Search code, repositories, users, issues, pull requests...

CII Best Practices badge project

https://owasp.org/www-project-integration-standards/ https://docs.google.com/presentation/d/16R84qeu9Lvvt4lrSG0dymHgTjqAEzB2XJIsDi4JCHr4/edit#slide=id.p

Inventory project (CRE)

Scorecards

https://docs.google.com/document/d/1c3HYr0ARjqK3qBCVBkkN-buZsD5KMpQc_dRhPa93Big/edit#

Synchronizing Group Efforts

Resources -

http://people.redhat.com/crrobins/DevBestPractice-RefArch.pdf
https://jamboard.google.com/d/1rpCIykiwrjFG-wvvyVg4YyMwP4RZI6txOWu3ociTOXo/viewer?f=0
http://people.redhat.com/crrobins/Dev_Best_Practices_Drawings.pdf

Conversation around next projects

Talked through desire of group to craft some actionable good practices
How can we provide advise to Maintainers on how to make upgrades easier

Recording

TBD

Regular meeting - May 10, 2021

Live Meeting Notes

Intro

New members on the call this week?

Please Vote

Seeking to move meeting to a better time, please vote: https://doodle.com/poll/xxh6ykwx23icqzrc

Quick status on in-flight projects - (~2min each)

Fundamentals course

https://courses.edx.org/courses/course-v1:LinuxFoundationX+LFD106x+3T2020/course/

course updates desired annually to 1.5 years
desire to convert from gdoc to markdown (having some opportunities

SKF

CII Best Practices badge project

https://owasp.org/www-project-integration-standards/ https://docs.google.com/presentation/d/16R84qeu9Lvvt4lrSG0dymHgTjqAEzB2XJIsDi4JCHr4/edit#slide=id.p

Inventory project (CRE)

Scorecards

https://docs.google.com/document/d/1P6TtTkbtSBLfdjlYWDS4c6EQi_1yTuxqEJyNcBHvrjY/edit#heading=h.f4s78jj8txih

Synchronizing Group Efforts

Resources -

http://people.redhat.com/crrobins/DevBestPractice-RefArch.pdf
https://jamboard.google.com/d/1rpCIykiwrjFG-wvvyVg4YyMwP4RZI6txOWu3ociTOXo/viewer?f=0
http://people.redhat.com/crrobins/Dev_Best_Practices_Drawings.pdf

Conversation around next projects

Talked through desire of group to craft some actionable good practices
How can we provide advise to Maintainers on how to make upgrades easier

Recording

TBD

Regular meeting - April 12, 2021

Live Meeting Notes

Intro

New members on the call this week?

Quick status on in-flight projects - (~2min each)

Fundamentals course

https://courses.edx.org/courses/course-v1:LinuxFoundationX+LFD106x+3T2020/course/

course updates desired annually to 1.5 years
desire to convert from gdoc to markdown (having some opportunities

SKF

CII Best Practices badge project

https://owasp.org/www-project-integration-standards/ https://docs.google.com/presentation/d/16R84qeu9Lvvt4lrSG0dymHgTjqAEzB2XJIsDi4JCHr4/edit#slide=id.p

Inventory project (CRE)

Scorecards

https://docs.google.com/document/d/1yNd8n5edZARxZ2dRWSG-0Z03dEOKdLruiIJSvgMTou4/edit#heading=h.f4s78jj8txih

Synchronizing Group Efforts

Resources -

http://people.redhat.com/crrobins/DevBestPractice-RefArch.pdf
https://jamboard.google.com/d/1rpCIykiwrjFG-wvvyVg4YyMwP4RZI6txOWu3ociTOXo/viewer?f=0
http://people.redhat.com/crrobins/Dev_Best_Practices_Drawings.pdf

Conversation around next projects

Talked through desire of group to craft some actionable good practices
How can we provide advise to Maintainers on how to make upgrades easier

Recording

TBD

Regular meeting - March 29, 2021

Live Meeting Notes

Intro

New members on the call this week?

Quick status on in-flight projects - (~2min each)

Fundamentals course

https://courses.edx.org/courses/course-v1:LinuxFoundationX+LFD106x+3T2020/course/

course updates desired annually to 1.5 years
desire to convert from gdoc to markdown (having some opportunities

SKF

CII Best Practices badge project

https://owasp.org/www-project-integration-standards/ https://docs.google.com/presentation/d/16R84qeu9Lvvt4lrSG0dymHgTjqAEzB2XJIsDi4JCHr4/edit#slide=id.p

Inventory project (CRE)

Scorecards

https://courses.edx.org/courses/course-v1:LinuxFoundationX+LFD106x+3T2020/course/

Synchronizing Group Efforts

Resources -

http://people.redhat.com/crrobins/DevBestPractice-RefArch.pdf
https://jamboard.google.com/d/1rpCIykiwrjFG-wvvyVg4YyMwP4RZI6txOWu3ociTOXo/viewer?f=0
http://people.redhat.com/crrobins/Dev_Best_Practices_Drawings.pdf

Conversation around next projects

Talked through desire of group to craft some actionable good practices
How can we provide advise to Maintainers on how to make upgrades easier

Recording

TBD

Regular meeting - March 15, 2021

Live Meeting Notes

Intro

New members on the call this week?

Quick status on in-flight projects - (~2min each)

Fundamentals course

course updates desired annually to 1.5 years
desire to convert from gdoc to markdown (having some opportunities

SKF

CII Best Practices badge project

https://owasp.org/www-project-integration-standards/ https://docs.google.com/presentation/d/16R84qeu9Lvvt4lrSG0dymHgTjqAEzB2XJIsDi4JCHr4/edit#slide=id.p

Inventory project (CRE)

Scorecards

https://docs.google.com/document/d/1rT6YPFb6LnL1EaCo97gFLcj_QanIoAt-f_q8V8SZqJM/edit

Synchronizing Group Efforts

Resources -

http://people.redhat.com/crrobins/DevBestPractice-RefArch.pdf
https://jamboard.google.com/d/1rpCIykiwrjFG-wvvyVg4YyMwP4RZI6txOWu3ociTOXo/viewer?f=0
http://people.redhat.com/crrobins/Dev_Best_Practices_Drawings.pdf

Conversation around next projects

Talked through desire of group to craft some actionable good practices
How can we provide advise to Maintainers on how to make upgrades easier
Could we take "Top X" from Stack Overflow and work on guidance to correct those things?

Recording

TBD

Regular meeting - March 1, 2021

Live Meeting Notes

Intro

New members on the call this week?
Brandon Caldwell

Quick status on in-flight projects - (~2min each)

Fundamentals course

https://courses.edx.org/courses/course-v1:LinuxFoundationX+LFD106x+3T2020/course/

course updates desired annually to 1.5 years
desire to convert from gdoc to markdown (having some opportunities

SKF

CII Best Practices badge project

https://owasp.org/www-project-integration-standards/ https://docs.google.com/presentation/d/16R84qeu9Lvvt4lrSG0dymHgTjqAEzB2XJIsDi4JCHr4/edit#slide=id.p

Inventory project (CRE)

Scorecards

https://zoom.us/rec/share/jGRUSBtJ1Jv7IE8Vvn8xRjAtMzfHjUHUZjaDH2k_TTWzeXXRXZpK6J1UPpy0hdzF.v5AMc6yj9XNpHD-T?startTime=1614614696000

Synchronizing Group Efforts

Resources -

http://people.redhat.com/crrobins/DevBestPractice-RefArch.pdf
https://jamboard.google.com/d/1rpCIykiwrjFG-wvvyVg4YyMwP4RZI6txOWu3ociTOXo/viewer?f=0
http://people.redhat.com/crrobins/Dev_Best_Practices_Drawings.pdf

Conversation around next projects

Talked through desire of group to craft some actionable good practices
How can we provide advise to MAintainers on how to make upgrades easier
Could we take "Top X" from Stack Overflow and work on guidance to correct those things?

Recording

Regular meeting - February 15, 2021 - Call Canceled

Intro

New members on the call this week?

Quick status on in-flight projects - (~2min each)

Fundamentals course

https://courses.edx.org/courses/course-v1:LinuxFoundationX+LFD106x+3T2020/course/

SKF

CII Best Practices badge project

https://owasp.org/www-project-integration-standards/ https://docs.google.com/presentation/d/16R84qeu9Lvvt4lrSG0dymHgTjqAEzB2XJIsDi4JCHr4/edit#slide=id.p

Inventory project (CRE)

Scorecards

https://courses.edx.org/courses/course-v1:LinuxFoundationX+LFD106x+3T2020/course/

Synchronizing Group Efforts

Resources -

http://people.redhat.com/crrobins/DevBestPractice-RefArch.pdf
https://jamboard.google.com/d/1rpCIykiwrjFG-wvvyVg4YyMwP4RZI6txOWu3ociTOXo/viewer?f=0
http://people.redhat.com/crrobins/Dev_Best_Practices_Drawings.pdf

Conversation around diagrams

Recording

N/A

Regular meeting - February 1, 2021

Intro

New members on the call this week?
Vinnod Anadan

Quick status on in-flight projects - (~2min each)

Fundamentals course

need to convert google docs to markdown format....someday
Seeking to do annual update/every year and a half
@CRob talk to david w about RH training (and any others that have interesting materials)

SKF

building feature for secure code review (CVEs, code snippets, etc). will have real examples in the near future. Xav will ping Glen to continue collaborating.

CII Best Practices badge project

https://owasp.org/www-project-integration-standards/ https://docs.google.com/presentation/d/16R84qeu9Lvvt4lrSG0dymHgTjqAEzB2XJIsDi4JCHr4/edit#slide=id.p

David posted email about longer-term project. Website runs on Rails5 due to library incompatibilities with Rails6. Working on conversion. Testing framework currently does not work (but most of the rest does).
David notes "making updates hard is a security problem. how do we fix this?"
We may want to pick this up as a future work item (simpler updates). We can provide advice, tooling, etc to help devs avoid getting in this spot. Dependabot and other tricks, guidance docs per language maybe? How do we address this from an SCA-perspective
Dan L has two recent posts two posts https://medium.com/swlh/the-dependency-jungle-841bd1c7bce0 & https://dlorenc.medium.com/zombie-dependencies-77c34740a7a8

Inventory project (CRE)

Update from CRE team - -"We just finished mapping the CREs (based on ASVS checks) to NIST SP800-53! After analysing the result we concluded we need an intermediate layer of concepts to make mapping and maintenance easier, but also to make the inventory more organized. See the slides for details and examples. We also specified the mapping data model, as promised. Currently we are adding the conceptual layers to the CRE mapping and then we can work with Glenn and Riccardo on importing and frontend work. In case we won't have a working demo next time we definitely can show you examples in the data of what it will look like using source data and mockups. We look forward to that."

Scorecards

https://courses.edx.org/courses/course-v1:LinuxFoundationX+LFD106x+3T2020/course/

working with Envoy project to eval dependencies.
questions on how to address best practices have come up..."how we we do crypto validation?", for example

Synchronizing Group Efforts

Resources -

http://people.redhat.com/crrobins/DevBestPractice-RefArch.pdf
https://jamboard.google.com/d/1rpCIykiwrjFG-wvvyVg4YyMwP4RZI6txOWu3ociTOXo/viewer?f=0
http://people.redhat.com/crrobins/Dev_Best_Practices_Drawings.pdf

Conversation around diagrams

Page 3 - Move SKF & CII into Venn overlap fully
@CRob to test out a few colours for diagram
Page 2 - remove Inputs/Output for now and ask project leads to flesh out project info for publication to WG landing page
Future Work Item - review desired requirements to endorse for OSS Devs with group. Provide guidance for MFA/2FA for Devs
Page 5 - Personas - @CRob share Vuln. Disclosure person PPT with group for review.
@ALL - review page 5 androvide notes on personas relevant to this WG, make suggestions for items to combine/not focus on, and personas to expand

Recording

TBD

Regular meeting - January 18, 2021 - Meeting Canceled

Intro

New members on the call this week?

Quick status on in-flight projects - (~2min each)

Fundamentals course

SKF

CII Best Practices badge project

Rails 5->6 update. "Making updates hard is a security problem"

Inventory project (CRE)

https://owasp.org/www-project-integration-standards/ https://docs.google.com/presentation/d/16R84qeu9Lvvt4lrSG0dymHgTjqAEzB2XJIsDi4JCHr4/edit#slide=id.p *Instantiated the first batch of low level common requirements, based on the ASVS checks • Linked these to the OWASP top 10 •85% Linking these to NIST SP800-53 rev.5. – as a donation to the community by the Software Improvement Group We regard this NIST publication as a good source as it is authoritative and provides useful additional content, like optional countermeasures such as purging a mobile device in case of a lockout. Approach: • Starting with ASVS since it generally is most detailed, then tracing the most relevant paragraphs in NIST-800-53. • Ignoring second-order relations (Related controls in NIST), as it creates a jungle of (circular) references that we are trying to simplify. • Starting up: Mapping WSTG - self maintaining! We are in the process of making the CRE-links with the OWASP Web Security Testing Guide the first self-maintaining mapping. The plan is to add tags to the WSTG sources that our parse will use to keep the CRE mapping up to date all the time. • Soon: importing in SKF and building first use case: Show CRE page based on CRE-ID. • After that: • Adding intelligence to the CRE parser that finds new (cross-) relations if new data is added by the community. • More use cases, e.g. search, coverage mapping from standard to standard • Setting up structure for native CRE browsing, using perspectives

Scorecards

https://courses.edx.org/courses/course-v1:LinuxFoundationX+LFD106x+3T2020/course/

Synchronizing Group Efforts

Resources -

http://people.redhat.com/crrobins/DevBestPractice-RefArch.pdf
https://jamboard.google.com/d/1rpCIykiwrjFG-wvvyVg4YyMwP4RZI6txOWu3ociTOXo/viewer?f=0
http://people.redhat.com/crrobins/Dev_Best_Practices_Drawings.pdf

Other subjects

Recording

TBD

Regular meeting - January 4, 2021

Intro

New members on the call this week?
Jon Zeolla

Quick status on in-flight projects - (~2min each)

Fundamentals course

SKF

up to 18 pis running the lab environment
toying with idea of adding code reading skill to SKF (wants to check with CodeQL guys) - provide snippet, have learner ID vuln/coding flaw. doesn't seem hard to integrate. (Xav will check to see what is available) Glenn will be updated site cert laster this week

CII Best Practices badge project

https://docs.google.com/presentation/d/16R84qeu9Lvvt4lrSG0dymHgTjqAEzB2XJIsDi4JCHr4/edit#slide=id.p

Updated stack (docker updates, etc) added small tweaks to criteria that were proposed ~Dec8; any last minute comments, please speak up now so they can be merged Thursday rebranding from CII to OpenSSF Best Practices Badge (costs involved)? If we do it, we'd like to do it just once. - coreinfrastructure/best-practices-badge#1515

Inventory project (CRE)

Working on NIST 800-53 mappings
OWASP testing guide up next Working with SKF to import to work to build the 1st use case DW - CRE needs a homepage (CRob agrees!!)

Scorecards

http://people.redhat.com/crrobins/DevBestPractice-RefArch.pdf https://jamboard.google.com/d/1rpCIykiwrjFG-wvvyVg4YyMwP4RZI6txOWu3ociTOXo/viewer?f=0

Synchronizing Group Efforts

Review first draft of RefArch with whole WG
Good round of comments, will continue to add information to diagram and refine. Artifact will be useful in explaining our group to ourselves and outsiders to help encourage participation in our projects and help developers get value out of our output.

Other subjects

Recording

TBD

Special meeting - December 15, 2020

Whiteboard diagram - http://people.redhat.com/crrobins/DevBestPractice-RefArch.pdf

Attendees: CRob, David, Xav, Altaz

Meeting Notes

Hit the record button? -- YUP WG purpose - educate people, give training (hands on/how-to apply), consistent community-curated requirements list, leverage community initiatives to achieve these goals Xav notes that reporting helps with adoption WG README - https://github.com/ossf/wg-best-practices-os-developers/blob/main/README.md Identify (CRE, standards), Learn (Fundamentals, OWASP SKF), Adopt (Badge (+Identify), Scorecards) Next steps - gap assessment - what are we missing to hit our mission/vision, what technical gaps do we have, what requirement/standards are we missing?

Recording

http://people.redhat.com/crrobins/OpenSSF%20Dev%20Best%20Practices%20Reference%20Architecture%20JAD%20(2020-12-15%20at%2011_33%20GMT-8).mp4

Regular meeting - December 7, 2020

Intro

New members on the call this week?
avalani (Altaz Valani)
Magnus
Todd Collum (Red Hat)
Mark Bestavros (Red Hat)
Ryan Ware (Intel)

Quick status on in-flight projects - (~2min each)

Fundamentals course

https://courses.edx.org/courses/course-v1:LinuxFoundationX+LFD106x+3T2020/course/

Stats for Fundamentals of Developing Secure Software (as of 12/01) Courses:
Secure Software Development: Requirements, Design, and Reuse (LFD104x) 508 registrants
Secure Software Development: Implementation (LFD105x) 279 registrants
Secure Software Development: Verification and More Specialized Topics (LFD106x) 253 registrants

SKF

busy upgrading Docker environment - projects perhaps up to 200 simultaneous users spinning up labs
using machine learning to automatically generate security requirements
looking to work on editing next - "easy editor" mode to practice exploits & implementation of controls within labs
Dan L asks if there are any estimates on potential on-going costs (Glenn is/will investigate

CII Best Practices badge project

https://docs.google.com/presentation/d/16R84qeu9Lvvt4lrSG0dymHgTjqAEzB2XJIsDi4JCHr4/edit#slide=id.p

CII Best Practices Badge: 3526 Projects are now enrolled. For stats over time, see: https://bestpractices.coreinfrastructure.org/en/project_stats

Inventory project

Possible demo to WG

Scorecards