Versions Compared

Old Version 15

changes.mady.by.user Unknown User (leerho)

Saved on

compared with

New Version Current

changes.mady.by.user Unknown User (mjc)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Possible security initiatives and things we've discussed doing as part of the work before, during, and after the January 13th 2022 meeting at the White House. 

Note this is a brainstorming document.  Items can be added by anyone without any expectation they are plausible or will become work we do or policy we produce.  They are in no particular order.

...

Theme: Developer Education

  • Require a minimum of 3 PPMC members to have attended a (yet to be written) training course on Vulnerability handling at the ASF before the podling is allowed to graduate
  • Require projects to maintain a security team of at least 3 people all of whom have undertaken the training described in the previous point
  • Is OpenSSF training something we should promote to committers
  • Educate projects on the selection of dependencies, and their upkeep (see also "Help users pick secure projects") (This could possibly be OpenSSF Scorecards)
  • Write up how the ASF acts as a Curator of OSS (in terms of the curation discussions happening) and what curation functions are performed

Theme: Improving our process and policy

WH Theme: Preventing Defects

  • Make sure our projects are keeping track of their dependencies, especially things that are EOL, especially things that are other Apache projects and EOL (example log4j v1)
    • Track the dependencies across our projects so we can see the combined-graph for the latest version of each ASF project. Work centrally to encourage that dependencies are not insecure, or excessively dated.
  • Facilitate direct funding efforts such as TideLift which provide direct financial support for developers to focus on matters such as security
  • How does OpenSSF Alpha and/or Omega fit with ASF
  • Look at the sponsored SOS rewards program
  • Think about which ASF projects would benefit from being covered by IBB (they reached out to us to expand our current set)
  • Looks at OpenSSF OSS Fuzz (high false positive rate - would benefit from manual triage by OSS Fuzz team before notifications are sent to maintainers). See also mail from GOSST. 

WH Theme: Identify Critical projects / Help users pick secure projects

  • How can we make the OpenSSF critical projects list better for ASF projects
  • Make sure our users know what they should be doing to find out about updates, EOL, CVEs with various OpenSSF initiativesIs the training something we should promote to committers
  • How can we make the OpenSSF scorecard better for ASF projects
  • Minimize situations in which PMCs refuse contributions for anything other than strong technical reasons
    • Forking increases the attack area and complexity of fixes - projects should be governed such that the need to fork when using the code is minimized
    • Stop accepting forks as a necessary and acceptable outcome of PMC control of ASF projects - users cannot be expected to invest in a community if the gates to the PMC are closed
    • Focus on education such that PMCs can enable "constructive forking" in a controlled manner such that the forking community are supported in improving a projects architecture to minimize the need to fork
    • Educate ASF projects that the way to a healthy community is through the production of reusable components that enable contributions designed to enhance reuse in broader contexts so as to allow the pool of contributors to grow
    • Re-Affirm that ASF Projects are successful when the broadest possible community is engaged leading to more maintainers and more eyeballs on the shared code
  • Consider annual re-affirmation by PMCs towards Apache Way, with reminders of What It Is.
  • Consider ASF Blog Post: "How You Can Help" directed towards corporate users .
  • Should have more complete policy around production of "builds" https://www.apache.org/legal/release-policy.html#compiled-packages
  • Spend Foundation resources (money) on creating messaging for community members, e.g.
  • Popularizing, re-affirming The Apache Way
    • Messaging to evangelize a "give back" culture among consumers
  • Presentations for community members to share with Colleagues on how to give back, how to handle Open Source contributions
  • Language for corporate lawyers to facilitate contributions by developers in their organization, what it means when a developer signs an ICLA (or is hired already having one on file), etc. 
    • )

WH Theme: SBOMS /  Notifications

Completed

  • Look again into SCR:CLR as a service to projects. Done. Rejected for various reasons.
  • Sometimes communication with vulnerability reporters breaks down, is it time to have a more structured tool for handling reports which forces the process? or is it more people engagement? or can we just require checkboxes before allocating CVE names in our existing tool?
    • From September 2022 we have a dedicated person paid by ASF to perform vulnerability handling functions
  • In July 2022 we implemented automated checks (INFRA-23459) to ensure packages contained the right signatures and met policy
  • Facilitate direct funding efforts such as TideLift which provide direct financial support for developers to focus on matters such as security
  • Consider adopting https://osv.dev/ instead of CVE/CVSS.
  • Require a minimum of 3 PPMC members to have attended a (yet to be written) training course on Vulnerability handling at the ASF before the podling is allowed to graduate
  • Require projects to maintain a security team of at least 3 people all of whom have undertaken the training described in the previous point
  • One of the big Elephants-In-The-Room in terms of security is that we have no idea who is using our products. Increasingly, finding good information on the Web requires some sort of log-in requiring an email address.  If we had a registry of everyone that downloaded our code by project, we would be able to notify them of updates and security fixes.  It would be best if this was implemented ASF-wide, at least as a policy, or as a shared registry.  I realize there are privacy issues here, but I believe these can be addressed.