Pawel Pawlak: Hello! Good morning to you.
Byung-Woo Jun (Ericsson Software Technology): Thank you.
Pawel Pawlak: Morning, are you.
Byung-Woo Jun (Ericsson Software Technology): Good, good.
Pawel Pawlak: Yeah, okay, okay, today, we have a
Pawel Pawlak: no sun day, no sunshine. So, yeah. But.
Byung-Woo Jun (Ericsson Software Technology): You know. Sunshine was.
Pawel Pawlak: Was too hot.
Byung-Woo Jun (Ericsson Software Technology): Listen. Oh, yeah. Yeah.
Pawel Pawlak: So it's good to have like morning with some rain, and you know.
Byung-Woo Jun (Ericsson Software Technology): Right, right.
Pawel Pawlak: Good for the Gaza.
Byung-Woo Jun (Ericsson Software Technology): Yeah, they need the water. So.
Pawel Pawlak: Yeah, yeah.
Pawel Pawlak: exactly. Okay, let me share my screen.
Pawel Pawlak: So today, we expect Ramesh to join right?
Byung-Woo Jun (Ericsson Software Technology): I don't know who's gonna join Megan. Not gonna join today. Right.
Pawel Pawlak: No, I'm talking about the policy team somebody from policy.
Byung-Woo Jun (Ericsson Software Technology): Yeah, yeah, yeah, yeah. Yeah. Let me let me ping him.
Pawel Pawlak: okay, okay.
Pawel Pawlak: because we discussed last time with the with Ramesh, that, if you would have any questions, tony here, and we are here so
Pawel Pawlak: good opportunity, and I gave the 1st slot
Pawel Pawlak: paramish if he, if he needs right.
Byung-Woo Jun (Ericsson Software Technology): Yep.
Byung-Woo Jun (Ericsson Software Technology): Let me give you the our new link.
Tony Hansen (AT&T Services, Inc.): They're here for you.
Pawel Pawlak: Yeah, thank you. Tony.
Byung-Woo Jun (Ericsson Software Technology): Let me see, maybe for that
Byung-Woo Jun (Ericsson Software Technology): I send the text team
Byung-Woo Jun (Ericsson Software Technology): oversee.
Pawel Pawlak: Okay.
Pawel Pawlak: before we start tomorrow, we don't have the preparation meeting right? Because on Thursday you have the guys
Pawel Pawlak: time off. Right? So yeah.
Byung-Woo Jun (Ericsson Software Technology): And then Ts is cancer. So this week. So right?
Pawel Pawlak: Yes, yes, yes.
Byung-Woo Jun (Ericsson Software Technology): K.
Pawel Pawlak: Hello, Mundasar! Good morning.
Muddasar Ahmed (MITRE): Good morning!
Byung-Woo Jun (Ericsson Software Technology): I just saw 20.
Pawel Pawlak: Okay, so alright.
Byung-Woo Jun (Ericsson Software Technology): Yeah, he's away from his desk, cause that's we do. And then when he join and we can.
Byung-Woo Jun (Ericsson Software Technology): huh, okay.
Pawel Pawlak: Okay, okay.
Pawel Pawlak: I guess also, Amy should join today. But
Pawel Pawlak: yeah, let's
Pawel Pawlak: okay. I hope you guys can see my screen right just to to check in the meantime. Okay, so, apart from the regular agenda, let's say
Pawel Pawlak: I have at least 3 topics added. One, is the policy road to gold badge. If Ramesh joins us so we could
Pawel Pawlak: have some
Pawel Pawlak: support for him if he already started to, you know.
Pawel Pawlak: to prepare some updates for the from the answers.
Pawel Pawlak: oh, sorry I I made some
Pawel Pawlak: paper here.
Pawel Pawlak: Mmm.
Pawel Pawlak: maybe also, Tony, you could have some updates as a follow up of the discussion. Maybe you had in the meantime
Pawel Pawlak: for governance. For the questions that would be on up wide right
Pawel Pawlak: that you had.
Tony Hansen (AT&T Services, Inc.): I can talk. I can talk about that for a minute. Sure.
Pawel Pawlak: With Sandra. Right?
Pawel Pawlak: okay.
Pawel Pawlak: There will be some vulnerability reports for Oslo release and amy and her team already working on it, so we expect to have it available on Friday.
Pawel Pawlak: And last, but not least, Csi, most critical open source projects, not using memory safe code
Pawel Pawlak: the documents that was shared by email. I think you you were the originator, right?
Byung-Woo Jun (Ericsson Software Technology): Yeah. Yep,
Pawel Pawlak: So I had a briefly
Pawel Pawlak: spend some time on on looking at it, and, you know.
Pawel Pawlak: made some copy paste of some statistics coming from those.
Pawel Pawlak: Yeah.
Pawel Pawlak: plenty of projects and and the different statistics per project. But there is a whole list of of of
Pawel Pawlak: and percentage at the end of the
Pawel Pawlak: document. That shows, you know, some
Pawel Pawlak: open source projects, and
Pawel Pawlak: if they are directly, or
Pawel Pawlak: it stated that sometimes, maybe even as a
Pawel Pawlak: as a tensitive dependency there, there might be
Pawel Pawlak: impacted in ways.
Pawel Pawlak: This is my understanding of of this.
Pawel Pawlak: A and yeah, the the regular review of the items. Some updates from the ptls called, yes, meeting.
Pawel Pawlak: maybe tech meeting. Yeah.
Pawel Pawlak: Okay. Hmm.
Pawel Pawlak: So
Pawel Pawlak: while we wait for for Ramesh, if he joins I don't know if we could have some short discussion. Where have you had a chance to take a look into the document?
Pawel Pawlak: That's the young shirt.
Pawel Pawlak: Are there any comments or questions.
Byung-Woo Jun (Ericsson Software Technology): There are 2 documents. One is for roadmap. So the other one is the analysis asking, you take the
Byung-Woo Jun (Ericsson Software Technology): 170 project and 52%. Yeah, yeah, that's the ones I'm not sure. What are you gonna do with the end on it? And what's the what does it mean to us?
Pawel Pawlak: I saw I saw some components that don't have this using right that that are mentioned there. I had no time to go deeply into the results. Right? Because even if the
Pawel Pawlak: the the component is on the on the list, right, if the percentage of the of the lines of code that is, memory unsafe is 0. Then, okay, we we know that's okay.
Pawel Pawlak: Although we use the language that is in general could be affected. But the product we are using.
Pawel Pawlak: Most probably it's not that much affected right.
Byung-Woo Jun (Ericsson Software Technology): Right.
Pawel Pawlak: This is my logic. If you think it's maybe it should be rephrased. Just just speak up.
Byung-Woo Jun (Ericsson Software Technology): On app doesn't use any cesc. Processing is just using mostly Java and the python.
Byung-Woo Jun (Ericsson Software Technology): According to this report, and not.
Tony Hansen (AT&T Services, Inc.): Downstairs.
Byung-Woo Jun (Ericsson Software Technology): Yeah, you're right.
Byung-Woo Jun (Ericsson Software Technology): Yeah. But the but even the
Byung-Woo Jun (Ericsson Software Technology): jdk, there was some percentage of vulnerability
Byung-Woo Jun (Ericsson Software Technology): and was even go. Nephew, we're not using goal. But, nephew, they go has 6%, something like that. So anyway, so in general, we need to
Byung-Woo Jun (Ericsson Software Technology): come up with some plan what to do.
Pawel Pawlak: Well, I think first, st we should.
Pawel Pawlak: We should analyze, analyze if and how much we are impacted right? And then, based on findings, we could say, Okay, there could be some action
Pawel Pawlak: plan for it or or not. Right
Pawel Pawlak: very much.
Muddasar Ahmed (MITRE): So. Paul, I think this is the stuff that needs to
Muddasar Ahmed (MITRE): go out to open. Ssf. In my view.
Muddasar Ahmed (MITRE): you know, lot of these languages have been around.
Muddasar Ahmed (MITRE): It's really the continuation of efforts that stays in the same language, right.
Muddasar Ahmed (MITRE): So
Muddasar Ahmed (MITRE): for projects who are starting new or who are building new capability. That's where it needs to go, because we cannot remove a lot of historical context.
Muddasar Ahmed (MITRE): And you know.
Muddasar Ahmed (MITRE): a Burdozer fashion cannot raise it. It's too cost
Muddasar Ahmed (MITRE): costly.
Muddasar Ahmed (MITRE): And so
Muddasar Ahmed (MITRE): it should be
Muddasar Ahmed (MITRE): part of the open Ssf. As one of the recommendation to use memory safe languages.
Muddasar Ahmed (MITRE): The project should part of their architecture, they should decide when they're building something
Muddasar Ahmed (MITRE): what kind of bricks and patterns they're gonna use
Muddasar Ahmed (MITRE): in their developmental plans.
Muddasar Ahmed (MITRE): I think that's the easy one that we can, you know, socialize with open Ssf.
Muddasar Ahmed (MITRE): and then if
Muddasar Ahmed (MITRE): we ever get elephant security focus group
Muddasar Ahmed (MITRE): operational. It'll become part of those.
Muddasar Ahmed (MITRE): And then we can also
Muddasar Ahmed (MITRE): at least within elephant projects.
Muddasar Ahmed (MITRE): We can socialize, you know. Maybe create one or 2 sliders send it up to
Muddasar Ahmed (MITRE): Tech, and you know, Board.
Muddasar Ahmed (MITRE): that
Muddasar Ahmed (MITRE): that they can socialize with all the projects is, you know, one of the goals would be.
Muddasar Ahmed (MITRE): and the future when you're building new capability. You know this should be part of the consideration.
Muddasar Ahmed (MITRE): Cause, I think, for us, we can analyze it. But moving this huge ship
Muddasar Ahmed (MITRE): to just remove those is not possible. It's not realistic.
Byung-Woo Jun (Ericsson Software Technology): Resource!
Muddasar Ahmed (MITRE): Exactly right. Well, it's time, too, right?
Muddasar Ahmed (MITRE): In order to migrate.
Muddasar Ahmed (MITRE): It's gonna require time.
Muddasar Ahmed (MITRE): And a lot of these projects are in that state that they haven't been, you know.
Muddasar Ahmed (MITRE): out in the market being used by, you know, the intended audience.
Muddasar Ahmed (MITRE): We're just gonna delay it more.
Muddasar Ahmed (MITRE): And might just kill the project itself.
Amy Zwarico - AT&T: So modisar. I mean, one of the things that's really interesting about the the use of memory. Safe languages is that for kernel development you can't.
Amy Zwarico - AT&T: So one of the flagship, one of the flagship.
Amy Zwarico - AT&T: projects out of the Linux Foundation
Amy Zwarico - AT&T: you know, which is Linux.
Muddasar Ahmed (MITRE): Yeah.
Byung-Woo Jun (Ericsson Software Technology): Yeah. Phoenix. Yeah.
Amy Zwarico - AT&T: You have to use a memory not unsafe language.
Byung-Woo Jun (Ericsson Software Technology): Yeah, Linux is the 1 90%, 95%.
Amy Zwarico - AT&T: And and so I think that the other thing is for the Lfn projects.
Amy Zwarico - AT&T: I know from the
Amy Zwarico - AT&T: around software community that
Amy Zwarico - AT&T: basically once you get down to
Amy Zwarico - AT&T: for sure the Odu.
Amy Zwarico - AT&T: So the distributed unit, but also to some extent the
Amy Zwarico - AT&T: the centralized unit.
Amy Zwarico - AT&T: The memory. Safe languages don't have the don't yet have the performance to be able to to implement. So most of that's either in C or C,
Amy Zwarico - AT&T: so I think that's 1 of the considerations that the that the Lfn has to hand has to consider is, are you using a are you operating in an are you writing code
Amy Zwarico - AT&T: or something that
Amy Zwarico - AT&T: the memory safe languages don't have the appropriate performance.
Tony Hansen (AT&T Services, Inc.): There is an effort to
Tony Hansen (AT&T Services, Inc.): move some of the Linux kernel into rest.
Amy Zwarico - AT&T: Are they.
Tony Hansen (AT&T Services, Inc.): Yes.
Amy Zwarico - AT&T: Oh, interesting!
Byung-Woo Jun (Ericsson Software Technology): Lost. Okay.
Amy Zwarico - AT&T: But I know that my husband says that and graphics still overwhelmingly, everything is
Amy Zwarico - AT&T: C and C, plus plus.
Tony Hansen (AT&T Services, Inc.): Oh, sure!
Amy Zwarico - AT&T: So, you know, gaming the same thing. So it's kind of interesting. I.
Tony Hansen (AT&T Services, Inc.): There's also an effort to do
Tony Hansen (AT&T Services, Inc.): memory safe subsets of C plus plus.
Amy Zwarico - AT&T: Oh, interesting!
Muddasar Ahmed (MITRE): I think those are the business decisions, right and
Muddasar Ahmed (MITRE): and backward compatibility, a whole bunch of other issues piling up.
Muddasar Ahmed (MITRE): I think the report itself wasn't for
Muddasar Ahmed (MITRE): certain areas where you don't have expertise or the performance requirement.
Muddasar Ahmed (MITRE): Generally they were targeting. Hey, you guys are writing applications, left and right, right. There's a huge industry that produce
Muddasar Ahmed (MITRE): capabilities in form of software.
Muddasar Ahmed (MITRE): Think that's their main goal is that
Muddasar Ahmed (MITRE): if you have a choice
Muddasar Ahmed (MITRE): selecting a language should be.
Muddasar Ahmed (MITRE): what are the criteria?
Muddasar Ahmed (MITRE): And the reports specifically mention
Muddasar Ahmed (MITRE): what they called
Muddasar Ahmed (MITRE): critical industry areas like.
Muddasar Ahmed (MITRE): you know, some some of the Dod needs and some other places. That's where there's immediate
Muddasar Ahmed (MITRE): concern.
Muddasar Ahmed (MITRE): But you you should be able to maybe
Muddasar Ahmed (MITRE): off
Muddasar Ahmed (MITRE): from many unsafe languages
Muddasar Ahmed (MITRE): generally.
Muddasar Ahmed (MITRE): There's going to be a you know 2015 year period before
Muddasar Ahmed (MITRE): a similar
Muddasar Ahmed (MITRE): to gently accept it.
Muddasar Ahmed (MITRE): software capabilities won't
Muddasar Ahmed (MITRE): move off of these things. But I think that you know the people who wrote software for F, 35, for example, or subsum submarine or nuclear power plan.
Muddasar Ahmed (MITRE): I I think that's that's the
Muddasar Ahmed (MITRE): critical industry sector that
Muddasar Ahmed (MITRE): the report was saying, hey, you should do something about it.
Muddasar Ahmed (MITRE): I think it's it's less of a concern for something like CUDU. For now.
Muddasar Ahmed (MITRE): then? What might be.
Muddasar Ahmed (MITRE): You know, some of the Dod's or governmental, like Irs applications that they've been more concerned about.
Amy Zwarico - AT&T: Right. And that's just. Yes. So those are, I think.
Amy Zwarico - AT&T: I think, like financial.
Amy Zwarico - AT&T: Some of the financial. So applications are very well suited for
Amy Zwarico - AT&T: a memory safe language.
Amy Zwarico - AT&T: I don't. I?
Amy Zwarico - AT&T: So so I think that. Yeah, I I think that's an interesting point. I haven't gotten a chance to read the article yet. But what about
Amy Zwarico - AT&T: Did they say anything about Scotta systems?
Muddasar Ahmed (MITRE): Yeah, they did. I think that's what it was going like the scalar systems going into. You know, the the petroleum electricity, the there are 16
Muddasar Ahmed (MITRE): industry factors that use government has classified as a critical infrastructure.
Muddasar Ahmed (MITRE): So their goal was that if there is, you know, opportunity
Muddasar Ahmed (MITRE): to get off of these.
Muddasar Ahmed (MITRE): that will be the priority.
Byung-Woo Jun (Ericsson Software Technology): Hmm.
Muddasar Ahmed (MITRE): So lot of industries. Ca, come in, and most of these critical
Muddasar Ahmed (MITRE): infrastructure industries.
Muddasar Ahmed (MITRE): And I think the telecom also falls in it.
Muddasar Ahmed (MITRE): But when you think of telecom, it's got the back end. Applications. It's got business applications. And then it's got these
Muddasar Ahmed (MITRE): network elements that provide Csp services.
Muddasar Ahmed (MITRE): I think one of us to kind of look at.
Muddasar Ahmed (MITRE): What's the exposure area? What's the
Muddasar Ahmed (MITRE): lateral translation? Left lateral
Muddasar Ahmed (MITRE): movement?
Muddasar Ahmed (MITRE): Threats for you. So everything, you know, when you do, these kind of changes have to do your, you know.
Muddasar Ahmed (MITRE): threat, analysis and risk analysis to figure out
Muddasar Ahmed (MITRE): what can go wrong. And if something goes wrong.
Muddasar Ahmed (MITRE): how much it's gonna hurt.
Muddasar Ahmed (MITRE): So a a DU
Muddasar Ahmed (MITRE): is not doing any kind of user data,
Muddasar Ahmed (MITRE): inspections or
Muddasar Ahmed (MITRE): core data inspections, basically mapping the channels and those kind of things. So the Max is going to have is denial of service.
Amy Zwarico - AT&T: Which I mean, as we saw with the Bgp incident in February. Was it?
Amy Zwarico - AT&T: that's that can be
Amy Zwarico - AT&T: pretty serious for a telecom provider.
Muddasar Ahmed (MITRE): Yeah. But it's it's localized, right? So you only gonna affect
Muddasar Ahmed (MITRE): one or 2. Are you
Muddasar Ahmed (MITRE): carrying? Maybe
Muddasar Ahmed (MITRE): no more than 400 500 users right?
Muddasar Ahmed (MITRE): Having.
Amy Zwarico - AT&T: Know we we wound up.
Amy Zwarico - AT&T: We had that that that incident was, and it was not a security incident it was.
Amy Zwarico - AT&T: but it was
Amy Zwarico - AT&T: nationwide. It was close to.
Muddasar Ahmed (MITRE): Yeah, so Bgp is different. Right? So that's why.
Amy Zwarico - AT&T: I know, but I'm just saying that.
Muddasar Ahmed (MITRE): Yeah.
Amy Zwarico - AT&T: I understand, and it's it was part of the way the protocol was built.
Amy Zwarico - AT&T: and it just
Amy Zwarico - AT&T: stupid things happened.
Amy Zwarico - AT&T: you just have to make sure that you don't have something that cascades.
Muddasar Ahmed (MITRE): Right. I so with the Ptp. I think that that was the the comparison with the you is that do? You can only affect Max of like maybe
Muddasar Ahmed (MITRE): to 300 users.
Muddasar Ahmed (MITRE): Bgp can affect worldwide global
Muddasar Ahmed (MITRE): traffic, whether you wanna send it to Bitbucket or send it to wrong direction. Or you know, a whole bunch of other stuff can happen. Because you're you're part of the global routing table. And you can change the behavior of global routing.
Amy Zwarico - AT&T: Right.
Muddasar Ahmed (MITRE): Whereas do you use localize? If at, and T needs to fix memory and safe language, I think the priority will be something like core router that participate as a Bgp neighbor.
Muddasar Ahmed (MITRE): Do that first.st And then when the time and
Muddasar Ahmed (MITRE): budget permits, you fix the DU, because the impact is low.
Muddasar Ahmed (MITRE): And I think for us, even in own app. If were to do, I would probably have to look at which components are
Muddasar Ahmed (MITRE): the the highest criticality components
Muddasar Ahmed (MITRE): that might have a privacy data breach
Muddasar Ahmed (MITRE): or higher impact than the localized impact.
Muddasar Ahmed (MITRE): And maybe we can consider that in the future
Muddasar Ahmed (MITRE): to remove
Muddasar Ahmed (MITRE): some of the software capability from
Muddasar Ahmed (MITRE): unsafe to safe.
Pawel Pawlak: Hmm, it makes sense.
Muddasar Ahmed (MITRE): So generally, I I think so, Amy, for both at Verizon, like organization.
Muddasar Ahmed (MITRE): That is really the risk analysis about localized impact
Muddasar Ahmed (MITRE): level movement impact
Muddasar Ahmed (MITRE): right from the use.
Muddasar Ahmed (MITRE): Because, you know, like you, said Bgp, right? So if there's a lateral movement
Muddasar Ahmed (MITRE): and
Muddasar Ahmed (MITRE): the the ability of an adversary to go look at your soft tools or noct tools.
Muddasar Ahmed (MITRE): and if all of those, or, you know, providing the same ample opportunities to adversary, then we're in the same boat right? Somebody can easily go affect the Bgp and affect the global network traffic.
Pawel Pawlak: Okay.
Byung-Woo Jun (Ericsson Software Technology): Okay, so.
Pawel Pawlak: To think about what to do. Yeah, just.
Byung-Woo Jun (Ericsson Software Technology): We are going.
Muddasar Ahmed (MITRE): I would.
Byung-Woo Jun (Ericsson Software Technology): Phone, app, yeah.
Muddasar Ahmed (MITRE): I would say, I think this needs to be socialized with open Ssf, that's that should be. Whoever you know. Occasionally parts bit in their proceeding.
Muddasar Ahmed (MITRE): introduce this idea.
Muddasar Ahmed (MITRE): so they can put it as part of their recommendation.
Muddasar Ahmed (MITRE): and for everybody else.
Muddasar Ahmed (MITRE): you know, even Linux Foundation for networking, or any other foundation
Muddasar Ahmed (MITRE): should be you. Every project should have their crown jewel analysis. Right? What's the.
Byung-Woo Jun (Ericsson Software Technology): Right.
Muddasar Ahmed (MITRE): Credibility of the
Muddasar Ahmed (MITRE): software components.
Muddasar Ahmed (MITRE): and one time permits you start going from top of the list.
Muddasar Ahmed (MITRE): Believe that.
Byung-Woo Jun (Ericsson Software Technology): Tony Tony open. SSR, Tsc.
Tony Hansen (AT&T Services, Inc.): I am.
Byung-Woo Jun (Ericsson Software Technology): Okay, good. We.
Pawel Pawlak: Great Great.
Amy Zwarico - AT&T: Yay!
Byung-Woo Jun (Ericsson Software Technology): Yeah, it's good to socialize and openness. Yeah, Tony's there.
Tony Hansen (AT&T Services, Inc.): If there's a
Tony Hansen (AT&T Services, Inc.): if we want to put together a statement to bring up to the Tsc.
Tony Hansen (AT&T Services, Inc.): Open Ssf, Tsc. That'd be fine.
Tony Hansen (AT&T Services, Inc.): Happy to socialize that within them.
Byung-Woo Jun (Ericsson Software Technology): Sure that's great, and let us know then. Well, it's great, super.
Pawel Pawlak: No, but the attention is that we could prepare something right. And then Tony could be the messenger, or, you know, communicating the the message right? But we should craft something.
Pawel Pawlak: Yes.
Byung-Woo Jun (Ericsson Software Technology): Hmm.
Pawel Pawlak: I don't feel the sense of urgency that we need to do it right now, right? Maybe we could think about it and
Pawel Pawlak: try to craft something next week. What do you think? Is it.
Muddasar Ahmed (MITRE): Yeah. So the the report was out last September.
Pawel Pawlak: Yeah, so.
Muddasar Ahmed (MITRE): So I would say, I think it's more like
Muddasar Ahmed (MITRE): my weight loss efforts right?
Muddasar Ahmed (MITRE): The 1st I need to stop eating the bad stuff.
Muddasar Ahmed (MITRE): Then maybe I can control the calorie intake.
Muddasar Ahmed (MITRE): or, you know, change my diet completely, or start exercising, but
Muddasar Ahmed (MITRE): not eating the bad stuff.
Muddasar Ahmed (MITRE): What would be the 1st stop, and I think that's kind of recommendation that open Ssf makes. Hey?
Muddasar Ahmed (MITRE): These are
Muddasar Ahmed (MITRE): good habits, and these are the bad habits you should avoid, and this should take it to avoiding the bad habits.
Pawel Pawlak: Hmm! Sounds like somebody
Pawel Pawlak: went to the doctor recently.
Muddasar Ahmed (MITRE): I lost 10 pounds. It's 4, so.
Tony Hansen (AT&T Services, Inc.): Like congratulations.
Pawel Pawlak: Oh, okay.
Amy Zwarico - AT&T: You!
Byung-Woo Jun (Ericsson Software Technology): Good.
Muddasar Ahmed (MITRE): I kept telling people, Man Covid. And one day I realized, you know what that was like 3, 4 years ago. There's no excuse. Now
Muddasar Ahmed (MITRE): there's a 4 mile a day. I do. 2530 miles bike riding on the weekends.
Pawel Pawlak: Oh, wow! Nice!
Byung-Woo Jun (Ericsson Software Technology): And.
Muddasar Ahmed (MITRE): Haven't changed any
Muddasar Ahmed (MITRE): dietary stuff a lot.
Muddasar Ahmed (MITRE): but I stopped going to dinner parties.
Pawel Pawlak: Yeah, that's okay. Good idea.
Muddasar Ahmed (MITRE): I I tell people, let's, you know, meet up. We'll go for a walk or hike.
Muddasar Ahmed (MITRE): but.
Tony Hansen (AT&T Services, Inc.): Oh.
Tony Hansen (AT&T Services, Inc.): probably not too many takers on.
Muddasar Ahmed (MITRE): Nope, it's me and myself only 2 all the time.
Muddasar Ahmed (MITRE): Nurse.
Pawel Pawlak: Okay.
Tony Hansen (AT&T Services, Inc.): Good job.
Pawel Pawlak: Yeah. Yeah. Good.
Byung-Woo Jun (Ericsson Software Technology): The problem. 1 1 question I have for owner.
Pawel Pawlak: And hmm.
Byung-Woo Jun (Ericsson Software Technology): I think Tony mentioned to mostly only programming languages, choice of program languages, Java and Python.
Byung-Woo Jun (Ericsson Software Technology): and we're not using too much C and C, plus, plus, of course, Linux using C and C plus, plus, we are on top of it.
Byung-Woo Jun (Ericsson Software Technology): But in that case.
Byung-Woo Jun (Ericsson Software Technology): and we just worry about the dependencies, and still, Java can produce depends on some low level of function
Byung-Woo Jun (Ericsson Software Technology): and some 3rd party library, you know. So maybe some analysis. I don't know what kind of tool we sell proper.
Byung-Woo Jun (Ericsson Software Technology): And using that, we kind of are getting this some information. That's the long term discussion. Yes.
Pawel Pawlak: Even having some short short term analysis of okay of the components mentioned in the in the document, right.
Pawel Pawlak: And the components used by or not. Right with the Clm scans. We know what? What are the components used
Pawel Pawlak: and simply checking. Okay, if any of those components are marked as
Pawel Pawlak: specifically unsafe with the number of
Pawel Pawlak: lines of code
Pawel Pawlak: that specified, as you know.
Pawel Pawlak: unsafe.
Pawel Pawlak: This is more like.
Pawel Pawlak: okay, kind of
Pawel Pawlak: assessment. Right? Okay, we are using this this
Pawel Pawlak: libraries, right? Packages. And okay, among those.
Pawel Pawlak: it looks like top 5 that are
Pawel Pawlak: the most risky, or you know, somehow
Pawel Pawlak: that should be highlighted. Are those ones right? And just, maybe highlighting to the community. Okay, probably we will not do that much. But just
Pawel Pawlak: to keeping the record.
Pawel Pawlak: okay?
Pawel Pawlak: And maybe even keep pushing to the release notes. Right? Okay?
Pawel Pawlak: Based on this document, we, we we identified that those
Pawel Pawlak: components that are used by our projects are
Pawel Pawlak: little bit more risky in the in the memory.
Byung-Woo Jun (Ericsson Software Technology): Him.
Byung-Woo Jun (Ericsson Software Technology): Okay, I got it. My SQL.
Pawel Pawlak: Just for the just, for the for the transparency. Right?
Pawel Pawlak: But you want to be transparent with the
Pawel Pawlak: our consumers and overall communities right.
Byung-Woo Jun (Ericsson Software Technology): Yeah. And also the timeframe. We gonna provide some discount of transparency to release release. Okay, not.
Pawel Pawlak: We are still at the very early
Pawel Pawlak: stage of Oslo, and to.
Pawel Pawlak: as we discussed.
Pawel Pawlak: we should have very soon
Pawel Pawlak: by end of this week. So so premier results of the of discounts, right? So just matching the what we have in the
Pawel Pawlak: in the scan results, and the table that is submitted
Pawel Pawlak: in this report
Pawel Pawlak: could bring us some some better visibility on.
Pawel Pawlak: Do okay.
Pawel Pawlak: the risk or level of.
Pawel Pawlak: you know, impact
Pawel Pawlak: Nathan.
Muddasar Ahmed (MITRE): So i i i think th that's probably
Muddasar Ahmed (MITRE): a better idea, because on app lite.
Muddasar Ahmed (MITRE): if Oslo pulls it off right.
Muddasar Ahmed (MITRE): that might be mostly widespread on app version. Right? There may be some other capabilities that
Muddasar Ahmed (MITRE): some operators or vendors may use.
Muddasar Ahmed (MITRE): but seems like
Muddasar Ahmed (MITRE): moving forward.
Muddasar Ahmed (MITRE): This majority of the users gonna be on on appliance. So giving
Muddasar Ahmed (MITRE): the the the project makes in own app light anticipated project, mix.
Byung-Woo Jun (Ericsson Software Technology): Can just.
Muddasar Ahmed (MITRE): To the risk analysis of own app, wide right, the the projects that there will be there
Muddasar Ahmed (MITRE): processes
Muddasar Ahmed (MITRE): the participate, the risk of process being manipulated or process not being available.
Muddasar Ahmed (MITRE): and any data that might be at risk can give us
Muddasar Ahmed (MITRE): ability to prioritize
Muddasar Ahmed (MITRE): those you know subset of projects
Muddasar Ahmed (MITRE): in their impact and criticality
Muddasar Ahmed (MITRE): line up.
Muddasar Ahmed (MITRE): and then we can put together the recommendation that in the future
Muddasar Ahmed (MITRE): we like to get off of.
Muddasar Ahmed (MITRE): if they have any, you know, unsafe line of codes.
Byung-Woo Jun (Ericsson Software Technology): Okay, okay.
Byung-Woo Jun (Ericsson Software Technology): makes sense.
Pawel Pawlak: Sounds like a good plan.
Byung-Woo Jun (Ericsson Software Technology): Okay, so.
Amy Zwarico - AT&T: You mentioned the fact that it runs on top of Linux. But isn't most of Kubernetes also written in c plus plus.
Byung-Woo Jun (Ericsson Software Technology): See, Kubernet is using.
Byung-Woo Jun (Ericsson Software Technology): not C plus plus. But I have to double check. I think they're they're using goal. Maybe.
Amy Zwarico - AT&T: Oh, okay.
Byung-Woo Jun (Ericsson Software Technology): But go is 0% according to this. But yeah, I think most like le, let me double check. But most.
Amy Zwarico - AT&T: Remember what Kubernetes was written in. But go makes sense.
Byung-Woo Jun (Ericsson Software Technology): Yeah, cool and then maybe low level. You know, the application level, we maybe see plus plus speed.
Amy Zwarico - AT&T: Sure other numbers.
Byung-Woo Jun (Ericsson Software Technology): The covers. Yeah, yeah, yeah.
Byung-Woo Jun (Ericsson Software Technology): we we'll check. We're gonna check it. And then one is my secure server, you know, and ingress and the ingress or some other, you know, this month, you know. Try to. Our analysis are on it, depending on some of the database, some of the, you know
Byung-Woo Jun (Ericsson Software Technology): security and mechanisms. So
Byung-Woo Jun (Ericsson Software Technology): they they have a vulnerability. Then we have a problem. Engineix is 99%.
Pawel Pawlak: Yeah, yeah, I saw it. Yeah.
Amy Zwarico - AT&T: Okay? So yeah, kubernetes is, go.
Byung-Woo Jun (Ericsson Software Technology): Yeah, yeah, I, I test my understanding. Go, yeah, go is 0%.
Byung-Woo Jun (Ericsson Software Technology): Yep.
Amy Zwarico - AT&T: So that's good.
Amy Zwarico - AT&T: And I'm guessing then that up most of the
Amy Zwarico - AT&T: service meshes on top of it also.
Byung-Woo Jun (Ericsson Software Technology): Alright!
Amy Zwarico - AT&T: Didn't even.
Byung-Woo Jun (Ericsson Software Technology): This. I'm I'm checking because the enginex is not good, but we're using ingress.
Byung-Woo Jun (Ericsson Software Technology): Istio. I'm gonna check. But you didn't say about Istio. But I'm gonna check to how. What's the Istio based language. So
Byung-Woo Jun (Ericsson Software Technology): the service mesh those thing we are using for? Istio.
Byung-Woo Jun (Ericsson Software Technology): it didn't say anything, but it's still here to my looking at the document now. So I'm gonna check that.
Amy Zwarico - AT&T: I'll check.
Muddasar Ahmed (MITRE): Checking it right now.
Muddasar Ahmed (MITRE): One thing to remember is that for a lot of the memory unsafe
Muddasar Ahmed (MITRE): threads
Muddasar Ahmed (MITRE): the documents. That particular report also lists
Muddasar Ahmed (MITRE): historically, what mitigations were available
Muddasar Ahmed (MITRE): to minimize that risk? Right?
Muddasar Ahmed (MITRE): So it's not ready binary that you're unsafe. That means.
Muddasar Ahmed (MITRE): you know, all abilities there. It's quite possible. I'll summon some or all of those techniques were employed
Muddasar Ahmed (MITRE): when a program or operating system module was written in memory and safe language.
Byung-Woo Jun (Ericsson Software Technology): The.
Amy Zwarico - AT&T: Right, but the sometimes those are very difficult to find by the way, for Istio on the control plane
Amy Zwarico - AT&T: is written and go. The proxy of the envoy. Proxy is C.
Byung-Woo Jun (Ericsson Software Technology): Yeah. Link received.
Amy Zwarico - AT&T: Proxy is, yeah.
Byung-Woo Jun (Ericsson Software Technology): We are using envoy proxy, which is in routine c plus plus not good.
Amy Zwarico - AT&T: It happens.
Byung-Woo Jun (Ericsson Software Technology): Yeah, much, because I need to perform this way. So.
Amy Zwarico - AT&T: You know we've been using memory on safe languages for.
Byung-Woo Jun (Ericsson Software Technology): Yeah, yeah.
Amy Zwarico - AT&T: Since we start programming an assembly language. So.
Byung-Woo Jun (Ericsson Software Technology): Right?
Byung-Woo Jun (Ericsson Software Technology): So I have to let the you know. Om team knows about this cause we are using India.
Byung-Woo Jun (Ericsson Software Technology): Okay.
Pawel Pawlak: We're clean.
Pawel Pawlak: So have
Pawel Pawlak: moving forward with the updates.
Pawel Pawlak: Thank you, motherf, for giving those links for the
Pawel Pawlak: Fraud Security group.
Pawel Pawlak: We had reviewed
Pawel Pawlak: the to be to be deprecated for police and shared with the Tsc. Last Thursday.
Pawel Pawlak: and I think Jess.
Pawel Pawlak: and took it to remove. I don't know I have any.
Byung-Woo Jun (Ericsson Software Technology): She did. She didn't move.
Amy Zwarico - AT&T: Yes.
Pawel Pawlak: Okay, so it is done. Okay.
Byung-Woo Jun (Ericsson Software Technology): This is.
Pawel Pawlak: I will do it as done.
Pawel Pawlak: Thank you for all these those efforts, I mean, for
Pawel Pawlak: well, thanks.
Amy Zwarico - AT&T: You guys for getting it done.
Byung-Woo Jun (Ericsson Software Technology): Yeah, me, yeah.
Pawel Pawlak: Yeah.
Pawel Pawlak: it's great. We?
Pawel Pawlak: Yes.
Amy Zwarico - AT&T: Nice to have this done.
Pawel Pawlak: I already mentioned. About this bomarama registration. So if you are interested, please don't hesitate to to register yourself.
Pawel Pawlak: Hmm!
Pawel Pawlak: I think we will not focus on the packages upgrades for the new Delhi. However, as I mentioned.
Pawel Pawlak: there should be some some packages upgrades
Pawel Pawlak: coming for the
Pawel Pawlak: also release probably on Friday
Amy Zwarico - AT&T: Yeah. The 1st the initial run, I think. Let me look.
Byung-Woo Jun (Ericsson Software Technology): I saw the the access.
Amy Zwarico - AT&T: Hannah said that she uploaded it.
Byung-Woo Jun (Ericsson Software Technology): Yeah, she did.
Pawel Pawlak: Okay, okay, so
Pawel Pawlak: that's great.
Pawel Pawlak: We could.
Amy Zwarico - AT&T: Check, some.
Pawel Pawlak: Some first.st
Amy Zwarico - AT&T: Maybe I'm too trusting of my team.
Byung-Woo Jun (Ericsson Software Technology): I I checked this morning, but there's a spreadsheet excel.
Amy Zwarico - AT&T: Right. That's what we've moved to. Just the.
Pawel Pawlak: Deliverable. Yeah,
Byung-Woo Jun (Ericsson Software Technology): The security.
Amy Zwarico - AT&T: It's easier to. It's easier for the team to do. It's
Amy Zwarico - AT&T: so let's see if
Amy Zwarico - AT&T: there's anything for Bnf. SDK,
Amy Zwarico - AT&T: no, the last one on the list is so
Amy Zwarico - AT&T: we should be. We are use case ui, so we're. I think we're in good shape.
Pawel Pawlak: Okay, I guess for login modification. We we.
Byung-Woo Jun (Ericsson Software Technology): And also updates.
Pawel Pawlak: Okay. We'll shoot.
Byung-Woo Jun (Ericsson Software Technology): Yet.
Pawel Pawlak: Github actions. Yeah, something
Pawel Pawlak: later than I expected, probably. But we need to wait for the updates and the one of the next essays.
Pawel Pawlak: 11 a. Ml, I guess. Nothing new.
Pawel Pawlak: Update.
Pawel Pawlak: nephew, security working group.
Byung-Woo Jun (Ericsson Software Technology): They are working on the demo. So, but not yet. But I think this week next week they're gonna preparing for some demo second demo. So.
Pawel Pawlak: Okay, so let me add some comments. Just need to release it.
Pawel Pawlak: 9 months
Pawel Pawlak: So Demo, next week, right.
Byung-Woo Jun (Ericsson Software Technology): Demo. Yeah.
Byung-Woo Jun (Ericsson Software Technology): Second, demo for workload identity
Byung-Woo Jun (Ericsson Software Technology): instead of manual base. They want to add automation, a little bit.
Byung-Woo Jun (Ericsson Software Technology): Automation demo.
Pawel Pawlak: Expected.
Pawel Pawlak: Mixed
Pawel Pawlak: automation leads.
Pawel Pawlak: Yes.
Pawel Pawlak: Okay.
Pawel Pawlak: On-up security implementation status.
Byung-Woo Jun (Ericsson Software Technology): Same. No, no, input to the postponed. Also.
Pawel Pawlak: We don't have Ramesh, or we don't.
Byung-Woo Jun (Ericsson Software Technology): Ramesh. We have Ramesh here.
Pawel Pawlak: Ramesh. Oh, sorry. Hmm! So, Ramesh, thank you for joining this session.
Pawel Pawlak: If you'd have any questions for the
Pawel Pawlak: gold badge, have you had a chance to take a look at the questions that are non yellow.
Pawel Pawlak: Yes.
Ramesh Murugan Iyer (Ericsson): Yeah, Hi, Pavel and the team. Yeah, I have. Adelie Wayne and Saul from the policy team with me in the meeting room.
Ramesh Murugan Iyer (Ericsson): Thanks for having this in the agenda for today's meeting. We just like to confirm one thing related to the whole badging criteria on the dynamic analysis functionality that is needed for the project. We already have Prometheus server integrated with our applications and our integration test and our stability and performance test seats that we have already with the project is
Ramesh Murugan Iyer (Ericsson): validating the Prometheus metrics on the test.
Ramesh Murugan Iyer (Ericsson): So we just like to know? That will be considered as a dynamic analysis for the project, and that criteria will be satisfied with that. Or should we be looking into something else to do with for the dynamic analysis.
Tony Hansen (AT&T Services, Inc.): So if you look at the definition, says.
Tony Hansen (AT&T Services, Inc.): Well.
Pawel Pawlak: Then they would.
Tony Hansen (AT&T Services, Inc.): Thanks, for sharing.
Pawel Pawlak: Your screen.
Tony Hansen (AT&T Services, Inc.): No, it's on different
Tony Hansen (AT&T Services, Inc.): different device. The project must apply at least one dynamic analysis tool to any proposed major production release of the software
Tony Hansen (AT&T Services, Inc.): produced by the project before it's released.
Tony Hansen (AT&T Services, Inc.): That's that's all. It says.
Tony Hansen (AT&T Services, Inc.): But if you go into the details of what
Tony Hansen (AT&T Services, Inc.): dynamic
Tony Hansen (AT&T Services, Inc.): analysis tools, are
Tony Hansen (AT&T Services, Inc.): they?
Tony Hansen (AT&T Services, Inc.): They're they're they're measuring things at Runtime.
Tony Hansen (AT&T Services, Inc.): So you're actually running the code with these tools
Tony Hansen (AT&T Services, Inc.): in play
Tony Hansen (AT&T Services, Inc.): for your tests.
Ramesh Murugan Iyer (Ericsson): Yeah.
Ramesh Murugan Iyer (Ericsson): So before every release, we run our stability and performance test seats. And also we have a Jenkins job that periodically triggers our Integration test
Ramesh Murugan Iyer (Ericsson): in Jenkins pipeline. So in these tests we have Prometheus server getting deployed, and it validates
Ramesh Murugan Iyer (Ericsson): list of metrics that is being exposed in the application.
Tony Hansen (AT&T Services, Inc.): And
Tony Hansen (AT&T Services, Inc.): s.
Tony Hansen (AT&T Services, Inc.): wondering what
Pawel Pawlak: Isn't it that the the intention of this question could be that okay, are you running any
Pawel Pawlak: the Asd right dynamic scans or.
Tony Hansen (AT&T Services, Inc.): Oh.
Tony Hansen (AT&T Services, Inc.): here's here's the
Tony Hansen (AT&T Services, Inc.): the extended
Tony Hansen (AT&T Services, Inc.): definition, a dynamic analysis tool examines software
Tony Hansen (AT&T Services, Inc.): by executing of specific inputs.
Tony Hansen (AT&T Services, Inc.): For example, the project may use a fuzzing tool
Tony Hansen (AT&T Services, Inc.): or a web application scanner
Tony Hansen (AT&T Services, Inc.): or in some cases
Tony Hansen (AT&T Services, Inc.): less.
Tony Hansen (AT&T Services, Inc.): the the project may be willing to apply this here. I'm trying to
Tony Hansen (AT&T Services, Inc.): read this
Tony Hansen (AT&T Services, Inc.): difficult.
Tony Hansen (AT&T Services, Inc.): Okay?
Tony Hansen (AT&T Services, Inc.): In some cases
Tony Hansen (AT&T Services, Inc.): the project may be willing to apply 1st testing to your you know.
Tony Hansen (AT&T Services, Inc.): that's referring to a specific for purposes. This criterion. The dynamic analysis tool needs to vary the inputs in some way to look for various kinds of problems
Tony Hansen (AT&T Services, Inc.): or be an automated test suite with at least 80% branch coverage.
Tony Hansen (AT&T Services, Inc.): The Wikipedia page on dynamic analysis and the Owasp page on fuzzing identify some dynamic analysis tools, analysis tools may be focused on looking for
Tony Hansen (AT&T Services, Inc.): security volume, vulnerabilities. But this is not required.
Pawel Pawlak: So in in other words, it could be penetration test, for example, right? The answer for this one.
Tony Hansen (AT&T Services, Inc.): Example, yeah. Dynamic.
Muddasar Ahmed (MITRE): I think no
Muddasar Ahmed (MITRE): dynamic is different. So usually the difference would be, as Tony was explaining. Right?
Muddasar Ahmed (MITRE): You're in a working environment meaning that except for your own
Muddasar Ahmed (MITRE): code component.
Muddasar Ahmed (MITRE): everything else is real, right, not emulated.
Ramesh Murugan Iyer (Ericsson): Yes, that's the case for both performance stability and integration tests. They are all running on running application.
Ramesh Murugan Iyer (Ericsson): And then we have
Ramesh Murugan Iyer (Ericsson): checks on
Ramesh Murugan Iyer (Ericsson): failure scenarios as well, and the
Ramesh Murugan Iyer (Ericsson): metrics check. If the
Ramesh Murugan Iyer (Ericsson): performance on CPU memory network within
Ramesh Murugan Iyer (Ericsson): what is supposed to be for each application.
Ramesh Murugan Iyer (Ericsson): How long it takes the the responses to take
Ramesh Murugan Iyer (Ericsson): if any of the requests is processed too much CPU or memory. So we have that on the integration test as well.
Ramesh Murugan Iyer (Ericsson): For the performance stability test we use J. Meter.
Ramesh Murugan Iyer (Ericsson): which was one of the listed applications for dynamical analysis. So basically, we just want to confirm. If that covers
Ramesh Murugan Iyer (Ericsson): dynamic analysis, or we need to look into something more specific.
Tony Hansen (AT&T Services, Inc.): That was pretty dynamic to me.
Muddasar Ahmed (MITRE): Yeah. So I think it doesn't matter if
Muddasar Ahmed (MITRE): where the stage is.
Muddasar Ahmed (MITRE): In essence, you wanna perform that activity. It seems like
Muddasar Ahmed (MITRE): you combine
Muddasar Ahmed (MITRE): integration. Usually
Muddasar Ahmed (MITRE): in
Muddasar Ahmed (MITRE): development environment, you probably have a, you know, integration doing a slightly different activity because it's really more focused on the integration aspects.
Muddasar Ahmed (MITRE): Then the dynamic aspects.
Muddasar Ahmed (MITRE): If you combine lot of your testing towards the end, your opportunity to find the bug
Muddasar Ahmed (MITRE): at an early stage diminishes right? Other than that. It looks like you're doing what dynamic desk calls for.
Ramesh Murugan Iyer (Ericsson): Okay.
Tony Hansen (AT&T Services, Inc.): So let me make
Tony Hansen (AT&T Services, Inc.): repeat one sentence out of what I read before.
Tony Hansen (AT&T Services, Inc.): the purpose of this criterion, the dynamic analysis tool needs to vary the inputs
Tony Hansen (AT&T Services, Inc.): in some way to look for various kinds of problems
Tony Hansen (AT&T Services, Inc.): or be an automated test suite with at least 80% branch coverage.
Ramesh Murugan Iyer (Ericsson): Yeah.
Tony Hansen (AT&T Services, Inc.): That's the crux of it.
Tony Hansen (AT&T Services, Inc.): So if you're
Tony Hansen (AT&T Services, Inc.): if your tests are
Tony Hansen (AT&T Services, Inc.): well.
Tony Hansen (AT&T Services, Inc.): running the system. And
Tony Hansen (AT&T Services, Inc.): we, we can show that, hey? We're covering over 80% of the
Tony Hansen (AT&T Services, Inc.): the the branches that are
Tony Hansen (AT&T Services, Inc.): and the code.
Tony Hansen (AT&T Services, Inc.): Then you're covered.
Tony Hansen (AT&T Services, Inc.): If you're doing, if you're doing some sort of fuzz test on with inputs, or you're varying the types of inputs in the.
Tony Hansen (AT&T Services, Inc.): you know, throwing garbage in, that's random
Tony Hansen (AT&T Services, Inc.): and everything's passing. You're covered
Tony Hansen (AT&T Services, Inc.): so.
Ramesh Murugan Iyer (Ericsson): We have on Sauna. Yes.
Ramesh Murugan Iyer (Ericsson): Jacket, the branch in covering.
Tony Hansen (AT&T Services, Inc.): Okay.
Tony Hansen (AT&T Services, Inc.): if you're
Tony Hansen (AT&T Services, Inc.): yeah, are you over 80% branch coverage when you're running your tests, then you're
Tony Hansen (AT&T Services, Inc.): put that check in there.
Ramesh Murugan Iyer (Ericsson): Okay. Yeah.
Tony Hansen (AT&T Services, Inc.): And document it.
Tony Hansen (AT&T Services, Inc.): So when you
Tony Hansen (AT&T Services, Inc.): there, there's 2 parts to each of these, one is, you're clicking the met, and then the other is the description
Tony Hansen (AT&T Services, Inc.): where you say
Tony Hansen (AT&T Services, Inc.): how you met it.
Tony Hansen (AT&T Services, Inc.): And
Tony Hansen (AT&T Services, Inc.): by having a statement saying.
Tony Hansen (AT&T Services, Inc.): now we run.
Tony Hansen (AT&T Services, Inc.): we we run this series test and this series of tests. And while we were doing this test, we run sonar, and we verified that we have over 80%
Tony Hansen (AT&T Services, Inc.): branch coverage.
Tony Hansen (AT&T Services, Inc.): That's I. I would say, that's sufficient.
Ramesh Murugan Iyer (Ericsson): Okay.
Pawel Pawlak: Thank you, Tony, thank you for this clarification.
Byung-Woo Jun (Ericsson Software Technology): So if you look at this report, the only 2 are the
Byung-Woo Jun (Ericsson Software Technology): yellow dynamic code analysis, and Java and Javascript
Byung-Woo Jun (Ericsson Software Technology): perform memory management. That's only 2 items. So
Byung-Woo Jun (Ericsson Software Technology): we checked up. Then you are good, Tony. I mean, policy is good.
Byung-Woo Jun (Ericsson Software Technology): I think everything else is
Byung-Woo Jun (Ericsson Software Technology): check, mark except 2.
Byung-Woo Jun (Ericsson Software Technology): Now, with your advice today, and if they might
Byung-Woo Jun (Ericsson Software Technology): checked off the 2 items, then
Byung-Woo Jun (Ericsson Software Technology): they are qualified. Gold badging? Yes, yes.
Tony Hansen (AT&T Services, Inc.): I'm looking at
Tony Hansen (AT&T Services, Inc.): dashboard right now. And I see
Tony Hansen (AT&T Services, Inc.): this, this.
Tony Hansen (AT&T Services, Inc.): This is on that policy. We're.
Byung-Woo Jun (Ericsson Software Technology): Yeah, owner policy. Yeah, yeah, I I said.
Tony Hansen (AT&T Services, Inc.): To any
Tony Hansen (AT&T Services, Inc.): 5
Tony Hansen (AT&T Services, Inc.): orange.
Byung-Woo Jun (Ericsson Software Technology): Orange. Yes.
Tony Hansen (AT&T Services, Inc.): Volumes.
Tony Hansen (AT&T Services, Inc.): build reproducible. There's no answer on that one.
Ramesh Murugan Iyer (Ericsson): Yeah, currently, the team is working on improving the coverage. We have few components in policy that are
Ramesh Murugan Iyer (Ericsson): close to 90%. So we still have to work on some of them to get it to 90. So the team is currently working on it. So before we we.
Ramesh Murugan Iyer (Ericsson): if finish it.
Ramesh Murugan Iyer (Ericsson): Once we finish it we'll be taking it to the Tsc for approval.
Ramesh Murugan Iyer (Ericsson): Apart from that stuff, I think once we have dynamic analysis.
Ramesh Murugan Iyer (Ericsson): we are good to go, I guess.
Tony Hansen (AT&T Services, Inc.): Here. Hardening does not have a URL
Tony Hansen (AT&T Services, Inc.): listing.
Byung-Woo Jun (Ericsson Software Technology): I mean, okay.
Tony Hansen (AT&T Services, Inc.): Small tasks.
Tony Hansen (AT&T Services, Inc.): does not have an answer.
Ramesh Murugan Iyer (Ericsson): Yeah, the some of the questions that are not being answered in the previous
Ramesh Murugan Iyer (Ericsson): entries. So we just have to.
Ramesh Murugan Iyer (Ericsson): We just have to go through them again, and fill them, fill them out.
Tony Hansen (AT&T Services, Inc.): Test branch coverage. You're just talking about test branch coverage.
Tony Hansen (AT&T Services, Inc.): that does not have an
Tony Hansen (AT&T Services, Inc.): answer
Tony Hansen (AT&T Services, Inc.): and test statement coverage. You're just talking about that. That's currently says, Unmet.
Tony Hansen (AT&T Services, Inc.): So
Tony Hansen (AT&T Services, Inc.): yeah,
Tony Hansen (AT&T Services, Inc.): and then there are several answers that
Tony Hansen (AT&T Services, Inc.): in the yellow cat yellow columns
Tony Hansen (AT&T Services, Inc.): that you can copy the
Tony Hansen (AT&T Services, Inc.): you should be able to copy the answers from the cps.
Tony Hansen (AT&T Services, Inc.): Those those are the
Tony Hansen (AT&T Services, Inc.): on app, wide responses, for example.
Tony Hansen (AT&T Services, Inc.): hardened sites
Tony Hansen (AT&T Services, Inc.): currently listed on that
Tony Hansen (AT&T Services, Inc.): copy. The answer from
Tony Hansen (AT&T Services, Inc.): cps.
Ramesh Murugan Iyer (Ericsson): Okay.
Tony Hansen (AT&T Services, Inc.): Require 2. Fa.
Tony Hansen (AT&T Services, Inc.): that's currently listed.
Tony Hansen (AT&T Services, Inc.): Not being answered.
Tony Hansen (AT&T Services, Inc.): Those are actually only 2.
Tony Hansen (AT&T Services, Inc.): Yeah, you're you're coming along. Very well.
Tony Hansen (AT&T Services, Inc.): Yep.
Byung-Woo Jun (Ericsson Software Technology): Tony are looking at the whole page. Will you click the owner policy? Click that, and then you have separate page.
Tony Hansen (AT&T Services, Inc.): So I am looking at my dashboard.
Byung-Woo Jun (Ericsson Software Technology): Okay.
Tony Hansen (AT&T Services, Inc.): Summarize summarizes everything for all the projects.
Byung-Woo Jun (Ericsson Software Technology): Okay.
Tony Hansen (AT&T Services, Inc.): I clicked.
Byung-Woo Jun (Ericsson Software Technology): Owner policy, and they provide separate page, and they only focus on the owner policy.
Byung-Woo Jun (Ericsson Software Technology): And then all the criteria and the answers they record there. So I don't know which one
Byung-Woo Jun (Ericsson Software Technology): we're looking at. Okay.
Tony Hansen (AT&T Services, Inc.): Okay, so
Tony Hansen (AT&T Services, Inc.): can you share.
Byung-Woo Jun (Ericsson Software Technology): Sure I can share.
Byung-Woo Jun (Ericsson Software Technology): Let me share
Byung-Woo Jun (Ericsson Software Technology): app.
Byung-Woo Jun (Ericsson Software Technology): Let me
Byung-Woo Jun (Ericsson Software Technology): Let me know if you see my screen.
Tony Hansen (AT&T Services, Inc.): Okay? So you're on the badging site.
Byung-Woo Jun (Ericsson Software Technology): Yeah, this is badging side. This is the one you. So hope everything is here. But if we click this 1 1 click policy.
Tony Hansen (AT&T Services, Inc.): So, yeah, it.
Byung-Woo Jun (Ericsson Software Technology): Showed everything like to here on their policy.
Tony Hansen (AT&T Services, Inc.): Go back to the dashboard.
Byung-Woo Jun (Ericsson Software Technology): Okay.
Tony Hansen (AT&T Services, Inc.): And
Tony Hansen (AT&T Services, Inc.): oh, interesting!
Byung-Woo Jun (Ericsson Software Technology): Different.
Tony Hansen (AT&T Services, Inc.): I see. Yeah, your screen? Oh, no, you're on. You're on the bronze.
Tony Hansen (AT&T Services, Inc.): So
Tony Hansen (AT&T Services, Inc.): you're showing mets all across for bronze. That's fine scroll down.
Byung-Woo Jun (Ericsson Software Technology): Scroll down. Okay.
Tony Hansen (AT&T Services, Inc.): Scroll down.
Tony Hansen (AT&T Services, Inc.): Now there is silver.
Tony Hansen (AT&T Services, Inc.): so these are all the silver responses and go down policy. You'll see all sorts of mets.
Byung-Woo Jun (Ericsson Software Technology): Okay, going into, yeah. Here, yeah, okay.
Tony Hansen (AT&T Services, Inc.): Okay. Now, scroll down to the gold area.
Tony Hansen (AT&T Services, Inc.): And
Tony Hansen (AT&T Services, Inc.): yeah, here. Now, you see the
Tony Hansen (AT&T Services, Inc.): the pinks and oranges
Tony Hansen (AT&T Services, Inc.): that need work.
Byung-Woo Jun (Ericsson Software Technology): I see?
Byung-Woo Jun (Ericsson Software Technology): Yeah, so good.
Tony Hansen (AT&T Services, Inc.): If you go back to the other page.
Byung-Woo Jun (Ericsson Software Technology): Okay, let me click this one.
Byung-Woo Jun (Ericsson Software Technology): Yeah, this one. Yes.
Tony Hansen (AT&T Services, Inc.): So at the top, you see, pass these are the passing level criteria. You can also view the silver or gold level criteria.
Byung-Woo Jun (Ericsson Software Technology): Yeah,
Tony Hansen (AT&T Services, Inc.): So click on gold.
Tony Hansen (AT&T Services, Inc.): and those are the the gold responses.
Byung-Woo Jun (Ericsson Software Technology): Okay. Now, now i i i got it. So now they're almost
Byung-Woo Jun (Ericsson Software Technology): toned.
Byung-Woo Jun (Ericsson Software Technology): And this is one just Ma Matthew with the the dashboard. Okay, got it. So this is my.
Tony Hansen (AT&T Services, Inc.): So now at the end, yeah, at the end of each of those descriptions you see a small
Tony Hansen (AT&T Services, Inc.): thing, and
Tony Hansen (AT&T Services, Inc.): inside of brackets.
Tony Hansen (AT&T Services, Inc.): like a.
Byung-Woo Jun (Ericsson Software Technology): Rocket.
Tony Hansen (AT&T Services, Inc.): Build.
Tony Hansen (AT&T Services, Inc.): build, reproducible. That's what your cursor is currently on.
Byung-Woo Jun (Ericsson Software Technology): Walk in beer system.
Tony Hansen (AT&T Services, Inc.): But at the end of the project must have a re reproducible bill. Select none
Tony Hansen (AT&T Services, Inc.): applicable, and a yeah URL required.
Tony Hansen (AT&T Services, Inc.): and then it says, build reproducible.
Tony Hansen (AT&T Services, Inc.): So
Tony Hansen (AT&T Services, Inc.): if you go back to
Tony Hansen (AT&T Services, Inc.): the dashboard.
Byung-Woo Jun (Ericsson Software Technology): I support.
Tony Hansen (AT&T Services, Inc.): You'll see. One of the columns is called Build reproducible.
Tony Hansen (AT&T Services, Inc.): Here.
Byung-Woo Jun (Ericsson Software Technology): Okay, got it?
Tony Hansen (AT&T Services, Inc.): So.
Tony Hansen (AT&T Services, Inc.): and if you hover, if you put your
Tony Hansen (AT&T Services, Inc.): cursor over the question, mark there and hover for a second.
Tony Hansen (AT&T Services, Inc.): it'll pop up. Okay.
Tony Hansen (AT&T Services, Inc.): The description from the other side.
Byung-Woo Jun (Ericsson Software Technology): Okay, I see. Okay.
Byung-Woo Jun (Ericsson Software Technology): But the team can work with the other. This one they can answer here, provide information. It will reflect into this, the dashboard.
Tony Hansen (AT&T Services, Inc.): Yeah, it's
Tony Hansen (AT&T Services, Inc.): right. They have to answer. Put their answers in on the website.
Tony Hansen (AT&T Services, Inc.): not the dashboard.
Byung-Woo Jun (Ericsson Software Technology): Understand. So then we then what you would need to work here, then what providing for? Yeah, okay, I got that I got now.
Ramesh Murugan Iyer (Ericsson): We will, we will be able to edit the answers in the website on open Ssf. Or
Ramesh Murugan Iyer (Ericsson): mail. Just one day.
Byung-Woo Jun (Ericsson Software Technology): Okay, about this, this one.
Ramesh Murugan Iyer (Ericsson): Yeah, in case.
Byung-Woo Jun (Ericsson Software Technology): If you want to.
Byung-Woo Jun (Ericsson Software Technology): Yeah, I didn't log in, but I'm sure Tony is your tool, so you can edit right here.
Tony Hansen (AT&T Services, Inc.): Now I
Tony Hansen (AT&T Services, Inc.): it's a peculiar.
Pawel Pawlak: Yeah.
Tony Hansen (AT&T Services, Inc.): Log him.
Pawel Pawlak: To do it right.
Tony Hansen (AT&T Services, Inc.): So if if you go back to the
Tony Hansen (AT&T Services, Inc.): if you go back to the dashboard towards the left, it tells you exactly who the editors are
Tony Hansen (AT&T Services, Inc.): for your project.
Byung-Woo Jun (Ericsson Software Technology): Left.
Tony Hansen (AT&T Services, Inc.): Pam, Dragos, RAM
Tony Hansen (AT&T Services, Inc.): Burma, Jim.
Byung-Woo Jun (Ericsson Software Technology): Yeah, yeah, yeah, yeah, yeah, yeah.
Tony Hansen (AT&T Services, Inc.): Liam fallon.
Byung-Woo Jun (Ericsson Software Technology): Ramesh is not.
Ramesh Murugan Iyer (Ericsson): Yeah, I think that.
Byung-Woo Jun (Ericsson Software Technology): Yeah, you.
Ramesh Murugan Iyer (Ericsson): Committers who are not anymore working on the pro.
Byung-Woo Jun (Ericsson Software Technology): Right they they left, so.
Tony Hansen (AT&T Services, Inc.): So.
Pawel Pawlak: Issue, we need.
Tony Hansen (AT&T Services, Inc.): Why should I listen?
Pawel Pawlak: To to Jesse, to Sandra right? She should have a
Pawel Pawlak: to add the Ptl. The new.
Tony Hansen (AT&T Services, Inc.): She has.
Pawel Pawlak: Yeah.
Tony Hansen (AT&T Services, Inc.): Ability to add in the new Id.
Pawel Pawlak: And maybe to to clean up the the the ones that are not.
Tony Hansen (AT&T Services, Inc.): We are not going to.
Byung-Woo Jun (Ericsson Software Technology): Meet you. Yeah.
Tony Hansen (AT&T Services, Inc.): So.
Byung-Woo Jun (Ericsson Software Technology): Wow, it's a old one. So, okay.
Byung-Woo Jun (Ericsson Software Technology): yeah.
Tony Hansen (AT&T Services, Inc.): So whoever
Tony Hansen (AT&T Services, Inc.): is going to be the other you can have, you should have more than whoever's the editors
Tony Hansen (AT&T Services, Inc.): Huck
Tony Hansen (AT&T Services, Inc.): should have
Tony Hansen (AT&T Services, Inc.): must have a login into the magic site
Tony Hansen (AT&T Services, Inc.): and so if you go back to
Tony Hansen (AT&T Services, Inc.): the badging site
Tony Hansen (AT&T Services, Inc.): and you log in
Tony Hansen (AT&T Services, Inc.): Eric.
Tony Hansen (AT&T Services, Inc.): I I'm assuming you have a login.
Tony Hansen (AT&T Services, Inc.): so go ahead. Click on login and login.
Byung-Woo Jun (Ericsson Software Technology): Eat. Up. Okay.
Tony Hansen (AT&T Services, Inc.): login with github or login.
Tony Hansen (AT&T Services, Inc.): Your eyes used to.
Byung-Woo Jun (Ericsson Software Technology): You don't. No, this is the Linux id.
Tony Hansen (AT&T Services, Inc.): No, this is a totally separate
Tony Hansen (AT&T Services, Inc.): id.
Byung-Woo Jun (Ericsson Software Technology): And Miss C.
Tony Hansen (AT&T Services, Inc.): Hope you're not using password from. It's also used on another site.
Byung-Woo Jun (Ericsson Software Technology): Maybe not. Yeah. I think, though.
Tony Hansen (AT&T Services, Inc.): Okay? Well, click on are you? Click on login with the github?
Tony Hansen (AT&T Services, Inc.): See what happens. Do you have a Github assigned
Tony Hansen (AT&T Services, Inc.): her account.
Byung-Woo Jun (Ericsson Software Technology): Yeah, I have a Giro account.
Byung-Woo Jun (Ericsson Software Technology): This is, get they are using github account.
Byung-Woo Jun (Ericsson Software Technology): And you see.
Pawel Pawlak: No, you need to click on the upper
Pawel Pawlak: log and.
Tony Hansen (AT&T Services, Inc.): Let's get up. Yeah, click on that.
Byung-Woo Jun (Ericsson Software Technology): I click that. But nothing happens.
Tony Hansen (AT&T Services, Inc.): Nothing happened. Okay? So what?
Tony Hansen (AT&T Services, Inc.): You're probably not logged into Github currently on any other tab.
Byung-Woo Jun (Ericsson Software Technology): Okay.
Byung-Woo Jun (Ericsson Software Technology): then,
Tony Hansen (AT&T Services, Inc.): Okay.
Byung-Woo Jun (Ericsson Software Technology): Didn't work for me.
Byung-Woo Jun (Ericsson Software Technology): I'm gonna check it.
Muddasar Ahmed (MITRE): If you open another tab log into Github, then you might get activated.
Tony Hansen (AT&T Services, Inc.): Just type. Get go into that, URL, and replace it with Github com.
Byung-Woo Jun (Ericsson Software Technology): Escape.
Tony Hansen (AT&T Services, Inc.): And then go across and log in.
Byung-Woo Jun (Ericsson Software Technology): I hope.
Tony Hansen (AT&T Services, Inc.): I.
Byung-Woo Jun (Ericsson Software Technology): I see
Byung-Woo Jun (Ericsson Software Technology): not in here.
Tony Hansen (AT&T Services, Inc.): Are you currently logged in.
Muddasar Ahmed (MITRE): I might be in the right upper right hand corner.
Muddasar Ahmed (MITRE): I'll tell you who who you.
Byung-Woo Jun (Ericsson Software Technology): Yeah.
Tony Hansen (AT&T Services, Inc.): The down.
Tony Hansen (AT&T Services, Inc.): Then
Tony Hansen (AT&T Services, Inc.): the the purple T there, what's that? Say?
Tony Hansen (AT&T Services, Inc.): Okay, so you are. You are logged in.
Byung-Woo Jun (Ericsson Software Technology): Yeah, I'm not.
Tony Hansen (AT&T Services, Inc.): So the
Tony Hansen (AT&T Services, Inc.): you have evidently never set up a badging account.
Byung-Woo Jun (Ericsson Software Technology): No, not not foraging, no.
Tony Hansen (AT&T Services, Inc.): Okay? Well, that's why it's not working so down at the bottom.
Byung-Woo Jun (Ericsson Software Technology): Let me check.
Tony Hansen (AT&T Services, Inc.): Sign up, now
Tony Hansen (AT&T Services, Inc.): blank.
Byung-Woo Jun (Ericsson Software Technology): Huh!
Tony Hansen (AT&T Services, Inc.): Down at the bottom of that badging page.
Byung-Woo Jun (Ericsson Software Technology): The dashboard.
Tony Hansen (AT&T Services, Inc.): No, the badging page.
Byung-Woo Jun (Ericsson Software Technology): Batting pay. Okay, this this one.
Byung-Woo Jun (Ericsson Software Technology): yeah.
Tony Hansen (AT&T Services, Inc.): Click on login. Yeah.
Byung-Woo Jun (Ericsson Software Technology): Sign again login, again.
Tony Hansen (AT&T Services, Inc.): Sign up. I
Tony Hansen (AT&T Services, Inc.): click on sign up there you go.
Byung-Woo Jun (Ericsson Software Technology): Okay.
Tony Hansen (AT&T Services, Inc.): no, okay, that's it. Yeah.
Tony Hansen (AT&T Services, Inc.): and it's gonna just send an email.
Tony Hansen (AT&T Services, Inc.): Okay.
Tony Hansen (AT&T Services, Inc.): you'll have to
Tony Hansen (AT&T Services, Inc.): click on the link that's in the email
Tony Hansen (AT&T Services, Inc.): to enable it.
Byung-Woo Jun (Ericsson Software Technology): Yeah, can't activate. I'm gonna activate. Now.
Pawel Pawlak: Guys as we just reached the top of the hour. So I propose we continue
Pawel Pawlak: next week
Byung-Woo Jun (Ericsson Software Technology): Yeah, I think.
Pawel Pawlak: If you want, we can. We can do some. We can chat
Pawel Pawlak: if you'd have any difficulties with the
Pawel Pawlak: of the, you know, getting the.
Byung-Woo Jun (Ericsson Software Technology): Yeah, but.
Tony Hansen (AT&T Services, Inc.): He wants to sign off and stop the recording. I can continue talking up beyond for a couple of minutes.
Pawel Pawlak: I have no control over the recording here.
Tony Hansen (AT&T Services, Inc.): Everything is optimized.
Byung-Woo Jun (Ericsson Software Technology): And that's I don't wanna recording in my password.
Pawel Pawlak: Of the year.
Pawel Pawlak: It.
Byung-Woo Jun (Ericsson Software Technology): That's why I was. Huh? I'm not doing this.
Byung-Woo Jun (Ericsson Software Technology): anyway. Okay, so I'm.
Pawel Pawlak: Check check offline being if it works for you right? If not, just let us know, and we can try to, you know. Do some
Pawel Pawlak: ad hoc session to
Pawel Pawlak: what needs to be done. Yeah.
Byung-Woo Jun (Ericsson Software Technology): And and.
Pawel Pawlak: The same must be for for Ramesh. So, Ramesh, if you could please drop an email to Sandra.
Pawel Pawlak: put Tony in copy. That's okay. We, you should be assign added to this list right as a.
Ramesh Murugan Iyer (Ericsson): Okay.
Pawel Pawlak: As your Ptl. For the for the policy project. Then.
Ramesh Murugan Iyer (Ericsson): No, no.
Pawel Pawlak: She should assign you to this to this list? Right? So you could have possibility to edit the the answers right. Provide your answers.
Byung-Woo Jun (Ericsson Software Technology): Yeah.
Tony Hansen (AT&T Services, Inc.): But you have to have an account on the badging site first, st before you send an email to Sandra.
Tony Hansen (AT&T Services, Inc.): Yeah, yeah, you need the you need the Id.
Ramesh Murugan Iyer (Ericsson): So what I'm assuming.
Pawel Pawlak: Create an account. And then when you have an account working, then just let's Sandra know. And she she will assign you to
Pawel Pawlak: sure, sure, thanks. This. Project. Okay.
Ramesh Murugan Iyer (Ericsson): Yeah. Thanks, Babel, thanks. Thanks for the inputs.
Pawel Pawlak: Let's stop for today. Thank you guys for for joining this session and talk to you next week.
Byung-Woo Jun (Ericsson Software Technology): Yup sounds good. Thank you.
Pawel Pawlak: Maybe.
Ramesh Murugan Iyer (Ericsson): Thank you. Bye, bye.
Muddasar Ahmed (MITRE): And congratulations. Folks.