Tracy Kuhrt: Right welcome everyone to the July 28 hyper ledger typical steering committee call, as you are always two things that we must abide by.
Tracy Kuhrt: The first is the antitrust policy notice that is displayed on the screen and the second is our code of conduct.
Tracy Kuhrt: So, as we move down the agenda we have our standard announcement.
Tracy Kuhrt: The Dev weekly developer newsletter doing this for memory goes out each day if you have something that you would like to add to that please can sit are clicking on the link and there's a wiki page where you can add your comments.
Tracy Kuhrt: If somebody was lying whoever sharing their screens going down on the agenda Thank you so much, any other announcements that anybody has.
Tracy Kuhrt: A room.
Arun S M: So i'm Julian Gordon VP for Asia Pacific archetypal Nigeria is currently visiting India, and there are a couple of events planned so he's in India for a week now.
Arun S M: And this Saturday, there is a public meetup event in Bangalore so if anybody's around or if you know somebody in Bangalore please let them know about the event and yeah it will be an in person event.
Tracy Kuhrt: anybody else have any announcements.
Tracy Kuhrt: Okay, if there's no other announcements we get get in the hyper ledger side to quarterly report or with a slight glitch with our project calendar reporting.
Tracy Kuhrt: It was supposed to be self sooth not transact with it last week we had transact on the list, but.
Tracy Kuhrt: In the let me know that it was supposed to be so teeth she got the reminder for safety net reminder for transact looking at the calendar, I did see that.
Tracy Kuhrt: The student got reversed, for some reason in this quarter, so I fixed that we could get the sawtooth report, please take the time to review it.
Tracy Kuhrt: didn't see any additional comments can do other than the ones I made but does anybody have any comments on the sawtooth report.
Tracy Kuhrt: Okay, I know a lot of us haven't had the opportunity to review that yet since it just came in yesterday, please take the opportunity to review that I will leave it on the.
Tracy Kuhrt: Meeting Agenda for next week in case anything comes up that we need to discuss.
Tracy Kuhrt: Next week we have coming do the hyper ledger areas and the hyper ledger indie reports so if you know anybody in those.
Tracy Kuhrt: projects.
Tracy Kuhrt: please feel free to remind them that they have that coming do.
Tracy Kuhrt: With that, as far as I know we don't have any PC business to discuss this week, but does anybody have anything that we should be bringing up to discuss.
Tracy Kuhrt: Will.
Arun S M: Show Chris a ticket pasted similar comments on the tsa group as well sometime back and ties back to what kind of projects should we attract and what should we do to make those projects incubated and the hyper ledger labs or hyper ledger, how do we invite those collaboration.
Arun S M: And I don't know, maybe we can open it up for comments and then, if not now, but please sometime in future.
Tracy Kuhrt: And does this relate early think to the project gaps task force that they know has been.
Tracy Kuhrt: Leading or Is this something else.
Arun S M: sure we can consider them part of the task force as well, and I think the task force is aimed at identifying the gaps, but it also am I, how do we.
Arun S M: collaborate or bring in those those kind of projects or how do we start those projects.
Danno Ferrin: I when I put the objectives that I think the collaboration of the bringing in is the next step, so I think it's two phase so yeah I think it, it does feed from the task force.
Danno Ferrin: project as a task force results, but I think it would be a separate Task Force actually more than a task force and ongoing thing.
Danno Ferrin: To outreach to projects, we think that would be positive for hyper ledger.
Danno Ferrin: So I think it's from stems from it, but I don't think we should limit it to the task force activities.
Tracy Kuhrt: In a room do are there, certain projects that you think would be worthwhile to approach at this point.
Tracy Kuhrt: This why this is coming to your mind.
Arun S M: Some ice, I see a need for using some of those projects so that's where the name comes from and if such thing does not exist anywhere and and if others are also willing to I mean show an interest, then that could be an initiation of how we take that forward like.
Arun S M: Ours where to find some will if many people have similar interests, maybe that could be an initiation.
Arun S M: So yeah I was hoping for those kind of discussions to happen at some point.
Tracy Kuhrt: Okay, I think.
Tracy Kuhrt: The two things they are waiting.
Tracy Kuhrt: You know, obviously, after the project gaps Task Force, we can talk through projects that may hit the gaps that we discover frank during that test scores, and then secondly.
Tracy Kuhrt: let's see what we can do if you have certain projects you already have in mind to get that list together so that we can have a more focused sort of conversation.
Tracy Kuhrt: Alright, so with that any other discussion items before we move on to the Security Task Force.
Tracy Kuhrt: Alright i'm seeing a coffee, it says i'm away on the screen here so everyone I think you're supposed to be driving us through the screen Task Force today.
Tracy Kuhrt: Hoping you're not really away.
Tracy Kuhrt: Alright sounds like maybe he is is there anybody else on the screen passports, you might be able to let us know current status and what we're discussing today.
Tracy Kuhrt: look like maybe around your.
Arun S M: hbc i'm sorry I got disturbed.
Arun S M: It was an emergency call.
Arun S M: What was the topic I missed probably.
Tracy Kuhrt: yeah, so I think we're at the point where we're ready to go through this task force.
Arun S M: Alright sounds from the previous call that we had it Casey I think one of the feedback that we strongly received was that.
Arun S M: least recommendations are fine, but what are we doing about.
Arun S M: Income sharing the right screen.
Tracy Kuhrt: see a black screen with a line down the middle.
Ry Jones: same thing.
Arun S M: i'd say is my.
Arun S M: screen is lost it's asking me to resume, but when I click on resume nothing happens.
Ry Jones: Is there is there a wiki page or something that I should share.
Arun S M: Sure that's the task force recommendation page.
Arun S M: Alright, so one of the strong feedback that we received in previous previous Casey call was that we needed concrete proposals and not.
recommendations.
Arun S M: And we needed plan of actions that as a tasc we can ask projects to start implementing and since then we got to meet, for once, and next.
Arun S M: August Second, we have the next meeting, but if you scroll down to the bottom, I think, in the previous call we were trying to come up with the concrete proposal fours on after item or of the action item.
Arun S M: So the first point i'll probably skip that every project to have a security representative, I guess, we already added that in our.
Arun S M: requirement project requirement for any project or even incubator we need that as a requirement and the second point that is put up or here in terms of concrete proposal.
Arun S M: So.
Arun S M: Does this related to addressing CBS on a timely fashion.
Arun S M: And, and the recommendation over here is, we definitely don't want to be pushy for all the CV spike, at least for the political winds and the definition of criticality goes with the score that's associated with it, so, at least for the ones that are highly.
Arun S M: Highly coming up, which are more critical, which are easy to discovered, and these are the factors that will determine if a CV is critical and to be objective on to it it's it's it can be considered as anything that is that is having a score of greater or equal to seven.
Arun S M: and
Arun S M: And the proposals or I mean the goal over here is to avoid.
Arun S M: Any such things being left out without fixing them for a long time.
Arun S M: And can we can we treat them as a.
Arun S M: Highly exploitable once that ought to be addressed so nice.
Arun S M: So the proposal is that every project will be should be a best practice badge I know Tracy you had a comment on that, but i'll probably just complete this and then we'll go into questions.
Arun S M: So the proposal is to have a best practice badge issued to all the projects and this badge will be issued on an automated basis in, and this will be reviewed or reconsidered every quarter, based on the projects report that they fill up to the tasc.
Arun S M: And when a particular project is incubated this batch will be awarded to it on the basis that it, it is incubated and the badge will remain with the project as long as they retain the status, the status of it in case if the project is is.
Arun S M: Is not maintaining the conditions which are side further than the badge will be revoked and if about badges revoked.
Arun S M: Then the project has to prove that they are following the process again, and they have to prove it for two consecutive quarters following relocation.
Arun S M: So that was the intention, so there is no punitive measures over here it's all about having that extra badge that gives.
Arun S M: The confidence to the consumer of that particular project saying that hey this project is pretty much active in considering at least fixing the.
Arun S M: Critical vulnerabilities right Ideally, we would like to have all of those to be fixed and into in order to support this in our quarterly reports will introduce a question that clearly states that.
Arun S M: If you're going if a particular project has any critical vulnerability, with a score of or here, it is assumed to be seven and again that's open for debate, we can always revise it to another number.
Arun S M: So we will ask the question if the score if they have any see we that are not fixed for more than 90 days and if s what which are those, and this is on the premise died after 90 days, all the series will be made available public.
Arun S M: And, of course, there will be consent, taken from the project and project team has to give an explanation for why it should not be reported.
Arun S M: So that's an exception process.
Arun S M: Then.
Arun S M: Right, so the next point actually talks about extension process and how long.
Arun S M: Such extension can be alone so to such extensions can be given, but not more than that.
Arun S M: In this entire process itself will take the CV to be more to be to be active for more than like close to three quarters right so that's The next point.
Arun S M: And the last point, as I said, it deals with the revocation and the rules for gain gaining back to back to be to be on the normal list.
Arun S M: So this was the only concrete proposal that we were able to put up after that call and next call is on second I think I see I know Tracy and heart racing.
Arun S M: No, no.
Danno Ferrin: So one of the things to consider in this is that.
Danno Ferrin: We don't hold all the cards when it comes to see the recording.
Danno Ferrin: Whoever proposes CV they're engaging and responsible disclosure in agreement that they won't disclose it.
Danno Ferrin: After certain reasonable time and 90 days is a pretty standard thing let's there's negotiation.
Danno Ferrin: But you know these might be research there's an after 90 days they might say, I need to publish a paper and unless it's going to burn down the Internet i'm going to publish it.
Danno Ferrin: So I mean we can you know how these rules to delay publishing the CDS but sometimes the project or hyper ledger is not a control.
Danno Ferrin: Of when the CV gets disclosed so that's that's one one aspect to consider in this, as we can use all the characteristics, we want, but we don't control the destiny on it sometimes.
Arun S M: Okay, thanks for that input data.
Arun S M: etc.
Tracy Kuhrt: yeah so.
Tracy Kuhrt: Three points.
Tracy Kuhrt: Maybe we'll start with the second ones relates to what data just said.
Tracy Kuhrt: You know I think in here mentioned that If yes please list the CBS I think that is a no no.
Tracy Kuhrt: Yes, from the perspective of if it truly is a CV and it has an eviction Should we really be reporting it out into a document that is publicly available to anyone.
Tracy Kuhrt: My second point here is I don't know what the score is greater than or equal to seven actually mean so for those of us who.
Tracy Kuhrt: are not familiar with that maybe we need to be more specific about what it is that 70 reflects.
Tracy Kuhrt: very much a magic number in my mind, and then the last point that I have is the one that I made in the comments which is.
Tracy Kuhrt: I feel like a badge even to a project that's never have had a TV that says this project is following the best practices for handling CVs.
Tracy Kuhrt: is not accurate right, I would prefer that if we do this, we have like a.
Tracy Kuhrt: never had a CV type badge and a yes, this project has dealt with all their CVs within the whatever this 90 day period might look like right or.
Tracy Kuhrt: Within the the timeframe that has been agreed with whoever with the reporter was so I think you know there's there's some challenges with clay me, you are good at something that you've never done and then also when you restore the badge.
Tracy Kuhrt: You know, after they've resolved that particular CV I think it's not quite right, either because we still don't know that they're good at dealing with CDs within the amount of time that had been specified, so I just feel like we need to be a bit more.
Tracy Kuhrt: Robust in how we're issuing these badges and when we're revoking these badges and when we're reissuing the badges.
Arun S M: Thanks Tracy i'm a late until probably call it that round Robin fashion.
Hart Montgomery: hey thanks yeah great points Tracy and Dan oh.
Hart Montgomery: I do want to it wasn't clear to me whether we were still by default releasing CVs after 90 days I think you know the automatic release without petition to the tasc is a good thing.
Hart Montgomery: Is data, points out, you know a lot of CVs are found by researchers and other people that.
Hart Montgomery: That have incentives to release them and particular we've even seen some CVs.
Hart Montgomery: brought by competitors that have you know lots of financial incentives to release CVs on hyper ledger stuff so you can guarantee that they're going to get released, you know as soon as the minimum window is.
Hart Montgomery: You know.
Hart Montgomery: is reached, so you know, I think, by default, you know, we should be releasing CVs after 90 days.
Hart Montgomery: You know, and I also wonder, you know about the scoring.
Hart Montgomery: You know the scoring is always a little bit subjective so so i'd worry that that could be gained a little bit.
Hart Montgomery: You know, so if this were you know totally up to me, I would just say let's release all CVs in 90 days you know sort of no matter what happens.
Hart Montgomery: You know, unless people ask for a tasc and if something is very minor you know.
Hart Montgomery: Well, maybe you can release it if it's not totally fixed right.
Hart Montgomery: But you know that that sort of addresses the point here, which is we want people addressing.
Hart Montgomery: You know, high high severity CVs you know, but we should also be transparent about the less severe CVs.
Hart Montgomery: So so i'd prefer like a mandatory release policy, because I think in practice we're going to have to pretty much do that anyway and there's no reason to hold these back.
Hart Montgomery: i'd be curious to hear what everyone thinks about that.
Arun S M: Thanks.
Arun S M: All right, Hello.
Arnaud J Le Hors ("Arno") @ IBM: Yes, hi guys.
Arnaud J Le Hors ("Arno") @ IBM: And I just I missed the call Task Force I since, in the reschedule I don't have it on my agenda to fix this I actually meant to attend, but so my point on this is that, in fact, a bit of for up to what Dan on our third.
Arnaud J Le Hors ("Arno") @ IBM: The I mean the openness of recommendation is that we should try to engage with the reporter and try to negotiate the time frame for the disclosure.
Arnaud J Le Hors ("Arno") @ IBM: And, as you know, often said that mean they may have their own you know timeline and the experience shows that, in fact, they are not always.
Arnaud J Le Hors ("Arno") @ IBM: Nice players and you know it might be, because there is competitive incentives, but there may be all sorts of reasons why people don't necessarily want to respect.
Arnaud J Le Hors ("Arno") @ IBM: You know, to give you enough time to fix the issue and so that's the reality we're dealing with it's, to the point where openness SF is actually now planning on developing a guide for.
Arnaud J Le Hors ("Arno") @ IBM: For reporters and it's well understood that they may ignore it, of course, but the thought is that maybe if you know.
Arnaud J Le Hors ("Arno") @ IBM: We give them an insight as to what it's like to be on the other side they might be more amenable to negotiating rather than.
Arnaud J Le Hors ("Arno") @ IBM: forcing their own schedule on on the project which sometimes can be quite challenging right.
Arnaud J Le Hors ("Arno") @ IBM: yeah you have to figure out whether this is real, you have to be able to reproduce it, you have to figure out the fix, and this may even with all good intentions for the project, it may still quite you know take quite some time.
Arnaud J Le Hors ("Arno") @ IBM: And so I think it's important here to take that into account, and I agree with Dan or that you know just saying oh.
Arnaud J Le Hors ("Arno") @ IBM: 90 days well in some cases they may be, you know agreeable to make it longer if you know it's a really hard problem to solve, and they might accept to give you more time.
Arnaud J Le Hors ("Arno") @ IBM: and other cases they may just say well screw how i'm going to release it next week and you just have to live with it, so I think did the I think a policy needs to reflect that you know, this is not cast in stone and it, it is.
Arnaud J Le Hors ("Arno") @ IBM: dependent on the reporter and their willingness to negotiate or not.
Arun S M: Thanks, that was a.
Arun S M: That was an option we did not know about things that a try.
Troy Ronda: So just a few thoughts I think the first thought is you know part of this proposal sounds a little bit like information gathering better transparency.
Troy Ronda: Another part is this the badge concept.
Troy Ronda: And you know i'm curious you know.
Troy Ronda: I am curious you know if the badge part is is important aspect of this or just the idea that there should be some easily discoverable information about the CD stats for a project.
Troy Ronda: So I think you know, maybe if maybe if the focus was on on the more of the transparency aspect, and not so concerned about you know rural setting about badging that might be easier to get started.
Troy Ronda: And my other thought is that you know projects like areas that have less and more mature sub projects within them.
Troy Ronda: A badging exercise like this might be fairly difficult right, whereas you know stats gathering with point easier So those are my thoughts here.
Arun S M: Thanks right.
Arun S M: um Okay, I think we have so many questions to discuss.
Arun S M: And debate about so i'll probably start with to try, so the intention is not to have a badge but intention is to have it easily consumable and probably.
Arun S M: incentivize projects to to do their best so that the consumers of that project they feel confident about the project.
Arun S M: So that's the intention behind it so badge is probably the easily convey.
Arun S M: An idea for somebody who's just looking into project, and they want to know hey can I trust this project, or is the project maintain to the standards that we expect.
Arun S M: And if there are other recommendations, apart from bypassing Dennis.
Arun S M: will come those as well.
Arun S M: and probably this ties back to the the idea that Tracy was talking about.
Arun S M: Right, we may not be good but single type of bike because of certain reasons that in a project is incubated they have not done any best practices issues that are starting to work in an open source community.
Arun S M: So they may not be X, they may not have exposed to certain scenarios which other projects might have already been exposed maybe not all their maintenance or occupied doing something else.
Arun S M: So it completely agree on that aspect some, if not a best practice in terms of CV we can always say that the project is as.
Arun S M: is good for last two quarters right in terms of how they are managing their CV so that can be a badge and that badge definition, can go by saying that.
Arun S M: The project is in good shape, for the last two quarters and it's it's given through these reports and other means and.
Arun S M: Either retired know CBS reported or it's following it's best to to address them so that can be a badge and again, it can be bad or it can be any other means of conveying that message.
Arun S M: And to another point.
Arun S M: That spoke about extensions and the minimum I mean disclosing it after minimum number of days that are.
Arun S M: that's an interesting aspect, and also, I guess that ties back to what are not set in terms of negotiating with the person who has raised, I was issued that CV right.
Arun S M: So.
Arun S M: I have added that as a comment in the notes letting the page is not in edit mode that so it's not showing up, but we will discuss that in the task force call to see.
Arun S M: If we need to do anything for now I think disclosing that after 90 days without having any extensions, because some of them, as you said, it is not in.
Arun S M: Our control that makes sense, and we can put that up and i'm not sure if projects would be happy to do it, though.
Arun S M: At least from us from a process point of view, we can state that and.
Arun S M: Did I miss any point.
Troy Ronda: Just from my point projects like areas which are more client frameworks and not blockchains.
Troy Ronda: have multiple projects within them, so these proposals 10 maybe night to address that issue that.
Troy Ronda: Something like areas may have a very, very fresh sub project vs no more long running some project and it's fairly difficult to have this global rule just for like say something like areas across the board.
Arun S M: I agree so each.
Arun S M: repositories and or each project, but in Aries is considered as independent one like that's what you mean.
yeah.
Troy Ronda: there's like several different frameworks and completely different containers right so.
Troy Ronda: it's a it's more challenging with with that kind of framework project than like see the blockchain projects to have a kind of a global scope like this.
Arun S M: um hey our time, please.
Hart Montgomery: yeah I mean choice choice point makes sense, but there's no reason we couldn't do this sub project by sub project right.
Hart Montgomery: You know, ultimately, we still want to you know indicate to folks like you know whether people are following best security practices or not, and if if you know if we need to do it sort of like repub by repo or sub project by project, you know I don't see why that would be an issue.
Hart Montgomery: With that satisfies your concerns Troy.
Troy Ronda: yeah, I guess, we have to start identifying that a little bit better um but I mean I think part of my point was just um.
Troy Ronda: You know I think the information, transparency thing is easier than you know trying trying to adjudicate badging is just like personal side as well, so.
Hart Montgomery: yeah totally agree with you.
Nathan George: I would read the report transparency thing doesn't go away with this, and I wonder if, maybe there's, something that would actually help general.
Nathan George: Project discovery if we had the maintainer group repositories and say these things are all part of one hole and these things are all each kind of stand alone, maybe because they're different implementations of the same protocol, or because.
Nathan George: There may be different plugins that are on the sit on top of the core and so a foreigner building one doesn't necessarily reflect on the others.
Nathan George: It feels like that organization in that making that hierarchy more visible would help with both the badging and in making the project more approachable.
Arun S M: So um I think going by that tried so.
Arun S M: Far the things which we use as a libraries as a dependency, sometimes we see that hey this particular framework has an issue by Andre in this programming language or so.
Arun S M: that's one consideration, but again, the question is how do we show that out to be showcased to consumers.
Arun S M: Point taken.
Arun S M: expect and hey Tracy.
Tracy Kuhrt: I think i'd like to really highlight and again on a suggestion, because I think it's not.
Tracy Kuhrt: it's not going through and so maybe we can state it a different way, which is.
Tracy Kuhrt: focused on the data first right, what is the data that you want to collect about CBS and that data is.
Tracy Kuhrt: CV name, date reported maybe the person who reported it the date that it was resolved, which would then allow you to calculate you know how many days was passed.
Tracy Kuhrt: Whether or not, that was within the agreed upon days to resolve right so maybe that's an initial sort of capture make.
Tracy Kuhrt: A point of data that you capture right once you get all these points of data that you want to capture about a CV, then you can decide what type of badges right and maybe it's.
Tracy Kuhrt: You know here's a couple of sequel statements or whatever you want to call to say like this is the data, you would need to see what the average amount of time, it was the results eat for this project that's repo this whatever it is that we're talking about right.
Tracy Kuhrt: This is the.
Tracy Kuhrt: You know number of times that the cbe was resolved within the agreed upon timeframe, you know all of these sorts of data is available, then to you after you get.
Tracy Kuhrt: That data collected and from there, you can decide what the badges are so let's I think Troy suggestion is really good, and so I want to see if we can focus instead of badges what is the data that we need in order to determine whether or not a project is doing good resolving their CDs.
Arun S M: Thanks race excellent point makes sense.
Arun S M: We need to figure out what kind of data, we can collect I think all the data points docusign should be, we should be able to get those.
Arun S M: And I guess I missed one other point I think you you wanted to understand how did we come up with a score seven and what does that really indicate.
Arun S M: score seven as use it for now is is a magical number, so we just consider that anything greater than seven to be critical.
Arun S M: But I can we can change it right, so that was that was a proposal and we had that in mind when when writing this proposal.
Arun S M: And I think is sharing the screen and whenever somebody reports I in issue, they will have to fill through our answered list of questions and so it's a pre set list of questions in a sense that we have to know like how much of a way, am I, giving for each of these aspects of tissue.
Arun S M: And, based on what a particular reporter is is saying we the calculators like it determines the score of that particular CV.
Arun S M: And once it gets reported and probably While talking to them, and we can like there can be a process which.
Arun S M: Which is established which which were a particular maintain or somebody can go there and talk to them and tell them hey.
Arun S M: I see that you have considered this particular aspect of the high, but for from from our definitions, because we assume certain things in the project.
Arun S M: Our security threat model does not consider these cases so that's where we don't think this is high, so we, we will change this tool it's a another value and that can reduce the score as well.
Arun S M: So this score gets calculated through these questionnaires that somebody answers and one of the recommendation that the task force also hide pause.
Arun S M: Since we are dealing with blockchain technology and multi party systems, if needed, we will bring in additional set of questions into this.
Arun S M: To have are meant to have influence on this code that gets calculated and those additional set of questions could be very specific to blockchain technology, and this, it should work for the core protocols projects like we have about six of them in hyper ledger.
Arun S M: Again that's not imposed on all the projects and the hyper ledger it specifically for those.
Ry Jones: also want to.
Ry Jones: I was showing.
Ry Jones: Earlier for fabric, we have this public dashboard.
Ry Jones: which shows the number of reports are policy etc and.
Ry Jones: You can dig into this and see.
Ry Jones: How many CBS cetera so there's more clicking you can do, I will post a link to this in the discord chat.
Tracy Kuhrt: And is a scoring minute.
Tracy Kuhrt: Looking at the site it's github github COM Is this something that is built into github and, if so, how would we go about making those changes that you're suggesting a room about you know they're selecting specific types of things that would need to be at it.
Ry Jones: I can answer the first part this this is built into github what I did for this was I started a draft security advisory on the governance repo.
Ry Jones: And then.
Ry Jones: Just started answering these questions.
Ry Jones: And once once you get a score here.
Ry Jones: You can go in here and set this yourself if you want, I will give you a walkthrough at a at a later date.
Arun S M: Right, I see how to raise.
Hart Montgomery: Contact yeah I would also take.
Hart Montgomery: A lot of the CV scores.
Hart Montgomery: The big grain of salt so, for instance, if you have a bug bounty program you know everyone wants to extract more money.
Hart Montgomery: From the program so they generally, we see that people try to inflate their scores when possible.
Hart Montgomery: You know and that's one thing, the other hand, if it's like someone from a project reporting a CV sometimes they will tend to under report it.
Hart Montgomery: So you know, we should be careful with the CV scores, particularly for for the bug bounty programs and CVs that are that come through that way.
Ry Jones: I will say that I spend a lot of time closing basically bogus reports on hacker one.
Ry Jones: So hearts point about over inflated is.
Ry Jones: Yes, very much so.
Arun S M: I think.
Arun S M: One other question that you hi Tracy was when we have our own set of questions, how do we consider them and.
Arun S M: Here right so that aspect is is not exploded.
Ry Jones: What.
Arun S M: Do you want to see on the screen.
Arun S M: i'm.
Arun S M: Sorry, I think that the question that Tracy had was in when we bring in our own set of questions which other than the one that we saw Nikita preach, how do we consider those in the scoring criteria.
I think that's an open question.
Arun S M: Like.
Arun S M: So um I would require request the thc and also the the maintainer stuff all the projects to join in the next Security Task Force meeting on Tuesday.
Arun S M: Because that's really the time where we dig some of these questions into deeper and we we do discuss a lot of not many things, and the summary over here captures it's probably a gist of what happened in the call but there's a lot that goes into those cons.
Tracy Kuhrt: Okay, is there anything else or anybody on the screen test for us would like to cover today.
Tracy Kuhrt: I will take that as a no.
Tracy Kuhrt: So, I guess, we will say that we are complete, for today next week Bobby will be presenting some of the work that they've been doing in the learning materials working group.
Tracy Kuhrt: To come up with some guidelines around documentation, or they had a task force going on there, so we'll let Bobby and to present that to us next week.
Tracy Kuhrt: If there's any other items that people think we should discuss as a tlc, please let me know and we will make sure to get that on the agenda as well, and with that I will close out the meeting for today.
Tracy Kuhrt: Thank you all for attending.
sure.