Tracy Kuhrt: All right, welcome to the July 7 episode your typical certain critical.
Tracy Kuhrt: As you are all aware of the things that we must abide by on the call the first is the antitrust policy notice that is currently being displayed on the screen and the second is our code of conduct, which is linked in the agenda.
Tracy Kuhrt: As far as announcements we have the standard announcement that we have every week every developer newsletter goes out each Friday.
Tracy Kuhrt: And if there's something that you would like to reach the hundreds of developers that we have, please consider leaving a comment there in the wiki page that's linked, also in the agenda.
Tracy Kuhrt: Any other announcements that anybody might have.
Tracy Kuhrt: whoa okay.
Tracy Kuhrt: So, as far as quarterly reports we don't have any do today.
Tracy Kuhrt: looks like we took a.
Tracy Kuhrt: Little hiatus here on the quarterly reports but I did include a link in the agenda for checking any open tasks that you might have.
Tracy Kuhrt: To see if there's any open quarterly reports that you haven't yet reviewed, I could see a number of people doing that, as I came in this morning and saw a bunch of emails from the wiki.
Tracy Kuhrt: So thank you to those who did take the time if you haven't yet had the opportunity, please do so catch up now is a good time to do that without any quarterly reports coming in.
Tracy Kuhrt: Although I did see that the hyper ledger fabric report came out, it is due next week so it's actually a week early.
Tracy Kuhrt: But thanks Dave for doing that, as a gordo for updating the wiki green agenda here to include that link.
Tracy Kuhrt: Any any comments or questions anything that anybody wants to bring up before we get to the discussion item that we have for today.
Tracy Kuhrt: Okay, see none, then we do have a one discussion item for today it's a carry over from last week, it is the Security Task Force recommendations.
Tracy Kuhrt: That a room wanted to bring to the technical steering committee, so a ruin i'm going to hand that off to you for walking us through and others recommendations.
Arun S M: Thanks Tracy.
Arun S M: Last week, we were unable to cover this as I was running late, and then we could not get enough time at the after discussing previous week's agenda items.
Arun S M: So this is the second time we are bringing the recommendation sheet that i'm showing currently to the tsa in the previous call I briefly discussed these 10 different action items or 10 different gaps that were identified and that we had to work on our words.
Arun S M: One of them is already considered and accepted from the tsa where we are mandating that each project should have representation and have a representative.
Arun S M: Who will be responsible, or who will be first point of contact for anything related to security and including fixes that are to be done, including issues that are reported.
Arun S M: and continuing on that discussion and I noted that there were a few open items from from the time that we last met last assembled on this topic.
Arun S M: field other topics that that are straightforward recommendations from the task forces to adopt some of these.
Arun S M: recommendations that are coming in from open systems right away so i'll defer to some of the comments are added over here, even within those bullet items for the discussion.
Arun S M: Point however i'll just cover different items that are to be adopted or as a recommendation that are coming in from openness.
Arun S M: One of them is the scorecard and I know we had different badging proposal last year and then we went through multiple iterations in discussing that so scorecard is kind of.
Arun S M: i'm going to score each project repository and through it takes us through a checklist and then make sure we are compliant and we are following some.
Arun S M: suggested recommendations which are good to follow from a security standpoint and there was a recommendation that there is no reason why we should not follow that becomes another metric for for us on how we utilize it, however, does the.
Arun S M: bigger picture or bigger point over there is.
Arun S M: It was related to how well each project is responding or reacting to the issues I didn't this kind of ties back to this point number seven that is written our in terms of responsible vulnerability disclosures.
Arun S M: One of the open item or bigger debating item that also came up in this week's Task Force meeting is also on how do we make sure each project.
Arun S M: Is is advancing on the issues that were reported right so.
Arun S M: This is where we need discussion within the thc and probably potential ideas on how that can be implemented across projects.
Arun S M: Are make I can just talk through some of the ideas that we had from the task force so one thing would be that.
Arun S M: CBS ought to be addressed, from the time they reported within 90 days of time if they are not addressed within that amount of time, then it will be made public and it kind of becomes.
Arun S M: kind of i'd say appraiser do the maintenance, that they will have to complete they are allowed to address this within 90 days and this.
Arun S M: They want everyone to know that something like this exist in the project which I don't think that should be done when it kind of forces everyone to do it, so this was one of the idea right so again this has to be there was a recommendation, there should be strict guidelines around how.
Arun S M: I mean the responsible disclosure element itself, so there are two angles to it the responsibility from within the project, and then the responsible disclosure aspect of it.
Arun S M: um.
Arun S M: So i'll probably pass away and, of course, there are a few other elements I mean we, we would like to definitely I want everyone's opinion or probably debate on this item and others non conflicting or straightforward items are with respect to the.
Arun S M: Release process which was open in the previous discussion, so there were discussions around this in not this week's call, but the previous week's call thanks to.
Arun S M: Item for all the inputs, I think usage is also suggested.
Arun S M: Not fabric team uses TV for all the production i'm not sure if it was fabric or at your workplace, but you are using three before scanning container images.
Arun S M: So idea was to have.
Arun S M: A pipe the verification or the reporting process or the identification process built in to the pipeline and.
Arun S M: In the CIA in both CD so.
Arun S M: In the release the artifact releases the binary releases that we are going to have it, even those are to be scanned I have given frequency and that frequency isn't it's not recommended from the task force.
Arun S M: Using tools like these rights of those artifacts could include the container images.
Arun S M: That was another straightforward item in a non.
Arun S M: What do I say there was no conflict of interest or deliver that thing that people would be contradicting to if we bring in that process.
Arun S M: And yeah I will take a pass here, probably would like to hear feedback on the scorecard and the vulnerability disclosure element.
Arun S M: But.
Tracy Kuhrt: So around for those of us that important Security Task Force I don't think that.
Tracy Kuhrt: there's been opportunity of time to review kind of these extra links from open ssl.
Tracy Kuhrt: With the vulnerability disclosures and the scorecard.
Tracy Kuhrt: I.
Tracy Kuhrt: guess you know from the Security Task Force perspective.
Tracy Kuhrt: The recommendation is on the this.
Tracy Kuhrt: vulnerability disclosures, the only real recommendation that I think I heard was the.
Tracy Kuhrt: CV East we published by the end of 90 days is there anything else in that link that.
Tracy Kuhrt: We would be needing to handle.
Arun S M: Okay um I would definitely recommend everyone to review the scorecard when it comes to the about element which is this vulnerability disclosures it mostly talks about the reasons and.
Arun S M: I believe it also has a collection of.
Arun S M: Some of the incidents are like series that were reported from the past, they are not from.
Arun S M: um yeah.
Arun S M: So this is something that natalie to review in terms of what needs to be reviewed, however, it is, is is fine over here the important aspect is in terms of.
Arun S M: Learning from the experience learning from what others have faced in the past and trying to understand at the best model that works for us so.
Arun S M: I would probably recommend to have a glance through if possible it's more of a retrospective way of understanding what happened and then, how do we make our processes better.
Arun S M: So, apart from this 90 days thing the scorecard was another.
Arun S M: proposal that came in from the recommendation right so.
Arun S M: um I don't know like do you want me to go through each element or here, or do you want.
Arun S M: To Members to give some give the same number some time so that they can go through it and come back with the debate or probably debate on this topic.
Arun S M: Just from a standpoint that.
Arun S M: What are the problems that computers are facing right now, or the maintenance are facing any Why would it be a challenge that.
Arun S M: Fixing something within 90 days is is not possible, or should we look into, for instance, the current release process because right now, like the lecture that's not have anything to say when it comes to release lifecycle up other than I think even that hard corrected me that that.
Arun S M: The release taxonomic thing is also not so tight right now right, I mean it's there is so much freedom from each project in terms of how they can.
Arun S M: proceed with the releases.
Arun S M: So there are multiple ways in which we can address this particular concern.
Arun S M: We can even tie this in with the release.
Arun S M: process itself, we can say that anytime a new project is releasing and if they are Monday release as let's say.
Arun S M: A major release or probably a release that they're going to support for a long time, then it becomes our responsibility from the hyper ledger foundation, because the release is happening under it under this umbrella projects.
Arun S M: So, if anything, gets reported than its responsibility or or anything that comes back would be named against the Foundation.
Arun S M: And not just a project as well, so I don't know about turning around that would also help benefit, I did not put those thoughts, because any thought here and affirmative response from from those who are on the call related to those topics.
Tracy Kuhrt: part.
Hart Montgomery: htc yeah thanks, so I think to sort of addressing your point, I think, are you know.
Hart Montgomery: I think the the plan today was to to go over some of the recommendations and then hear what people think, and then eventually package them in some kind of actionable.
Hart Montgomery: way that the you know, make an actual rule that the tasc can vote on, so I think that's the plan in the future.
Hart Montgomery: But you know.
Hart Montgomery: This is more of you know, these are the recommendations What do people think, and then you know, can we package these into rules will be coming so.
Tracy Kuhrt: Okay yeah thanks right.
Tracy Kuhrt: And I think that's the way my concern re.
Tracy Kuhrt: Obviously, have not attended any of this training Task Force calls.
Tracy Kuhrt: Do too complex and it so for me coming in kind of fresh and i'm sure there's other folks on the call can hear fresh air.
Tracy Kuhrt: To looking at this and not having clicked on any of these links, I like Okay, what do you want us to do right, so I guess the thing that you're asking for right now it's just commentary specifically on seven and eight.
Tracy Kuhrt: Not necessarily on the rest of them at this point, but eventually on the rest of these recommendations is that kind of where we're at for today's discussion.
Hart Montgomery: yeah well we'd love commentary on all of them, but sort of you know we've thought that.
Hart Montgomery: You know, seven is something that very much needs to be addressed, and you know it's easy to address.
Hart Montgomery: So you know our plan was to go over this and then.
Hart Montgomery: If people are okay, with it, you know, maybe in a couple of week or two will will propose a.
Hart Montgomery: Proposal rule now.
Hart Montgomery: Some of these have sort of already been the policy in theory but there's never been any enforcement and nothing has ever been done.
Hart Montgomery: But.
Hart Montgomery: Yes, I hope that makes sense.
Tracy Kuhrt: yeah.
Tracy Kuhrt: So I mean for number seven.
Tracy Kuhrt: Like I said, I think the one actionable item that I see, there is the the 90 days which, personally I don't have any sort of.
Tracy Kuhrt: commentary for other than to say, I think, whatever best practices that's what we should do and i'm assuming that OSS has the best practices and so therefore that 90 days is coming from them and there's probably the right direction to head for the for the scorecard.
Tracy Kuhrt: I guess the question that I have is right now we do.
Tracy Kuhrt: The only scorecard that I know that we're doing is.
Tracy Kuhrt: I forget what it's called because it's changed name but is this somehow different than the existing kind of self attested responses that we have for our projects to.
Tracy Kuhrt: To see that they're in a certain state is this only focused on security is, how is this different than is it, how does this.
Tracy Kuhrt: One benefit the projects and to benefit the hyper ledger foundation.
Tracy Kuhrt: And heart, I see you hit up.
Hart Montgomery: room, if you want to take over, please feel free to jump in.
Arun S M: And i'm looking for my on to based.
Hart Montgomery: I will say that yeah seven also involves about getting project contact point setup.
Hart Montgomery: So we think it would be you know good to require that you know graduated projects have security contacts.
Hart Montgomery: We plan on writing that down in a rule.
Hart Montgomery: As you know, as far as the the 90 days goes, yes, that is very much the standard beyond the open ssf even and it really would you like to talk about the scorecard.
Arun S M: Yes, I finally found my and icon.
Arun S M: So Tracy I guess you had a couple of questions in your previous ask in terms of scorecard I am not sure if you're asking about the CIA, by the way, earlier hot to a project is.
Arun S M: The one that you're.
Arun S M: Right, I think it was renamed and this scorecard captures.
Arun S M: element in addition to that, if i'm not wrong.
Arun S M: Right.
Arun S M: I need to go back to my notes sorry I will check the notes from one of the meetings i'm mature I think another question that you are asking, with respect to 90 days.
Arun S M: was an art also kind of brought up a separate committee, so now that we have representation from each project who's responsible to handle those issues what we were thinking is in terms of long term plan.
Arun S M: Have a committee set up and give focus more towards security aspects as well, and this needs to be kind of cross collaboration that may not necessarily be within the project but.
Arun S M: Try to address some of them cross projects and try to see how to handle them so in order to support that or encourage it, there was also discussed there were also discussions in terms of.
Arun S M: Stopping a project from graduate graduation and.
Arun S M: Unless they meet certain criteria and then this criteria evaluation happens through a committee which is again sell form with with this group, that we were talking about.
Arun S M: And so, again, there were a few other open items will will tsa be okay with it and with the.
Arun S M: shift towards to see rtc How would that be handled what kind of responsibilities would this particular group of Members would would have and.
Arun S M: What would they be making decisions on these are some of the open items that we could start debating in terms of how to handle it right.
Tracy Kuhrt: Okay, so back to the scorecard.
Tracy Kuhrt: So this is different than the open ssl.
Tracy Kuhrt: Best Practices badge that we have had projects going through, or is this.
Tracy Kuhrt: Is this the same night because the open ssl best practices badge has a security section in it so i'm curious like are we asking for more work from the projects is it you know how how much more work is it going to be for the project.
Arun S M: It would be nice if one of the project can volunteer and evaluate it.
Arun S M: And i'm happy to work through.
Arun S M: walkthrough on that right so there's one more action item that I personally have taken through through the task force that's to understand the current process so.
Arun S M: I have set up some time independently to discuss with the staff members itself to understand what do they go through and and what's the process involved and why.
Arun S M: Why did this question, even came up that we are talking about disclosing vulnerability at a cutoff date of 90 days and why is it take when taking that long for us if we know that it's a critical vulnerability so in terms of.
Arun S M: gold card.
Arun S M: i'm consulting for a meeting in which are supported by.
Arun S M: I see i'm not talking i'm sorry i'm not.
Arnaud Le Hors (IBM): yeah hi i'm talking yet, but.
Arnaud Le Hors (IBM): I mean, I wanted to answer directly tracy's question, I mean there is no current alignment between scorecard and the openness of badge and.
Arnaud Le Hors (IBM): So they are indeed the you know doing both requires more effort than doing one or the other.
Tracy Kuhrt: I think so yeah and I was trying to quickly scroll through this scorecard.
Tracy Kuhrt: It looks like the there's some recommendations around from github actions of products can run to kind of get their score for this scorecard.
Tracy Kuhrt: And I guess you know.
Tracy Kuhrt: I i'm thinking about in the past where we've done things where we've tried to make things easier for the projects and the projects have pushed back.
Tracy Kuhrt: As far as you know, they don't want to do that or it's it's you know the.
Tracy Kuhrt: tools that we have is very specific to a particular language or Whatever the case may be right and and so i'm I just want to see like how.
Tracy Kuhrt: sure we are of this recommendation that the projects are actually going to think that this is useful versus it's painful for them to do this.
Tracy Kuhrt: I mean no way suggesting that security is about thing here right i'm just trying to think about in the past what's happening within hyper ledger different projects where we've you know put down requirements for running particular tools.
Arnaud Le Hors (IBM): I agree, I think you bring a very good point there and and I just wanted to explain a little bit the bag right, I mean open ssl badges are basically renamed the CCI badges we've known for a long time and.
Arnaud Le Hors (IBM): And the scorecard is a new tool that was developed initially by Google, and so there is they don't share the same routes at all, and we can hope that open ssf eventually will try to get all these things neatly aligned but it's clearly not the case.
Arnaud Le Hors (IBM): They have different origins and they actually maintained by different groups and openness, they said so.
Tracy Kuhrt: heart.
Hart Montgomery: yeah so Tracy you bring up a great point about.
Hart Montgomery: Things being you know easy and low.
Hart Montgomery: I guess low work for projects, so what the the plan going forward is is, we would like the tlc to sort of look over all of these recommendations.
Hart Montgomery: And as a starting point, we want to put together, you know, a list of some of the easiest and highest impact ones to implement right, and then we will put those for approval for the tasc.
Hart Montgomery: This is, you know, obviously going to be an ongoing process and some of the things are going to you know take quite a while to.
Hart Montgomery: To put in practice and something like the ssf scorecard which is you know, not even I would say, not even a complete effort at this point, might not be one of the first things we do right.
Hart Montgomery: We may want to let that mature a little bit before we asked projects to do it, for instance, and there are a number of other things on this list that.
Hart Montgomery: We probably aren't going to want to do immediately, but we would like to see long term does that make sense.
Tracy Kuhrt: yeah.
Tracy Kuhrt: i'm just trying to see how we can help move this discussion forward.
Tracy Kuhrt: Right, for your for something to come back here to the etc for for vote so trying to really understand and hoping that this discussion is useful for others as well, since i'm the only one who's who's asking the questions at this point.
Hart Montgomery: I think a lot of people probably have questions, but here, so thank you for asking them.
Tracy Kuhrt: anybody else have any thoughts on this Hello.
Angelo De Caro: I like this to be honest, this this idea of discourse maybe in the sense, maybe that is also something that guidelines that we can find are specific for blockchain.
Angelo De Caro: And that will be interesting, can we ask a volunteer so the beginning, maybe we don't force, but we have a bit of a first period where we as volunteers from the projects, I don't know fabric.
Angelo De Caro: Maybe you can volunteer well I don't want to put it.
Angelo De Caro: In I put myself in the shoes of Dave or not, but to be the Samsung sounds very interesting as a as an idiot and maybe you can be a good point of reference reference point for also for the for the clients for the enterprise or looking for.
Angelo De Caro: I mean for some handles I really like this.
Hart Montgomery: Sorry, I forgot to take my head down.
Tracy Kuhrt: Oh okay.
Tracy Kuhrt: Well, that came back up.
Tracy Kuhrt: We take it down and then the big you did perfect.
Tracy Kuhrt: Worries any other comments.
Tracy Kuhrt: Come.
Kamlesh Nagware: yeah it is clearly like this, I think this is a need to be committed foundation project because, even in me in the hybrid India we.
Kamlesh Nagware: kind of responded to a couple of inquiries, where people are using the project same.
Kamlesh Nagware: As about the kind of vulnerabilities in the hyper ledger codes under time, I think we don't have some some some kind of framework or some girls recommendation feel available.
Kamlesh Nagware: Then we as a Community can share or maybe the people who are using the progress can get confidence like hyper ledger police pulling the particular so miss gender and some some guidelines and ensuring the security aspect of the predicts as in this good initiative.
Tracy Kuhrt: Thanks, so much so, I have a follow up question, which is, I think, somewhere, as you were scrolling everyone, I noticed something about projects moving incubation to graduate.
Tracy Kuhrt: And so i'm curious as to security is not a one and done type thing right as security changes as the code changes.
Tracy Kuhrt: And so what sort of.
Tracy Kuhrt: expectation, do we have for.
Tracy Kuhrt: The scorecard remain up to date and as the code changes, you know the reevaluation happening to ensure that no security issues have been created slash added slash whatever right to to the storage space.
Arun S M: Tourists either to the question um.
Arun S M: I don't think so we discussed on that aspect, but we were still thinking, if such a thing would be accepted by the tsa or not, if.
Arun S M: We think we need to go in that direction, then it's definitely we will start thinking in the next upcoming call it i'll bring this topic up again and in terms of what we were thinking just for a regular cadence I believe I don't know so there were.
Arun S M: In terms of it was tying back again to the standard processes that we were following and and how do we.
Arun S M: Make sure that we're following those processes right so.
Arun S M: So I had two thoughts are on day one is with respect to apart from the process itself in in terms of how well, a project is going to handle in when something is reported how well are we responding back to those even those metrics are to be captured.
Arun S M: um but yeah we haven't had a chance to discuss go deep into this direction and i'm thinking that we were not sure if something like this would be accepted.
Tracy Kuhrt: yeah I mean, I do think that you know the considerations as far as the cadence or.
Tracy Kuhrt: When this gets reported how often that's good smoke, that is important, I I just don't think that we can say that it's a static we've done this when we moved to graduation and so therefore we're we're done in whenever we're going to look at security and.
Tracy Kuhrt: that's that's the piece that I would think through what makes sense, again with the the caveat of.
Tracy Kuhrt: How do we ensure that we're not.
Tracy Kuhrt: causing more work for the projects and they actually need to be going through right is it every time they do a release, they have to do this is it.
Tracy Kuhrt: You know, once a year, they have to do this, you know I don't know what the right cadence is, but I think there is a cadence and we have to understand how that impacts, the different projects Angela.
Angelo De Caro: But, for example, I will definitely would like to have an update when there is a long term release long term support release.
Angelo De Caro: That, I would like to see that an update on the score that I don't like I don't need to see an update on.
Angelo De Caro: The day the day to day commit because that I, as a company, I will, I will not take that I will not use that the those commits those temporary can commit so I don't expect to see the the score on evaluated the main branch.
Angelo De Caro: That that's for sure I wouldn't expect that.
Angelo De Caro: Okay.
Tracy Kuhrt: All right.
Arun S M: Interesting you know, we did not explicitly discussed going this far, assuming that.
Arun S M: We would not even sure if we were going to adopt a policy that would stop projects from graduating.
Arun S M: So if we want to go down that direction, then one of the thought process at least it came in this week's and called board.
Arun S M: In terms of than 90 days boundary that we were to put what if projects don't follow up on that in that given boundary so there were discussions were probably we should bring down that project from graduated to incubating.
Arun S M: Large.
Arun S M: That was one of the way.
Arun S M: We were discussing in terms of how can we make sure that projects understand that this is important at the same time we don't put in too much pressure in and going and taking the drastic measures.
Tracy Kuhrt: That one get a lot of henry's is.
Bobbi Muscara: Well, I know that we're working at the task force for the documentation and we're having running into the same issue like when is it.
Bobbi Muscara: required information from each one of the projects when is it suggested information and what's the cadence for the update so.
Bobbi Muscara: I mean, maybe there needs to be some kind of system in place for the projects to you know, maybe with the new release or yearly check in and say yeah all this stuff is updated.
Troy Ronda: yeah I was just commenting on the idea of.
Troy Ronda: Moving graduated projects to incubate it, I think we should be careful, throwing up those kind of ideas that's extremely drastic.
Troy Ronda: You.
Tracy Kuhrt: know.
Arnaud Le Hors (IBM): yeah I guess i'm kind of in the same you know thought here I mean I you know before we get into discussing punitive.
Arnaud Le Hors (IBM): actions against projects, I think you know it would already go some ways to come up with clear recommendations instructions for the projects to follow.
Arnaud Le Hors (IBM): And then you know we can see how much uptake response we get and if really there are projects that seem to be reluctant, we need to try to understand why.
Arnaud Le Hors (IBM): And only once, you know we've gone through the whole process of ensuring Okay, this is really something people must do.
Arnaud Le Hors (IBM): We should think about you know this kind of action, I think, for now, I mean we haven't had any policies we have been setting expectations.
Arnaud Le Hors (IBM): Even though some might feel like a this is, you know part of this should have been taken care of by any you know reasonable project I think again, for now, we should just lay the ground, so to speak, and what what project should do.
Tracy Kuhrt: Okay, thanks Angela.
Angelo De Caro: yeah, so I will start by saying that I don't like, but the paternalistic approach, so I think we should not mandate anything specific but.
Angelo De Caro: In this coach, who is the target of the score, these are the possible clients so possible users of these enterprise.
Angelo De Caro: The Center so they will they will be the one pushing for having this course, so if a project doesn't update the scoring or doesn't update this.
Angelo De Caro: They will just lose tracking because they will cry enterprise, we prefer other block chains that.
Angelo De Caro: Are other tools will are keeping up with the scoring thing, and so on, so in case I guess our guidelines, I would expect guidelines and say, if you as a project you think that, for your clients for.
Angelo De Caro: New potential clients, this is a good thing follow these guidelines, if you don't want to follow up to you, I mean, then you, we are on the market.
Tracy Kuhrt: Right.
Hart Montgomery: yeah so so a couple of carpets answer though I think you're thinking like a security professional and I wish more people analyzed situations like you.
Hart Montgomery: Then again, if you look at how much money some say people dumped into the iota cryptocurrency with their hash function if you recall i'm not sure everyone makes these educated decisions.
Hart Montgomery: To our nose point we don't want to you know sort of immediately throw out, you know everything under the sun.
Hart Montgomery: We want to you know sort of slow roll these things out piece by piece right, so any kind of binding rules or anything we want to you know we plan on moving a little bit at a time.
Hart Montgomery: And as far as you know.
Hart Montgomery: Active projects goes, you know if a project is not responding to their security vulnerability reports, you know, should we really consider them an active project, you know I mean, I think, at some point we have to draw a line in the sand there.
Hart Montgomery: Oh.
Troy Ronda: yeah I mean I hear that it's just you know it's some point we have to also be worried about.
Troy Ronda: yeah meet me painters time and interest and not every project and hyper ledger is a blockchain.
Troy Ronda: For example, areas is a set of umbrella projects and i'm not sure how you know these ideas about kicking things out of active would actually work for all the projects across hyper ledger so.
Troy Ronda: I again urge caution on these kind of ideas of.
Troy Ronda: Punitive measures.
Troy Ronda: Where containers may start losing interest in in hyper ledger rate.
Tracy Kuhrt: Right.
Arun S M: Right, so I think that's.
Arun S M: The reason I did not mention this particular thing in the very beginning, is to avoid these kind of discussions, I understand.
Arun S M: All projects, they were we work hard to get them into the stage where we, we are currently and then.
Arun S M: From the intention old intention over here is to understand what is blocking in from from addressing some of the critical vulnerabilities versus prioritizing them as opposed to like, for instance.
Arun S M: We know the capital projects are being worked on and when when we know.
Arun S M: That if we understand that this particular issue would take us to redesign certain elements and that would take more than 90 days So yes, that is understandable so.
Arun S M: They will be, of course, provision so it's it's not it was just a thought process like it should be it won't be to that level for sure.
Arun S M: But there will be some recommendations which will come in a way which will allow.
Arun S M: A pathway where project teams can explain why certain thing is taking longer than expected and allow them to discuss through their.
Arun S M: scenario and, if needed, see if we can get some help from some other place so it's more to understand what's happening and then.
Arun S M: um I would probably also request this quorum, now that we are understanding the intensity of the of the issue of for any such suggestions that you may have what.
Arun S M: What might benefit each project right so.
Arun S M: I think it's good if we can also bring in those ideas, if you can share those ideas that you might have it will definitely help us.
Tracy Kuhrt: Any other thoughts or comments.
Tracy Kuhrt: I think one thing that I heard in.
Tracy Kuhrt: The discussion where we just had, is that.
Tracy Kuhrt: People want guidelines not mandates, which I think is very much on point with where we have been in the past with our history for the technical steering committee so just maybe take that into consideration as you move forward with this part.
Hart Montgomery: So I will say that pretty much all these rules have been stated as guidelines for quite some time, like the 90 day thing has been in the security guidelines since I want to say 2017 or 2018.
Hart Montgomery: And at some point, you know.
Hart Montgomery: Well, we have to ask if these guidelines are being effective.
Tracy Kuhrt: yeah and.
Tracy Kuhrt: The question there, I think you know 2017 we had a What was it by projects or something like that.
Tracy Kuhrt: we've increased since that point, have we done a good job of communicating what what guidelines exist when we onboard new projects i'm not sure that we've done a great job of that in the past and so maybe that's a you know, a question of how do we, how do we do a better job of.
Tracy Kuhrt: Bringing along the history to new joiners new contributors new mean caterers new projects as they come into the hyper ledger foundation.
Hart Montgomery: Totally you're absolutely right, and I also want to emphasize that we don't want to you know just sort of dump a bunch of mandates out on the Community right anything that we mandate would would be sort of.
Hart Montgomery: Slow rolled if that's the right word, you know we'd want to you know we don't want to take.
Hart Montgomery: We don't want to do this sort of all in one big massive chunk right, we want to do a little by little by little.
Hart Montgomery: So something like our first mandate that we would want to see would be that every project would have to maintain owners or two people on the security.
Hart Montgomery: Vote the security list for hyper ledger right, so this is how you this is how you know if someone.
Hart Montgomery: files a bug or post something on hacker one this is how you get it right, and this is sort of like a very minimum low bar, you know, and I would be surprised if anyone were against sort of this being a mandate right.
Hart Montgomery: Because it is such a low bar and it is something that you know projects would really have so we don't want to you know start with massive mandates, we want to start with sort of you know, small easy things like that.
Hart Montgomery: And then we can gradually you know if things go well, introduce more stringent requirements, I hope this makes sense to everybody.
Nathan George: yeah I just think of what this would have done to a project like borough where you know they might have had.
Nathan George: A few maintain owners, but some of the maintains were a bit of a stretch because they were trying really hard to grow and recruit more contributors and and.
Nathan George: And we're struggling to do so, and so you know I I don't think it's a question of reasonableness I think it's a question of you know how do we make these guidelines to where they.
Nathan George: They help grow the project and we help make and show clear value or we use them as a marketing tool, or we we do things to try to align these.
Nathan George: Extra steps with things that help bring customers in or help bring contributors in and hopefully convert them to maintain owners and that that's where some of these steps.
Nathan George: They feel reasonable when we think Oh well, everyone has plenty of time to do them, but when we're kind of in the middle of one of those projects that's that's kind of trying to get that traction it can be hard to meet all these check boxes at once.
Hart Montgomery: So Nathan borough was never an active project, so I don't think this would have ever applied to borough.
Hart Montgomery: And I don't think this is meant to apply to you know projects that are getting started this is more of a steady state, you know long term, you know your project is in production, so we need to have confidence and its security kind of thing.
Hart Montgomery: Does that answer the.
Hart Montgomery: The comment.
Nathan George: It helps um it just it feels like we're.
Nathan George: we're adding enough requirements that we need to acknowledge that it creates more distance for those projects to cover to get where they're trying to go.
Tracy Kuhrt: Right.
Troy Ronda: yeah I you know, of course, with Nathan there.
Troy Ronda: I am worried that we're not using enough perspective from the containers and.
Troy Ronda: On these discussions right.
Troy Ronda: I am worried about the same points about the loss of interest lost lost momentum is not just about this thing right it's just in general, the shift from.
Troy Ronda: kind of.
Troy Ronda: The coders voice to not is is is something we should be careful about.
Troy Ronda: In in trying to attract projects and people's time.
Tracy Kuhrt: might be worth the task force reaching out to the maintainer mailing list or the maintainer chat channel to have some of these conversations, to see if there's other sorts of input that like.
Tracy Kuhrt: Like provided different perspective or idea or.
Arun S M: i'm just wanted to understand the last concern that Troy raised is it more to understand, I mean is, it is it right you're asking how do we differentiate.
Arun S M: Any issue against a CV or is it on the other, spectrum like on it is determined to be as a CV.
Arun S M: Like, how do we protect our maintenance from having to do something in a given time.
Troy Ronda: So it was just a general is just a general.
Troy Ronda: comment that.
Troy Ronda: I am worried that you know we're kind of shifting from.
Troy Ronda: The the guidelines and growing projects and using the coders voice on on, for example, the tlc and shifting to.
Troy Ronda: less so, and I think the less that the coders voices is here.
Troy Ronda: The more trouble we will have growing projects and attracting interest so just a general comment that.
Troy Ronda: I am a little concerned.
Arun S M: Show thanks.
Tracy Kuhrt: Any other comments or feedback for the security test worse my condition open sharing with us.
Tracy Kuhrt: A real heart any questions that you have specifically for the thc that we can answer that we haven't already talked about.
Arun S M: The wood tcp oh sorry at Peter is fine i'll go next if it.
Peter Somogyvari: Just one last quick comment.
Peter Somogyvari: On I think.
Peter Somogyvari: The theme is here from people's comments, is that some people say oh yeah, we need better security may improve some people say Okay, but we don't want.
Peter Somogyvari: That to cost us maintain owners who would otherwise be willing to be maintainer so contributors, but then because of the security.
Peter Somogyvari: process David just shy away from hyper ledger.
Peter Somogyvari: So I see both points being made.
Peter Somogyvari: And then my full on that is.
Peter Somogyvari: That we should keep this in mind, as a guest the mandates should not be too harsh.
Peter Somogyvari: But all this will also keep in mind that.
Peter Somogyvari: There is a bar there has to be Sir it's just a matter of where we set it and then variable reset it should really be the level there.
Peter Somogyvari: They actually are confident saying well, if you want it to be a maintainer but you think this security bar is too high, then maybe it's better for everyone if if it's not happening actually.
Peter Somogyvari: So that then we all have to be sort of confident and believing this.
Peter Somogyvari: And then that way, this question this conundrum can be resolved in my opinion, in a way that everybody satisfied with it.
Peter Somogyvari: So it's a it's a gradual thing and.
Peter Somogyvari: They can set the bar got variable will be wanting, so I think we should focus on.
Peter Somogyvari: Not better mandates are needed at all or not because I would say, there has to be some.
Peter Somogyvari: But then we can we can keep working on very abortion with these mandates.
Peter Somogyvari: Because there is a version of events where the bar is too high, and then they lose valuable.
Peter Somogyvari: Before who would have been great maintain years and they would have put in some effort in security just maybe not the extreme that we said but there's also a version of events where there's no bar at all.
Peter Somogyvari: And then, some people end up being maintainer some religious did not care about security at all, and I would try us to focus on staying somewhere in the middle, which is the optimal.
Thank you.
Hart Montgomery: yeah thanks for the comments Peter, and I want to reassure everyone that in all these meetings.
Hart Montgomery: You know any mandates that we've talked about are extremely minimal the bar has been extremely low and it's been sort of things that.
Hart Montgomery: You think about it here like you know if something if some project didn't do something you'd be like wow that's really bad that's embarrassing.
Hart Montgomery: You know we're not we're not we don't want to start with a high bar, we want to start with something very, very low and very easy.
Hart Montgomery: And we have talked to maintain owners and we have taken into account, you know how much extra work that these things would involve for maintainer and you know we do want to keep that is as small as possible.
Hart Montgomery: So, so we have you know, a ruin is is leading this and doing a great job and we have addressed, we have thought about these issues and we don't want to scare anyone away with a too high, bar.
Hart Montgomery: So I hope that all makes sense.
Tracy Kuhrt: on time.
Tracy Kuhrt: Time.
Troy Ronda: yeah I mean I think everybody I shouldn't say everybody, but I think most will say security is important and.
Troy Ronda: You know track tracking these these issues is important, and you know the downstream organizations that use these projects will probably agree with that.
Troy Ronda: What we're should.
Troy Ronda: But, but in some other ways, it will also drive you know the utility and the usefulness of these projects by these organizations and if they're not doing these things in the projects will be used right so.
Troy Ronda: There is alternatives to the tasc.
Troy Ronda: Trying to have unified uniform.
Troy Ronda: High bars across all projects where it may make less sense, in certain cases right so that's that's kind of the problem with, I think.
Troy Ronda: Setting the the the unified bar for for everybody, when these projects or even all in the same category so again like security is important tracking these things is important, especially in production organizations downstream from it will push from it.
Troy Ronda: Besides, besides these kind of goals, but I think.
Troy Ronda: You know.
Troy Ronda: Keeping the maintainer is on board is is is is quite important and getting momentum is quite important traits so.
Troy Ronda: It is tricky but uniform rules, I don't know that always works right so that's why guidelines is kind of a interesting way to be and yeah obviously things embarrassing should should be, it should be addressed.
Hart Montgomery: yeah so try that those are all good points, and these have come up in our Security Task Force meetings, obviously, like you know, a blockchain explorer is going to need different security scrutiny.
Hart Montgomery: than you know, a block chain itself right or cryptographic library or something like that.
Hart Montgomery: You know we've thought about this, we have discussed this extensively, so I think you know we.
Hart Montgomery: This is not something that we haven't considered.
Hart Montgomery: You know, even if it I guess didn't make it into the recommendations document, but if you or anyone else you know is interested in this stuff and wants to talk about these issues i'd highly.
Hart Montgomery: recommend coming to a task force meeting because I think a lot of the questions today we actually have addressed and have talked about in the task force meetings and they you know just they haven't percolated up to this document.
Troy Ronda: yeah I mean that's just I think I got triggered and maybe others to on the you know.
Troy Ronda: The offhand comment about downgrading projects where we're clear that that's that turns from.
Troy Ronda: You know not not a discussion about fixing embarrassing things but to setting very high bars and being punitive rate and that when when it's when it's or something like that I think people's hairs go up right.
Hart Montgomery: And, but you know we're just we just want to ask for like you know very minimal things right, you know we don't want to we don't want to punish anyone who's you know trying right.
Hart Montgomery: So, so I think you know what we'll come up with something more concrete, I think, then these recommendations, and I think people will see that this is not like you know being punitive is not the goal right, we want to just we went to incentivize people to do the right thing.
Hart Montgomery: So when we don't want to punish people for trying so, so I hope this I hope this makes sense, and I hope, like.
Hart Montgomery: You know if if we can come back with sort of you know more concrete things that the tasc can actually vote on that that people will see that they're not you know excessively punitive and I don't think that a lot of these worries will.
Hart Montgomery: will come to fruition.
Tracy Kuhrt: Peter.
Peter Somogyvari: Thus, I just wanted to agree with heart and try to also say it a different way that I just for us, which is that.
Peter Somogyvari: Probably what we want to.
Peter Somogyvari: avoid or protect against is this sort of legal term that I heard, which is gross negligence when.
Peter Somogyvari: People cause some big trouble just by not giving at least a little bit of attention to something.
Peter Somogyvari: So I think.
Peter Somogyvari: If if if you phrase it that way, then everyone can agree that we should try to prevent those cases, you know if if there's a dlp project within hyper ledger.
Peter Somogyvari: We should try to prevent issues they're huge amounts of money, money will be lost in a production deployment because someone didn't take five minutes to double check something.
Peter Somogyvari: So I think the scope, if you think about it that way, then.
Peter Somogyvari: It becomes visible why, at least a little bit of something is necessary.
that's it Thank you.
Tracy Kuhrt: All right.
Tracy Kuhrt: Well, with that I think we're just about.
Tracy Kuhrt: At the top of the hour, I appreciate all the thoughts in the comments and i'm sure the Security Task Force does as well.
Tracy Kuhrt: I heard a room, thank you for bringing this to us and we look forward to having some concrete guidelines being brought forward to the tasc in the future.
Tracy Kuhrt: For us to have a look at and commit and hopefully work through the the process of deciding whether or not.
Tracy Kuhrt: The guideline is something that we want to bring to the different hyper ledger projects so with that i'm going to close today's meeting, thank you all for your time and we will talk again soon.
Hart Montgomery: Excellent Tracy.