Arun S M: Right.
Arun S M: So today's discussion will be on concrete proposals for the scorecard and responsible vulnerability disclosure, at the same time, we will also try to see.
Arun S M: If we can come up with a concrete proposal on how we can adopt our proposed three way to be added for any scan like we are planning to do for the baby jars right or built binaries, not just for josh for all the container images and every package like we generate.
Arun S M: So yeah that's that's probably going to be the agenda for today on bringing up to concrete proposals that Casey can vote on.
Peter Somogyvari: yeah I think.
Peter Somogyvari: Although the first question is already proposing.
Peter Somogyvari: recommendations and requirements are both because I think we wanted some.
Peter Somogyvari: Some of the things we wanted them to be actual requirements right.
Arun S M: Right.
Arun S M: In the previous.
Arun S M: Call I think.
Arun S M: You were also the right so when we when we brought these recommendations, and I think, since many of them were not part of the task force, they generally had a concern that a we don't know these topics, so we don't know what we are debating on.
Arun S M: And the other thing that came up in the meeting was when we say we are adopting scorecard what is the impact of type on maintenance and what are we in terms of requirement as a side, what are we expecting project maintenance to do, in addition to what they're already working on.
Arun S M: Like is the other bigger topic that like to most of the time was around.
Arun S M: When we said, like we want to bring in.
Arun S M: kind of punitive measures checks in case somebody is not addressing.
Arun S M: On the CBS on priority, or maybe even after repeated calls.
Peter Somogyvari: yeah.
Peter Somogyvari: yeah I still think that some level of.
Peter Somogyvari: requirements is warranted.
Peter Somogyvari: Just hard to pin down what's the optimal level for it.
Peter Somogyvari: So it's not discouraging.
Peter Somogyvari: People from joining, but at the same time, it does have to.
Peter Somogyvari: push everyone to.
Peter Somogyvari: To actually care.
Peter Somogyvari: And then.
Peter Somogyvari: yeah if we if we set the bar too high.
Peter Somogyvari: There lower in the thc or not enough people in DC will support it.
Peter Somogyvari: But if it's too low, then it's kind of pointless.
Peter Somogyvari: So where do we said that for.
Arun S M: The what is our English, you know what is our goal with setting the bar whatever intending to say by setting the bar is it to improve the code or do we all.
Arun S M: have some other intention, like in terms of getting that let's say like hyper ledger has the best policy in terms of security So what are we aiming towards I think that's good we are.
Arun S M: Measuring metric for us to know like where we are setting the bar and how we are progressing.
What do.
Peter Somogyvari: I say the number one thing for me that we're trying to avoid is.
Peter Somogyvari: Some high profile vulnerability that gets exploited actively in the violent option.
Peter Somogyvari: That is not just.
Peter Somogyvari: A high profile or ability that gets exploited, but.
Peter Somogyvari: it's also an easily preventable one.
Peter Somogyvari: So.
Peter Somogyvari: If if you have a bug give me, you will always have high profile vulnerabilities that are exploited, but.
Peter Somogyvari: The difference in my mind is, you can have on that would have been trivial to prevent if you just put in some legwork.
Peter Somogyvari: And then there's the ones that are a combination of different things happening at the same time I am you know perfect storm kind of thing where.
Peter Somogyvari: Where you kind of just throw your hands up and say well.
Peter Somogyvari: This would have been extremely hard to prevent, because if you look at what happened in hindsight, even in hindsight you're like I don't know what I would have done better to actually plan this so.
Peter Somogyvari: On this spectrum.
Peter Somogyvari: I would aim to just prevent least.
Peter Somogyvari: The ones that are low hanging fruit like we don't want to give the attackers see.
Peter Somogyvari: Low hanging fruit, with serious liabilities that's the one class where.
Peter Somogyvari: I think we.
Peter Somogyvari: want to.
Peter Somogyvari: push a little more on trying to encourage people to.
Peter Somogyvari: not let that happen.
Peter Somogyvari: And then here's one more idea.
Peter Somogyvari: But sorry my free to type.
Arun S M: You can continue.
Arun S M: boot to finish up the sentences later and do that.
Peter Somogyvari: Okay, so i've always high profile herbal tea getting exploited or the laws that are trained, you know.
Peter Somogyvari: I wouldn't say or I would say.
Peter Somogyvari: avoid the high profile vulnerabilities that are trivial.
Peter Somogyvari: So.
Peter Somogyvari: They are it's an end relationship.
Peter Somogyvari: Yes.
Peter Somogyvari: aka the low hanging fruit.
Arun S M: I think that intending right, so one means argue that longing one sorry probably low priority.
Peter Somogyvari: yeah.
Peter Somogyvari: and
Peter Somogyvari: And then the question is how do we define.
Peter Somogyvari: Think.
Peter Somogyvari: Failure to address, I mean.
Peter Somogyvari: Why don't we just start with a badge or some sort.
Peter Somogyvari: Instead of getting aggressive and try to get people out or punish them or whatever.
Arun S M: I mean, we have a bag stacked will be taken away from the project.
Yes.
Peter Somogyvari: And then later on, if we want to crank it up.
Peter Somogyvari: Okay, can turn that badge into a requirement for being an active project.
Peter Somogyvari: But I feel like maybe if you start slower, it will have more support.
Arun S M: So are we saying that every project will be.
Arun S M: Given with a badge when they graduate.
Peter Somogyvari: or and a incubator.
Arun S M: Okay, we should a badge for best practice in CV addressing.
Arun S M: incubate.
Arun S M: Like six months.
Peter Somogyvari: Well, until they addressed.
Arun S M: There is no point right, I mean.
Arun S M: So this is not.
Once.
Arun S M: Right, so this is not a punishment right so probably we can block them from getting the badge so should be felt like it's hard to under badge and they should be, they should they should be willing to on the bike.
Peter Somogyvari: And then one more thing is that.
Peter Somogyvari: Instead of mentioning CVs in general.
Peter Somogyvari: I would say, only this whole thing only make matters for.
Peter Somogyvari: stevie's above a certain score threshold.
Peter Somogyvari: Because the low.
Peter Somogyvari: severity vulnerabilities.
Peter Somogyvari: As much as those are still vulnerabilities they are low severity.
Peter Somogyvari: So.
Peter Somogyvari: let's focus on the importance of just to you know narrow the scope and.
Peter Somogyvari: Make it that sound like a huge chore to.
Arun S M: really know.
Arun S M: what's the threshold that we are planning to consider.
Peter Somogyvari: i'm going to propose a score of seven but.
Peter Somogyvari: I will.
Peter Somogyvari: update that later if your heart or anyone thinks that maybe it's.
Peter Somogyvari: Better to have a lower or higher score.
Peter Somogyvari: And I would say, only the CVs crossing certain thresholds are considered.
Peter Somogyvari: Just to make sure to people get it.
Peter Somogyvari: And then I will also, I would even put it in the first line.
Peter Somogyvari: Like in the.
Peter Somogyvari: Sorry, not.
Peter Somogyvari: They actually yeah.
Peter Somogyvari: And then say projects to address high severity see ease.
Peter Somogyvari: or norm, instead of high severity just.
Peter Somogyvari: Create or equal seven.
Peter Somogyvari: yeah.
Peter Somogyvari: And then the other thing that I think we should put in a concrete proposal is to have.
Peter Somogyvari: To every project should have one security person.
Peter Somogyvari: That they.
want.
Peter Somogyvari: So we already have that.
Arun S M: As we most recently.
Peter Somogyvari: And then.
Peter Somogyvari: It should be the security.
Peter Somogyvari: Council committee.
Peter Somogyvari: Of those security representatives.
Peter Somogyvari: Who should.
Peter Somogyvari: decide.
Peter Somogyvari: Whether.
Peter Somogyvari: The project could have a badge or not.
Arun S M: Okay, so it's the Arden no talking about back.
Peter Somogyvari: yeah surely deterministic.
Arun S M: shouldn't that be a deterministic the approach than relying on a group of people.
Peter Somogyvari: can make it automated.
Peter Somogyvari: Then yeah.
Peter Somogyvari: Okay, but then we have to say exactly how whichever.
Peter Somogyvari: So do we count.
Peter Somogyvari: Only dependable alerts or.
Peter Somogyvari: or all the github reported sees.
Arun S M: them, maybe the metric is based on already reported, I think we should go with the benefit of doubt, and our project wants to incubate.
Arun S M: We should let.
Arun S M: Whenever a project is incubated we should give benefit of doubt that the project will have best practices in place.
Arun S M: And, in case the project does not follow the best practices recommended only than the actual record and, until then, like badges given to them on benefit of doubt sing assuming that the project maintenance will be behaving as expected.
Arun S M: Maybe only if project maintenance or not feeling that incentivized that's when we pitch in and say hey.
Arun S M: This badge probably does not make sense, because the project is not following best practices for us these vulnerabilities are important to be fixed addressed, so we are revoking it for six months or so.
Peter Somogyvari: Okay, but who's the in this equation.
Arun S M: Should that be a tlc maybe that's one question that we can ask in an all the reports are probably it could be an automated alert saying that these miniseries or reported and these many word trust in the quarterly reports.
Peter Somogyvari: Okay, we can make it self reported.
Peter Somogyvari: Okay, I like that yeah.
Peter Somogyvari: We can put so then a concrete proposal is put a question and quarterly report.
Peter Somogyvari: That says how many high severity vulnerabilities do you have in your could be code base currently.
Arun S M: So do you think this is a metric tied to publishing the quarterly report, the number of CVs and their scores.
Arun S M: Even before this 90 days limit.
Arun S M: I mean interesting.
Peter Somogyvari: Well, you could you could make the argument that we don't want the public.
Peter Somogyvari: Okay.
Arun S M: Maybe then it becomes like a previous quarters.
Arun S M: Right.
Peter Somogyvari: yeah but.
Peter Somogyvari: Then we won't know about it until it's too late, anyway, I.
Arun S M: Think it's it's kind of a reminder for the projects in the quarterly report when they try to fill the question is.
Arun S M: Did you have any CV which were not fixed beyond 90 days in the previous quarter, the answer is, then, we asked them the matrix because, by then, it would have been publicly disclosed already and we can then evaluate the criticality of that that the scores of that CV.
Arun S M: And, based on the score, we know with the project is healthy or probably then tasc can decide choose to.
Arun S M: To move remove the batch.
Peter Somogyvari: yeah right Okay, but let's specify high severity, he was all.
Arun S M: I don't want maybe hear me.
Peter Somogyvari: I don't want it on.
TV.
Peter Somogyvari: Sorry go ahead.
Arun S M: Sorry.
Arun S M: I understand your concern that you don't want projects to be to feel threatened and like how many CBS do you do have you seen so far, like that gets reported as it too large and don't assume it to be right it's it could be like feel comfortable numbers.
Peter Somogyvari: Well, on cactus we get dozens of low severity ones that.
Peter Somogyvari: Are from dependencies that are slower.
Peter Somogyvari: to fix the vulnerabilities because it actually boils down to a dependency of a dependency of a dependency.
Peter Somogyvari: And then that makes it so when it's a low priority severe so it's a low severity thing.
Peter Somogyvari: Then the very last dependency fixes first and it releases it, but then the other one upgrades and you know it bubbles up the tree the dependency tree.
Peter Somogyvari: But because it's low severity people are not really rushing it.
Peter Somogyvari: And then, with deep dependency trees, this can boil over to more than 90 days so that's why.
Peter Somogyvari: I don't want it tip.
Peter Somogyvari: about low severity stuff because of.
Peter Somogyvari: The goal being to avoid high profile or abilities that would have been trivial to fix.
Peter Somogyvari: And then the low severity vulnerabilities stone.
Peter Somogyvari: fit into the picture because.
Peter Somogyvari: By the, by definition, they are low severity so it's not an RC or.
Peter Somogyvari: anything like that.
Arun S M: So we are seeing the proposal is that a question will be introduced.
Arun S M: In the quarterly reports that each contract.
Arun S M: shall answer.
Arun S M: The question.
Arun S M: will be to understand.
Arun S M: It they're bored.
Arun S M: I see we already.
Arun S M: see me as.
Peter Somogyvari: An address.
Peter Somogyvari: In the previous quarter.
Arun S M: As in this.
Arun S M: proposal.
Arun S M: If it is.
Arun S M: not trust.
Arun S M: In the previous quarter chores.
Peter Somogyvari: Yes.
Peter Somogyvari: And I will.
respond here.
Peter Somogyvari: For more than.
Peter Somogyvari: yeah.
Peter Somogyvari: they're asking whether I would specify again hi severe to being score seven or higher, I would just put that everywhere very mentioned it's so.
Peter Somogyvari: it's not ambiguous to you.
Arun S M: I just made it like, as in the proposal that we always refer to the top one.
Peter Somogyvari: Okay yeah I didn't catch that.
Arun S M: Probably just me me.
Peter Somogyvari: And I think what we should do here is actually just write down the exact question.
Arun S M: make sense.
Peter Somogyvari: So that the tsa does have to debate that.
Arun S M: The project have in.
Arun S M: TV is.
Arun S M: reported.
Arun S M: TV tv's.
Arun S M: course not.
Arun S M: reported and.
i'm not a dress.
Arun S M: For.
Arun S M: 90 days.
Peter Somogyvari: or more.
Arun S M: Yes.
Arun S M: If s.
Arun S M: Please mention them.
Arun S M: Please mentioned the CV.
Arun S M: And this this Okay, maybe list off this place mentioned the list.
Peter Somogyvari: But please list to see ease yeah.
Peter Somogyvari: Okay, so.
Peter Somogyvari: Okay, I would also put specifically in the proposal.
Peter Somogyvari: That like as a sub points to the first point of the proposal, I would say that.
Peter Somogyvari: Projects get the badge automatically as they incubate.
Peter Somogyvari: And then.
Peter Somogyvari: If they fail to comply with addressing Chi square seized and it can be taken away.
Arun S M: So let's think like i'm.
Peter Somogyvari: Being the power of the explicit proposal.
Arun S M: project.
Arun S M: um Okay, the CV by.
Arun S M: will be.
Arun S M: review based on quarterly reports.
Arun S M: PC and make a decision.
Arun S M: will be probably the CV badge is.
Arun S M: Initially issue.
Arun S M: For infinite period.
Arun S M: No okay.
Arun S M: Maybe i'll just say validity of.
Arun S M: The bye.
Arun S M: bye.
Arun S M: every quarter.
Arun S M: You see me make a decision.
Arun S M: or revoke the badge and case project it's not as not complying.
Arun S M: With the requirements.
Arun S M: But where are we defining the requirements and we should define the requirements, saying that.
Arun S M: They should not be, for instance, more than.
Arun S M: Two such CVs or maybe they should not be, I think, since its security related thing and it's hype cbot we should probably even say they should not be.
Arun S M: Any high severity CV that is not a dress for more than 90 days and if more time is required and project maintenance can get extension of one month.
Arun S M: And that can that they can get twice and failing to do like failing to address in those five months will lead to immediate the vocation director vocation will last for like say.
Arun S M: Six months.
Arun S M: Does that make sense.
Peter Somogyvari: yeah I agree, I agree, and I have to apologize, but I have to leave for a meeting that's starting to status conflict for this one sorry about that.
Arun S M: Okay.
Arun S M: We are almost.
Arun S M: Is it nine your time or 788 38 okay.
Arun S M: No worries.
Peter Somogyvari: Okay i'll talk to you later.
Arun S M: Thanks Peter my.
Arun S M: problem needs also stop recording.