up a point related to open ssl where.
Hart Montgomery: I think you're on the call.
Hart Montgomery: Right now right.
Aruna S M: that's right, I see all the TEAM members on the call.
Aruna S M: i'm correct me if i'm wrong if i'm wrong, so the major things that were bought out in the particular call was I don't think so nothing was precise in such as such that, like nothing was called out as a record for the current process, but things such as.
Aruna S M: The current mailing list has.
Aruna S M: field architect from each project that and if a vulnerability gets reported that gets sent out to each of them.
Aruna S M: Irrespective of whether they're involved in that project or not.
Aruna S M: So that was one of the question that was brought up, and I believe the other question that was brought up was we have multiple forums to report this one taste and.
Aruna S M: There is.
Aruna S M: In terms of disclosure, there is no clear process define right.
Aruna S M: Is there any other major point that time is from the other call.
Arnaud Le Hors: So I think there there's there are several issues, also with regard to identifying all the key points, making sure all the projects have at least one contact person that's on the secret, at least, or whatever we use to get you know to to.
Arnaud Le Hors: route, the the issues to get brought up and.
Arnaud Le Hors: There was the mean to kind of society issue, but you know.
Arnaud Le Hors: Daniel brought up the fact that.
Arnaud Le Hors: The guidelines from open ssl did not seem to specifically address the case of.
Arnaud Le Hors: The contributors to the project being the source of the issue.
Arnaud Le Hors: Or the you know the reporter, I actually brought that up I don't think we have to deal with it it's I actually reported that back to the openness of working group, and I think they will look into it.
Arnaud Le Hors: Like.
Arnaud Le Hors: I wasn't going to try to update the documentation.
Danno Ferrin: I didn't have opened up in mind that was the current hyper ledger security policies but it's interesting to hear that it's also a gap in open ssl.
Arnaud Le Hors: yeah I think it is when I read the documentation and for them, there was, like their reaction was it's the same you use the same process like yeah but it doesn't say that in your documentation.
Arnaud Le Hors: So it will be good to explicitly you know, say that you should treat this thing the same way, which you know, whatever the the reporter is, but so that that's kind of I am just bring it up to try to you know get us all back to where we left this discussion.
Arnaud Le Hors: These are the points that I remember, we talked about.
Arnaud Le Hors: Which page, are you looking at why, when I look at the wiki page.
Ry Jones: If you put in.
Arnaud Le Hors: The right page.
Ry Jones: If you put in edit mode.
Ry Jones: If you edit it you'll see it.
Arnaud Le Hors: Ah.
Arnaud Le Hors: OK, thank you that's it.
Arnaud Le Hors: Any source.
Arnaud Le Hors: Because i'm not logged on but sorry.
Aruna S M: I request you to jump in it's it's for me it would be too much to type on.
Arnaud Le Hors: yeah that's cool thanks.
Aruna S M: hey turn on thanks for bringing that up do you want us to review that right now, or do you think we should review it offline and maybe come back with comments open questions.
Arnaud Le Hors: yeah it doesn't have to be done now, but we just have to keep track of it, so we don't lose those things, not all.
Aruna S M: Now.
Aruna S M: let's set a goal against this particular.
Aruna S M: I don't know why it standing.
like this.
Aruna S M: let's set a goal for.
Aruna S M: reviewing this particular task sorry.
Arnaud Le Hors: yeah I mean it's me add to this that you know open ssf very much eager to get feedback we might have right So when I reported Oh, we have started looking into it and what it means for us it was like Oh, this is great, please let us know you know if there's anything.
Arnaud Le Hors: So there you know, like everybody else, when you produce something you're eager to get feedback and see if it's any useful or not, so they were very you know pete you know that we started looking into it.
Ry Jones: So I don't know if I agree with the assertion from open ssf that it's the same for internal reporters.
Ry Jones: I don't know Dan I was that you brought it up.
Ry Jones: I mean I I think there's some steps steps you can skip but I don't think it's I think it's the same no.
Danno Ferrin: yeah it's not the same because part of the early steps that are in our process are basically negotiating between the recorder, and the team as to whether it's a vulnerability.
Danno Ferrin: um how long to disclose it are they going to fix it, you know that's actually some of the initial things as the debate about well is this actually a vulnerability.
Danno Ferrin: um you know, so if if someone on the team finds it in the Caribbean and CBD worthy I mean that short circuits really quick, so you can argue.
Danno Ferrin: I guess that it's the same process because you're just talking to yourself.
Danno Ferrin: But I think some of the gaps there that are missing that are implicit when you have to reporters is what's the accountability and record ability.
Danno Ferrin: You know I could find vulnerabilities all day and quietly patch them and tell nobody and not make any information that there's systems out there that need to be updated.
Danno Ferrin: So you know part of that is implicit when you have what is essentially an adversarial reporting environment where someone reports it.
Danno Ferrin: And you need a fix it because they're going to release the local a 90 days when you find yourself there's no one sentence release in 90 days, because you're on both sides of the equation, you have a.
Danno Ferrin: You have a conflicting interests there to what fits in to not make a big deal about it.
Danno Ferrin: So I think that's why you really can view, it is the same process, because the incentives are are not the same, the the game theory just doesn't work out on it.
Danno Ferrin: So my main question that process is well if I do find something that I think is CBD where they what reporting to these two I have is you know, should I tell a hyper ledger security.
Danno Ferrin: Because what what's brought this up was I actually have released a CD last Friday I was going to make a bigger deal out of it until the whole lot for jt blue and it's just like Well, this is a climactic.
Danno Ferrin: everyone's can update for that so went ahead and release the CV anyway, but it was basically a minor thing with the vm supposedly minor thing.
Danno Ferrin: It can it can keep you from accepting transactions, if you did apply a patch which in some situations completes the forks and that was why I decided it was CD really but.
Danno Ferrin: This is the sort of the patch that gets has done in the past, the hyperlink the.
Danno Ferrin: Various foundations go client that they fixed in the past, not told anyone and has resulted in chain splits because they have no accountability to report to anyone when they do.
Danno Ferrin: high sensitivity fixes like this, so that's why I feel it should be there should be whenever you.
Danno Ferrin: find something that you feel is a CV ready, that there should be some academy responsibility to have someone else hold you against the clock it's a great you found it will in 90 days we're going to tell the world so.
Arnaud Le Hors: And that's interesting points, I agree.
Hart Montgomery: yeah I mean, I agree with you, Dan about pretty much all that stuff.
Hart Montgomery: And whether something is a is a vulnerability or not is you know.
Hart Montgomery: That can be difficult and people cannot even agree.
Hart Montgomery: So, like we have something.
Hart Montgomery: In earth right now, where some people are saying, like well this might be a vulnerability and other people are saying, like this is not.
Hart Montgomery: This would never have this like model, under which this is a vulnerability would never apply to any of our use cases so so we don't care.
Hart Montgomery: So, so people can't even agree whether it's a vulnerability or not.
Danno Ferrin: right but.
Danno Ferrin: In the system where you have.
Danno Ferrin: One person reporting said hey it's a vulnerability and the maintainer saying it doesn't matter use cases.
Danno Ferrin: The incentive, there is the reporter say all right, we talked to them, they said it's not a vulnerability we're going public and letting the world aside.
Danno Ferrin: So they've done the responsible disclosure that talks to the people I think hey, this is no big deal so, then they you know they released their research on it.
Danno Ferrin: And if it's no big deal a waste of their time if it is a big deal, then you know it's it's out there, but they've tried to disclose that they've tried to get it fixed.
Danno Ferrin: And if they keep it quiet and it is a vulnerability, you know you get some moral arguments that they're just keeping vulnerability secret, you know it's discouraging disclosure so.
Danno Ferrin: That first part of it, the negotiation, if the negotiations break down, then the people who founded on our ability, have full right to just say hey here's how exploited.
Hart Montgomery: But this isn't external negotiations, this is like internal negotiations.
Right.
Danno Ferrin: negotiations.
Danno Ferrin: So, again it's a it's not a vulnerability, then they have the right to.
Hart Montgomery: disclose it publicly yeah it's really more of a well.
Hart Montgomery: it's it's a complicated thing but yeah.
Arnaud Le Hors: yeah but that's what makes this case interesting I think right is that the forcing factor of having some external entity, putting pressure say get better fix it, though i'm going to disclose it and no world will know about it.
Hart Montgomery: Well yeah.
Danno Ferrin: Go ahead, I have.
Hart Montgomery: Some cases the case i'm thinking about it was an external disclosure.
Hart Montgomery: Basically, the, to be precise.
Hart Montgomery: Someone found a like relatively minor bug in the item mix specification.
Hart Montgomery: Until one of the earth implementations closely corresponds to the item specification.
Hart Montgomery: So this is this is actually like a more theoretical issue rather than a like an ursa implementation issue, but the sort of the the way that this has resulted in an attack is like is like very, very.
Hart Montgomery: The.
Hart Montgomery: Some parties that most people would presumed to be trusted in the applications would be the only people that could could mount this attack and so you know sort of changing the protocol to fix it is expensive so we're getting a lot of people that are saying, like Oh, the model is fine.
Hart Montgomery: So.
Danno Ferrin: And with more eyes on it, then.
Danno Ferrin: You know more to decide.
Hart Montgomery: Exactly.
Hart Montgomery: that's what i'm trying to do.
Danno Ferrin: We have a video on this.
Danno Ferrin: And then it can do an informed choice on the risk when it's out so.
Hart Montgomery: yeah.
Danno Ferrin: You know it's not.
Danno Ferrin: A break the world thing, but one of the advantages of having a you know if I think I found a CV and have somebody need to report to internally.
Danno Ferrin: Is I can get the report together, I can get it to them, and they can say Oh, this is nothing you know you really don't need to do a CD you can't be one but we've reviewed it and we think it's nothing that is one of the bands and having a second set of eyes.
Danno Ferrin: So I did do this return review internally with some of the internal base of people they agree that it's probably see the worthy, but that was my question, do I owe a duty high REP to hyper ledger or do I go to keep it within the projects with review.
Danno Ferrin: So.
Danno Ferrin: that's that's that's where the that's been the self reported, you know hold the duty to report in the px turtle visibility, a lot of this when you find your own bugs.
Danno Ferrin: That have shipped and what triggered will be fabolous by was it actually happened in production, one of the test networks i'm.
Danno Ferrin: Passing the value, I mean any blood ship over 256 is pointless it's going to be zeros but, if you will, light it along and 32 byte barrier it causes things before the bug.
Danno Ferrin: Of ridiculously large number that no one in their right mind with us, and so, and actually did that, because it's theory so.
Danno Ferrin: that's how we found in production was it a test that it never made it on the beam that before we fixed it but that's the sort of situation where i'm you know that just just to.
Danno Ferrin: You know extol the virtues of responsible disclosure a small group of people knew how to fix it they went for it, they fixed it.
Danno Ferrin: And they got it out there before people figured out that they could use it on other networks on their basis only networks out there that could have been affected by this.
Danno Ferrin: Their networks were basically, is one of the validators on there and they could have used it to initiate a change split.
Danno Ferrin: So to keep this quiet out there and fix it and have the release out in in production, before you disclose it, I think, is one of the great things about the responsible disclosure processes.
Danno Ferrin: You can say hey we messed up and, by the way, everything's gonna be fine because we fixed it, but I think it's important to have external parties.
Danno Ferrin: To be able to hold them hold their feet, to the fire, just like well, you have this 90 days ago, what have you done.
Aruna S M: I just raised, my hand, so I have a question, maybe to Dan or maybe are not because you're more experienced on.
Aruna S M: In these questions.
Aruna S M: So how do.
Aruna S M: Other projects, they measured the CV scores and cases right, so I guess going back to the destination at heart, or the problem that I thought was bringing up or and Donna was talking about.
Aruna S M: isn't tied covered as part of CVs code that hey, this is a vulnerability, but I mean, even though it occurs in specific instance for this specific case, it still is a vulnerability that can be exploited.
Aruna S M: But the score is low because of certain conditions that is only going to happen under these conditions right.
Aruna S M: Any info on how does that get measured with other projects.
Aruna S M: Hello.
Hart Montgomery: yeah so.
Hart Montgomery: Go ahead.
Hart Montgomery: Or, no one is saying anything so Can you clarify your question a little bit sorry.
Danno Ferrin: i'm sorry.
Aruna S M: Okay i'll repeat my question, so I guess if I didn't understand the question wrong like what you're suggesting is there could be few, so I think the first issue is whether we qualify an issue as vulnerability or it's just a bug not exist in the code right, and the second question.
Aruna S M: Second part of that is.
Aruna S M: Even if we want to qualify it as an ability.
Aruna S M: Even though the chances of exploiting that particular thing is let's say very minimal.
Aruna S M: isn't it supposed to consider that.
Aruna S M: As a vulnerability and maybe measure it with certain score saying that hey this CV is has the score because it can only be exploited under these conditions.
Danno Ferrin: Oh, I could talk about what I did for this recent example, if I could get the share screen, I can show you the.
Danno Ferrin: editor side.
Danno Ferrin: Of what one of these.
Danno Ferrin: Issues look like, and this is the added no this isn't submitting the victory get just the right screen share.
Danno Ferrin: So this is that when you do a security vulnerability inside of github it's really slick, what are the things that has it fill out is what we've been talking about this CVs escorting and you can go open like Lincoln new tab I think there is a.
Danno Ferrin: there's a user guide give you descriptions about it and businesses to be linked to an online score.
Danno Ferrin: I may have done a Google search for an online scoring thing so when you're considering making a CV I agree with the room that this is the important step.
Danno Ferrin: Is you need to score and figure out what the impacts our and our score on this was 7.5 so it was high because was high as the point that I said, we probably need to do a CV it's not the 10 point over the.
Danno Ferrin: Was, thank goodness, but still on a determined attacker could construct something and the right situation, the cause significant problems in the block chain network, I think the worst thing that can happen to the blockchain number because before.
Danno Ferrin: were two people disagree on consensus it's.
Danno Ferrin: Basically, a consensus break, so the whole point of a blockchain is consensus so given those things twice decided, you know there's a way to cause consensus break with this that we should go with it.
Danno Ferrin: yeah this will last few you know what's the name of that your package and what's really fun is when you put these numbers in.
Danno Ferrin: The dependable will actually pick these up and update it for you and note that if if anyone's using basically 2110 or 21 to 10 zero 2110 one.
Danno Ferrin: That they will you know say hey you need auto updates This is like some really slick stuff with github integration.
Danno Ferrin: And that's also more motivation to do the CD so that your downstream users can get the update.
Danno Ferrin: And then you got three of us do you have an existing CB it i'm actually requested wanted to put it in here, so if you're ready to have one.
Danno Ferrin: And these common weakness enumerators I think it was just an integer corps and I think, is the only one, I put on it.
Danno Ferrin: because all the other failures drew from that signed or unsigned breakage then, then you just write up your description of the patch and it gives you a template and then you post it if someone else found it, you can post it there, so yeah that's you know.
Danno Ferrin: Some of the process of reporting it, but this right here, if you come up here and you get a low you know you should go back to the people you're working with and say is this really something worth discussing you know.
Danno Ferrin: So i'm done sharing right could probably put the notes back up.
Danno Ferrin: How far Am I taking us down this rabbit hole totally off the.
Danno Ferrin: Agenda
Aruna S M: Oh, that.
Aruna S M: We are still on the agenda, I guess, we are in.
Aruna S M: It gets me reviewed.
Aruna S M: What happened in the DC call, and then we were supposed to review the document from right and then probably talk about the Serbian feedback but it's fine, we can talk about it.
Aruna S M: We are under.
Danno Ferrin: yeah, so we should probably get back on the agenda, I think, just what that was using what when we went with base was an example of where we could.
Danno Ferrin: You know model changes, we might need in the security process, but I think rise Doc has some good reviews, for us, and I do have some questions about all star but.
Aruna S M: Probably.
Aruna S M: OK we'll we'll come back to taking feedback from project teams and what has been working well for different projects and.
Aruna S M: let's also keep noting down all the solutions and to address comments let's quickly talk about this proposal letter I had this particular document that I had created for us.
Ry Jones: sure.
Ry Jones: keep in mind that when I I wrote this up.
Ry Jones: My expectation was that the tlc was going to.
Ry Jones: come in and.
Ry Jones: And you know.
Ry Jones: Essentially rewrite this or code apart, I was surprised that didn't happen like before it got to the stage so.
Ry Jones: I don't take it personally if if you know, everybody wants to rewrite it or whatever i'm fine with that that's.
Ry Jones: One thing that I had hoped to happen, and I see that.
Ry Jones: I see that cam from Cuba has joined and I know that camera has been.
Ry Jones: trying to get some work done through the through our security process so.
Ry Jones: I should need feedback that you might have on that.
Cam Parra | kiva.org: yeah I guess it's a read the old spec of what was there and.
Cam Parra | kiva.org: it's very vague and I guess it doesn't have things like you know, like added to github issues for the repo so.
Cam Parra | kiva.org: there's no way to like follow through or follow up, I guess, with with the maintainer of the repo and so yeah so, is it is kind of a a yeah there's much updating that needs to be done, I guess.
Cam Parra | kiva.org: But I know that the process is working, because the right has contacted me and has let me know that you know, or that the the person who who needed to get it is in the process is involved as well.
Cam Parra | kiva.org: But yeah not not not not the easiest process right now and that's us reporting a reporting issues that were found through a paid audit.
Cam Parra | kiva.org: yeah I guess an internal audit of our code base that included the Open Source projects and.
Cam Parra | kiva.org: Both of them being the.net areas agent and the.
Cam Parra | kiva.org: Areas cloud agent in Python.
Aruna S M: thanks for the feedback.
Aruna S M: Right, would you like to continue on this proposal.
Ry Jones: Sure, I guess what's what is to continue on it, though, so we have I put for proposals forward.
Ry Jones: And we can either go down the list or.
Ry Jones: How would you, but I had these are in no particular order.
Ry Jones: We could use.
Ry Jones: I think these are decompose level.
Ry Jones: Like the only one that is like three and four would, for I say for some projects, you should turn a assured into a must.
Ry Jones: But I think, in particular, I feel the proposal to.
Ry Jones: The Governing Board should fund.
Ry Jones: hacker one.
Ry Jones: fabric currently has directed funds.
Ry Jones: I don't remember the number off top my head, such that we can award bounties on hacker one I think if we're going to use hacker one I think all the other programs should be involved there and that might help remove some of the tension between.
Ry Jones: Is this a.
Ry Jones: You know.
Ry Jones: Does someone who's a it I think it's not very contentious that if you are running one of the dlc projects, you should have someone on the security list, but if the example toys uses does explorer need someone there and we were internally having this discussion around.
firefly and cactus.
Ry Jones: Are do those new projects i'm sorry I said firefly a cactus what I meant was a firefly and bevel do those two projects require security audits does hyper ledger need to spend money to get security audits done on those.
Ry Jones: i'm not sure.
Ry Jones: So I we can discuss these in any order, but I think like the second one should be I feel should be non controversial, but I don't know.
Aruna S M: I have a question.
Aruna S M: For that, I guess, one of the question that was raised was.
Aruna S M: How do we figure out if the issue that was reported, is it can be qualified as a vulnerability.
Aruna S M: So if anybody's really.
Ry Jones: I think that what Daniel had you know showed before is the CBS s score right, I mean that's if a lot of the vulnerabilities that we get quote vulnerabilities unquote the weekly reports are not.
Ry Jones: Their DNS errors or something of that nature they're they're not interesting every once in a while we get something that's obviously a bug.
Ry Jones: But doesn't seem like a security vulnerability.
Ry Jones: I think if we had a tool, like the CSS score that the DEMO had linked to before.
Ry Jones: That might be a good model to use, I know, Daniel, how do you feel about that tool.
Danno Ferrin: So it's basically a survey you click the buttons you like, and you get the number at the end, the real back and forth comes into saying well, is this really require user interaction is this really network exploitable, is it really you know, causing data data leakage so um.
Danno Ferrin: And I think those should be part of you know any report coming in, but at the same time, the people receiving the report should feel free to.
Danno Ferrin: view those claims of skepticism and require evidence, maybe not evidence, but you know a little bit more justification oh yeah it's totally a 10 RC Bud will show me how.
Danno Ferrin: You know, an RC really requires a proof of exploit, in my opinion, but you can still have a pretty severe bug without proof of exploit if you have a good explanation of what's going on, so you know the seat CSS CSS score is good, but you know we shouldn't presume that the Finder is.
Danno Ferrin: entirely accurate and their understanding, because there's also you know, one of the problems with hacker one.
Danno Ferrin: Is you added a new incentive in that there is a reward for finding books, so you give an incentive to the Finder to inflate their score if you put a high barrier, you know it has to be higher higher.
Danno Ferrin: than they're going to push buttons to make sure the score jumps up the high so there's there's some big things there, but on the other hand, with the incentive for money.
Danno Ferrin: you're increasing the likelihood that the number of actual vulnerabilities that meet your standards you'll get will increase so.
Danno Ferrin: I like using the score is like some initial filter if they can make a coherent argument why it's a high, but.
Danno Ferrin: Then it's worth looking at if they can't make a coherent argument with the incentive, then I think it's a pretty solid justification to say we're not even going to spend our time on it.
Hart Montgomery: yeah oh sorry I don't know if we're if we have enough people to do hand raising.
Hart Montgomery: I think this kind of score thing is a good filter but it's definitely not sort of the bl to end all it.
Hart Montgomery: Particularly a lot of these score based things are very traditional.
Hart Montgomery: Security metrics and they don't necessarily.
Hart Montgomery: take into account the modeling or the ease of actually.
Hart Montgomery: triggering the bug I guess.
Hart Montgomery: So you know.
Hart Montgomery: The example I have in my mind is like you know if if there's a system where the consensus algorithm is purportedly secure if two thirds of the parties are honest.
Hart Montgomery: But you know someone comes up with an attack that breaks the system with you know, a quarter malicious parties.
Hart Montgomery: What do you do with that right, you know, ostensibly it it breaks everything but the assumptions for mounting the attacker are quite high.
Hart Montgomery: And this is the kind of thing that I did I think a lot of these security questionnaires don't handle really well and and you know this is this is also really subjective thing right.
Hart Montgomery: So it's I think these these questionnaire things are good for sort of a first filter and I think that's what Diana was proposing great.
Aruna S M: Proposing.
Aruna S M: A.
Aruna S M: Two step process of.
Aruna S M: A project team, then, that the question of other project team is working like is expected to.
Aruna S M: let's say, are we proposing up mechanical don't wear a project teams get notified about this, but along with them somebody else also get notified as a third party who would follow up with project teams in case of.
Aruna S M: Some conflicts.
Hart Montgomery: So that wasn't entirely clear to me in terms of the proposal like danna what sort of third party, do you want notified.
Danno Ferrin: um so like there was a security alias for hyper ledger maybe some other projects, maybe.
Danno Ferrin: And I think there should be at least one person notified outside of the project that.
Danno Ferrin: I mean that's that's the dilemma, I mean, because we need to get volunteers again want to be participants in the process to say i'm willing to you know release this and 90 days if you're not doing the right thing.
Danno Ferrin: And I don't have a I guess I don't have a firm recommendation on that, but it just doesn't feel right that a project can find an exploit and their projects quietly fix it and not have to tell anyone unless they feel like telling anyone.
Danno Ferrin: And that's The thing is guilty and sounds don't line so be nice it projects that want to notify people have some notification quest can say hey here's a cbe coming up, please make sure we do the right thing or tell us that we're overreacting so.
Hart Montgomery: yeah I mean I guess the tricky part, then, is you want someone that's familiar enough with a project that they can sort of have some intuition about the security of but have a vulnerability right but also distant enough, whether or not they're not gonna you know.
Hart Montgomery: I don't want to say cover for the project but they're not gonna you know, say, like you know what i'll be.
Danno Ferrin: Covering or having the appearance of covering, for example, this is above that covers the theory of maintenance, you can argue that holding ether.
Hart Montgomery: Is a conflict of interest yeah definitely working for census or the theory foundations, a compound.
Hart Montgomery: interest.
Danno Ferrin: Absolutely so whether or not there really is a conflict, the appearance of conflict is really what's important, so if there's some third party like I could ask the the ursa people or I could ask the pattern people to say hey he did give us a once over.
Hart Montgomery: yeah.
Hart Montgomery: yeah no I think you're totally right I just don't know the look I don't know how to handle the logistics with this.
Danno Ferrin: it's almost like we need a volunteer review team, but then we're asking for more volunteers and that of the compensation reward which is you know.
Danno Ferrin: If there's no incentive to do the job.
Danno Ferrin: it's really hard to get volunteers to do the job right.
Hart Montgomery: yeah I mean the.
Arnaud Le Hors: The risk is, if you.
Hart Montgomery: Try go ahead.
Arnaud Le Hors: We used to have the security maven who could have played that role, but nowadays with that I I just I understand where you're coming from that oh I just don't know that we have the resources to make that to implement that role.
Danno Ferrin: yeah I agree.
Aruna S M: Do you think we should include somebody who raises, because if they are going to raise this particular issue as a vulnerability, maybe they have a way to reproduce it or maybe they have gone depth into some of it, do you think we should.
Aruna S M: Probably just make them a third party.
Aruna S M: And if project teams have a concern for that let's say let's say the discussion between the project team and the reporter.
Aruna S M: And then, in case of conflicts, then project team can request somebody outside of the project on case basis to be involved.
Danno Ferrin: But I think, in most cases we're going to get a good vulnerability on their security researchers who.
Danno Ferrin: You know their their careers are based off of finding these vulnerabilities and getting them fixed properly, so if we're getting good report from a good person they fit that role.
Danno Ferrin: Of the adversarial party who's going to hold your feet, to the fire until you do the right thing, because it's their incentives are aligned, but you know when you find it yourself your incentives are all crossfire.
Danno Ferrin: Try to force that into doesn't really work that well.
Danno Ferrin: So I don't know the person, instead of just going to have the intended effect and i'm actually concerned about have.
Danno Ferrin: Negative counter effects so maybe we just need a statement of ethics, where do you find your own bug rather than a required process that, by the way you have to tell the hyper ledger security maven.
Danno Ferrin: And they're going to put a $20,000 bounty on if you don't to release your fix in 90 days you know I don't think that that's necessarily the right solution but.
Danno Ferrin: You know, we need at least some expectation, when you find it yourself that you know here's what you should consider as you do it yeah.
Hart Montgomery: yeah I guess in your your point is that, like you know also that, if we look around the the general block chain space like lots of other groups are not really doing this right either.
Danno Ferrin: know, and you know, even though I would consider the hyper ledger group enterprise deal t's and multi party systems be distinct from what people say blockchain they took pictures is defined indexes and you know.
Danno Ferrin: sure.
Danno Ferrin: doggy anoints flippin set so she's but and it's honestly it's because of that association why I think we have the very least need a checklist of so you found your own security vulnerability here's what you should consider who you should consider contacting.
Hart Montgomery: yeah.
Danno Ferrin: And I think that's probably given incentives and the risk of the incentives going crazy.
Danno Ferrin: is probably the best thing we should do is, we should just agree on here's a list of what you should consider what you should ask so when the reporter from coin Telegraph comes and asks you what What did you do, you can say, well, this is what we did.
Hart Montgomery: yeah that's.
Hart Montgomery: I agree with you 100% in principle, I mean the question is just how do we, how can we make the logistics work here.
Danno Ferrin: Right so.
Danno Ferrin: I think we just need a checklist for the first half of the security process so you've Andrew on bug.
Danno Ferrin: there's two entry paths one is an external recorder, and the other is the founder yourself and eventually they're going to merge, because when you decided to fix is going to be done in a CD he needs to be posted is essentially the same process, from that point forward.
Arnaud Le Hors: Yes.
Arnaud Le Hors: So my thought is that Okay, given that we don't have like a secret email and somebody who can actively be involved the closest to the ideal, we can probably debt is.
Arnaud Le Hors: have some kind of process that establish a record, so that they can be basically we're implementing some audio stability mechanism and.
Arnaud Le Hors: it's it's there's still the problem that if people just decide to keep it silent entirety well I think we're out of luck, but that would be true anyway, even if we had a security maven on point.
Arnaud Le Hors: If they never mentioned it, the security may have, and then it gets aware, we can they expect the security that you look into every project be on the lookout for anything coming up so there's still this responsibility to rely on that somehow people are going to report.
Arnaud Le Hors: But at least when it comes to the you know once it's reported somehow once it, you know we can have auditor be like a trace of good they've done about it, they can be documented, we can have a process that you know clearly step.
Arnaud Le Hors: gives instructions on how to document what they've done about it.
Arnaud Le Hors: So that again, we can have a trace and and the we can audit what they've done.
Arnaud Le Hors: not ideal, but.
Arnaud Le Hors: Maybe the best we can do practically speaking.
Danno Ferrin: satisfy my concerns with this, as we can get this audit ability.
Danno Ferrin: Is I mean there's great examples of where in the block chain space, and I speak of the coin type people where they found their own thoughts and fixed it and as close to it, I think, probably the most biggest one would be when.
Danno Ferrin: The ck electric when company had one in there and there's zero knowledge coin that was very foundational and they kept it quiet for like months until they got fixed up.
Danno Ferrin: But they documented it and they released it and I think whatever checklist we have it, we should model toward success stories, like that to where either we went through it decided wasn't bad and here's the stuff of go through to prove it.
Danno Ferrin: Then you stash that file somewhere have put.
Danno Ferrin: The hash on some change somewhere, so you can come out and say, well, we thought about it, we looked at it, this is what we thought so you have some.
Danno Ferrin: Proof that you tried to do the right thing to the best of your ability and I think the the.
Danno Ferrin: The cases where you think you have a vulnerability, but you don't I think you're the stickiest once because you need a you know log Assad have the ability, because what if your analysis wasn't strong enough because you're not.
Danno Ferrin: You know security researchers have a mindset that's very different from a builder so it's totally understandable why you would think of the right way to bridge.
Aruna S M: That okay what I apologize I don't know at least I haven't heard back.
Aruna S M: Any issues that I sent to security mailing tread.
Hart Montgomery: what's the I guess.
Hart Montgomery: How are we going to.
Hart Montgomery: So it seems like everybody here wants said it says, the proposed solution should be some kind of audit ability right.
Hart Montgomery: Do you want any system for that, besides the list.
Cam Parra | kiva.org: So my question is with github issues, does it report privately to the maintainer of that repo.
Hart Montgomery: yeah but the data point is that it should report to someone who's not in the project.
Cam Parra | kiva.org: Right yeah anyone to your draft CDs.
Danno Ferrin: You can have anyone on github geographies So if I was if I was doubtful about whether or not I should do this I can totally add I mean.
Danno Ferrin: I think Ryan was on this moment I opened it you got to see the number he knew about it.
Danno Ferrin: But if we have some other designated you know parties that are listed needed to know what we consider these or we escalate it and you ask versus you know I asked her to look it over I can add him to this.
Danno Ferrin: And i'm wondering if we could just have a close draft serve as our audit ability went through it we discussed it there's discussion thread in there, the decision was not to make the review public, but you still have it in there as record.
Danno Ferrin: And you can show who was looked into it and who did look into it so.
Danno Ferrin: You know I think you know my concern of using the existing security list is that's where like three quarters of my spam emails come from right now, so I the email list I i'm skeptical of its future value because it's been out there for so long, and you know there's so many.
Danno Ferrin: crazy things that come through there that I just.
Danno Ferrin: So it's hard for me to take you seriously I.
Ry Jones: thought I had resolved that.
Ry Jones: particular point, because it used to be a reflector it's no longer a reflector and I personally gate all the email.
Ry Jones: From non subscribers to the security mailing list, like, I have to go in and click a button and say, yes, allow this to be published so if you're still getting spam from there i'd like to know how you can tell me privately.
Danno Ferrin: Okay, I haven't checked in the past month I just checked my spam and it's much better now.
Danno Ferrin: So that that resolves my issue with the mailing list we can use the mailing list now, it looks more functional.
Ry Jones: i'll share my screen just for a second here.
Ry Jones: So this doesn't have anything for the security list, but like this is the last day or two of blocked messages that were obviously spam.
Ry Jones: But every every.
Ry Jones: Post from a non.
Ry Jones: Non subscriber ends up here and I have to click the approved button so.
Danno Ferrin: it's going to be at this point, give me one subscribers.
Danno Ferrin: We sent it to the invite only list actually helps a lot.
Aruna S M: They I believe there is an option to default report.
Cam Parra | kiva.org: To everyone and.
Aruna S M: If they're members that way, even if you own and delete anything, it still gets reported on his accent to others.
Cam Parra | kiva.org: This might not be crazy but well if we make the mailing list a github account and we add it to the issues that are reported and that that that email that goes out when are issues reported is also sent to the to this security list.
Ry Jones: I i'm not against that I need to think about how exactly to implement it, because the reason that.
Ry Jones: I got the email is because i'm an owner.
Ry Jones: Of github of the github org and then it was pointed out to me by someone last week that.
Ry Jones: They couldn't see the dependency issues I looked into it, you can add specific non owner accounts to repose.
Ry Jones: To get alerted of all security issues, I know i'm not sure that that's the right way to do it because dependable is very spammy.
Ry Jones: So let me look into that.
Aruna S M: So thanks for the great input, given the time like we are approaching towards the committee of this meeting.
Aruna S M: Maybe it's better if we can try the rest of the agenda items and i'm sure we can have a few more calls on this task force.
Aruna S M: To address some of the open items that we had in this call, and also bring up new points and feel free to add your comments and offline as well, so that we can keep discussing that and that's I would strongly encourage that we keep this conversation going on.
Aruna S M: I would like to quickly start summarizing and probably going towards next session items.
Aruna S M: And since we kind of covered survey and feedback, I will keep that meeting item sorry the particular agenda item in next meeting as well, will again review and receive feedback from other projects as they come in.
Aruna S M: So on the frequency and the period of Task Force for this particular task depending on goals and.
Aruna S M: The open items that we have we can determined so let's quickly jump onto goals for now, so I know we have to give.
Aruna S M: One of the feedback to open ssf itself.
Aruna S M: On what are we recommending to within hyper ledger foundation and what guidelines are we following, but I believe from through through this suggestions that we received today, some of them are needed to be addressed right there was one checklist that was brought up.
Aruna S M: So i'll probably put that as one of the action items that we start adding comments or points towards that in there was.
Aruna S M: One survey link that maybe Donna, if you can get started on that, on the show that you just showed us of reporting, or maybe getting the score that will be another action item.
Danno Ferrin: yeah so no that's right but write that down.
Aruna S M: And I don't think asking to gardening board is the right step as of now so it's it's an action item for show, but maybe not an immediate action item that we need to work on it's just one of the proposal.
Arnaud Le Hors: Now, do you want to write in a question on the hacker one.
Arnaud Le Hors: stuff from in as that shown to be a useful thing to do.
Ry Jones: I have strong personal feelings about it and I don't want to let my feelings color my statements about it.
Ry Jones: So i'm going to say that there have been valid reports through it.
Ry Jones: fabric funded it.
Ry Jones: there's still money in it, I don't know if we want to close it down.
Ry Jones: But if we're not going to close it down, I think it would make sense to have more people put eyeballs on it.
Arnaud Le Hors: Okay.
Arnaud Le Hors: I agree with your general practice that if we do it if we think it's valuable probably expanding it to.
Arnaud Le Hors: Other projects would make sense I questioning within this is the really were getting what you know.
Arnaud Le Hors: Whether it's for the money.
Ry Jones: Well it's i'm trying to remember the the pithy name for it but they're.
Ry Jones: There it's basically mostly people begging for $100 right.
Ry Jones: There they run an automated tool they find a header missing in a website, which is out of balance.
Ry Jones: They file a ticket as a complete severity total compromise blah blah blah.
Ry Jones: It isn't I close it, and then they keep saying where's my money where's my money, and then I block them as a spammer that's like.
Ry Jones: 95% of my interaction with everyone is just blocking.
These.
Ry Jones: beggars basically they're begging for $100 so.
Arnaud Le Hors: I think we're starting to get a sense of what your feelings are, but this.
Ry Jones: Yes.
Arnaud Le Hors: it's Okay, so I question based on this one thing you know, maybe this is the case where we shouldn't actually shut it down rather than expected yeah.
Arnaud Le Hors: let's not get everybody's problems if it's already a problem.
Arnaud Le Hors: it's going to increase this kind of activity you're dealing with.
Ry Jones: I guess my other motivation, there is.
Ry Jones: We are you get a bunch of those reports for other projects like in the last month or so there's been a guy has been very diligently filing reports on.
Ry Jones: he's been going through go and finding any modules that no longer exists on github and registering those modules.
Ry Jones: Is that a vulnerability, I mean yes technically.
Ry Jones: But most of them are not even that high quality so.
Ry Jones: If it's gonna it's going to exist, everyone should do it it's not going to exist, we need to pull the plug.
Aruna S M: You think maybe the CV scores sorry the score could help us determine which of them qualify for a bounty program versus which of them will not.
Arnaud Le Hors: and
Arnaud Le Hors: It does, but it still.
Arnaud Le Hors: requires.
Ry Jones: The other reason.
Arnaud Le Hors: Why we doubt the crap.
Now.
Ry Jones: So the my my feelings your complex like if someone wanted to report a security vulnerability against fabric The thing is, we told them.
Ry Jones: Go get an ID go set up a jira account go file a bug in a very specific technical way there's a total pain in the butt blah blah blah it's terrible is hacker one better than that probably it's easier.
Ry Jones: So that's where my attention to my feeling is so just saying shut it down it's terrible nobody use it.
Ry Jones: What we're offering them we're telling people to use is is just as terrible in a different way.
Hart Montgomery: So basically you're saying on one hand we have a high friction system that discourages people from filing and on the other hand, we have a low friction system that encourages a lot of bogus reporting.
Cam Parra | kiva.org: Well, I think you want to fix your for the first.
Cam Parra | kiva.org: One of the mentors because what you're going to get most out of is all the different companies doing independent artists and sending in their their findings, instead of, and those are probably you know more real than than what you're going to get on hacker one.
Hart Montgomery: i'm actually with Peter, I have to drop for the next meeting.
Cam Parra | kiva.org: yeah I have to drop as well yeah.
Hart Montgomery: Sorry, everyone, and thanks, a lot of rude.
Aruna S M: Thank you all, I guess, we will also probably close on this meeting i'll send a meeting minutes to the mailing list as well, so.
Aruna S M: I guess the last question is when are we going to call me again.
Aruna S M: Do you think first week of June is a good time because last two weeks in December I don't think so, there are going to be any meetings.
Hart Montgomery: yeah that's.
Good.
Arnaud Le Hors: So.
Aruna S M: Thank you i'll send another email i'll send meeting manage to the mailing list so that we can also update later, thank you.
Arnaud Le Hors: Thank you.
Thanks.
Aruna S M: bye.