Arun S M: hello, welcome to my pleasure Security Task Force meeting, and today we will continue putting up the concrete proposals that Club in plan for a while now.
Arun S M: So we have discussed the recommendations, however, these recommendations sound too abstract and we will have to come up with concrete proposals that can be approved or that can be debated by the tsa so the point that we are moving towards.
Arun S M: And in the previous call we had, and one of the proposal that's already approved is related to the security representative in each project that's approved and by the tsa every project will have one person.
Arun S M: It was more like non controversial, it was straightforward, however, with respect to disclosure that's where I think there were some concerns that thc raised.
Arun S M: And heart, I remember you wanted all of it to be disclosed because we don't really have control over which often we don't really have control over how to disclose them like it there's no real extension possible per se.
Hart Montgomery: yeah so so a couple of things.
Hart Montgomery: So Point number one is that, like whoever found the book will disclose it whenever they think it's been reasonable time.
Hart Montgomery: Right and you can, as somebody pointed out, you can talk to them, but you know they're not going to wait forever and ultimately it's on them to discuss decide when to disclose.
Hart Montgomery: And just you know saying we have a disclosure policy, and you know that.
Hart Montgomery: sort of having the default for us saying like Okay, please give us 90 days is good right.
Hart Montgomery: I will point out, we have had some adversarial disclosures.
Hart Montgomery: or sorry we have had some adversarial bug fines so we're like competitor finds a bug and, obviously, these people are not going to give us anything on disclosure right, you know they're gonna want to disclose as soon as they can.
Hart Montgomery: So so that's that a mother worries about the CV score.
Hart Montgomery: You know, in theory, it makes sense to tie something to a CV score and practice like who's doing the CV score reporting.
Hart Montgomery: So, like everyone in their brother who's reporting a bug who's not affiliated with hyper ledger gives their CV score like an 11 out of 10.
Hart Montgomery: Just because they want the attention and they want to maximize like what they get in a bug bounty program or whatever right.
Hart Montgomery: So we've seen this happen, quite a few times.
Hart Montgomery: So.
Hart Montgomery: I wouldn't want to necessarily tie stuff to a CV score.
Hart Montgomery: Unless we have some sort of like I guess Artem dropped.
Hart Montgomery: Unless we have some sort of like extremely thorough CV rating system which we don't have yet.
Hart Montgomery: Does that make sense.
Arun S M: But then, forcing these rules for every one sound for everything sounds too much is the feedback that we had right.
Hart Montgomery: So I think it's simple, but what are these rules forcing great.
Hart Montgomery: I mean we just say we disclose bugs after 90 days right.
it's more than disclosure.
Hart Montgomery: Sorry go ahead.
Arun S M: It was more than disclosure aspect that comes in here it's also about encouraging each of the project team to fix them as as they will.
For instance, presumably.
Hart Montgomery: You know the release will fix it was you know that's motivation if it's severe to fix it and if it's just something like super like well you know.
Hart Montgomery: Even if you, you can either fix it or not right, it will be released, and you know you may see practically some very, very minor things that aren't fixed right.
Hart Montgomery: I don't know how this relates to badging but again i've worried that the sort of the.
Hart Montgomery: The CV.
Hart Montgomery: Like scoring system is going to be problematic.
Arun S M: So, so the intention is to encourage everyone to fix them on time if they don't fix it, it should not be punitive measures, it should at the same time.
Arun S M: should make them feel like hey I should have done this.
Arun S M: in other ways.
Hart Montgomery: So how I mean this is sort of like I mean.
Hart Montgomery: I don't think this is like we're not imposing the extra punitive measures here right.
Arun S M: And it's not even encouraging if we don't if we just say disclosure then they'll be like okay disclose it.
Hart Montgomery: I mean yeah and then, if they don't fix it it's sort of them right.
Arun S M: Probably removed from the heading shows.
Hart Montgomery: So.
Hart Montgomery: You know, we.
Hart Montgomery: yeah I guess my worry yeah this proposal puts a lot of weight on a particular CV score but we don't have a CV we don't have like a solid CV rating system right.
Hart Montgomery: So.
Hart Montgomery: that's.
Hart Montgomery: You know, and then who does who's who's writing right people are going to rate.
Hart Montgomery: Different vulnerabilities different ways right.
Arun S M: Our question so when let's say if we put a policy around that right is that policy enforceable already stuck just a customer a request that we are making to people, because if they have control, then they could still do it.
Hart Montgomery: yeah well if they come in through the security list that we can that anyone on the list can disclose them right, including like rye would usually does all the like hacker one and other stuff.
Hart Montgomery: Though.
Arun S M: So.
Arun S M: Is that only we have like a set of people who can do it, or is it also the person who raised that he didn't sell can disclose it.
Hart Montgomery: Well, the person who found the bug can disclose whatever right.
Hart Montgomery: They may not be affiliated with hyper ledger right.
Arun S M: mm hmm.
Hart Montgomery: we're sort of only asking them to be responsible right they're responsible disclosure practices.
Arun S M: How can we enforce that.
Hart Montgomery: Enforced responsible disclosure practices.
Hart Montgomery: We can't do we just expect people to follow them right.
Hart Montgomery: If you're like a reputable security researcher you follow responsible disclosure practices right.
Arun S M: Okay.
Hart Montgomery: So yeah.
Hart Montgomery: The idea is, if you don't get a response, or if you don't get a fix by.
Hart Montgomery: You know person usually in 90 days, then you're encouraged to just disclose the vulnerability anyway right so there's you know.
Hart Montgomery: that's sort of why this is right.
Okay.
Arun S M: Something like hyper ledger foundation as well, calm use the war comes on.
Arun S M: The.
Arun S M: us the forum available to disclose.
Arun S M: vulnerabilities.
Arun S M: By case to respond simply disclose those.
Arun S M: I think we need to probably put a bigger text here this stuff policy should not be a statement, it should be a.
Arun S M: set of bullets.
Arun S M: i'm not sure if this already exists, I think it takes a stone.
Hart Montgomery: What exists exactly.
Arun S M: Now that responsible disclosure statement or.
Hart Montgomery: The police, I mean I don't know that we have one for hyper ledger, but this is like a well known.
Hart Montgomery: sort of a well known thing, at least in security research.
Arun S M: Is there any reference, we can look into ours, an openness is a fast one.
Hart Montgomery: yeah that's probably the one we should use.
Arun S M: got it.
Hart Montgomery: there's a Wikipedia.
event.
Hart Montgomery: so well, this is known.
Arun S M: Okay, I think I like.
Arun S M: To read through this.
Hart Montgomery: yeah so going through that.
Arun S M: they're defining personas and then they're defining what really is meant by vulnerability under this disclosures thing.
Arun S M: And what are the what is the motive behind.
Arun S M: they're also talking about some infrastructure which probably is like an advice to I pledge a foundation.
mm hmm.
Hart Montgomery: We have that right.
Arun S M: Right.
Hart Montgomery: This is our security mailing list.
Arun S M: or create a vulnerability management.
Hart Montgomery: which we do right that's why we asked people for projects or for projects for people.
Arun S M: But then, how are we putting responsibility on them like it seems like a voluntary thing for now.
Hart Montgomery: Well, everything in open sources voluntary right.
Arun S M: Okay.
Hart Montgomery: Our intake is security at.
Hart Montgomery: domain.
Arun S M: So guitar been.
Arun S M: No.
Arun S M: But I still feel like we can document each of them and shady.
Arun S M: intake matter.
Arun S M: How is this different from.
Hart Montgomery: let's just explaining that in more detail.
Arun S M: So his old I saw an announcement sorry right put up a message or email on this thing is this currently supported on the hyper ledger private patch down.
Hart Montgomery: Yes.
Hart Montgomery: Good.
Arun S M: How.
Hart Montgomery: they're both ways, you can do this.
Hart Montgomery: The easiest way is just to create a private for can share it with people on the security.
Hart Montgomery: list there's some issues with testing that's where we sort of run into issues.
Hart Montgomery: Like if you want to run something through the test net.
Hart Montgomery: Or the ci CD.
Hart Montgomery: Then that's that's trickier.
Hart Montgomery: I guess they cover that in the.
Hart Montgomery: You know.
Arun S M: cama con.
Arun S M: Are the saying that we only recognize this CNS.
Hart Montgomery: Basically yeah.
Arun S M: But.
Hart Montgomery: You.
Arun S M: know as a person, if I found a vulnerability, if I don't have trust on this CNS I would probably just disclose it right.
Hart Montgomery: If you don't have trust on these days, what do you mean.
Arun S M: let's say i'm not really sure of their scoring criteria like they're probably not considering my issue was so severe than i'm.
Arun S M: I don't know i'm expecting this each cna would give me a.
Hart Montgomery: Well, this is just the numbering authority right.
Hart Montgomery: This is just everybody has a unique.
Hart Montgomery: CV right, this is not anything else.
Arun S M: isn't good scoring like decided by each cna or if the scoring itself is separate from the cma.
Arun S M: it's just like is decided by the reporter essentially right.
Arun S M: i'm.
Hart Montgomery: Like there's no.
Hart Montgomery: there's no authority that there's an external authority that does the scoring right.
Arun S M: So does that mean, like the set of questions that we end up asking it's the same it's just that, at the end we go to one of the CNS and we say, is what I report, I want to report and give it a numbers.
Arun S M: Or is it like each of them will have their own set of.
Arun S M: of calculating those numbers it's it's sure like a time I will be filling up your.
own.
Hart Montgomery: yeah it's just a you can look at the process it's basically just like we went to we went to avoid duplicate CVs right.
Hart Montgomery: This might be necessary for some of our projects right.
Arun S M: Now, so is this like.
Arun S M: like an expedited process of disclosing or is this like a expanded process of trying to fix it.
Hart Montgomery: So this is more like you basically want to.
Hart Montgomery: You want to get people who run like who read extremely high value things on your software right.
Hart Montgomery: And sort of let them know that something is coming right.
Arun S M: How would we then choose this embargo list.
Hart Montgomery: it's just a judgment call.
Arun S M: To even need to have one is the judgment call right.
Hart Montgomery: There are some pros and cons.
Arun S M: This could lead into some call to actions let's say there is a CV that would.
Arun S M: That could affect that would probably Hello somebody from network device or network service to access additional information from mortar already have, and since, in a blockchain network we are allowing competitors to be in that same network.
Arun S M: And this relates to network.
Arun S M: It allows those competitors to scrape the data that ideally should not have done that.
Arun S M: i'm not saying it's it would be done, but just a possibility.
Hart Montgomery: Well they're on the same network right that's.
Hart Montgomery: You know that's the more interesting things if someone.
Hart Montgomery: If it could different network competitor finds about great.
Hart Montgomery: People probably aren't going to attack a network they're on right now.
So.
Hart Montgomery: That makes sense.
Arun S M: it's helped me and understanding how would we create a list, but it is.
Hart Montgomery: How it would be a project by project thing right.
Arun S M: It would also end up becoming a case by case basis for each CV.
Hart Montgomery: yeah.
Arun S M: And who would be the decision makers.
Hart Montgomery: Yes, people on the security list usually.
Hart Montgomery: Okay, the security team.
Arun S M: Okay.
Hart Montgomery: yeah I mean the embargo right, this is so that you give people a heads up if there's a big big change coming right.
Hart Montgomery: Like imagine there's an interface right or there's some API call that is massively insecure and the only way to.
Hart Montgomery: to fix it is to to close that it particularly API call right.
Hart Montgomery: Then, what do you do right, this is going to require you know if you send if you fix this it might break everybody's builds downstream right.
Hart Montgomery: So you might want to tell people your biggest users or you know, maybe people that you can trust that, like hey you know you need to take this API call out of your system now.
Hart Montgomery: That kind of thing right.
Hart Montgomery: Is that.
Hart Montgomery: sort of clear.
Arun S M: let's understand that that clarifies it but at what stage ready to disclose to whom it is.
Hart Montgomery: yeah that's the judgment call of who's on the list right and who's managing the list so that would be a judgment call.
Arun S M: shows.
Arun S M: In terms of communication template, I guess, we do have one in place.
Artem Barger: What is the best practices to manage this list, I mean you know you might have a lot of companies and it's it's like kind of mailing list that you will open the door, make sure you'll have placed on those notes.
Hart Montgomery: yeah it's it's just there's a security mailing list right now right.
Hart Montgomery: We have a number of ways to input like Ryan manages our hacker one account.
Hart Montgomery: And if there's a hacker one report he sends it to whoever is.
Hart Montgomery: You know handling who's on the list for that project right.
Artem Barger: Okay.
Hart Montgomery: yeah we do need to build more infrastructure around this because we typically had none in the past.
Artem Barger: So, for now, just going to utilize always.
Artem Barger: suggest to utilize the mailing list as a security one.
Hart Montgomery: that's what we're doing now.
Artem Barger: Okay.
Arun S M: Would that also be signed me up for this embargo list increase i'm interested in and maybe that will take them to a web form, where they will have to tell about themselves so that project team gets notified hate.
Arun S M: us.
Hart Montgomery: We don't.
Hart Montgomery: We don't have a formal embargo list yet for any project I don't think.
Hart Montgomery: I know Andy has created sort of an informal one where they've tried on down all the deployments.
Hart Montgomery: were a couple of major issues but.
Hart Montgomery: yeah we we haven't.
Hart Montgomery: We haven't gotten, to the point of formal embargo this and for big projects for something like fabric that would be very, very tricky.
Hart Montgomery: Because they're just so so many deployments right.
Right.
Arun S M: So, as you said, it can be a decision that somebody on the security mailing list would take or somebody in that bmt group can take.
Hart Montgomery: And yeah and.
Hart Montgomery: for something like fabricated be especially precarious right because you have.
Hart Montgomery: Several how I should put this disreputable entities, who legitimately use fabric right.
Hart Montgomery: But they also potentially launch cyber attacks on other people right.
Hart Montgomery: So that's a tricky thing to manage right.
Artem Barger: it's actually a little unclear.
Hart Montgomery: yeah so I mean I, like you, don't have to have an embargo list right.
Arun S M: Listen, we won't have it, but at least we should know who wants to be part of it, like right, in which case we still notify them about it, we don't create a list as such, but we at least take input of intent.
Hart Montgomery: We can think about this i'm a little hesitant to recommend this at this point, because this is a lot of work right.
Arun S M: Otherwise, how would.
Hart Montgomery: you read what.
Arun S M: Otherwise, how would we know who could potentially we let's at some point in future be part of embargo list.
Arun S M: And somebody who adopts the project, they would not go and say that hey i'm using fabric, or there is no direct way of tracking it right it's just a service that anybody could download build and.
Hart Montgomery: deploy it in their infrastructure, I mean.
Hart Montgomery: embargo lists are especially hard with open source right it's much easier and closed source.
Hart Montgomery: Like if i'm selling you software right it's much easier to build an embargo list.
Hart Montgomery: Because I know who I sold software to, and I can.
Hart Montgomery: use that to build a list right.
What.
Arun S M: Are we expecting or a set of for somebody who's going to use fabric, no.
Hart Montgomery: No Absolutely not.
Artem Barger: But.
Artem Barger: We can just replace this embargoed is the proper place to put the announcements of.
Artem Barger: abilities and if you care that much of the project that.
Artem Barger: you're using get the table and production, you will be a real this Bulletin board, so you know it will get a notification.
Hart Montgomery: yeah that's a good suggestion.
Arun S M: But isn't the point to disclose it much before the actual disclosure timeline.
Hart Montgomery: yeah the the embargo list is sort of an early disclosure thing, but you know it's going to be.
Hart Montgomery: Like I don't want to like mandate or recommend that at this point, because I think it's a can of worms and I think it's a huge amount of work and a huge amount of politics.
Hart Montgomery: And I don't want to like you know necessarily.
Hart Montgomery: have to wait into that.
Arun S M: I think I still like away where at least let's say if we can go with somebody who is on the emptiness stars somebody who manages to list itself, they can further.
Arun S M: With some restrictions share the content.
Arun S M: But again, they have to they have to tell others that they're going to disclose it to rest of the people.
Arun S M: and
Arun S M: then like to get who they can disclose it to that can be a.
Arun S M: onboarding page right.
Arun S M: let's collect.
Hart Montgomery: So this this might be something we can think about in the longer term, but let's keep it very simple for these first tasc recommendations.
Arun S M: Okay.
Hart Montgomery: Like, I would like us to come up with things that are like pretty non controversial and pretty hard to argue against and very simple right.
Hart Montgomery: And this is going down the path of like quite complicated and sort of anytime we we selectively include people it's going to be very, very political right.
Arun S M: Okay let's keep this away for now, but.
Hart Montgomery: But we like I agree this is like an ideal thing in the long run.
Hart Montgomery: We would like to have some of these kinds of things, but.
Hart Montgomery: You know.
Arun S M: We could put in a statement saying that for now we don't have a process for embargo list, but there is a provision for us to improve in this Asia.
Hart Montgomery: Well, I mean I don't know like we could like we could decide that it doesn't make sense right.
Hart Montgomery: Like.
Hart Montgomery: You know what do you do if.
Hart Montgomery: If there's like you know.
Hart Montgomery: If someone who is very disreputable and who you think will use the knowledge to attack your system.
Hart Montgomery: has access to the embargo list.
Hart Montgomery: And what if they may have you know they may also be using your thing, so they may you know.
Hart Montgomery: There are lots of people that use fabric right.
Hart Montgomery: For critical applications.
Hart Montgomery: Some of them are absolutely not trustworthy.
Hart Montgomery: So.
Hart Montgomery: Like making a fabric embargo list would be very difficult and politically fraught.
Hart Montgomery: Does that make sense.
Artem Barger: I think it does, but I can kind of concern question you know you mentioned.
Artem Barger: And i'm trying to understand what is the potential exploitation that you can find inside the Commission the network that usually has a very strict and private governance model to the level that you can actually utilize that exploit the in a very harmful way.
Hart Montgomery: Well, I mean maybe there's a I mean look we're totally speculating here right, but maybe somebody breaks that right, you know what if someone can you know.
Hart Montgomery: What if someone can make transactions on a network without you know proper permissions or what if they you know get the exploit to someone who does have permissions on the network right.
Artem Barger: I see.
Hart Montgomery: You know, like it's all about preparing for like the worst case that you don't necessarily like it shouldn't happen.
Hart Montgomery: But just because it shouldn't happen doesn't mean it won't write.
Artem Barger: Your rights.
Hart Montgomery: Then I don't know Artem about how some of these like fabric uses I don't know how much you all have seen but.
Hart Montgomery: It turns up in a lot of surprising places.
Hart Montgomery: Like fabric, you know I don't know.
Artem Barger: I you know, in order to be able to do something really dangerous, you have to be basically a top thing in the mean access to the public network, and given that it's like a game right they don't even need an exploit if you already obtained in manassas.
Hart Montgomery: huh well yeah I mean it's it's yeah we don't know what the.
Hart Montgomery: hell, you want to be prepared for everything.
Artem Barger: No i'm just you know it's not it's not like i'm opposed info.
Hart Montgomery: yeah.
Artem Barger: I think i'm so.
Artem Barger: Mad it's it's valid points it's actually interesting to to think about it, like you know, trying to totally mentioned that the expectation vector of a you know.
Artem Barger: I will not ability on on something like fabric is it to me something that's not very strict using a village, to make anger honestly relation model.
Hart Montgomery: yeah.
Artem Barger: Because you know it's not it's not like you're on the public network, today, you can have which explores like TAO.
Artem Barger: Just because everyone do whatever they like, when he was completely different think you have to obtain access and someone to issue.
Artem Barger: A certificate, so you will get a you know, a will be able to execute anything on this network, and I think same goes for business and they solve those.
Artem Barger: In other permission networks that we have under vocabulary so that's why i'm curious what what are they what level a it's even possible to do to actually use this exploits but.
Artem Barger: You still have a point that.
Artem Barger: It doesn't say if if you think it won't happen and that's a you know it's gonna happen it doesn't mean it's one so yeah you like.
Hart Montgomery: yeah I mean there are a couple of things right, well, I mean basically was a main net client right, so I think it's like four to 5% of a theory of main net notes run basically at this point.
Hart Montgomery: So that's totally public I mean there are lots of fabric deployments that are semi permissions right.
Hart Montgomery: Where like users have some level of interaction with the network, even if they're not like involved in consensus, or anything like that.
Hart Montgomery: You know, maybe I can trick someone into running a smart contract for me or something right.
Artem Barger: mm hmm.
Hart Montgomery: There you know, maybe one of the nodes.
Hart Montgomery: Like running consensus gets compromised or is malicious right.
Artem Barger: Well that's that's the point, it says.
Hart Montgomery: yeah if you're running fabric on a server right I don't necessarily if I just track the server right, I can actually cause.
Artem Barger: yeah I go to a point, I think I think I even have an example, so you know fabric allows you to run in Java Java based the chain course right, and then you have this work for GE exploits.
Artem Barger: and hopefully you'll be able to utilize something like that even a you don't have any you know admin access to the network, but still using this fact that you can just you know.
Artem Barger: inject.
Artem Barger: executable and then a escalate privileges inside and that's broken then it's okay so.
Artem Barger: There are there are there examples that we can you can break a the things are low, you still have students governance model so.
Hart Montgomery: Definitely.
Arun S M: Probably move to the next section, and this on this disclosure part, we do have a template defined with an appalachian foundation that's security Emily where we specify.
Arun S M: The how to report kind of a thing, but we will have to at least fill up some of the other information, for instance.
Arun S M: It makes sense for us to just create a wiki and then add extra line into the security empty files which talks about responsible vulnerability disclosure like the policy that is in place.
Arun S M: Right, so I think the section purely talks about.
Arun S M: How do we publish it.
Arun S M: I think we currently don't have a process of publishing it.
Arun S M: Right so.
Hart Montgomery: This is published the process right not publish the CVs.
Arun S M: publish okay publish to process this.
Hart Montgomery: is just make sure people know what your processes right.
Arun S M: Sure, so there can be multiple ways we can do that, like.
Arun S M: I guess each project should should put in their security empty file another link to wiki that we can capture actual process.
Arun S M: So Okay, I think the next section talks about how do we respond back to each of the request so each of the reports that are coming in.
Arun S M: they're expecting a new thing called a certain book empty.
Arun S M: Oh sorry it's just they're asking us to read through it.
Arun S M: should acknowledge saying that we received your request or issue.
Arun S M: I think this is where most of the time gets consumed on assessing.
Arun S M: Because this requires consumes the time of someone who's familiar with the project.
Arun S M: And this was something new, which I did not know personally until are not told last time, how do we establish this process would it be a private communication with the disclosures that.
Hart Montgomery: that's usually how it happens.
Okay.
Arun S M: We can give them the policy which states the 90 days disclosure thing.
Hart Montgomery: And at the same time, so you can see a list some examples.
Hart Montgomery: There right.
Hart Montgomery: acknowledgement in two days.
Hart Montgomery: First, less than 90 for disclosure.
Hart Montgomery: People usually disclose even if no fixes available after a certain amount of time.
Hart Montgomery: yeah know that 90 days is the longest embargo period entertained by various groups as a default.
Arun S M: But.
Hart Montgomery: Sorry.
Arun S M: No, I say they come to.
Arun S M: I could see some examples that are written.
Arun S M: So we probably go through one of these examples and probably read through how they're doing it.
Hart Montgomery: yeah I mean you got to go through all of them.
Arun S M: shows it and yeah and all that.
Arun S M: Then they're talking about creating a patch and attaching this patch information to the CB entry wherever it is created.
Hart Montgomery: The hook.
Arun S M: Oh.
Arun S M: I thought this was already done.
Arun S M: If they're not already created maybe we can ask them to create one could be as part of this ask.
Hart Montgomery: We would create what.
Arun S M: they're asking to.
Arun S M: Like courses one.
Hart Montgomery: This is yeah, this is just the process right there just listing this in order now.
Arun S M: Okay.
Hart Montgomery: They have already gone over this yeah.
Arun S M: For a patch they would like us to.
Arun S M: This is what would be sent us also in the.
Arun S M: embargo let's write it, but all we create one we say hey, it is a big change that is coming in, and this is.
Arun S M: This would be part of this.
Arun S M: We have a place where all the TVs and they are associated fix us are listed within hyper ledger.
Arun S M: Or is it that we are expecting users to go and search through every place and find out when.
Hart Montgomery: We should have a clear place for that.
Artem Barger: I think self organization, as the.
index route.
Artem Barger: many places, and they have kind of keep a global database or the CBS and the there are there are very few that was we bought it for several projects and hyper hyper ledger particular fabric that's already available in there yeah.
Hart Montgomery: There are places that index them, but it would be good to have a list.
That we have an advocate.
Hart Montgomery: I don't currently I don't think.
Arun S M: Is there any service provider who does that, or is it something that we have to do manually or create a place by ourselves.
Hart Montgomery: we'd probably have to do it ourselves.
Okay.
Arun S M: This is interesting.
Arun S M: Right, so if.
Arun S M: applicable, we talk to those service providers under embargo list and.
Arun S M: Why after writing it twice.
Hart Montgomery: If you do an embargo.
Arun S M: or here they're covering the weekend, we can take them all here they're covering public days and.
Arun S M: The content that needs to be going so since we are, for now, keeping this away it's trying to skip it.
Arun S M: cutter release and publicly disclose the issue, but for this should we wait for a few days to go by, and then the announcement, should we put a policy like that, or should we say as soon as release is going, we can say hey just there is an actual risk.
Arun S M: fix it like, how do we do that.
Hart Montgomery: You know, we are using github security advisories right.
Hart Montgomery: You can easily.
Hart Montgomery: Then mailing list right.
Hart Montgomery: Like there's a big bug you want everybody to know about it and fix it.
Arun S M: So it would be an immediate notification.
Arun S M: earnings.
Hart Montgomery: that's right yep.
Arun S M: Okay, well, I had to sing disclose quickly.
Arun S M: And they're all here they're just talking about disclosing all the information that we have without.
Arun S M: Keeping anything secretive.
Arun S M: Okay that's fine, we can just put this as an advisory.
Arun S M: Okay, so.
Arun S M: Here they're talking about common challenges.
Arun S M: is, of course, like figuring out if it's an issue or it's an inability.
Arun S M: This probably requires context of the issue when somebody to analyze it.
Arun S M: Larry porter is not responsive.
Arun S M: I think over here if something cannot be resolved quickly I don't think.
Arun S M: it's I mean this is a tricky situation right, we cannot end up disclosing it if it is simply I.
Hart Montgomery: know that is a correct statement that they have there, so you if you can't fix it it's still better to let users know.
Hart Montgomery: Security without.
Hart Montgomery: Security by obscurity is a terrible practice.
Hart Montgomery: So if if software is broken so badly that we can't fix it.
Hart Montgomery: We still need to let people know.
Like.
Hart Montgomery: And this is again where just the default release of 90 days comes in right if you can't fix it it's still better to let people know right.
Arun S M: And this is another thing that is very tricky for us to figure out.
Arun S M: Because this can be literally disclosed anywhere outside of.
Hart Montgomery: Particular people don't have to like.
Hart Montgomery: There should, but they don't have to you know.
Hart Montgomery: They don't have to necessarily be nice about it right.
Right.
Arun S M: Okay it's important to notify again they're talking about the importance.
Arun S M: And that's I.
Arun S M: Think very this is pretty extensive document.
Hart Montgomery: is a good document.
Arun S M: You can borrow so much from here and put up our first initial draft, and I can take that action item looks.
Arun S M: i'll probably create another page under this wiki.
Arun S M: Okay start putting down, based on the discussion that we have so far right let's anyway getting recorded if I need to reference I can go back to this recording.
Hart Montgomery: But it was.
Hart Montgomery: asked to feel free to ask.
Hart Montgomery: But yeah I mean let's so for our first pass right, we want to go through that open ssl document and make sure we were we're having people do like the easy stuff right.
Arun S M: Right.
Arun S M: So a document that is inspired from open ssl but a disclosure statement put up somewhere else, probably create a disclosures wiki.
Arun S M: content.
Arun S M: That that can be taken to tlc for approval.
Arun S M: Okay, no, I also wanted to discuss this element which was about how do we encourage the project.
Arun S M: Without being opinionated person and.
Hart Montgomery: generative here.
Arun S M: So anything that they would have access to with all the current let's say.
Arun S M: Anything that they would otherwise be denied from accessing that's a punitive measures right, so if something does not already exist that project team does not consider that it's there right for being in part of my pleasure.
Arun S M: Then that's not going to be punitive it's like we are giving additional feature or additional thing if you follow this process it's just i'm not going to give you this if you're not following the process and that's not punitive it's just I am giving extra credits or extra.
Hart Montgomery: Extra rank or it was the.
Hart Montgomery: What were the punitive measures you are worried about.
Arun S M: Punitive measures are the ones let's say I would say hey since you're not following this process, I would probably.
Arun S M: say this, you should not call yourself a graduated project you don't have the.
Arun S M: Right so probably you should go back to incubation and if you still continue to do that in incubation you should probably go back to lab so that's punitive measure right again i'm not saying we should do that it's just an example of.
Hart Montgomery: Clinical nature, well, I mean I am actually in favor of requiring that graduated projects follow best security practices that if you don't follow best security practices, you probably shouldn't be a graduated project.
Arun S M: But that's the whole point that was discussed in around the tsa call that projects may start taking it otherwise, and if it becomes too hard for somebody to be a graduated project.
Hart Montgomery: that's fine right then don't be you know if you can't follow best security practices.
Hart Montgomery: Maybe you shouldn't be a graduated project right, why should we have faith in you, as a community to you know build secure code right, we should.
Artem Barger: I think that that's a good point it's like you know if it's helpful your total attending university emptiness it.
Hart Montgomery: Like.
Hart Montgomery: it's not about it's just.
Hart Montgomery: You know, telling people what the reality of the situation is right.
Arun S M: You are in favor of punitive measures and such large extent punitive measures.
Hart Montgomery: Well, I mean this is like we require a bunch of stuff for a project to.
Hart Montgomery: You know, be graduated right.
Hart Montgomery: You know I mean I don't think we necessarily need to do this to projects and incubation right.
Hart Montgomery: But you know I think this should, I think we should require graduated projects to follow best security practices and if they you know, make a habit of not doing it then yeah we probably should send them back down to incubation.
Hart Montgomery: I was actually quite surprised by the tlc discussion that was like you know.
Arun S M: So please in the colic fake like.
Arun S M: They were felt, I mean the the opinion was built up saying that it becomes too hard for somebody to graduate in hyper ledger so they eventually will more out of my pressure.
Arun S M: That we want to have.
Hart Montgomery: Does it, I mean.
Hart Montgomery: They would presumably just not graduate right.
Hart Montgomery: Like do we as an organization want to market projects that don't follow best security practices.
Hart Montgomery: That sort of a question for me right, that has an obvious answer.
Hart Montgomery: Do you agree with that are.
Arun S M: Being a person who.
Arun S M: Who wants security to be a top priority I agree to that.
Hart Montgomery: I mean, I think, is an org, we have to you know I mean look it's fine if your people think this is sort of catastrophic and terrible you know of projects lose momentum all the time right.
Hart Montgomery: And they you know, often lose momentum for a large variety of reasons, which are you know, not necessarily tied to the merits of the project right.
Hart Montgomery: So you know what we as an organization wants to do is just to accurately and transparently, you know reflect to potential users contributors companies, what the state of things are right.
Arun S M: So in if you are in favor of tact and what would be your major of have somebody not following this process would it be common across for any level of security.
Arun S M: Because that.
Arun S M: forced them.
Arun S M: To evaluate if reported bug is really CV or not.
Hart Montgomery: And that was you know this.
Hart Montgomery: weather bugs or severe.
Hart Montgomery: reported budgets of fear not right.
Hart Montgomery: that's a sign of a good active project right.
Hart Montgomery: Is that not the case.
Arun S M: How much can be in quotes on a project like case.
Hart Montgomery: Well, I mean think about like just think about fabric, how much real economic value is built on this software.
Hart Montgomery: Right.
Hart Montgomery: You know people people deserve to know.
Hart Montgomery: Like I don't think our major projects have a problem with this right they typically do do these things right.
Hart Montgomery: Like certainly fabric and bases are relatively.
Hart Montgomery: We had one issue.
Hart Montgomery: The only issue we've had with fabric, with the security response is when.
Hart Montgomery: Is when Dave and your was on vacation when a bug got filed.
Hart Montgomery: That but in general right, you know they respond quickly they handle.
Hart Montgomery: protocols and you know it sort of works right.
Arun S M: Okay.
Arun S M: So we are saying, if somebody does not follow some let's say some rules that we will come up with years, maybe more than.
Arun S M: No less than less than three active CBS which are active for more than 90 days.
Hart Montgomery: We don't necessarily want to put a quantity on it right.
Artem Barger: Just dumped another call, but thank you.
Artem Barger: Thanks.
Hart Montgomery: yeah thanks for joining item.
Artem Barger: Like I.
Arun S M: Was I.
Hart Montgomery: mean we don't need to necessarily like put a number on CBS right.
Hart Montgomery: But and I don't like this is a long term thing right I don't know that in our first version of this proposal.
Hart Montgomery: We should put this in because I think very irrationally the tasc didn't like this.
Hart Montgomery: So I would like to just have a first proposal that is very simple, that has some good best practices in it that are very difficult for anyone to argue against right.
Hart Montgomery: So, like the default thing of releasing TVs after 90 days right.
Hart Montgomery: You know, and, with the exception of.
Hart Montgomery: you've negotiated with the submitter right.
Hart Montgomery: That would be the exception case right.
Hart Montgomery: stuff like that.
Hart Montgomery: So we can go through the open ssl document.
Hart Montgomery: You know, and we can potentially pull out other stuff like that right.
Arun S M: Right um I think oh Is there more than the guy that we just went through.
Arun S M: It no.
Hart Montgomery: yeah there's I mean there's a ton of stuff in the open ssf is just one thing right.
Hart Montgomery: There are lots of different flavors of this They cite some of the others in that document, but there's still more that they don't cite so.
Arun S M: Okay, I will try to compose a list for.
Arun S M: This policy statement or policy that we would like to put up and try to keep all the non controversial things like people should not have any opposition to.
Arun S M: Richard more be like a best practice guide than anything it's like it's just follow this then it's really good for your project.
Arun S M: and
Arun S M: My thinking in terms of enforcing those.
Arun S M: At least.
Hart Montgomery: The things we can enforce right like the disclosure in 90 days when.
Hart Montgomery: We can have right disclose right like anyone on the list can disclose or we could probably even automate right.
Hart Montgomery: So I would like things that are enforceable but.
Hart Montgomery: Like trivially enforceable right.
Hart Montgomery: Does that make sense.
Arun S M: yeah.
Arun S M: i'll keep a threat actor will keep a new page created and in form you're probably put it in the chat and ask everyone to join in and let's try to get this list not industry as a call but probably in the next DC call.
Hart Montgomery: awesome alright that sounds good.
Hart Montgomery: Anything else.
Arun S M: I think there is a lot more that we can start with, but time it's.
Hart Montgomery: we're already out of time.
Arun S M: But yeah definitely I think should I increase the frequency of these calls, or is the current frequency good enough for us.
Hart Montgomery: it's probably fine we're not getting a lot of people on the call so.
Arun S M: Let me stop recording.