Aruna S M: Good morning, good afternoon or good evening everyone, welcome to the next, the second meeting of hyper ledger process security of a task force and.
Aruna S M: As a note all hyper ledger meetings as part of open source community, we are advised to follow antitrust policy notaries and I see all the familiar Members on this call, so I hope you're all aware about it.
Aruna S M: And we'll get started with today's agenda so mainly we have two topics to be discussed a.
Aruna S M: Continuation of what we had in the initial call some time ago late last year.
Aruna S M: and
Aruna S M: And before that I see any new members on the call I see make joining me.
Aruna S M: To say oh.
Ry Jones: I haven't seen you, since a things very good to see you.
Mic Bowman: It has been a while.
Aruna S M: or some.
Aruna S M: So we'll get started with today's agenda so.
Aruna S M: The first topic for today would be Donna will go over our focus over a recent issue like was filed on base so and then he will also explain.
Aruna S M: go through the forms that he had to fill in which rated on that particular vulnerability K, with some score so we'll work on that So do you know.
Danno Ferrin: Okay, let me share my.
Danno Ferrin: web browser.
Danno Ferrin: So the vulnerability that we found a couple of months ago, I think it was December.
Danno Ferrin: To do with published in December, so we founded in November, so I was doing some optimizations for the vm.
Danno Ferrin: And I was messing with one things I was messing us, but this was the shift operations.
Danno Ferrin: And the past all the reference tests, they have a set of reference test that theory and foundation runs they test, a lot of error cases and a lot of boundary conditions, so I have pretty high confidence that it was still going to work that wasn't causing the problems.
Danno Ferrin: Because we had all the tests, so I went ahead and published it we shipped it and then about a month later on.
Danno Ferrin: One of the test net the theory i'm runs I think it was a recap be.
Danno Ferrin: We fell out of consensus we basically got a block that everyone else accepted and we rejected because we came to a different conclusion as to what ABM execution for that should have been.
Danno Ferrin: So I spent some time this isn't the first time i've had a debug on a consensus failure, the first time that distracted my fault, which was a fun discovery, but it was mystifying to me why it was initially, and it has to do with this this shift operator.
Danno Ferrin: The tests were testing unlimited based on 256 bits but the actual bug itself was when we cast it to 32 bit signed integers it should have been cast with 32 bit unsigned integer which was not a test case that the reference desk for testing.
Danno Ferrin: So.
Danno Ferrin: When we look at this, you know I thought about it from alpha you know what if somebody deliberately because we've seen this before and if there.
Danno Ferrin: If a client has a vulnerability and it's consensus a bad actors can use it to split networks if we were because recovery is only run by get but if this was ungodly.
Danno Ferrin: And there was a block that was had this error, where we're basing was one of the validators and nevermind and gas and open a theory for the other validators if these validators.
Danno Ferrin: If one of them fell out of line, then it could cause the possibly the whole chain to halt if one validator was refusing to validate.
Danno Ferrin: The chain, the rest of the validators were working so it's a very explainable way to bring a change to a halt, if it's deliberate plan.
Danno Ferrin: So in doing the writing this up one of the questions that has up when you do a new vulnerability i'll go ahead and go to the edit mode.
Danno Ferrin: It asks you a bunch of questions and one of the questions is well what you see the score, and this is actually.
Danno Ferrin: What I went through this process when I thought about filling it out what I decided to escalate it to the level of something that required a C D.
Danno Ferrin: And this is a common set of scoring rules that they have for their something that you can do if it's bad to your software will how bad is it, they have a calculator here on github when you fill it out, but I like better the one on first.org.
Danno Ferrin: The 3.0 calculator, and the reason is so let's go ahead and start this out fresh.
Danno Ferrin: It gives you the same things you can put in values it tells you how bad you are click all the fart things on the left.
Danno Ferrin: get a full score it's going to tell us the score zero you can't do anything, then you know there's no vulnerability and it gives you the Nice summary string here.
Danno Ferrin: That you can then paste into this field, it will calculate it for you, but what I like about it is, if you mouse over it it'll tell you.
Danno Ferrin: The definitions of what these values are you know, is it network Jason local physical and it gives you the details, you know you need physical access to the computers.
Danno Ferrin: You need to be on the local network, you need to be next door to it, or in the case of this you just need to be on the same network, so you click network what's the complexity it's low someone wrote a dumb contract just need to.
Danno Ferrin: Read redeploy it and run certain things.
Danno Ferrin: The one that gets it had no it's some of these contracts it's high complexity until someone shows you how to do, and then you just copy it.
Danno Ferrin: And there's no privileges required no user interaction no scope no confidentiality what was what was the thing about oh availability.
Danno Ferrin: So availability just clicking this instantly brings up to 7.5 now availability is on none there's no impact on the availability when the impact components there's reduced performance but I read it at high because use this.
Danno Ferrin: And it's trimming it off on us on the right side, so you can see it.
Danno Ferrin: So with high vulnerability availability you do this exploit you can possibly bring a network down and the correct configuration, I mean maybe that's to bring it down like a little bit of a high complexity.
Danno Ferrin: But people you know it's not I considered rate is low complexity to cause problems because the very least, it brings your node servicing the network down, which also breaks the availability.
Danno Ferrin: So from this you get a vector string, and this is what drove me to to go ahead and say, this is a CV worthy bug.
Danno Ferrin: i've written many bugs in base two, but this, I think this is the first one that elevated to the level of we needed to get a CV number for it.
Danno Ferrin: And I just you know I want to say that process reporting security and get hub is amazingly easy on you fill out these things it'll give this number gh SA this completely opaque number for you.
Danno Ferrin: And this is, I have a CV number, but when you're filling it out, you can say I don't have a CV number, please issue it to be.
Danno Ferrin: So github will get to see the number for you, you don't have to have any accounts with mitre or any high level security clearance or any of the other.
Danno Ferrin: Things to get at it, and so you can get a CV number, and of course the most important part of any security vulnerability.
Danno Ferrin: Is you need to describe what's vulnerable and how you can exploit it, and this is just a standard old markdown.
Danno Ferrin: thing to fill out so in here I described what you would need to do, and the impact and why why this rates as a high, as opposed to 5.9 medium that we probably could just quietly fix and say, please don't use the old versions.
Danno Ferrin: um another cool thing about this is, you can also get related patches for it now because it's the theorem way.
Danno Ferrin: The actual fix for this went in differently i'm.
Danno Ferrin: Back ledger based to.
Danno Ferrin: pull request, this will be back in December pull request to be on pace to log.
Danno Ferrin: In this is very traditional way for any theory, implying to fix things.
Danno Ferrin: You quietly put the fix and you ship it when you get enough saturation that he said Oh, by the way, that fix was a horrible security but, but now, nobody can explain it because we have enough.
Danno Ferrin: People using it.
Danno Ferrin: was even there's actually November.
Danno Ferrin: Looking for my picture.
Danno Ferrin: To 10 three snapshot.
Danno Ferrin: To tentatively there we go shift optimization so here is that fix that went out.
Danno Ferrin: And readership calculations, that we have an actual result, and this is your classic one line fix that gets rid of the bug.
Danno Ferrin: And we clicked it under the cover of an optimization because that's what caused the bug so we just go back and fix the optimization and why did this get the red X on it, because we have sonar cloud yeah we had some turned on.
Danno Ferrin: Because we didn't have enough code coverage, but we didn't have any bugs okay we're good.
Danno Ferrin: which the code coverage is actually good good point because later on, as part of the vulnerability, when you do these vulnerabilities it opens up a new workspace for you and I can't get at it now because i've submitted and closed it.
Danno Ferrin: But let's see this purity advisory should show up in the change log, but you can also put your proof proof of fixing it as well, and in this commit um.
Danno Ferrin: I put in the actual success factors and the test vectors are basically.
Danno Ferrin: The golden piece that anyone with much edm experience could figure out exactly how to explain this if I push these test vectors that with the fix.
Danno Ferrin: Some of paying attention that was motivated enough to cause problems because i've seen what was going on here and said Oh, you have a bite boundary bug on 32 bites which.
Danno Ferrin: Reference just don't validate so let's go ahead and figure out, you know test all the other clients because another thing you'll discover about these at during clients is when one client has a bug.
Danno Ferrin: The other clients tend to have it, so I also communicated this, we have a telegram group with key data is from the other, not a telegram group a yeah.
Danno Ferrin: what's that one of the encrypted messaging groups, we have a messaging group with all the other end developers on all the other clients and I was able to share this with them and.
Danno Ferrin: You know their initial response was oh wow why didn't their tests get that so it's you know suddenly security or is it just you know you get an a minus in the room, and they can always think about it, because it's so obscure.
Danno Ferrin: But once they see it, they can go ahead and fix it because there's many times in this group we're another mind will say, and we have this plugin basically will have it or get will have it and will say Oh, we got lucky, because we do a different approach.
Danno Ferrin: But you know these these things, these failure Center cluster and they tend to get get used.
Danno Ferrin: So that's the quick overview i'm reporting a bug and also the I think the more important part is the CVs see.
Danno Ferrin: If you have what you think is a bug it can just go to this page go to the calculator fill out the things and it'll answer the questions for you, you know you just need to ask.
Danno Ferrin: You know, is this high complexity what's the standard for high and low complexity integrity well what on earth is integrity well there's.
Danno Ferrin: For low and save you can modify data for high you could turn last month, you could totally change the data, I mean those are probably be relevant if you can crank crank everything up it doesn't take much to get a 10 on some of these scope, I think, is an incident when.
Danno Ferrin: i'm complexity bring stuff down.
Danno Ferrin: privileges required his reaction.
Danno Ferrin: yeah this.
Danno Ferrin: If you can change scope.
Danno Ferrin: With no interaction I got to get a combo on some of these.
Danno Ferrin: But there's a lot of arcane rules that go with calculating these numbers and it'll help you figure it out for you.
Danno Ferrin: So.
Danno Ferrin: that's my experience reporting bugs.
perfect.
Aruna S M: So I have a few questions and.
i'm sure.
Aruna S M: So far, what you explained right, so there are many things that we can as a community start looking into, for example, I know you mentioned some time ago that.
Aruna S M: hyper ledger doesn't by itself has an ability to create the issue ID However we rely on most of the Linux foundation projects rely on external reporting age.
Aruna S M: entity that would create an ID for us this data recommendation from the next foundation on whether to go use the tabs one, or is there any.
Ry Jones: My personal recommendation is I.
Ry Jones: If you want to know what my answer to almost anything is, I want to put the power to do the thing in the hands of the people that want to do the thing.
Ry Jones: And github makes that very easy for maintainer of repose so my recommendation is use github it's integrated with our flow and it's really nice so.
Ry Jones: I would not worry about trying to find another.
Ry Jones: agency.
Arnaud J Le Hors (IBM): yeah and I would add to this every time we do something different eventually we go back to say Okay, now the service of github is better and it's just a hassle to use something else so let's switch to whatever gets a missing bonnie so might as well stick to it right now.
Ry Jones: And I know that.
Ry Jones: We, the Linux foundation.
Ry Jones: is going to have a bunch of guidance on this coming out soon.
Ry Jones: Around the open ssf project.
Ry Jones: and
Ry Jones: You know there's going to be.
Ry Jones: F bombs there's going to be.
Ry Jones: A lot of guidance coming out about this, so there will be some more concrete guidance in the next quarter or so, but this get up process will definitely be still be part of it.
Okay.
Aruna S M: The other question I see hard raising his hand.
Hart Montgomery: He did Oh, I had a question.
Hart Montgomery: Do you think we could improve this process, or perhaps make it more specific to some of the applications that we're working on like specifically blockchain stuff.
Hart Montgomery: Like do you know if there's a theory of thing that that's the sort of more blockchain specific like for a security bug You might ask if it affects consensus or stuff like that.
Danno Ferrin: So I think we.
Danno Ferrin: would probably want to provide guidance as to the various fields that would be let me bring up the screen again and share that okay um.
Hart Montgomery: Maybe we want our own.
Hart Montgomery: Our own scoring system here right.
Danno Ferrin: So if we do our own scoring system that's our own thing and it reduces I mean when I reported through this way the CV and the numbers.
Danno Ferrin: Someone from Linux foundation made sure that it got submitted to to the miter database and they added a few lines of my description.
Danno Ferrin: And they massage it and they gathered all these URLs together to show all the commits so one of the one of the risks of doing our own scoring system.
Danno Ferrin: Is that we lose some of these general integrations and when it comes to you know, making enterprises happy.
Danno Ferrin: You know, they want to be able to know that if there's something wrong it's going to come to this channel if there was anything I would change.
Danno Ferrin: I would probably think we should get better guidance as to what we need to change what we need to describe in these fields, for what how he's applied to a blockchain.
Danno Ferrin: Because when it's a consensus failure, you could make two arguments about availability of how it impacts, the system it's like well as a smart contract.
Danno Ferrin: And it'll fail well that only affects that smart contract, but if it affects the validator note, and if it affects the ability to validate or no it's just been a consensus.
Danno Ferrin: You know it's probably a high complexity attack that could help the chain, and that I think any bug that can help the chain, I think it's an instant 10.0.
yeah.
Danno Ferrin: So that's I think if there's anything we would do it's you know we would give.
Danno Ferrin: If there are certain situations and certain things that can be done, we would give recommendations on how to score it to make sure that the scored value is high enough.
Danno Ferrin: You know, maybe we should you know drop make sure that it's it's have complexity, we could change the attack complexity on some of these because let's see this is what got me an 8.6 or 7.5 i'm.
Danno Ferrin: What numbers would increase because these are lower it.
Danno Ferrin: This law is that.
Danno Ferrin: This lowers it explores it.
Danno Ferrin: That don't think that uh I could do anything that wouldn't.
Danno Ferrin: Integrity, maybe.
Danno Ferrin: No, but I mean, I think we could give you know recommendations is what these fields mean then maybe you can say yes yeah he is a 7.5, but we should consider this to be a critical because we've observed chain halls you know if if we've seen.
Danno Ferrin: Because there's also the issue of the temporal score can, I think all the central scores only reduce it.
Danno Ferrin: remediation levelers official fix that brings it down.
Danno Ferrin: confirmed that only brings it down these are only mitigating factors well any of these rays it's.
Hart Montgomery: It.
Danno Ferrin: I guess my point here we.
Go.
Danno Ferrin: We could give recommendations on the environmental score so maybe we have an extra number on blockchain score that will set floors, for we still use the scores, but we have another category.
Danno Ferrin: I don't know if we want to call the blockchain score, but you know if you get a chain hall that's an interesting point oh if it's been observed, you know that's there was any changes that would be to add extra layers and add score floors to some of these conclusions.
Hart Montgomery: yeah I guess one way to to do that would be to add extra.
Hart Montgomery: Extra ratings.
With you so.
Hart Montgomery: I guess.
Hart Montgomery: yeah I don't know i'm.
Hart Montgomery: Good guess the target audience for this is probably someone who's not.
Hart Montgomery: Working in security.
Danno Ferrin: mm hmm.
Hart Montgomery: And we should be cognizant of that and that's certainly a blind spot that I have.
Hart Montgomery: But.
Hart Montgomery: I think.
Ry Jones: The target audience for this.
Ry Jones: is going to be well, there are a lot of audiences, but I think like the the primary one is going to be.
Ry Jones: people that have this deployed.
Ry Jones: Right it's going to be ups and.
Ry Jones: If they're using a tool like snake, or whatever, and they see that you have a cbe in one of your dependencies, then you need to update, I think that is is one of them is it's.
Hart Montgomery: Okay.
Ry Jones: it's a low bandwidth way to convey information, but when I.
Ry Jones: If you could go to the.
Ry Jones: DEMO if you could go to the github repo.
Hart Montgomery: So right that makes total sense sorry to.
Ry Jones: get no worries.
Hart Montgomery: Thank you for explaining that because that puts diagnose.
Hart Montgomery: commented much more context for me.
Ry Jones: Okay well.
Ry Jones: i'll try to do a screenshot soon and show you something else but carry on.
Danno Ferrin: I know this works, because we got to depend about for this work.
Danno Ferrin: gets.
Their.
Danno Ferrin: services.
Danno Ferrin: And let me find podcasts.
Danno Ferrin: Now we just get these all the time there's none of them they're tied to security.
Danno Ferrin: would have been attempted three.
Ry Jones: Could I share my screen for a second.
yeah.
Ry Jones: This is what I see for a random other project.
Ry Jones: These dependable alerts that say.
Ry Jones: You know the severity.
Arnaud J Le Hors (IBM): So that's why I have seen this too in fabric.
yeah.
Aruna S M: This would be reported on the github has an integration to those projects right.
Ry Jones: or.
Danno Ferrin: Which is why they troll to see the reports for github repos and try and tie it to it because of the value or whoever works as in mitre let me check my email to see.
Danno Ferrin: Who was a Linux foundation, who was the.
Danno Ferrin: I got that from.
Ry Jones: I don't I remember vaguely being involved in that, but I don't remember who did it was probably Scott would be my guess.
Danno Ferrin: mm hmm.
Danno Ferrin: and doing CD he just gets me all the security.
Danno Ferrin: vulnerabilities for the security list.
Danno Ferrin: i'll dig for the email.
And let you know if I find it.
Aruna S M: So another question that comes up and Nano, in the end.
Aruna S M: When you were walking us through the scoring guidelines and how you process that information was regarding communication like, especially in this case, it was it a medium where it could have been affected in other cases as well, I mean other protocols other implementations as well.
Danno Ferrin: yeah so.
Danno Ferrin: I think this is honestly, the less interesting case where you find a vulnerability and you decide to report and you decide to escalate um if you escalate, something that shouldn't be escalated I think there's less security damaged just creating a little bit of noise.
Danno Ferrin: But I think the more interesting cases let's say I find something and I don't know if it's a CD and I have my own decision decide it's not CV worthy.
Danno Ferrin: What thresholds, do I seek outside advice to say you're right this isn't CD worthy or you know this absolutely should be a cbe because this affects X y&z that you might not have exposure to.
Danno Ferrin: So that's one you know one question that check this process, but at the same time.
Danno Ferrin: Every time I feel about file a bug when you get someone from an outside project read the bug and say Oh, this is scary isolate this isn't.
Danno Ferrin: There are some threshold, where you would you know, decide to self report and some threshold, where you think Well, this is, you would want to say, well, I think this is a security vulnerability.
Danno Ferrin: I assess it with someone outside the project and they said you're not sure, and I don't think it is you got outside.
Danno Ferrin: counsel is probably the wrong word, because that implies a tactical lawyer, but you saw outside advice and the advice was and we concur it's not.
Danno Ferrin: Security worthy but it's on the line, so you don't need to do a CD on it and that's the part of the process, you know what do you do I have.
Danno Ferrin: We think we have a CD and we turn it down to disclose it to other people or to share with other people or seek the counsel because, like I said, not everything is.
Danno Ferrin: You know, should even go through this process, you know you misspelled word that's not a security exploit but it's a it's a bug so.
Danno Ferrin: I don't know.
Aruna S M: So that goes back to the discussion that we had earlier on.
Aruna S M: What should be the responsibility from a Community versus the reporter versus the project maintenance.
Aruna S M: And the staff.
Danno Ferrin: Exactly.
Aruna S M: And that also puts up another discussion point of.
Aruna S M: I mean when do we consider reporting this as as critical vulnerabilities because, having a score of 7.5 showed it as an high critical.
Aruna S M: may not be critical, but high issue, maybe there are implementations or operate OPS teams will be interested in patching and patching this up.
Aruna S M: So that was an interesting case the the explanation that you gave of.
Aruna S M: silently patching it and then reporting it I guess that's another topic that we will have to discuss.
Danno Ferrin: Right, so I know that I think falls into the responsible disclosure, because that is established pattern among.
Danno Ferrin: Production networks, as you said, yeah and that's what gets has been doing, they tried giving a warning ahead of time say hey there's going to be security patching don't need to update this one when it comes out next Tuesday.
Danno Ferrin: within days someone had a reverse engineered it from a big old code dumb forget exactly what the bug was created a transaction that caused.
Danno Ferrin: Parts of the theory of network to fork some critical infrastructure so from that experience, I think that confirms the practice of stealth patch it and then announced that a month later, when you know.
Danno Ferrin: it's been APP because you know you'll say you patch it version point three.
Danno Ferrin: And then Point seven you'll actually announced and say hey, this is a mandatory update their security fixes and it fixes didn't come and Point six 2.7.
Danno Ferrin: It came all the way back in the point three, and once inside your list goes, by the way, it's this fix here it is we patched it a month ago.
Danno Ferrin: So that makes it a bit more difficult because that's one of the classic problems with security reporting is to say hey there's a security thing.
Danno Ferrin: And you know the day one day two attacks, where people reverse engineer the patch and go attack it that's why you know Microsoft went to their their patch Thursday solutions.
Danno Ferrin: Why patch security leases a coordinated amongst larger projects so that the window of this vulnerability is reduced so and with the act of blockchain you can't wait till the third Thursday of the month tripoli's release a security update.
Hart Montgomery: Your DNS exactly right This is standard practice and this goes back to people.
Hart Montgomery: reverse engineering windows updates this kind of attack vector long predates blockchain.
Hart Montgomery: And just getting the the best practices, always of course to disclose the bug but you want to disclose it well after it's been fixed it after everyone has been given reasonable time to update.
Danno Ferrin: And then, a great conference sessions, where you go back and say here's the here's our town and here's what happened.
Danno Ferrin: yeah oh yeah always the ones that I always loved with.
Hart Montgomery: This is security research right people talk about like attacks they've done or vulnerabilities you know and they talk about how they fixed it, and this is, you know, like six months after the fact, so.
Hart Montgomery: yeah if, if you like this, there are a bunch of good security research conferences to to go to where you can have literally see dozens of talks like this.
Aruna S M: Correct me from wrong here I go down to net net again so one other one other question that comes up with this is.
Aruna S M: So when whenever we report.
Aruna S M: One ability like this.
Aruna S M: There would be requests in terms of auditing that goes on in identifying if somebody exploited.
Hart Montgomery: yeah you can look at this.
Hart Montgomery: This is an interesting question for hyper ledger.
Hart Montgomery: Because hyper ledger like.
Hart Montgomery: You know, because this is easier for a theory right where a theory amongst the code and they also in the blockchain and they can try to examine.
Hart Montgomery: Right like for Dan knows bug you know people could just do a search and see if there are any smart contracts that contain like similar code that could have done this exploit right.
Hart Montgomery: But this is a little harder right if you don't necessarily have the production blockchains.
Hart Montgomery: To me, I guess, we could solicit input from the Community to see if these things were exploited.
Hart Montgomery: But this can be difficult, because no one likes to say they're exploited.
Danno Ferrin: But they love to say, we ran the audit.
Hart Montgomery: team I clean yeah absolutely so people yeah people, update and say oh yeah we're doing great, but no one is yeah.
Hart Montgomery: it's it's a hard sell to get people to say like oh yeah you know we were exploited by this bug.
Hart Montgomery: So.
Hart Montgomery: I do want to say, though, I mean data, you mentioned that the.
Hart Montgomery: The CVs are just like.
Hart Montgomery: The inflated CVs or just noise.
Hart Montgomery: And, and my experience with a lot of these things is particularly contributors, that are not core to like people that are not core to a project have a tendency to wildly inflate CVs.
Hart Montgomery: So I sort of view this as.
Hart Montgomery: You want like.
Hart Montgomery: You you want people quarter the team to go over everything, obviously.
Hart Montgomery: Before.
Hart Montgomery: Before you say the sky is falling.
Hart Montgomery: I don't know if you had Have you had that experience.
Danno Ferrin: That there's an exploit on our wordpress page on some marketing thing and therefore it's critical.
Hart Montgomery: Well, you mean that's.
Hart Montgomery: that's an extreme circumstance, but yeah.
Danno Ferrin: um it happens regularly, so I don't know if I call it extreme.
Hart Montgomery: Extreme exaggeration.
Ry Jones: It.
happen so.
Ry Jones: it's it's going on right now and on our hacker one program every every book that gets submitted is like a 10.0.
Ry Jones: And it's not so.
Arnaud J Le Hors (IBM): Well, I was going to say I think you need bounty program me kind of pushes in that direction cine.
Arnaud J Le Hors (IBM): Of course, people are going to claim they found the gold.
yeah.
Hart Montgomery: And that's why I guess for these questionnaires, the best questions are are ones that are concrete.
Hart Montgomery: But.
Hart Montgomery: So it's I guess the action items like one good thing we could do is.
Hart Montgomery: Is think about the score and guidelines for hyper ledger.
Hart Montgomery: I think, Dan are you suggested that earlier.
Danno Ferrin: yeah maybe contemplate a supplementary score they would elevate levels.
Danno Ferrin: Instead of our floor or something's like a chain all to get a 10.
Hart Montgomery: yeah I mean.
Danno Ferrin: The wild chain hard to get a 10.
Hart Montgomery: Any consensus break should be you know.
Hart Montgomery: should be huge right.
Danno Ferrin: yeah anything that could cause a validated upon a consensus should be at least a nine.
Hart Montgomery: yeah I mean any like.
Hart Montgomery: Any like core cryptographic protocol breaks.
Hart Montgomery: All of these things.
Aruna S M: i'm so hard, if you don't mind would you lead on this activity alarms you can.
Aruna S M: bring in others as needed.
Hart Montgomery: And then maybe if yeah I mean I can.
Hart Montgomery: yeah I can like take a stab at it, you guys might hate what i've done.
Hart Montgomery: But.
Hart Montgomery: yeah I think this is.
Hart Montgomery: I can definitely think of some things that are that are blockchain specific and we can say like you know this, this should.
Hart Montgomery: This should get our immediate attention right.
Aruna S M: Right and probably other thing to note pete since we expanded the scope of hyper ledger foundation itself.
Aruna S M: We need to look at holistically.
Hart Montgomery: Are you referring to like multi party system stuff.
Hart Montgomery: Right, so I think this is.
Hart Montgomery: Is this call being recorded.
Aruna S M: Yes.
Okay.
Aruna S M: Sure, so along with multiparty systems, I was about to mention, we do have projects such as our side and and.
Hart Montgomery: Right in this like this scoring system doesn't make a lot of sense for Sir.
Hart Montgomery: But but that's obviously like a totally totally different beast.
Hart Montgomery: I think there's some other things, we probably want to do.
Hart Montgomery: That would be more relevant for ursa that would also be.
Hart Montgomery: Relevant for potentially other hyper ledger projects.
Hart Montgomery: So one of the things that the open ssf is doing is they are.
Hart Montgomery: there.
Hart Montgomery: I kind of call it like a review diary.
Hart Montgomery: where you can look at where people can sort of document the reviews that have been done for various different.
Hart Montgomery: Projects or even like more fine grained like files or libraries or stuff like that, and then you can say you know, like Oh well, this piece of code has been reviewed by all these people, it has had all this automated work done on it.
Hart Montgomery: You know this analysis it's good we're happy with it, or like oh no, you know only like you know, only to maintain errs took a cursory piece of you know, took a cursory glance at this code, maybe we shouldn't be so confident and its security.
Hart Montgomery: So so like for so one of the things we do is we get cryptographers to review code.
Hart Montgomery: And sort of like documenting that is is really useful.
Hart Montgomery: And lets us know what we what people think is secured what people you know think is not and how confident we are in the security of the code.
Hart Montgomery: But documenting this you know.
Hart Montgomery: documenting this in a place where the public can see it.
Hart Montgomery: it's probably a really good idea.
Hart Montgomery: And this might be something that you know this open ssf tool might be something that we can.
Hart Montgomery: You know that other projects in hyper ledger might be interested in looking at.
Hart Montgomery: Did that all make sense.
Aruna S M: Sure, do you have any info links on that opens up to maybe it's.
Hart Montgomery: Better if you can try to find it.
Hart Montgomery: Yes.
Hart Montgomery: The open ssl is I can't right, can you can you change chat so I can Brock or you can broadcast to everyone, there we go.
Ry Jones: I think I changed it a while ago.
Hart Montgomery: Okay perfect, so this is what i'm talking about.
Hart Montgomery: And this isn't like quite, to the point where we want where we could use it yet, but.
Hart Montgomery: This is kind of.
Hart Montgomery: I think a really good idea.
Hart Montgomery: I know our know is familiar with the open ssf stuff Is anybody else.
Hart Montgomery: Right i'm sure is.
Peter Somogyvari: yeah.
Mic Bowman: Yes, awesome.
Ry Jones: yeah I i'm aware of it i'm not spending every waking minute working on it, but.
Hart Montgomery: yeah it's interesting stuff.
Hart Montgomery: From our perspective, though the and and Brian and David and people will tell you this, the open ssl is really focused on bringing up the floor of security.
Hart Montgomery: And we probably want to concern ourselves more with the ceiling.
Hart Montgomery: But it will probably have a lot of useful tools for us to to look at using.
Arnaud J Le Hors (IBM): Can you expand a bit of a statement that i'm trying to pass this openness itself is trying to bring the floor up and we are more interested in this city what was that about.
Hart Montgomery: can try this was an.
Hart Montgomery: English idiom.
Hart Montgomery: So, so the open ssf, at least at this point is focused on.
Hart Montgomery: automated processes to find common security bugs.
Hart Montgomery: or common security malpractice.
Hart Montgomery: And sort of you know, obviously, the better security framework, you have in place.
Hart Montgomery: The less useful that is going to be to you.
Hart Montgomery: So, like, for instance fabric pretty much already.
Hart Montgomery: implements something equivalent to what the open ssf recommends.
Aruna S M: When you say tool is it going, is it a static code analysis kind of a tool, or is it a questionnaire kind of a tool like.
Hart Montgomery: All of the above.
Arnaud J Le Hors (IBM): yeah I have to agree with this, I mean I don't want you to think that openness SF only deal with this, because I mean there are many different activities, all the way to you know listing the top 200 most critical Open Source components out there that should.
Arnaud J Le Hors (IBM): Take care of and monitored closely to you know, providing tools, as well as there's basically.
Arnaud J Le Hors (IBM): it's a follow up to the CCI badges there is what's called South saw which provides a set of criteria with different levels that you can claim to comply with.
Arnaud J Le Hors (IBM): That gives people different insurances as to a level of security of your software and it does go into like tools that also do static analysis with you know, is this tool called scorecard that.
Arnaud J Le Hors (IBM): runs a bunch of a bunch of your sticks that test, and they will look at many different things, not just your code, they also look at you know, do you have like peer review on all your commits, for instance, things like this.
Arnaud J Le Hors (IBM): So there's a huge range of activities around a bit ssf, and I mean right now it's got the focus is like hyper ledger in the early days, where you know it becomes like the.
Arnaud J Le Hors (IBM): The sinkhole for everything related to software security seems to be coming into open ssl.
Arnaud J Le Hors (IBM): Or, more positive it's the Center of gravity.
Arnaud J Le Hors (IBM): sinkhole might be seen as something negative.
Aruna S M: But like probably This is something which we can go over in detail and in our next call, we can review it once thanks for the link hi.
Hart Montgomery: yeah I mean this is just something that.
Hart Montgomery: I think would be really useful but.
Hart Montgomery: It may be.
Hart Montgomery: Maybe not suitable for everything.
Aruna S M: sure.
Aruna S M: um.
Aruna S M: Okay, so I guess, we do have one action item.
Aruna S M: For us of this discussion so far and I wanted to also cover some part of our next topic that we had to cover today and we'll come back to this topic.
Aruna S M: About scoring and then reporting vulnerabilities by.
Aruna S M: Two in the one one other discussion that we had in our previous call was regarding how do we report vulnerabilities so I guess.
Aruna S M: There were many talks around.
Aruna S M: Project team reporting vulnerability versus somebody else reporting and again it covers all those questions of.
Aruna S M: How do we decide if an issue is vulnerable or not and we discuss that will put around our thoughts in our wiki but I don't see any proposals at but i'm open for suggestions and then we can probably start a page where we can jot down ideas and start working towards it.
Aruna S M: look for solutions if.
Aruna S M: If we think we need more time to probably put down thoughts, maybe we'll cover it in our next our next call.
Aruna S M: On, however, we need to start working towards that.
Hart Montgomery: So I guess the action items are I will.
Hart Montgomery: Think about scoring guidelines for blockchain.
Hart Montgomery: Do we have a list.
Hart Montgomery: You know.
Hart Montgomery: Do we have a list or like where should I do this work, basically, I can do it in like a Google Doc.
Hart Montgomery: and share with everybody or I could do it on the wiki does anybody have a preference.
Ry Jones: Please at least do it in your personal space on the wiki and then, once you've done your you've done once you're done iterating on it, we can move the content over elsewhere.
Hart Montgomery: Okay, maybe then I will post in a Google Doc up like can I post on this page like a link to the Google Doc in the contents for more interactive editing.
Ry Jones: Yes, but the so the reason.
Ry Jones: Google google's star is blocked in China.
Ry Jones: So using Google docs for anything collaborative makes excludes anyone in China.
Ry Jones: Okay, so that's why i'm harping on using the wiki.
Ry Jones: But.
Ry Jones: You know, go for it and let's just get the content over to the wiki as soon as reasonable.
Okay.
Aruna S M: So, probably, we can realize the space of task force that required is like, for example, I had put up this proposal, some time ago in we can continue adding more proposals over here.
Aruna S M: We didn't have all the required materials in one place.
Hart Montgomery: sure.
Aruna S M: I pasted the link to this task force.
Aruna S M: Perfect so I guess for the next meeting, we have three topics to be discussed we'll go we'll go over to open ssl security reviews once and then.
Aruna S M: The guidelines for reporting vulnerabilities plus the scoring guidelines for blockchain and then we need to think towards.
Aruna S M: Other other than blockchain projects we can hyper ledger foundation if they need any extra scoring guidelines for them.
Aruna S M: So these three would be topic for our next call in two weeks.
Hart Montgomery: Just Out of curiosity.
Hart Montgomery: Do you think there are any things that are non blockchain that will need more scoring criteria.
Aruna S M: I don't know so i'll keep that option open if we think we.
Aruna S M: At this point in time i'm unable to think of any.
Aruna S M: But let's keep that option open, then, if we could not find anything, then we'll probably close it.
Hart Montgomery: Okay yeah no my intuition would be that blockchains would have the most difficult security model.
Hart Montgomery: But it's possible that i'm just missing something.
Hart Montgomery: it's a good thing to consider.
Aruna S M: I don't have more agenda items for today, so we could probably end early.
Aruna S M: Thank you all, and looking forward to seeing you in two weeks.
Danno Ferrin: Is.
Arnaud J Le Hors (IBM): Good Thank you.