Ry Jones: Recording is in progress and everybody abide by the antitrust rules and be cool.
Aruna S M: I still see the recording as paused on my zoom screen.
As.
Ry Jones: It says that it's recording to the cloud on mine.
Ry Jones: Not okay.
Aruna S M: Thank you, in good morning good afternoon and good evening everyone, welcome to hyper ledger foundations Task Force and to this task force, we are looking at.
Aruna S M: What can we do to improve the existing or the current.
Aruna S M: Security process that we follow type A letter and.
Aruna S M: Thank you for.
Aruna S M: Giving your valuable inputs, in the past weeks and today's discussion i'm sure is going to be more exciting and more interesting.
Aruna S M: So I guess right already reminded by the quick note all hyper ledger meetings.
Aruna S M: are open to everyone and antitrust policy basically means that.
Aruna S M: you're expected to behave well in the Community so which we are all good but.
Aruna S M: And now we can get started, but before we get started, if you're new to the call and, if you would like to introduce yourself to the Community, please feel free to unmute yourself and introduce and then we'll get started with pageant items.
Deepika Karanji: hey everyone deepika here i'm here to hyper ledger just joined in to see what it's all about and excited to learn something new today thanks.
Weihong Ou: hi this is way home i'm not new to hyper ledger, but this is my first time joining this kind of tasks was good, you have to be.
Something that.
Aruna S M: i'm very hungry is my my colleague at work as well.
Aruna S M: I make good to see you again.
Mic Bowman: Hello.
Aruna S M: Okay, we will get started with agenda items.
Aruna S M: So the first topic that we wanted to discuss, I know, in the previous call we postpone this discussion this particular topic we want.
Aruna S M: In the week before that there was a suggestion of how do we we discuss elaborately on CBS course and how do we come up with guidelines for hyper ledger projects or in general for any blockchain.
Aruna S M: protocols that are.
Aruna S M: That are developed under hyper ledger and that was one of the broader ADR to be discussed and and one of the topic that.
Aruna S M: I brought up and then recent conversations is about, we should probably start with trek modeling and also looking at some of the papers that discusses about.
Aruna S M: How do we secure and what parameters, should we consider so that can be inputs for our discussions right so i'll set the stage for how to talk on that.
So yeah.
Hart Montgomery: I can jump in so as a rune alluded to earlier in the call.
Hart Montgomery: We sort of have two different security problems that we need to think about.
Hart Montgomery: We need to think about security of our infrastructure right which is like.
Hart Montgomery: Our people you know getting the right.
Hart Montgomery: Essentially packages, you know can people break into our github.
Hart Montgomery: You know, essentially, is the development process secure.
Hart Montgomery: And then we also need to think about the security of our software right, and this is, you know.
Hart Montgomery: How severe our bugs in this particular blockchain system.
Hart Montgomery: How, you know that sort of thing.
Hart Montgomery: So.
Hart Montgomery: I know ruin said this.
Hart Montgomery: But we really have sort of two different problems and they're somewhat related but not.
Hart Montgomery: entirely.
Hart Montgomery: The same.
Hart Montgomery: And what i'd like to do well, essentially for both of them is.
Hart Montgomery: We should do some threat modeling so, particularly for our.
Hart Montgomery: Particularly for the first one of these problems where we're sort of looking at our infrastructure.
Hart Montgomery: We should think about what an attacker might do to cause problems or.
Hart Montgomery: Generally break the system and keep it in mind that an attacker is not necessary, you know if i'm using the.
Hart Montgomery: The language of security here an attacker doesn't necessarily have to be malicious it could be a lazy that that makes a mistake right.
Hart Montgomery: So we shouldn't sort of model around our infrastructure, what are the threats, what are we worried about.
Hart Montgomery: And, and what are sort of what mitigation needs to be done.
Hart Montgomery: For all of these if any of you are familiar with the open ssf they've done a little bit of this very I would say informally, and we probably want to do something.
Hart Montgomery: I guess much more comprehensive for hyper ledger.
Hart Montgomery: Given that the open as SF is sort of focused on automated tools and I would say, raising the floor.
Hart Montgomery: of open source security rather than the ceiling, and we really want to raise the ceiling.
Hart Montgomery: And then, as far as like you know understanding.
Hart Montgomery: You know, security of blockchains and this gets into you know.
Hart Montgomery: Thinking about CVs and how severe things are, and if an adversary can do X, what does that mean in terms of what they can do.
Hart Montgomery: For practical attacks, this is sort of you know, within block chain.
Hart Montgomery: threat modeling.
Hart Montgomery: And you know, we also need to think about this as well, so I should probably stop talking for a second.
Hart Montgomery: Does does anyone have questions does this make sense, do you want to tell me i'm just out of my mind.
Peter Somogyvari: It makes us thank you.
Aruna S M: I.
Aruna S M: Have a question rather.
Aruna S M: Right so let's say we pick, how do we define these things are we going to say hey here is a set guidelines of.
Aruna S M: When we say network boundaries of and let's any particular blockchain protocol, then these are the standards that you should follow, and this is what we recommend in hyper ledger or others.
Aruna S M: I mean in terms of compute, and these are these are some of the conditions that you must follow in terms of choosing libraries here are our recommendations is that what we're going to do, art and how do you define the boundaries right because each project is different.
Hart Montgomery: Right and certainly some projects are going to care about security more than others right like you know exploit, you may not really care much about.
Hart Montgomery: Security for something like explore this just a blockchain viewer right that that's going to be very different than something like you know, a full dlp.
Hart Montgomery: So I think we would probably want to classify projects or even you know code segments within projects by what they do right and then consider sort of.
Hart Montgomery: sort of security by type right like something like you know I don't know if you want to color code or whatever, but you know something like a consensus implementation would be critical, whereas something like a viewer would be.
Hart Montgomery: You know, probably less critical right.
Hart Montgomery: Did that answer your question.
Aruna S M: When sure in a in a way.
Hart Montgomery: Can you.
Hart Montgomery: What can I do to help them better ads right.
Aruna S M: I I was not looking at distinction between next let's explore around and fabric or.
Basic.
Hart Montgomery: question.
Aruna S M: yeah go ahead, I was looking mode from are you going to set set rules for let's say how basic should work and a piece of fabric works, and since we have defined these rules and you must change your implementation because you're not following these guidelines is type mark we're going.
Hart Montgomery: well.
Hart Montgomery: I mean this is up to the the thc right does the tlc want to do technical steering, and I mean.
Hart Montgomery: You know there if if some project has a grave security issue and refuses to do anything about it, you know what happens then right.
Hart Montgomery: I mean I don't know that you want to necessarily make you know.
Hart Montgomery: You know there's a fine line between going overboard you know, on this, but you know if i'm putting out just like an blatantly insecure say dlp and.
Hart Montgomery: You know and i'm refuse to try to do anything about it.
Hart Montgomery: But what should happen next.
Hart Montgomery: Does that answer your question better.
Aruna S M: short.
Aruna S M: I think that makes sense to have those guidelines but i'm just wondering how would those be applied and.
Vikram Sharma: And maybe you know how you would you know make some money you know compliant also.
Vikram Sharma: Like he is when you create your guidelines that it has to be secure, but also, you know how to go about it, you know what would be the benchmarking.
Vikram Sharma: yeah what.
Hart Montgomery: it's all about best practices right that you know that is a very good point like no software is totally secure you know outside of like Hello world anyone that tells you that they've written a completely secure piece of large software is just like great.
Hart Montgomery: So so it's all about following best practices and having methods in place to recover from.
Hart Montgomery: From bad events right.
Vikram Sharma: yeah.
Hart Montgomery: So I don't know if you all saw the news, very recently, there was a big bug and coinbase.
Hart Montgomery: Where you could take out infinite money.
Peter Somogyvari: was a fun one.
Hart Montgomery: And they gave the they give a $250,000 bounty for it, which is.
Peter Somogyvari: A little.
Hart Montgomery: yeah.
Peter Somogyvari: Take it a lot more.
Hart Montgomery: They couldn't take yeah.
Hart Montgomery: it's unclear exactly how much they could take before coinbase noticed.
Hart Montgomery: Because I assume they have they claim, and I assume that they do have some.
Hart Montgomery: Some way of like you know, throwing on the brakes if an unexpected amount of money is leaving.
Hart Montgomery: But I don't know what that number would have been.
Hart Montgomery: So.
Hart Montgomery: yeah I mean it is a bad bug, but they did they did fix it.
Hart Montgomery: quickly and.
Hart Montgomery: I don't know does anyone else, want to comment here, I feel like i've just model login.
Peter Somogyvari: Have stuff that I wanted to chime in on, but it was for the rfp that started talking about in the very beginning about splitting it asked for more so i'm just leaving for this particular topic to finish, and then i'll say.
Aruna S M: So i'll probably i'll on to again jump in and.
Aruna S M: comment and i'm not sure if it makes sense.
Aruna S M: So.
Aruna S M: In my previous experience work experience right, so I was working at a company where.
Aruna S M: The security threat modeling used to go I granular level, in the sense like we used to even look at where the code gets executed and is there a possibility for potential memo really as well right, so what i'm confused, or what i'm unsure of when we do when we say trick modeling.
Aruna S M: What are those parameters that we are looking at and where are we defining boundaries around.
Aruna S M: Two, and how are we making a generic across all the projects in hyper ledger.
Hart Montgomery: that's a great question and I think that the answer is, we need sort of many threat models right.
Hart Montgomery: People can people can attack our like development process right.
Hart Montgomery: They can attack our releases, they can attack you know.
Hart Montgomery: They can attack things at a very high level right or also, as you point out, you know we can look at sort of like very low.
Hart Montgomery: Very low level stuff like that you pointed out, like.
Hart Montgomery: You know that's really more of a question of the individual.
Hart Montgomery: Software security.
Hart Montgomery: and
Hart Montgomery: That that sort of corresponds to more of the second problem we were talking about.
Hart Montgomery: But, but I guess the short answer is, you know we have a lot of different security problems in hyper ledger right.
Hart Montgomery: From the infrastructure in the org to the the minutiae of the code right and they're all going to sort of have to be dealt with very well, not very differently, but but with different sort of approaches right.
Hart Montgomery: This is.
Like.
Vikram Sharma: yeah multi prong approach definitely you know, because not all threats are same and maybe obviously the, the solution is also not the same so by it's more like that you know you do mitigation at places, and you can do fixes at places like it's always that kind of approach.
Hart Montgomery: yeah well it's just like.
You know.
Hart Montgomery: I don't think like most projects, if any, are signing their releases right now right.
Ry Jones: That is functionally correct yes.
Hart Montgomery: So, like that's a problem right, this is, you know in our model right, we could be man in the middle and someone could trick people potentially into.
Hart Montgomery: You know downloading or using a malicious release right.
Hart Montgomery: So that's.
Hart Montgomery: that's sort of a problem in our infrastructure and when we come up with a threat model for our infrastructure, we should include that right.
Hart Montgomery: That is a potential go ahead right.
Ry Jones: What I would propose is that, as you said, these are.
Ry Jones: two distinct things and I think the.
Ry Jones: You know that, like the github security and, like all of that is.
Ry Jones: That is going to be dictated by.
Ry Jones: lf to us.
Ry Jones: So there, I think our tools, when I say our I mean employees and Linux foundation.
Ry Jones: Our tools for that are going to be dictated we can go beyond that we, the project hyper ledger can go beyond that.
Hart Montgomery: But I think we probably should right, I mean if the.
Hart Montgomery: lf isn't.
Hart Montgomery: It releases right now.
Ry Jones: Right, but I, so there was a big call yesterday.
Ry Jones: That you didn't make where a lot of us was discussed.
Hart Montgomery: i'm sorry.
Ry Jones: yeah no worries, no, no, you had more important things to do, I promise.
Ry Jones: But the the signing of releases and all this, this is absolutely something that we.
Ry Jones: You and I are going to need to work with projects on how exactly do we do this.
Ry Jones: You know who has the keys, etc, etc, so I think like the infrastructure part.
Ry Jones: Is.
Ry Jones: A different a completely distinct.
Ry Jones: conversation from the handling, if I might earn.
Ry Jones: If I could share my screen for a second.
Hart Montgomery: So I mean, and I am totally fine if this group wants to push upstream at lf about infrastructure handling In fact I would rather enjoy that.
Ry Jones: you and me both.
Hart Montgomery: So, like this, this is something like you know if we want, I mean the open ssf is sort of doing this, but you know, there are also a lot of things specific to blockchain and some of the stuff that we're doing that might.
Hart Montgomery: That might make it so a higher level of security is desirable.
Ry Jones: So I just wanted to show people like what we get we get a bunch of these types of reports.
Ry Jones: Which are.
Ry Jones: unclaimed mpm packages or.
Ry Jones: There was one that was a an unclaimed you know go package.
Ry Jones: Those are pretty clearly a project oversight.
yep.
Ry Jones: And those are those are something that we need to address with the projects.
Ry Jones: But the the other stuff like the infrastructure type stuff I think is somewhat independent.
Hart Montgomery: I would say this is more of an infrastructure problem.
Ry Jones: My.
Hart Montgomery: So to maybe I did a bad job of explaining but my sort of dividing line was.
Hart Montgomery: If you're looking at the code in a black box way so you're not looking like in the code it's probably an infrastructure problem.
Hart Montgomery: And if you're looking at the code in a white box way so you're like actually look, you know, like something's wrong in the code then that's that that's not an infrastructure problem that that was my dividing line and maybe that was not you know that's not the right intuition.
Ry Jones: Okay, I think we had an impedance mismatch there, and that was the source of my confusion.
Hart Montgomery: yeah no worries.
Hart Montgomery: Sorry, I did I didn't do a good job of explaining it.
Ry Jones: No worries.
Hart Montgomery: So, like I view the the unclaimed sort of a vm thing is like as more of a more of an infrastructure issue, we could check for that right.
Hart Montgomery: Like we could automate that probably pretty easily.
Ry Jones: Probably there was another issue there that I didn't flip to which was.
Ry Jones: unclaimed go package which is upstream or not unclaimed vulnerable go package it's like two levels up.
Ry Jones: On a lab it's like Okay, how do we handle that.
Ry Jones: You know, we, the that would be that's an issue where you know, two levels up there's there's no substitute package.
Ry Jones: Anyway, this is probably getting too into a broader conversation but i'll i'll shut up.
Hart Montgomery: No that's good to bring up.
Hart Montgomery: You know these these things happen all the time.
Hart Montgomery: So.
Hart Montgomery: it's not a it's not a bad thing to talk about.
Hart Montgomery: Does anyone else, want to chime in with with questions or comments like Dan oh and mick you all have been surprisingly quiet.
Mic Bowman: i'm always quiet.
Hart Montgomery: that's a lie.
Danno Ferrin: I think this is good stuff I think it outlines that there's multiple services of security, we need to be considering you know the software itself or what's being produced and how it's being produced and.
Danno Ferrin: I mean it's software security is not just one aspect it's it's one aspect of multiple facets, so I think.
Danno Ferrin: The outcome of this this this group is probably going to have recommendations on multiple levels almost maybe split up the deliverables into those levels.
Hart Montgomery: yeah I mean absolutely I think it makes sense to try it like.
Hart Montgomery: i'm a big fan of doing things in smaller pieces, whenever possible, and I think it certainly makes sense in this case.
Hart Montgomery: To try to think about some of the different levels of security.
Hart Montgomery: You know individually.
Hart Montgomery: And I guess, my question is, how does this group want to go about this.
Aruna S M: Since we are on the topic, I guess, Peter wanted to chime chime in and to try to add some comments.
Peter Somogyvari: Yes, well, even before I get my comments, the question that came up just now is.
Peter Somogyvari: automation has been mentioned, and I like doing stuff related automation but here's the question.
Peter Somogyvari: Since they are in here specifically about raising the ceiling feel like automation is always kind of trending towards what is the floor.
Peter Somogyvari: So we want to kill it anything that's alteration in this group, or what is our default action for all of those things to push it either, up to the lf for somebody else.
Hart Montgomery: Great question so it's not clear that, like the lf is going to necessarily give us or provide us with tools to reach the levels of security, we desire.
Hart Montgomery: Certainly.
Hart Montgomery: We should hammer on the lf and say you know, like.
Hart Montgomery: like this release citing thing right, this is an lf wide issue and.
Hart Montgomery: You know, we could just say like hey lf like we want this, you know, everybody needs it, we need to get you know something needs to happen right.
Hart Montgomery: and
Hart Montgomery: yeah I don't know i've only been at the lf for basically a week now, so I don't know how well this like pressure is going to work.
Hart Montgomery: But it's also possible we could upstream things to you know Dell effort to tell if infrastructure, this is not uncommon or another heard of in the past.
Hart Montgomery: Like the cnc F has historically upstream to a lot of things to the lf, for instance, and right i'm sure, I can tell you a lot more about that sure.
Ry Jones: I just wanted to show.
Ry Jones: Briefly, from the PCC point of view.
Ry Jones: This shows where the lf security Bot is configured and it will be configured everywhere soon.
Ry Jones: And what that does is under development.
Ry Jones: So there is the opportunity to feed requirements like.
Ry Jones: Are your releases signed.
Ry Jones: into this development process, so this Bot, is currently being developed and the status of that will eventually show up in insights.
Ry Jones: So there is tooling.
Ry Jones: it's coming along, we have an opportunity to make the tooling better so do keep that in mind, the security, but right now is not what the security bites going to be in a month, so.
Mic Bowman: So is there, but.
Mic Bowman: I think this goes back to you know some of the earlier comments about you know security is a multi faceted problem.
Mic Bowman: Talking about infrastructure and pieces like that that can be provided is their advantage, and looking at some of the tools that are now under development for doing robust build processes like can you use salsa in order to.
Mic Bowman: Do multiple builds on multiple platforms multiple independent platforms compare the signatures as a result, and then create an infestation about what the build process was.
Mic Bowman: That could be consumed that way, and this, this goes way beyond just.
Mic Bowman: Signing releases.
Aruna S M: But.
Mic Bowman: But that's kind of the question is, you know what what is enough, and how do we capture the claims that we're making about the robustness of a particular project and and one of the things that that i've always been.
Mic Bowman: semantically concerned about is that the projects don't capture what their security expectations are very well at all what the assumptions are what the claims are.
Mic Bowman: about it that's kind of it almost at the other end of the spectrum of being you know kind of clear out at the at the application level, so I guess my my question is.
Mic Bowman: At some level, what are we providing that somebody who's picking this information that can interrogate understand build process process project expectations.
Mic Bowman: analyses that have been performed on it.
Mic Bowman: Where do we have that information are we keeping it.
Hart Montgomery: A MIC.
Hart Montgomery: you're like.
Hart Montgomery: you're like 10 steps beyond what people do and you're touching on some like very.
Hart Montgomery: very tricky issues like, as you know, anyway, and others may, though, one of my pet peeves in the blockchain blockchain space.
Hart Montgomery: Is when people say they're blockchain.
Hart Montgomery: achieves privacy or confidentiality and don't define what that means.
Hart Montgomery: You know and we're in the even.
Hart Montgomery: Simpler case where people claim their blockchain is secure and they don't define what it means right.
Hart Montgomery: And this is again.
Hart Montgomery: This is going a little bit beyond threat modeling into cryptographic games and what it means to be like a secure blockchain.
Mic Bowman: well.
Mic Bowman: But, but let me challenge that just a little bit that that I don't think we can go to the formal representation of this and, and if you are making.
Mic Bowman: Robust claims going to the formal representation is a good thing right but, but even beyond that something that basically comes back and says hey look.
Mic Bowman: You know, we are a proof of proof of work or you know pick your favorite consensus algorithm and this consensus algorithm has the following assumptions.
Hart Montgomery: yeah.
Mic Bowman: yeah telling me proof of work is secure, is ridiculous, because it's secure so long as there's no 51% attack and you know variety of other things.
Hart Montgomery: Right, no, I understand.
Mic Bowman: And, and so, even just even just sort of a human consumable, this is what our expectations are.
Mic Bowman: Would would make life, a whole lot easier.
Mic Bowman: But this is and then mapping it down into the formal threat model that you were talking about so.
Hart Montgomery: This is like moving towards the formal threat model right.
Hart Montgomery: Yes, you're talking you're giving me like the technical overview of the formal threat model pretty much.
Mic Bowman: I guess what i'm saying is is that it, I have a hard time believing that most of the projects in hyper ledger going to be able to come up with a formal.
Hart Montgomery: Absolutely.
Hart Montgomery: And that I think they can come up with a.
Mic Bowman: textual description of this is what our assumptions are.
Mic Bowman: And then those that that document to something that could be challenged over time at least a captures at least it's a starting point.
Hart Montgomery: Right, well, I mean I think some of the projects like.
Hart Montgomery: Certainly, to be able to come up with the formal model, and some have been proved in a formal model right like.
Hart Montgomery: fabric has has like papers that that prove it in various formal models right.
Hart Montgomery: An extremely formal models I don't know if there's like a full uc proof of fabric, yet, but there is a full uc proof of quarter.
Mic Bowman: degree.
Hart Montgomery: And so, like you know we are.
Hart Montgomery: Attempting to like.
Hart Montgomery: Formally, prove like cactus and Weaver right.
Hart Montgomery: So, so this is not, you know totally out of the question of of what's possible and what people are doing.
Hart Montgomery: And if you talk to some people like certainly like if you took a poll at the academic crypto conference.
Hart Montgomery: The vast majority would say you should never even use a blockchain system without a formal proof so.
Hart Montgomery: You know.
Hart Montgomery: Again I agree with you that.
Hart Montgomery: That there are always two.
Hart Montgomery: degrees of this and we should start with with things that that people are comfortable with, and we should even list security properties right in ways that consumers and users can understand.
Hart Montgomery: If I wrote like a formal game for something like the normal like some business guys gonna be like well this doesn't mean anything.
Hart Montgomery: We can still colloquially spell out security properties which I think is what you're getting at.
Mic Bowman: I guess what i'm suggesting is again it, you know security is multifaceted there are several parts of this.
Mic Bowman: Historically it's been difficult to find a.
Mic Bowman: Human readable articulation of claims on assumptions.
Mic Bowman: Yes, i'm security for the projects right.
Mic Bowman: The formal proofs.
Mic Bowman: Make in those assumptions, but they're not always in a way that and this goes back to your comment about you know.
Mic Bowman: If you're going to claim privacy, then define what it means, and the scope over which it's happening what assumptions you're making about it, some private from whom.
Mic Bowman: And a lot of times we get down to the point where we're doing the formal articulation of that and we have lost the human consumed ability of it.
Mic Bowman: and
Mic Bowman: Go ahead.
Hart Montgomery: yeah no, I agree with you, particularly for for user applications there's a fine line right the human consume ability version has to mean something right.
Mic Bowman: Yes.
Hart Montgomery: So it has to like sort of.
Hart Montgomery: yeah, it has to be concrete and and for certain things like you know.
Hart Montgomery: Like two thirds of your validators are honest right.
Hart Montgomery: That means something right, I mean and that's even a little tricky right because you have the rationality versus honesty discussion right.
Hart Montgomery: But, but I agree with you, and I think that listing the security requirements of blockchains in a human readable way.
Hart Montgomery: would be very good for for preventing misuse right.
Hart Montgomery: You know the people using these blockchains aren't going to all be able to go read 100 page you see paper.
Hart Montgomery: So yeah absolutely stating like you know this block chain works if blah blah blah percentage are honest, or you know, like.
Mic Bowman: yeah.
Mic Bowman: I think we're in agreement, I just.
Hart Montgomery: yeah.
Mic Bowman: You know, when we look at the when we look at how to communicate the security and robustness and resilience of a project.
Mic Bowman: There has to be a broad swath of information available I I think Ryan is been doing a fantastic job about finding better and better ways to make the infrastructure piece robust.
Hart Montgomery: Absolutely yeah.
Mic Bowman: Right and and I just think there are, and you know we've done some formal proofs and things.
Mic Bowman: I know, in the past we've had a hard time though articulating the sort of human.
Mic Bowman: communicated creating something that a human could consume.
Hart Montgomery: And then totally yeah totally.
Mic Bowman: that's the core of my point.
Hart Montgomery: totally agree and I think that, like even define you know even explaining the difference between like.
Hart Montgomery: Like everybody in here, probably gets the difference, but you know a lot of people using blockchain don't understand the difference between crash fault, tolerance and Byzantine fault tolerance right.
Hart Montgomery: And you know, explaining that is is really key right like we don't want someone to set up a.
Hart Montgomery: You know, like a CB DC with a crash fault tolerant mechanism probably right.
Hart Montgomery: You know.
Vikram Sharma: yeah.
Hart Montgomery: So.
Hart Montgomery: I do think, I agree with you 100% on this.
Hart Montgomery: So did everybody else follow this conversation, is it clear for everyone.
Peter Somogyvari: yep.
Peter Somogyvari: But I am in agreement.
Peter Somogyvari: With them from justin said.
Hart Montgomery: Okay.
Hart Montgomery: So I guess what do you all think should be the the next steps forward.
Hart Montgomery: Then, how do you want to sort of to handle all of these things we've sort of had a discussion on how security.
Ry Jones: I.
Ry Jones: Did use.
Peter Somogyvari: My heart.
Hart Montgomery: yeah sorry I.
Aruna S M: Was disconnected looking at my doctor.
Hart Montgomery: My into my computer just said, my Internet is unstable, can you guys hear me now.
Aruna S M: I can.
Hart Montgomery: Sorry for that so yeah so I was just wondering.
Hart Montgomery: What how people wanted to move forward if there any particular problems that anyone found individually interesting.
Hart Montgomery: yeah I mean I feel like i've done too much talking this meeting.
Peter Somogyvari: I like the human readable approach, because I feel like that the popular with the maintainer i'm i'm basing it off of myself, you know I I can deal with the document it.
Peter Somogyvari: is written, at least the language that somewhere between halfway through between me and the heart for security researcher, but I I won't get much out of reading 100 page piece of paper, even if I go into the office, I will kind of get it, but you know not that much.
Peter Somogyvari: So producing something that gets people a little more awareness or helps them in some way through that more human readable approach to me personally that sounds like.
Hart Montgomery: So, so in that vein.
Hart Montgomery: i'd like to assign people homework if that's an acceptable thing to do, for a task force.
Hart Montgomery: So I already I already pointed this out to a room, but in the.
Hart Montgomery: In the chat I linked a I like pretty well known paper at this point it's called the bit bitcoin backbone protocol.
Hart Montgomery: And what this does is it is it it's been updated, but it was the first sort of formal proof that bitcoin is secure in a certain model so.
Hart Montgomery: You know if you've seen the the bitcoin White Paper right it's sort of.
Hart Montgomery: it's sort of articulate for security, but it doesn't.
Hart Montgomery: It doesn't provide a rigorous security proof and some of the claims made in the bitcoin backbone paper are just wrong right like.
Hart Montgomery: selfish mining turns out to be a problem and.
Hart Montgomery: Immediately breaks, a number of claims in the original White Paper.
Hart Montgomery: So, so I like ass I like telling people to read this paper because it's very well written it's very clean and it's about something that people generally already know right you already know and understand how bitcoin works right, so you don't need to understand the.
Hart Montgomery: You don't need to sort of like learn bitcoin from this paper what's interesting is how they model bitcoin.
Hart Montgomery: And how.
Hart Montgomery: And how they consider security.
Hart Montgomery: So you know you don't have to follow the math in this paper you don't need to go into the details, but I think it's really useful to go over.
Hart Montgomery: Just so that you can think about how they argue security for bitcoin.
Hart Montgomery: And the paper is relatively straightforward and that it doesn't have a ton of heavy math or cryptography or anything like that in it.
Hart Montgomery: But do you think about this.
Peter Somogyvari: If the homework is to read it i'd be happy to yeah.
Hart Montgomery: I mean, even if you can't make it through or sort of understand it it's a good for like.
Hart Montgomery: it's good for thinking it's.
Hart Montgomery: it's good for thinking about what.
Hart Montgomery: makes a blockchain secure right.
Hart Montgomery: And sort of how these.
Hart Montgomery: How these proofs work.
Hart Montgomery: Like and you don't need to understand like.
Hart Montgomery: Like like how exactly the proofs work, although you all, probably can.
Hart Montgomery: But, just like just the models, you know, like.
Hart Montgomery: Just how they how they consider bitcoin and how they can you know, think about security.
Hart Montgomery: yeah.
Hart Montgomery: Back do you think this is too much for this Cooper.
Mic Bowman: That papers, a little dense it's it's it's a good read.
Mic Bowman: Especially for establishing how hard it is.
Mic Bowman: And how much has to be.
Mic Bowman: how important the details are.
Mic Bowman: It is also a very good paper, so I think it's I think the homework of reading, it is a great is a great suggestion so.
Hart Montgomery: awesome yeah and if you guys have questions if you all have questions, please feel free to like reach out or.
Hart Montgomery: I mean, this is the simple version like I don't know if you've seen the uc version of this pay.
Mic Bowman: You say version is an.
Mic Bowman: unfathomable i'm sorry.
Peter Somogyvari: to interrupt just because I have to leave a doctor's appointment, but I want to ask the Court to post a link, not just on this little bios on the mailing list.
Hart Montgomery: So really has already posted it in the wiki.
Peter Somogyvari: Oh perfect okay so that's why I wanted.
Hart Montgomery: To better yeah yeah no no worries have a good doctors appointment Peter Thank you.
bye everyone.
Aruna S M: Okay.
Hart Montgomery: yeah, so this is a, this is a great way to start understanding.
Hart Montgomery: What it means to.
Hart Montgomery: To be a secure blockchain at least from a, at least in a rigorous way.
Hart Montgomery: and obviously we can't we can't write claims on our website, you know we can't say.
Hart Montgomery: We can't tell users like to read this paper read a paper to understand our our blockchain security, but we can think about this kind of thing and define good human readable claims that.
Hart Montgomery: tightly reflects security properties if that makes sense.
Hart Montgomery: And I think that's what make was getting at.
Aruna S M: chiller and I think that's a good starting point for us to define how, how can we get started on the trick modeling for like you're talking about for hyper ledger may not be mine.
Hart Montgomery: I mean, this is really only scratching the surface right there are so many things to do, like we.
Hart Montgomery: We want to probably you know streamline.
Hart Montgomery: streamline code review processes like I would love to get some sort of like I know that there's.
Hart Montgomery: Open ssf has some kind of beta version of the tool, but I would love to get a tool, where we could track reviews efficiently.
Hart Montgomery: So I can understand, like exactly how well code was reviewed and sort of who looked at it.
Hart Montgomery: I know i've talked to some of you about this before, but this is particularly useful for like you know very dangerous code like cryptography algorithms or consensus algorithms.
Hart Montgomery: Where a lot of the traditional security audits or automated tools are not going to catch really, really bad bugs.
Hart Montgomery: And you may want to know that, like you know 15 people have reviewed, like some consensus algorithm or something instead it's Okay, if you want to use it.
Hart Montgomery: This makes sense.
Ry Jones: say yes, so you don't have to wonder if you're still connected to the call.
Hart Montgomery: I hope you're telling the truth.
Ry Jones: well.
Ry Jones: I mean.
Ry Jones: It makes sense, but I don't want to.
Ry Jones: You know.
Hart Montgomery: I don't want to assume for everybody.
Ry Jones: Right, I mean I spent years and security for Microsoft and sun and the stuff.
Ry Jones: yep that makes sense to me, is probably not fair to you know extrapolate.
sure.
Hart Montgomery: and say my get as MC will tell you I get carried away in my appreciation for formal definitions.
Mic Bowman: Sorry what's I carried away you just have a.
Mic Bowman: enthusiastic reaction.
Hart Montgomery: that's being very nice.
Hart Montgomery: yeah and I guess let's another thing is is let's continue to try to break you know the security as a massive problem here.
Hart Montgomery: And let's continue to try to break things down into bite sized pieces.
Hart Montgomery: And then we can sort of address things like piece by piece.
Ry Jones: So what in I mean I have my audience.
Hart Montgomery: would love to hear.
Ry Jones: Like what is the.
Ry Jones: What is the easiest first step.
Ry Jones: That that we could take.
Ry Jones: For instance.
Ry Jones: We have the get ups code scanner Bot installed everywhere.
Ry Jones: We have projects that have hundreds of security reports in that that haven't been addressed.
Ry Jones: Do we care, do we, the tlc what of which i'm not a Member care.
Ry Jones: Is there.
Danno Ferrin: A good measure, I think you mentioned that there's projects that have piled up security reports I think that's a metric we should track is an indication that projects being abandoned if they're not being up to date on a security that's a low bar to clear as far as doing a release.
Hart Montgomery: yeah I mean, I agree.
Hart Montgomery: And you know, not every Security Report is valid you know we've gotten there everybody likes to say the crypto nurses broken and like.
Hart Montgomery: The vast majority of them are incorrect.
Danno Ferrin: But.
Hart Montgomery: yeah, but you have to like say like hey, thank you for reporting, this is, you know.
Hart Montgomery: But I mean this is a great question for the tlc like what if a project like What do you do if a project just is totally broke it in terms of security.
Hart Montgomery: Like and they refuse to fix it.
Ry Jones: might be a strong word I would say.
Hart Montgomery: It is a struggle neglect.
Ry Jones: neglect to fix it yes.
Aruna S M: Right, I know more curious because you know I mean this directly consultancy as well, and you mentioned that you have a project with hundreds of security.
Aruna S M: Risk pointed out right i'm curious to know which project, it is you can answer that question later, but I guess, we need to address that first if.
Aruna S M: I know, one of the project that i'm associated with it shows the github tool shows up that we need to fix certain things.
Aruna S M: And then I looked into those reports it, it is looking at a minute is pointing at that say example kind of us examples folder where somebody might have written an example of that has a dependency and that has a.
Aruna S M: report issued against a trade so they're asking probably operate the library are changing so.
Ry Jones: I want to I know where you're going.
Ry Jones: I want to like emphatically argue against that.
Ry Jones: Again, like.
Ry Jones: At Microsoft for nfc in particular.
Ry Jones: We published a ton of example code that was copied and pasted into thousands of Apps which are completely insecure.
Ry Jones: And Microsoft after I left had a huge project of rewriting all the examples to the same coatings these can't same coding standards, as you know, windows, or any other flagship project, and when I say thousands of things were shipped with completely vulnerable example code.
Ry Jones: i'm not excluding Microsoft products because people at Microsoft would go look at the docks and they say Oh, this is how you do the thing copy paste boot and move on, so I think the quality of your example code needs to be as high as the as your shipping code.
Ry Jones: I did say I think and i'm open to push back on that.
Hart Montgomery: No, I agree with you and I know that's happened with like fabric people just copy and paste the examples i've seen it happen.
Hart Montgomery: In like much more serious things.
Hart Montgomery: So, so I totally agree with you.
Vikram Sharma: and told me know on the similar lines again, you know those examples and updates has created some you know definitely you know i've seen some instances people tweet about you know Okay, this is a good best practice, this is a good practice of doing.
Vikram Sharma: Rather than understanding that somebody was just trying to give you a Hello world but they put the you know the tape take it away Okay, this is the best way of doing it let's practice.
Hart Montgomery: yeah I absolutely think that how you handle security reports should be a metric.
Hart Montgomery: I don't know how we want to incorporate that or what kind of requirements should be around it, but absolutely I will ask are all the maintainer is on this call on the like security reporting notification list or whatever we call it.
Ry Jones: No, I think there are two people on this call that are on it.
Hart Montgomery: Are you counting me or not.
Ry Jones: i'm not.
Okay.
Ry Jones: I have asked and asked and not had a lot of uptake.
Hart Montgomery: So I think we require maintainer but and I don't know who on this call is a maintainer other I know a few of you are, but if you are a maintainer and you're on this call you should probably join that list.
Aruna S M: Take back maintenance sorry this mailing list was a closed one.
Aruna S M: It was just wanted to being.
Hart Montgomery: recruited.
Hart Montgomery: Right, are you there.
Ry Jones: yeah yeah yeah i'm trying to get to.
Ry Jones: i'm just going to answer the question right.
Hart Montgomery: All right around consider yourself conscripted.
Hart Montgomery: Oh OK that's it yeah.
Ry Jones: yeah so you know.
Ry Jones: it's heavily dominated by hyper ledger staff.
Hart Montgomery: yeah.
Ry Jones: yeah so there's Dan oh David and.
Ry Jones: I guess that's it.
Hart Montgomery: Was me until recently yeah.
Hart Montgomery: yeah.
Hart Montgomery: A rude why don't you I would recommend that you join that.
Danno Ferrin: So count counterpoint that might not be a bad thing, as long as we appropriately route it to the appropriate projects.
Hart Montgomery: yeah, but we need.
Danno Ferrin: Everyone in the world knows about it increases the risk of the hot button.
Hart Montgomery: Absolutely, but we should have somebody from at least at least one person, I would say it like ideally, I would like at least a couple people from every project on that list right.
Hart Montgomery: Like in that like that list is so short like what if Dave, and here it is on vacation and something happens right.
Ry Jones: And that's a.
Ry Jones: Timely example because fabric did have an issue, while David was.
Hart Montgomery: I know yeah.
Ry Jones: I don't know why you chose that.
Hart Montgomery: I was in my head like.
Hart Montgomery: Sorry, I agree with you, Dan know that you want to keep it like relatively small, and you don't want.
Hart Montgomery: You know.
Hart Montgomery: You don't want to open it up too much, but you want to make sure that, like somebody from the project can get it in a timely fashion right.
Hart Montgomery: And you don't want it to have to like go through like multiple people.
Ry Jones: Well, and even the hacker one stuff I mean hacker one applies solely to fabric.
Ry Jones: And the vast minority of reports that we get are from fabric, or for fabric projects.
Ry Jones: and getting anyone.
Ry Jones: To treat the hacker one reports, even after I filter out the spam.
Ry Jones: But even to log into hacker one and and comment on the bug and say, this is not a concern for some reason or another it's impossible I can't get people I know hacker wants terrible I.
Hart Montgomery: mean the.
Ry Jones: I don't like the platform I don't like that we use it, but it's popular.
Ry Jones: I can't get people to even log in and and triage a bug so.
Hart Montgomery: I I sort of don't blame people for all of the noise and hacker one right.
Hart Montgomery: Like my experiences like your font color is different, on your website like.
Ry Jones: I am.
Ry Jones: So what i'm saying is I filter all that out, I promise.
Hart Montgomery: No, I said.
Hart Montgomery: we're almost out of time, though.
Aruna S M: Like I.
Aruna S M: Okay, so hard sorry to interrupt I wanted to quickly also see one thing, since we are going to break up break this task force into multiple work streams and, along with the homework that UK.
Aruna S M: let's add an action item to this and i'm not sure make I.
Aruna S M: I used to follow you in my previous employment and.
Aruna S M: I think you could be a great value to define how do we divide the work streams and where do we start focusing on so that we can start small and complete those individual tasks, would you be willing to help us on that.
Mic Bowman: I can contribute but i'm not going to lead it.
Mic Bowman: I don't have enough cycles you're not part of it so.
Mic Bowman: If somebody else wants to take lead on it, I will be happy to help out.
Hart Montgomery: But this should be a collaborative thing, but I can take it for a shot if people need that.
Ry Jones: I think it would be good, because.
Ry Jones: It would be nice to have a.
Ry Jones: Fresh.
Ry Jones: Much less jaded set of eyes, look at things because, when I look at it i'm just yeah it's terrible burn it all down.
I mean.
Hart Montgomery: Be careful what you wish for your sort of getting you're getting like an extremist salad instead of a jaded person.
Ry Jones: well.
Mic Bowman: i'll provide radio i'll work to provide a little balance for heart.
Ry Jones: house that I appreciate that.
Mic Bowman: Because because i'm the deeply pragmatic one around here so.
Hart Montgomery: He said he wanted to burn it all down.
Mic Bowman: yeah I heard him.
Ry Jones: I yeah I definitely want to like like the way forward with the bridges burning behind me.
Hart Montgomery: You sound like you want someone.
Hart Montgomery: With a pitchfork in a torch so.
Ry Jones: yeah yeah i'm going to the pitchfork store i'll buy him all right anything else.
Hart Montgomery: No so so i'll work on that and i'll try to send something out next week and people can discuss.
Hart Montgomery: In the meantime, if do we have a mailing list for this.
Ry Jones: We just use the tasc mailing list we can set up a discord channel.
Hart Montgomery: Okay.
Ry Jones: I mean the mail we just use the tlc mailing list for the other ones and.
Hart Montgomery: How salty are people going to be if I write this up in tech.
Ry Jones: i'm not.
Mic Bowman: As long as it can be compiled into PDF who cares that's not that difficult.
Hart Montgomery: that's exactly what I wanted to hear alright.
Hart Montgomery: Great, so I will i'll do some of that next week.
Hart Montgomery: and get it out to people in the meantime.
Hart Montgomery: You know.
Hart Montgomery: i'd encourage people to go over that paper, if you have time, if you have other thoughts yeah.
Hart Montgomery: Thanks that seem okay room.
Aruna S M: that's like no thanks.