Peter Somogyvari: Welcome everyone to the Security Task Force meeting of the technical Steering Committee.
Peter Somogyvari: Please by the code of conduct and entities policy notice that I will show a second.
Ry Jones: don't worry about that, but you've said enough.
Peter Somogyvari: Okay, good.
Ry Jones: No, no antitrust don't do that.
All right.
Peter Somogyvari: i'm just looking at wiki page.
Peter Somogyvari: For the notes.
Arun: In the last week's discussion, we were talking about one of the open item that tsa brought up right so in terms of having concrete proposals, so the discussion tended to words I hope i'm article.
Arun: yeah yeah so the discussion tended towards having.
Arun: Having a strong measure, as in terms of it's not a punitive approach that we are taking it's rather.
Arun: it's just an approach, a straightforward approach that everybody has agreed to in terms of making.
Arun: A standard process in how we disclose and vulnerability, that is brought forward right so it's not going to be a punishment or anything for any project, as everybody concerned about or concerned about.
Arun: it's rather going to be an information disclosure process that we are embedding here and in the previous meeting, we also went over each element within the open ssl.
Arun: And what was that security disclosure process and we decided that hyper ledger should also have a place.
Arun: either in each repository within the security.md or probably that security dot empty file points to a wiki page that's written elsewhere.
Arun: That list this entire steps which follows open, this is a recommendation, but tweak to what hyper ledger wells.
Arun: cannot can afford from that list right and we went through each and every item in that list.
Arun: And we discussed through them, we decided that will have that so that one of the action item that spending on me, I took the action item because we went through that and then but still remains fresh when I go through the list I can.
Arun: Sorry gone.
Peter Somogyvari: Saying.
Arun: Okay, so yeah that's that's one action item that still pending i'll get it working i'll get it in some time and then say share it across to everyone on the team and ask for the feedback right, we can also get tucked in our agenda for tlc if there is a space for it.
Peter Somogyvari: Okay.
Peter Somogyvari: That sounds great sorry that I couldn't make it less meeting.
Peter Somogyvari: and
Peter Somogyvari: Okay, then what we could do now.
Peter Somogyvari: At least started document.
Peter Somogyvari: will be created, right here under the Security Task Force folder.
Arun: So there, there are a few more concrete proposals that we can get forward, apart from vulnerability disclosure itself.
Arun: That we can we can discuss in this call, and probably take action items to come up with those recommendations right.
Arun: So one direction that even heart agreed to that we should take right now is how all the information compiled in one place that pst will approve.
Arun: Without any contentions and if we think some of the elements that we are going to discuss is going to be like a contention is it going to have some discussion points will bring them up not right now, but as alliterative.
Arun: um so given that understanding, I think the previous discussion was really helpful.
Arun: And then in today, probably, we can look over some of out of those 10 recommendations that are listed on the top will pick up the remaining ones and come up with a concrete proposals for each of them right.
Peter Somogyvari: Now, but it also makes us.
Peter Somogyvari: identify key contact points saying.
Arun: So we this.
Arun: Video say, for instance, there is one approved.
Arun: There is one approval from tsp already in terms of having the key contact point from each team each each project team, so that they take care of at least they are the initial.
Arun: contact point for that particular project in case anything is needed from a security standpoint.
Arun: on it that much has been approved and but in terms of what are what is going to be their role, or do we have more responsibility on them apart from day being the contact person from the team that's something not defined.
Arun: But one of the open ssf recommendation is that each community in each open source community how their own.
Arun: Security process right, so we do have a security mailing list.
Arun: and open ssl recommends that we have a group, like that, but we need more representation and more productive representation in it.
Arun: I think in terms of dependent bought a lot if i'm if I remember correctly, from the tsa call the ask was that we put a statement or we put our requirements, stating that each project should follow.
Arun: The vulnerabilities that are reported through some means does not necessarily mean through a dependent about a lot or something else, and the concrete proposal should capture the reason for doing it.
Arun: and make one, what is this impact if it is not done, we.
Peter Somogyvari: should be.
Peter Somogyvari: Should we add the separate item for dependable from.
Peter Somogyvari: From this proposal item, where we say already that.
Peter Somogyvari: You have 90 days to fix it.
Arun: I don't know what you think of a movie so one of the other concern that was also brought up in the tsa call is type it in when we go into that direction of.
Arun: What is the impact if if a project team does not follow this properly, so what is that we are really trying to do, are we trying to just tell them that hey, this is an issue we will disclose it to end users, or are we telling them.
Arun: Like if you don't follow this your you do not have a place at hyper ledger or I don't know what we are trying to do with it.
Arun: So far, most of the vulnerabilities it makes sense for us to just disclose it in open and then let people decide how good the project is right, and each project team will do their best to avoid that kind of.
Arun: thing from happening.
Arun: And from hyper religious point of view, the The thing is that we, we need to be really careful on watch which projects we call as graduated once.
Arun: Because we don't want to end up having projects that is really not following a good security practice right in which is impacting production deployments which has whenever it is disclosed in open in which people can read through so.
Arun: I don't know it's a.
Arun: it's a small villages for.
Peter Somogyvari: The I definitely wouldn't.
Peter Somogyvari: tell them that they don't have a place in hyper ledger.
Ry Jones: Can I share my screen for a second.
Peter Somogyvari: yeah cool.
Ry Jones: So this is part of the fx platform which is available to anybody.
Ry Jones: That has.
Ry Jones: An account, which is anybody.
Ry Jones: So this is that indie I mean So you can see.
Ry Jones: If you look at.
Ry Jones: You know this shows you the types of vulnerabilities that are out there, and if we take I don't know cactus.
Ry Jones: Well it's not gonna let me do the thing.
Ry Jones: Anyway, here's Andy.
Ry Jones: It shows you.
Ry Jones: You know what are the vulnerabilities.
Ry Jones: What are the dependent what's the dependency tree.
Ry Jones: let's see i'm going to pick critical.
Ry Jones: And didn't find any critical anyway, so this this these types of tools are not only available from Linux foundation, but they're widely available, so I don't know that.
Ry Jones: Threatening disclosure, I mean it's not like we hold the keys to the kingdom right.
Ry Jones: So that that's all I was trying to say is there's.
Ry Jones: There are a lot of tools out there that are free, that people can use to find these.
Ry Jones: Before hyper ledger has a chance to act.
Peter Somogyvari: yeah.
Arun: I thought the person who's going to raise that as an issue.
Arun: They can still be negotiated right until they make it publicly visible.
Ry Jones: Oh well, okay so you're talking about a reported one vulnerability okay I.
Ry Jones: misunderstood.
Ry Jones: So.
Arun: All right, so the report it once.
Ry Jones: yeah ignore what I said.
Arun: Right, I think i'm.
Arun: Probably mixed up to things so for the for the auto alerted things that we just were talking about something like dependent board but anyway public right and.
Arun: I know right now it's not publicly visible for any of the hyper ledger cost, but people have ways to figure it out like literally they have the version numbers, they can know if that person has an issue.
Arun: i'm.
Arun: Part like another easiest option option to know that is just clone the repo push it to some private purple purple and push it under their name.
Arun: That that's probably another way like github a lot of flack it right, so that that's that's fine that's one day.
Arun: But I would be more worried about apart from the dependent bought alert I would be worried about the vulnerabilities that are disclosed if people know that there is a vulnerability and people know that it can be exploited.
Arun: They will definitely try to do it and if a project things that they have to be graduated then they need to be really.
Arun: working towards having those production issues resolved as soon as possible, if that's something affecting different many production deployments they're not solving it and they should be some punitive measures for them.
Arun: And, and the reason why they should be punitive measures is just because.
Arun: The the consequences if not done.
Arun: will come to hyper ledger right so like hyper ledger being open source community is not doing anything it's just providing the space for any project.
Arun: Which is not following these things so at the end, people will not say project, he did not do this project, we did not do this, they will say I fletcher has issues security issues like that's probably the last thing we want to have.
Peter Somogyvari: Or could tie that to the security badge that is already in the proposal.
Peter Somogyvari: Now, if you fail to act in time you take away the security badge.
Peter Somogyvari: That you have and then.
Peter Somogyvari: It is something of a punitive measure because you can no longer claim that you have the security badge.
Peter Somogyvari: And so, people will see that they shouldn't be using your project is.
Peter Somogyvari: it's not here.
Peter Somogyvari: I feel like that's something that.
Peter Somogyvari: reasonably almost everyone will agree without even asking their questions.
Peter Somogyvari: But if we go for harder punishment.
Peter Somogyvari: Like taking away their graduated status.
Peter Somogyvari: then pay some people will be against that So if you want to go with.
Peter Somogyvari: The ideas that.
Peter Somogyvari: tasc will likely be able to reach consensus so and approve them.
Peter Somogyvari: i'd say.
Peter Somogyvari: They can tie it to security.
Arun: Big transfers contentious and that has a call, as I remember, because people were asking the proposal here is to get things working not.
Arun: towards patch if you're introducing bites and how do we name them.
Arun: Should we have all the projects, they went back, even if, before they follow any process, what if there is no CV reported on any project, how would you rate them, then we end up with different status for each project and alone so.
Arun: It takes its own direction right, so we and then not talking about single status or single badge we're not talking about status specific patches.
Arun: And if you go take that route, then it has no significance as equal to, like every project has some badge for some reason, which is concrete in more confusions not solving any more any further any questions any any issues.
Peter Somogyvari: Well yeah if.
Peter Somogyvari: The badges themselves are not going to be there, or not in the way we hoped them that's a different topic.
Peter Somogyvari: Well then, the only thing I can think of is.
Peter Somogyvari: If you're bad with the dressing room or abilities, then the downgrade the from graduate to incubation.
Peter Somogyvari: Or maybe call it some other state.
Peter Somogyvari: to signify that you have fallen from the top.
Peter Somogyvari: But.
Peter Somogyvari: You don't want to threaten them to get kicked out of the organization.
Peter Somogyvari: I think.
Peter Somogyvari: A lot of people would support that.
Arun: So I mean we can keep this as a low priority recommendation because the moment we recommend this everybody will pitch in and then say hey you know you're making it shows.
Arun: With an iPhone later to do something, it feels like.
Arun: It feels like all these measures are being put to reduce the number of projects.
Arun: Like i'm sure like existing projects that are living for a while they may not feel happy about imposing additional process in place.
Arun: So maybe we can consider this as a low priority item for now I mean in terms of the proposal from the task force but definitely something we have to discuss, but the initial proposal can skip this part in, especially the punitive measure measurement part.
Arun: i'm.
Arun: Like, how do we any do you have any ideas on how do we enforce somebody from fixed thing depend about alerts.
Peter Somogyvari: On.
Peter Somogyvari: could be automated because dependable.
Peter Somogyvari: Is tool itself.
Peter Somogyvari: So.
Peter Somogyvari: depends on the focusing on dependable.
Peter Somogyvari: We could.
Peter Somogyvari: Have a tool that.
Peter Somogyvari: looks at the vulnerabilities that dependable says found.
Peter Somogyvari: See if they've been addressed or not and.
Peter Somogyvari: And they just start sending emails.
Peter Somogyvari: To their actual mailing lists and other skewed a mailing list.
Peter Somogyvari: After.
Peter Somogyvari: After the grace period of 90 days.
Arun: So there is no rule we can impose like which will make people to start fixing them it's probably just a recommendation which we can make a there are tools that are available, and you can avail those tools right.
Peter Somogyvari: yeah.
But.
Peter Somogyvari: What we can do.
Peter Somogyvari: As make them more aware.
Peter Somogyvari: So that if, in the event of.
Peter Somogyvari: A vulnerability getting exploited, because they.
Peter Somogyvari: didn't fix the dependable alerts.
Peter Somogyvari: They don't have the excuse that they didn't know dependable existed, or something like that.
Arun: Concrete proposals.
Peter Somogyvari: Looking through the list.
Peter Somogyvari: explore alternative for using the mailing list reports to issues.
Peter Somogyvari: What are our alternatives.
Peter Somogyvari: Are we talking about the tools here like hacker one and the other ones or something else.
Arun: About.
Arun: How do we make it streamlined right in case of any anything it's supported.
Arun: Or do we streamline it, how do we bring it to our attention, or somebody who is working in a specific project and how do we get the proper response, thank you for all these like we have to become a bridge from hyper ledger, how can we have to become that bridge.
Peter Somogyvari: Oh.
Peter Somogyvari: i'm usually.
Peter Somogyvari: Against.
Peter Somogyvari: Doing manual things but.
Peter Somogyvari: This is the rare exception where.
Peter Somogyvari: I will say having someone.
Peter Somogyvari: in charge of keeping an eye on the mailing list and.
Peter Somogyvari: booking maintain errs to address reported vulnerabilities.
Peter Somogyvari: would be a good idea, even if.
Peter Somogyvari: The addressing is just by saying.
Peter Somogyvari: Oh, I disagree, this is not a high severity.
Peter Somogyvari: it's just a little severe.
Peter Somogyvari: But bottom line yeah somebody.
Peter Somogyvari: Should the.
Peter Somogyvari: store.
Peter Somogyvari: Make sure that reported vulnerabilities get addressed as in responded to.
Peter Somogyvari: That by the maintain errs and.
Peter Somogyvari: I would be very specific about saying that.
Peter Somogyvari: We don't prescribe but responses.
Peter Somogyvari: But they have to acknowledge that they've seen it and then.
Peter Somogyvari: described, but their resolution is going to be, if anything.
Peter Somogyvari: So they just have to show no signs of life.
Peter Somogyvari: And this all again just goes back to.
Peter Somogyvari: The idea that.
Peter Somogyvari: If we at least make sure that people are aware.
Peter Somogyvari: They will be less likely to forget it or ignore it, because they know that.
Peter Somogyvari: I have to vulnerability.
Peter Somogyvari: turns out to be something again that.
Peter Somogyvari: They won't have the schemes.
Peter Somogyvari: Oh, I didn't know because.
Peter Somogyvari: I didn't see the mailing list or I didn't get the notification.
Peter Somogyvari: or anything else.
Hart Montgomery: Sorry, I missed this Peter what's the topic.
Peter Somogyvari: I are no worries.
Peter Somogyvari: we're talking about.
Peter Somogyvari: reported issues reported vulnerabilities.
Peter Somogyvari: And how.
Peter Somogyvari: How should we enhance the responsibility or the responsiveness of the maintainer song on the mailing list.
Hart Montgomery: gotcha.
Hart Montgomery: And what was the suggestion i'm sorry to jump right in I just had a call that ended at 830.
Peter Somogyvari: So.
Peter Somogyvari: Quick tl Dr is that.
Peter Somogyvari: i'm usually against.
Peter Somogyvari: manual Labor but this one, I think.
Peter Somogyvari: Someone.
Peter Somogyvari: should be designated to.
Peter Somogyvari: watch the mailing list and make sure that if vulnerabilities reported on the mailing list, then the maintainer of that project.
Peter Somogyvari: respond to it.
Peter Somogyvari: And we don't prescribe what the response asked to be we don't even say that it has to be Oh yes, we will fix this.
Peter Somogyvari: But they have to acknowledge that they've seen it that they know about it, because then.
Peter Somogyvari: implicitly they are more likely to address it, because they know that.
Peter Somogyvari: Everyone knows that they've seen it so that they know about it and it becomes.
Peter Somogyvari: powder to have excuses later saying stuff fly I didn't see the mailing list I didn't get the notification I wasn't aware of this, for whatever reason, because it is documented that they have been made aware of it, and they acknowledge, seeing it.
Hart Montgomery: yeah that's usually how.
Hart Montgomery: I guess best security practices are supposed to.
Hart Montgomery: To work.
Hart Montgomery: You know.
Peter Somogyvari: yeah, the question is who is going to be this person.
Peter Somogyvari: Well, the people project is probably a few people.
Hart Montgomery: yeah it should be a few people right, and I mean I thought this should be a.
Hart Montgomery: You know, a condition of being the project is that you should have.
Hart Montgomery: You know, multiple people who are on the security list and willing to you know respond to security disclosures right.
Peter Somogyvari: I was talking about.
Peter Somogyvari: Having a few people who would watch these people to make sure that they do monitor domain list.
Peter Somogyvari: And the reason for that is because i've actually in violation of this myself to this day, because.
Peter Somogyvari: I have been added to the mailing list but i'm still not getting the emails.
Hart Montgomery: or something I really let sounds like a mailing list issue.
Peter Somogyvari: I know, but you know, the bottom line is, if you reported a cactus older ability, today I want to see it, and I would feel like that's my fault, but also at the same time, of course, out be like well the mailing list of stuff working.
Hart Montgomery: yeah let's just get the mailing list working, that seems.
Hart Montgomery: You know, it seems the easy vector there.
Peter Somogyvari: yeah.
Peter Somogyvari: yeah but also.
Peter Somogyvari: The point about the like the WHO watches the watchers because i'm the watcher in this equation and i'm not doing my job.
Hart Montgomery: Well, I mean the list is filled with people on other projects right.
Hart Montgomery: So there are plenty I think people watching the watchers is fine right.
Peter Somogyvari: Well then, so if if someone reported a cactus vulnerability today.
Peter Somogyvari: And then I of course I wouldn't respond because I don't see it.
Peter Somogyvari: You think someone would message me directly, saying hey did you see that.
Hart Montgomery: Yes, that someone would probably be me but.
Ry Jones: I I just added you to the list I didn't see that.
Ry Jones: You weren't a member of the you weren't a subscriber.
Ry Jones: yeah.
Ry Jones: whoa I like literally just added you.
Peter Somogyvari: I was at a years ago.
Ry Jones: So well I don't know.
Ry Jones: There haven't been any cactus things here, so let me take a look here so here here's who's who the Members are.
Ry Jones: And I just added your central address.
Ry Jones: So I don't know, perhaps you had your email bounced or something I don't know why you weren't on it.
Peter Somogyvari: yeah.
Ry Jones: So I apologize.
Peter Somogyvari: you're.
Peter Somogyvari: There now I remember, we had the someone back then, whose title is security may even within the organization, but then they switch jobs.
Peter Somogyvari: yeah I forgot their name but.
Peter Somogyvari: But I had multiple conversations with them and they said yeah I added you to the mailing list we should get the emails.
Ry Jones: Oh.
Ry Jones: you're there now don't worry, so this list is relatively new.
Ry Jones: Now that you're a member feel free to go directly to the to the archive of messages and see if there's anything interesting.
Ry Jones: Okay there, there have been 36 messages in the entire time that this.
Ry Jones: mailing list is existed.
Peter Somogyvari: So.
Ry Jones: don't worry you haven't missed much.
Peter Somogyvari: Okay.
Peter Somogyvari: So he said archive because I think before let's set up and I was told.
Peter Somogyvari: That for security reasons, the older messages are not visible anywhere, so in this new what I can go and check the historical reports.
Ry Jones: So the the those messages are not.
Ry Jones: visible to non members.
Ry Jones: They are archived we haven't deleted any messages.
Ry Jones: So.
Hart Montgomery: Okay promise.
Peter Somogyvari: Thank you.
Peter Somogyvari: Alright, then I guess what I was talking about is not really necessary, because it already is just their existence.
Peter Somogyvari: So we don't need to propose that we can skip to the next one.
Peter Somogyvari: Oh, and before we do that sorry but I may.
Peter Somogyvari: yeah I have to go in five minutes because I also have a conflict in leading, so I have to cut cut this one short 10 minutes.
Arun S M: Worries Peter thanks.
Hart Montgomery: yeah.
Peter Somogyvari: But what I wanted to ask is, do we have.
Peter Somogyvari: Any information or do we have any budget.
Peter Somogyvari: For bug bounties because.
Peter Somogyvari: Item number six talks about about body Program.
Peter Somogyvari: But then, for that, for us to discuss that we need to know is there even the budget for that or.
Hart Montgomery: We do have a budget for that.
Hart Montgomery: It is not extremely well defined and we're in discussions to sort of formalize the security budget.
Hart Montgomery: You know, we don't even have a proper security audit budget right.
Hart Montgomery: Historically, this was just who bugged the hyper ledger staff, the most.
Hart Montgomery: So.
Hart Montgomery: The This is something that's a work in progress.
Peter Somogyvari: Should we put off discussing this ourselves until we know the actual details of how.
Hart Montgomery: I think it's great I think it's great to have people discuss this.
Hart Montgomery: You know.
Hart Montgomery: I think everyone would appreciate it if.
Hart Montgomery: People like you all came up with the solution.
Peter Somogyvari: Okay.
Peter Somogyvari: Great.
Peter Somogyvari: I was thinking, the bug bounty program could also be.
Peter Somogyvari: Something that you get enrolled into as you graduate so that there's more incentives to graduate into active status.
Peter Somogyvari: that's a cross current concern from water discussions basically the tasc where we were saying how do we incentivize projects, do you get active.
Peter Somogyvari: and
Peter Somogyvari: I guess what we need to make sure is that.
Peter Somogyvari: The fee have a bug bounty program for all the active projects, then the researchers are let know upfront.
Peter Somogyvari: that the budget is shared among the projects because I see what will be I seem.
Peter Somogyvari: The Foundation will have one pool of money and then, if that runs out then that's it.
Hart Montgomery: um yeah I don't know we haven't like explicitly thought about you know if one project does you know, has a bunch of egregious bugs and drains the bug bounty program or something like that right.
yeah.
Peter Somogyvari: Oh, my my thing, there is just to make it very clear to researchers what they can expect, and they cannot because there was this one person in cactuses and he is fixing.
Peter Somogyvari: Fixing some really trivial stuff like something that the code scanner highlights is a low severity vulnerability and they fixed it legitimately.
Peter Somogyvari: But then they were saying Oh, where can I collect my bug bounty.
Peter Somogyvari: And I had to tell them well I don't think we have one I don't know where you read about it, but if you've read about it somewhere i've seen you better by somewhere, then.
Peter Somogyvari: they're probably should have been a little more information there that would have let you know that.
Peter Somogyvari: Just because you fix this automatically highlighted boarding in cactus you not necessarily about getting some payday.
Ry Jones: I know exactly who you're talking about, and he has been a thorn in my side.
Ry Jones: As he runs around, and I mean the bugs are real.
Ry Jones: But he's constantly like begging for.
Ry Jones: Non fabric payoff and it's like buddy i've told him a million times No, this is not a fabric issue you don't get paid.
Ry Jones: Then.
Peter Somogyvari: You know buddy yes, you see it on the pull request So yes, I remember now.
Peter Somogyvari: yeah I mean if it's just a one off issue with just one person, then.
Peter Somogyvari: Maybe it's a special case that we don't need to address but that's what gave me the idea that.
Peter Somogyvari: We should.
Peter Somogyvari: Somehow make it clearer, so that this just doesn't happen to begin with.
Peter Somogyvari: But I don't really know I don't even know where he got that idea from that cactus.
Peter Somogyvari: that's.
Ry Jones: One thing that we could do is, and I know you're up against hard stop is, we could have.
Ry Jones: We could propose modifying security md to say we are not part of a bounty program or something like that.
Peter Somogyvari: yeah.
Peter Somogyvari: yeah have a yay or nay explicitly there and then that would settle it, they have like I could just then tell him.
Peter Somogyvari: That not put about a program it's on the security and the file check it right here sorry sorry if you missed that and then case closed.
Peter Somogyvari: yeah I think that's a good actual proposal that we can put down, and I think reasonably tsu to prove it, I just i'm Sorry, I have to go to the next call it's all i'm late already.
Ry Jones: Okay.
Ry Jones: Thank you later.
Hart Montgomery: Thanks Peter have a great rest of your day.
Peter Somogyvari: Thank you.
Arun S M: Great so yeah That was a good discussion so hard before you joined and I was just given a summary that, in the previous call we went over the open ssl recommendation for vulnerability disclosure and.
Arun S M: That also spoke about the things that we can put in our proposal right away, except for those factors that relate to the contentious items right so that's still an action item pending on me which i'll get it rolling.
Arun S M: And we started discussions on the dependent upon a lot and how we enforce that such things automated alerts are fixed by the team so it's most not likely going to be a.
Arun S M: Enforcement it's rather going to be a recommendation, saying that here's a tool that will allow you to fix some of them automatically and here are automated tools that would help you in keeping your project up to date in terms of best practices to be followed.
Arun S M: So there is no enforcement as such that we can enforce from the tsa it's probably a recommendation.
Arun S M: At least for automated dollars, but for the vulnerability, as we discussed last time, the initial approach is to just get the non-contentious things approved by the TC and then bring in the tough sanctions on the projects that.
Arun S M: are not.
Hart Montgomery: Good yeah.
Hart Montgomery: yep start with the easy stuff and then move to the hard stuff.
Arun S M: Like.
Arun S M: And I guess just before just when you joined the topic mode on to the mailing list and how do we how those reports monitor.
Arun S M: yeah and now we will continue, so the approach are the discussion in this meeting is still going to be the same thing that we come up with the concrete proposals that it is requested.
Arun S M: And just go through the rest of the items listed here, out of these 10 items which are you want to pick up then start walking towards.
Hart Montgomery: sounds good.
Arun S M: So, probably which one.
Arun S M: Take a stab and.
Arun S M: So, since we were on this topic.
Arun S M: Shall we put up a proposal that says that modify the security md and, if you want to be in the bug bounty program and work with hyper ledger team, if not, then mentioned this line.
Hart Montgomery: That we just need to figure out the budget.
Hart Montgomery: that's probably the biggest issue there.
Hart Montgomery: I don't think it would be an issue but.
Hart Montgomery: You know.
Hart Montgomery: We just need to make sure that works.
Hart Montgomery: And I liked your suggestion that we should tie it to graduated projects.
Arun S M: makes sense.
Hart Montgomery: And yeah we would need to come up with like.
Hart Montgomery: General guidelines like, if you look at I don't know, like the guest bug bounty like various different bug bounty programs they.
Hart Montgomery: You know, have general outlines and you say you know this kind of bug gets you this and and so forth right.
Hart Montgomery: And so we would probably want to publish something like that, just so we didn't get people arguing with us over how much they should get paid.
Hart Montgomery: Rather, they argued less.
Hart Montgomery: they'll still argue.
Arun S M: So wouldn't that be staff decision, as opposed to what do you say can enforce.
Hart Montgomery: Well, it probably ultimately I mean I don't know what kind of money we're talking about it will be a staff or a governing board decision right but I mean you know wouldn't hurt to get feedback from from people to see what they thought right.
Arun S M: So, shall I have an action item on you to get some more information figuring out on this topic.
Arun S M: So here we are clear.
Arun S M: And the proposal is still the bar that are graduated projects.
Arun S M: There is a bug bounty Program.
Arun S M: By the details of it has to be figured out later.
Hart Montgomery: yeah I think that's right.
Arun S M: So do we want to consider is one of the item that came up in the tsa discussion when we were talking about the bug bounty program was.
Arun S M: In terms of how active a particular project is ours should.
Arun S M: And then, where people work say we will people started commenting on in terms of writing research papers to just make them into cover up that right or paid research papers to cover up those aspects.
Arun S M: So when we were discussing this particular topic.
Arun S M: bug bounty programs.
Arun S M: And I guess, there was a comment made by somebody to have this as a metrics measured in the quarterly reports.
Arun S M: And then there were a few other discussions, I think that also happens regularly where people started saying what if this becomes a paid research paper that is written on a specific project.
Arun S M: And if those those items are considered in our quarterly reports should be.
Arun S M: The direction went somewhere else on this topic was being discussed.
Hart Montgomery: I don't know I mean, I guess, I don't know how to handle this for quarterly reports, we could put like one thing that we could do.
Hart Montgomery: You know just to put general metrics like so like you know.
Hart Montgomery: Are things outstanding right how many vulnerabilities are outstanding and what sort of status are they being fixed right, so you don't necessarily have to say what they are.
Hart Montgomery: But you could say like you know this quarter, we had you know five vulnerability reports, and you know, three of them were handled then then two of them are being done with us, or something like that right.
Hart Montgomery: I know that's very vague, but you know something like that my work.
Hart Montgomery: Does that make sense.
Ry Jones: yeah if you look at our the hyper ledger hacker one public activity you'll see that for fabric.
Ry Jones: And I was just showing earlier in the in the meeting I don't have it up right now but.
Ry Jones: The fx security product has a similar thing that's available.
Ry Jones: yeah so.
Hart Montgomery: We can definitely I think.
Hart Montgomery: Do something like this that will you know catch people's attention.
Hart Montgomery: If there are reports, not being followed.
Arun S M: So we are seeing the.
Hart Montgomery: you're saying what.
Arun S M: But, but the problem sorry I was about to write a concrete proposal on in terms of what do we what to expect in the quarterly reports, but the bigger question is, as you pointed out last time, there is no.
Arun S M: it's it's not one place, that we can, that we should be monitoring right, so people can disclose vulnerabilities in any form, that they like or anywhere that tonight.
Arun S M: it's just that we are saying in case you want to in case you have an issue then follow these best practices, be a Good Samaritan in the Community, but it's up to them on what to do with it.
Hart Montgomery: yeah I mean, I guess, eventually, you want to sort of codified best practices, but you know.
Hart Montgomery: So.
Hart Montgomery: be there.
Arun S M: yeah i'm here.
Arun S M: I just waiting for your response, but.
Hart Montgomery: I was just thinking i'm sorry.
Hart Montgomery: yeah.
Hart Montgomery: Well there's a bunch of stuff, we need to see.
Arun S M: Understand boys.
Arun S M: We are three minutes left for us to start looking into the scorecard right away, but that's another topic we definitely should start looking into.
Hart Montgomery: You know the scorecard should be more straightforward.
Hart Montgomery: We can just do that right we don't necessarily have to attach anything to it initially.
Arun S M: As it just a bunch of questions team has two answers.
Hart Montgomery: yeah pretty much.
Arun S M: It is cold okay.
Hart Montgomery: And that's easy because we can just tell people that they have to do it.
Hart Montgomery: Or we just post it right, and if they don't do it then it's like they get it automatic zero percent.
Hart Montgomery: Which is presumably now they want on their project website.
Hart Montgomery: So.
Arun S M: How do we put this present scorecard.
Arun S M: And is it true or bad yours.
Hart Montgomery: Is it yeah I think there's an openness SF way of doing it.
Hart Montgomery: I don't know what they have currently but.
Hart Montgomery: Oh don't be surprised if they don't have some like nice format.
Hart Montgomery: Then we should probably.
Hart Montgomery: complaint.
Arun S M: Okay, I look into and figure out where to.
Arun S M: find the dog.
Arun S M: Show or something like that to action spending on the one is on the disclosure process and the one is on the scorecard in that case.
Hart Montgomery: So it's good.
Hart Montgomery: awesome all right, why, unfortunately, to go for this next meeting.
Hart Montgomery: So.
Arun S M: Thanks.
Hart Montgomery: thanks for the rest, your day.
Hart Montgomery: Talk to her, thank you.