WEBVTT

1
00:00:02.715 --> 00:00:04.525
<00:00:02.715>Okay, <00:00:03.181>good <00:00:03.648>afternoon <00:00:04.115>everybody.

2
00:00:05.275 --> 00:00:06.605
<00:00:05.275>Good <00:00:05.574>that <00:00:05.873>you're <00:00:06.172>still <00:00:06.472>around.

3
00:00:06.825 --> 00:00:09.485
<00:00:06.825>Um, <00:00:06.980>in <00:00:07.136>the <00:00:07.291>next <00:00:07.447>30 <00:00:07.602>minutes, <00:00:07.758>we're <00:00:07.913>gonna <00:00:08.069>go <00:00:08.225>over

4
00:00:09.505 --> 00:00:11.205
<00:00:09.505>and <00:00:09.785>look <00:00:10.065>into <00:00:10.345>third <00:00:10.625>party <00:00:10.905>libraries

5
00:00:11.585 --> 00:00:13.565
<00:00:11.585>and <00:00:11.785>how <00:00:11.985>they <00:00:12.185>are <00:00:12.385>from <00:00:12.585>a <00:00:12.785>security <00:00:12.985>perspective.

6
00:00:13.905 --> 00:00:16.085
<00:00:13.905>And <00:00:14.045>hopefully <00:00:14.184>you <00:00:14.325>can <00:00:14.465>get, <00:00:14.604>you <00:00:14.745>can <00:00:14.885>take <00:00:15.024>something <00:00:15.165>with <00:00:15.305>you

7
00:00:16.625 --> 00:00:18.325
<00:00:16.625>in <00:00:16.800>order <00:00:16.975>to <00:00:17.150>have <00:00:17.325>a <00:00:17.500>better <00:00:17.675>sense <00:00:17.850>of <00:00:18.025>like

8
00:00:18.325 --> 00:00:20.485
<00:00:18.325>what <00:00:18.500>libraries <00:00:18.675>are <00:00:18.849>doing <00:00:19.025>for <00:00:19.200>security <00:00:19.375>and <00:00:19.550>so <00:00:19.724>on.

9
00:00:21.015 --> 00:00:23.005
<00:00:21.015>First, <00:00:21.248>I <00:00:21.481>already <00:00:21.715>had <00:00:21.948>a <00:00:22.181>brief <00:00:22.415>introduction

10
00:00:23.025 --> 00:00:24.245
<00:00:23.025>before <00:00:23.299>this, <00:00:23.573>which <00:00:23.848>is <00:00:24.123>good.

11
00:00:24.345 --> 00:00:26.965
<00:00:24.345>So <00:00:24.695>Stein <00:00:25.044>is <00:00:25.395>security <00:00:25.744>researcher

12
00:00:26.965 --> 00:00:28.445
<00:00:26.965>with <00:00:27.409>Veracode <00:00:27.853>Static <00:00:28.297>research.

13
00:00:28.445 --> 00:00:31.645
<00:00:28.445>That's <00:00:28.620>what <00:00:28.795>I <00:00:28.970>do. <00:00:29.145>Static <00:00:29.320>analysis <00:00:29.495>on <00:00:29.670>net <00:00:29.845>applications.

14
00:00:31.675 --> 00:00:32.925
<00:00:31.675>Also <00:00:31.862>doing <00:00:32.049>a <00:00:32.237>lot <00:00:32.424>of <00:00:32.612>rust <00:00:32.800>lately.

15
00:00:33.505 --> 00:00:35.445
<00:00:33.505>And <00:00:33.785>I'm <00:00:34.065>an <00:00:34.345>MVP <00:00:34.625>with <00:00:34.905>Microsoft.

16
00:00:35.605 --> 00:00:36.605
<00:00:35.605>I <00:00:35.754>do <00:00:35.904>a <00:00:36.055>lot <00:00:36.205>of <00:00:36.355>public <00:00:36.504>speaking

17
00:00:36.605 --> 00:00:38.965
<00:00:36.605>because <00:00:36.838>I <00:00:37.071>enjoy <00:00:37.305>talking <00:00:37.538>about <00:00:37.771>security <00:00:38.004>problems

18
00:00:39.265 --> 00:00:40.885
<00:00:39.265>and <00:00:39.420>how <00:00:39.576>I <00:00:39.731>think <00:00:39.887>we <00:00:40.042>should <00:00:40.198>do <00:00:40.353>a <00:00:40.509>better <00:00:40.665>job.

19
00:00:41.265 --> 00:00:42.165
<00:00:41.265>And <00:00:41.535>that's <00:00:41.805>exactly <00:00:42.075>what

20
00:00:42.165 --> 00:00:43.365
<00:00:42.165>we're <00:00:42.319>gonna <00:00:42.473>do <00:00:42.627>in <00:00:42.782>the <00:00:42.936>next <00:00:43.090>30 <00:00:43.245>minutes.

21
00:00:43.745 --> 00:00:45.925
<00:00:43.745>Um, <00:00:44.095>this <00:00:44.445>is <00:00:44.794>the <00:00:45.144>XKCD,

22
00:00:45.925 --> 00:00:48.085
<00:00:45.925>which <00:00:46.205>probably <00:00:46.485>everybody <00:00:46.765>knows <00:00:47.044>is <00:00:47.324>graphs.

23
00:00:48.105 --> 00:00:50.005
<00:00:48.105>You <00:00:48.279>can <00:00:48.455>have <00:00:48.629>the <00:00:48.805>one <00:00:48.980>on <00:00:49.154>SQL <00:00:49.330>injection, <00:00:49.504>right?

24
00:00:50.005 --> 00:00:51.325
<00:00:50.005>But <00:00:50.174>this <00:00:50.344>is <00:00:50.514>the <00:00:50.683>one <00:00:50.853>on <00:00:51.023>all <00:00:51.193>modern

25
00:00:51.595 --> 00:00:53.725
<00:00:51.595>application, <00:00:52.295>uh, <00:00:52.995>infrastructure.

26
00:00:53.785 --> 00:00:55.525
<00:00:53.785>But <00:00:54.065>you <00:00:54.345>can <00:00:54.625>just <00:00:54.904>replace <00:00:55.184>infrastructure

27
00:00:55.525 --> 00:00:57.125
<00:00:55.525>with <00:00:56.225>application <00:00:56.925>architecture

28
00:00:57.305 --> 00:00:58.525
<00:00:57.305>and <00:00:57.488>work <00:00:57.671>your <00:00:57.854>way <00:00:58.037>down <00:00:58.220>from <00:00:58.403>that.

29
00:00:58.985 --> 00:01:00.965
<00:00:58.985>If <00:00:59.185>we <00:00:59.385>build <00:00:59.585>software, <00:00:59.785>and <00:00:59.985>Julian <00:01:00.185>said <00:01:00.385>it

30
00:01:00.965 --> 00:01:03.525
<00:01:00.965>before, <00:01:01.165>we're <00:01:01.365>lazy, <00:01:01.565>I'm <00:01:01.765>lazy <00:01:01.965>developer <00:01:02.165>as <00:01:02.365>well,

31
00:01:03.745 --> 00:01:05.005
<00:01:03.745>you <00:01:04.122>reuse <00:01:04.500>stuff, <00:01:04.878>right?

32
00:01:05.005 --> 00:01:07.245
<00:01:05.004>And <00:01:05.121>we're <00:01:05.238>gonna <00:01:05.354>create <00:01:05.471>a <00:01:05.588>pile <00:01:05.705>of <00:01:05.821>stuff <00:01:05.938>on <00:01:06.054>top <00:01:06.171>of <00:01:06.288>each <00:01:06.405>other.

33
00:01:07.705 --> 00:01:09.365
<00:01:07.705>But <00:01:07.880>if <00:01:08.054>there <00:01:08.230>is <00:01:08.405>one <00:01:08.580>brick <00:01:08.755>at <00:01:08.929>the <00:01:09.105>bottom

34
00:01:09.545 --> 00:01:13.205
<00:01:09.545>that's <00:01:09.745>thankless <00:01:09.945>being <00:01:10.145>maintained <00:01:10.345>by <00:01:10.545>somebody <00:01:10.745>random, <00:01:10.945>uh,

35
00:01:13.505 --> 00:01:16.005
<00:01:13.505>and <00:01:13.660>somewhere <00:01:13.816>we <00:01:13.971>put <00:01:14.127>a <00:01:14.282>lot <00:01:14.438>of <00:01:14.593>trust <00:01:14.749>in <00:01:14.905>it,

36
00:01:16.035 --> 00:01:18.245
<00:01:16.035>once <00:01:16.175>the <00:01:16.315>block <00:01:16.455>falls <00:01:16.595>out, <00:01:16.735>then <00:01:16.875>we <00:01:17.015>have <00:01:17.155>an <00:01:17.295>issue, <00:01:17.435>right?

37
00:01:18.685 --> 00:01:21.285
<00:01:18.685>I <00:01:18.812>think <00:01:18.939>we <00:01:19.066>should <00:01:19.194>do <00:01:19.321>a <00:01:19.448>better <00:01:19.575>job <00:01:19.703>on <00:01:19.830>understanding <00:01:19.957>our <00:01:20.085>third

38
00:01:21.285 --> 00:01:22.565
<00:01:21.285>party <00:01:21.573>libraries <00:01:21.860>that <00:01:22.149>we <00:01:22.437>use

39
00:01:23.065 --> 00:01:25.365
<00:01:23.065>and <00:01:23.192>hopefully <00:01:23.319>we <00:01:23.446>have <00:01:23.574>a <00:01:23.701>better <00:01:23.828>way <00:01:23.955>of <00:01:24.083>looking <00:01:24.210>at <00:01:24.337>it, <00:01:24.465>right?

40
00:01:25.425 --> 00:01:27.645
<00:01:25.425>And, <00:01:25.705>and <00:01:25.985>making <00:01:26.265>better <00:01:26.545>well-informed <00:01:26.825>decisions.

41
00:01:27.985 --> 00:01:29.365
<00:01:27.985>And <00:01:28.123>that's <00:01:28.261>exactly <00:01:28.399>what <00:01:28.536>we're <00:01:28.675>gonna <00:01:28.813>do <00:01:28.951>in <00:01:29.089>the <00:01:29.226>next

42
00:01:29.625 --> 00:01:30.765
<00:01:29.625>25 <00:01:30.651>minutes.

43
00:01:31.035 --> 00:01:32.965
<00:01:31.035>Hopefully <00:01:31.268>I <00:01:31.501>have <00:01:31.735>some <00:01:31.968>time <00:01:32.201>for <00:01:32.435>q

44
00:01:32.965 --> 00:01:34.605
<00:01:32.965>and <00:01:33.140>a <00:01:33.315>at <00:01:33.490>the <00:01:33.665>end <00:01:33.840>I'm <00:01:34.015>gonna <00:01:34.190>be <00:01:34.365>around,

45
00:01:35.015 --> 00:01:36.565
<00:01:35.015>we're <00:01:35.294>gonna <00:01:35.573>look <00:01:35.852>into <00:01:36.131>some <00:01:36.410>risks

46
00:01:37.065 --> 00:01:38.965
<00:01:37.065>of <00:01:37.265>third <00:01:37.465>party <00:01:37.664>package, <00:01:37.865>some, <00:01:38.065>some <00:01:38.265>basic <00:01:38.465>stuff.

47
00:01:38.965 --> 00:01:40.365
<00:01:38.965>We're <00:01:39.145>gonna <00:01:39.325>see <00:01:39.505>a <00:01:39.685>log <00:01:39.865>four <00:01:40.045>J <00:01:40.225>again.

48
00:01:40.865 --> 00:01:43.405
<00:01:40.865>Um, <00:01:41.065>then <00:01:41.265>we're <00:01:41.465>gonna <00:01:41.665>look <00:01:41.865>into <00:01:42.065>open <00:01:42.265>SSF

49
00:01:43.405 --> 00:01:44.765
<00:01:43.405>scorecard, <00:01:43.649>how <00:01:43.894>we <00:01:44.139>can <00:01:44.384>use <00:01:44.629>it.

50
00:01:45.115 --> 00:01:47.765
<00:01:45.115>Then <00:01:45.255>I <00:01:45.395>want <00:01:45.535>to <00:01:45.675>focus <00:01:45.815>more <00:01:45.955>on <00:01:46.095>looking <00:01:46.235>at <00:01:46.375>some <00:01:46.515>industry

51
00:01:47.925 --> 00:01:49.645
<00:01:47.925>standard <00:01:48.205>and <00:01:48.485>some, <00:01:48.765>some <00:01:49.045>measurement <00:01:49.325>tools

52
00:01:50.105 --> 00:01:51.445
<00:01:50.104>and <00:01:50.346>to <00:01:50.587>see <00:01:50.828>how <00:01:51.069>that <00:01:51.311>correlates

53
00:01:51.445 --> 00:01:53.805
<00:01:51.445>to <00:01:51.619>open <00:01:51.794>SSF <00:01:51.970>and <00:01:52.145>the <00:01:52.320>things <00:01:52.494>that <00:01:52.669>we <00:01:52.845>see.

54
00:01:53.805 --> 00:01:54.925
<00:01:53.805>If <00:01:53.973>we <00:01:54.141>run <00:01:54.309>it <00:01:54.477>against <00:01:54.645>the <00:01:54.813>package,

55
00:01:55.115 --> 00:01:56.765
<00:01:55.115>there's <00:01:55.395>some <00:01:55.675>valuable <00:01:55.955>information <00:01:56.235>in <00:01:56.515>that.

56
00:01:56.905 --> 00:01:59.285
<00:01:56.905>And <00:01:57.045>at <00:01:57.185>the <00:01:57.325>end, <00:01:57.465>we're <00:01:57.605>gonna <00:01:57.745>conclude <00:01:57.885>and <00:01:58.025>have <00:01:58.165>hopefully <00:01:58.305>q

57
00:01:59.285 --> 00:02:03.005
<00:01:59.285>and <00:01:59.425>a, <00:01:59.565>the <00:01:59.705>evidence <00:01:59.845>code <00:01:59.985>base <00:02:00.125>we <00:02:00.265>write <00:02:00.405>20% <00:02:00.545>is <00:02:00.685>ourselves

58
00:02:03.265 --> 00:02:04.845
<00:02:03.265>and <00:02:03.545>80% <00:02:03.825>is <00:02:04.105>somebody <00:02:04.385>else's <00:02:04.665>code.

59
00:02:05.225 --> 00:02:06.845
<00:02:05.225>And <00:02:05.399>you <00:02:05.574>can <00:02:05.750>argue <00:02:05.925>about <00:02:06.100>the <00:02:06.274>fact <00:02:06.449>like, <00:02:06.625>hey,

60
00:02:06.885 --> 00:02:08.805
<00:02:06.885>I <00:02:07.025>pull <00:02:07.165>in <00:02:07.305>a <00:02:07.445>library, <00:02:07.585>I <00:02:07.725>maybe <00:02:07.865>use <00:02:08.005>a <00:02:08.145>small <00:02:08.285>chunk

61
00:02:08.805 --> 00:02:09.885
<00:02:08.805>of <00:02:09.048>it, <00:02:09.291>not <00:02:09.533>everything, <00:02:09.776>right?

62
00:02:10.265 --> 00:02:13.525
<00:02:10.264>But <00:02:10.440>let's <00:02:10.614>assume <00:02:10.789>that <00:02:10.964>the <00:02:11.140>big <00:02:11.315>biggest <00:02:11.489>chunk <00:02:11.665>of

63
00:02:13.525 --> 00:02:15.765
<00:02:13.525>what <00:02:13.805>we <00:02:14.085>write <00:02:14.365>ourselves, <00:02:14.645>um, <00:02:14.925>is,

64
00:02:15.905 --> 00:02:17.285
<00:02:15.905>is <00:02:16.215>somebody <00:02:16.526>else's <00:02:16.836>code, <00:02:17.147>right?

65
00:02:18.265 --> 00:02:20.085
<00:02:18.265>So <00:02:18.498>at <00:02:18.731>Veracode, <00:02:18.964>we <00:02:19.198>publish <00:02:19.431>a <00:02:19.665>state

66
00:02:20.085 --> 00:02:21.365
<00:02:20.085>of <00:02:20.373>software <00:02:20.661>security <00:02:20.949>each <00:02:21.237>year.

67
00:02:21.385 --> 00:02:24.765
<00:02:21.385>And <00:02:21.501>this <00:02:21.618>is <00:02:21.734>one, <00:02:21.851>this <00:02:21.968>is <00:02:22.084>version <00:02:22.201>11, <00:02:22.318>we're <00:02:22.435>at <00:02:22.551>14 <00:02:22.668>right <00:02:22.785>now.

68
00:02:24.985 --> 00:02:28.485
<00:02:24.985>Um, <00:02:25.140>and <00:02:25.296>that <00:02:25.451>one <00:02:25.607>11 <00:02:25.762>focused <00:02:25.918>on <00:02:26.073>open <00:02:26.229>source <00:02:26.385>security.

69
00:02:28.705 --> 00:02:33.165
<00:02:28.704>And <00:02:28.821>one <00:02:28.938>of <00:02:29.054>the <00:02:29.171>quotes <00:02:29.288>that <00:02:29.404>was <00:02:29.521>put <00:02:29.638>in <00:02:29.755>is <00:02:29.871>like <00:02:29.988>almost <00:02:30.105>80%,

70
00:02:33.165 --> 00:02:37.965
<00:02:33.165>79% <00:02:33.320>of <00:02:33.476>the <00:02:33.631>times <00:02:33.787>the <00:02:33.942>developers <00:02:34.098>never <00:02:34.253>update <00:02:34.409>added <00:02:34.565>packages

71
00:02:38.435 --> 00:02:39.885
<00:02:38.435>like <00:02:38.696>once <00:02:38.957>they <00:02:39.218>scan <00:02:39.478>it, <00:02:39.739>right?

72
00:02:40.175 --> 00:02:41.405
<00:02:40.175>Which <00:02:40.544>is <00:02:40.913>quite <00:02:41.282>worrisome.

73
00:02:41.545 --> 00:02:44.165
<00:02:41.545>So <00:02:41.778>packages <00:02:42.011>become <00:02:42.245>stale <00:02:42.478>over, <00:02:42.711>over <00:02:42.945>time.

74
00:02:44.165 --> 00:02:47.085
<00:02:44.165>Stuff <00:02:44.304>happens, <00:02:44.445>right? <00:02:44.584>And <00:02:44.725>that's <00:02:44.864>exactly <00:02:45.005>what <00:02:45.144>we <00:02:45.285>saw <00:02:45.424>for <00:02:45.565>Log

75
00:02:47.085 --> 00:02:50.885
<00:02:47.085>for <00:02:47.240>J <00:02:47.396>and <00:02:47.551>Luck <00:02:47.707>for <00:02:47.862>j <00:02:48.018>Julian <00:02:48.173>briefly <00:02:48.329>described <00:02:48.485>it.

76
00:02:50.885 --> 00:02:53.245
<00:02:50.885>It's <00:02:51.118>code <00:02:51.351>execution <00:02:51.584>based <00:02:51.818>on <00:02:52.051>logging, <00:02:52.285>right?

77
00:02:53.465 --> 00:02:56.405
<00:02:53.465>And <00:02:53.620>on <00:02:53.776>certain <00:02:53.931>format <00:02:54.087>in <00:02:54.242>strings <00:02:54.398>within <00:02:54.553>the <00:02:54.709>Java <00:02:54.865>ecosystem.

78
00:02:57.065 --> 00:02:58.885
<00:02:57.065>So <00:02:57.265>last <00:02:57.465>year <00:02:57.665>it <00:02:57.865>was <00:02:58.065>the <00:02:58.265>second <00:02:58.465>anniversary

79
00:02:58.885 --> 00:03:00.445
<00:02:58.885>and <00:02:59.165>Chris <00:02:59.445>Eng, <00:02:59.725>chief <00:03:00.005>research <00:03:00.285>officer

80
00:03:00.465 --> 00:03:02.965
<00:03:00.465>of <00:03:00.640>Veracode <00:03:00.815>looked <00:03:00.990>into <00:03:01.165>the <00:03:01.340>data <00:03:01.515>that <00:03:01.690>we <00:03:01.865>have

81
00:03:03.425 --> 00:03:05.765
<00:03:03.425>and <00:03:03.625>said, <00:03:03.825>okay, <00:03:04.025>let's <00:03:04.225>look <00:03:04.425>into <00:03:04.625>the <00:03:04.825>apps

82
00:03:05.915 --> 00:03:09.005
<00:03:05.915>that <00:03:06.054>had <00:03:06.195>log <00:03:06.334>four <00:03:06.475>J <00:03:06.614>usage <00:03:06.755>and <00:03:06.894>let's <00:03:07.035>dissect <00:03:07.174>what <00:03:07.315>happened

83
00:03:09.025 --> 00:03:11.525
<00:03:09.025>and <00:03:09.180>did <00:03:09.336>we <00:03:09.491>learn <00:03:09.647>over <00:03:09.802>the <00:03:09.958>last <00:03:10.113>two <00:03:10.269>years, <00:03:10.425>right?

84
00:03:11.935 --> 00:03:13.965
<00:03:11.935>Turns <00:03:12.110>out <00:03:12.285>that <00:03:12.460>close <00:03:12.635>to <00:03:12.810>3% <00:03:12.985>is <00:03:13.160>still <00:03:13.335>vulnerable,

85
00:03:14.255 --> 00:03:15.845
<00:03:14.255>which <00:03:14.721>again <00:03:15.188>is <00:03:15.655>worrisome.

86
00:03:16.575 --> 00:03:19.205
<00:03:16.575>3.8% <00:03:17.274>is <00:03:17.975>vulnerable.

87
00:03:19.225 --> 00:03:20.805
<00:03:19.225>Not <00:03:19.424>to <00:03:19.625>log <00:03:19.825>for <00:03:20.025>shell <00:03:20.225>log <00:03:20.424>for <00:03:20.625>J,

88
00:03:20.805 --> 00:03:24.405
<00:03:20.805>but <00:03:20.960>to <00:03:21.116>one <00:03:21.271>of <00:03:21.427>the <00:03:21.582>sequenced <00:03:21.738>published <00:03:21.893>CVEs <00:03:22.049>after <00:03:22.205>that,

89
00:03:24.405 --> 00:03:26.365
<00:03:24.405>because <00:03:24.580>I'm <00:03:24.755>not <00:03:24.930>sure <00:03:25.105>if <00:03:25.280>you <00:03:25.455>know <00:03:25.630>the <00:03:25.805>narrative,

90
00:03:26.365 --> 00:03:28.805
<00:03:26.365>but <00:03:26.505>it <00:03:26.645>was <00:03:26.785>fixed, <00:03:26.925>it <00:03:27.065>was <00:03:27.205>not <00:03:27.345>fixed, <00:03:27.485>it <00:03:27.625>was <00:03:27.765>fixed.

91
00:03:29.105 --> 00:03:30.885
<00:03:29.105>And <00:03:29.244>then <00:03:29.385>they <00:03:29.524>had <00:03:29.665>like <00:03:29.804>a <00:03:29.945>series <00:03:30.084>of <00:03:30.225>patches <00:03:30.364>you <00:03:30.505>need

92
00:03:30.885 --> 00:03:32.965
<00:03:30.885>to <00:03:31.060>run <00:03:31.234>eventually <00:03:31.410>to <00:03:31.584>get <00:03:31.760>into <00:03:31.935>a <00:03:32.109>good <00:03:32.285>state.

93
00:03:33.585 --> 00:03:37.045
<00:03:33.585>And <00:03:33.725>the <00:03:33.865>most <00:03:34.005>worrisome <00:03:34.145>thing <00:03:34.285>is <00:03:34.425>like <00:03:34.565>32% <00:03:34.705>rely <00:03:34.845>on <00:03:34.985>version

94
00:03:37.045 --> 00:03:40.165
<00:03:37.045>that's <00:03:37.200>end <00:03:37.356>of <00:03:37.511>life, <00:03:37.667>which, <00:03:37.822>ah, <00:03:37.978>you <00:03:38.133>don't <00:03:38.289>want <00:03:38.445>that

95
00:03:40.165 --> 00:03:42.365
<00:03:40.165>because <00:03:40.398>if <00:03:40.631>we <00:03:40.864>look <00:03:41.098>at <00:03:41.331>dependencies, <00:03:41.565>right?

96
00:03:42.425 --> 00:03:45.165
<00:03:42.425>As <00:03:42.580>an <00:03:42.736>application, <00:03:42.891>and <00:03:43.047>these <00:03:43.202>are <00:03:43.358>code <00:03:43.513>cartoons <00:03:43.669>from <00:03:43.825>link

97
00:03:45.285 --> 00:03:46.565
<00:03:45.285>clock, <00:03:45.477>from <00:03:45.668>the <00:03:45.861>BI <00:03:46.053>Code <00:03:46.245>Alliance <00:03:46.437>people

98
00:03:46.565 --> 00:03:49.005
<00:03:46.565>who <00:03:46.681>have <00:03:46.798>seen <00:03:46.915>my <00:03:47.031>web <00:03:47.148>assembly <00:03:47.265>talk <00:03:47.381>last <00:03:47.498>year, <00:03:47.615>I <00:03:47.731>use <00:03:47.848>the <00:03:47.965>same

99
00:03:49.005 --> 00:03:51.285
<00:03:49.005>because <00:03:49.160>the <00:03:49.316>problem <00:03:49.471>space <00:03:49.627>we're <00:03:49.782>talking <00:03:49.938>about <00:03:50.093>is <00:03:50.249>the <00:03:50.405>same.

100
00:03:51.705 --> 00:03:53.405
<00:03:51.704>But <00:03:51.938>just <00:03:52.171>imagine <00:03:52.404>you <00:03:52.638>have <00:03:52.871>a <00:03:53.105>transitive

101
00:03:53.405 --> 00:03:54.445
<00:03:53.405>three <00:03:53.716>of <00:03:54.029>dependencies <00:03:54.341>here.

102
00:03:54.605 --> 00:03:56.565
<00:03:54.605>App <00:03:54.804>is <00:03:55.005>on <00:03:55.204>top, <00:03:55.405>and <00:03:55.605>I've <00:03:55.804>added <00:03:56.005>two

103
00:03:56.565 --> 00:03:57.765
<00:03:56.565>of <00:03:56.924>the <00:03:57.285>dependencies <00:03:57.644>underneath.

104
00:03:57.985 --> 00:04:00.405
<00:03:57.985>You <00:03:58.218>will <00:03:58.451>always <00:03:58.685>have <00:03:58.918>a <00:03:59.151>transitive <00:03:59.385>things

105
00:04:00.425 --> 00:04:01.605
<00:04:00.425>you <00:04:00.602>get <00:04:00.779>for <00:04:00.956>free <00:04:01.133>with <00:04:01.310>it, <00:04:01.487>right?

106
00:04:01.685 --> 00:04:02.965
<00:04:01.685>A <00:04:01.877>package <00:04:02.069>never <00:04:02.261>comes <00:04:02.453>on <00:04:02.645>its <00:04:02.837>own.

107
00:04:03.505 --> 00:04:06.525
<00:04:03.505>Um, <00:04:03.644>looking <00:04:03.785>at <00:04:03.924>it <00:04:04.065>from <00:04:04.204>a <00:04:04.345>security <00:04:04.484>perspective, <00:04:04.625>if <00:04:04.765>a <00:04:04.905>process

108
00:04:06.665 --> 00:04:09.205
<00:04:06.665>of <00:04:06.820>an <00:04:06.976>application <00:04:07.131>starts, <00:04:07.287>it <00:04:07.442>will <00:04:07.598>have <00:04:07.753>the <00:04:07.909>same <00:04:08.065>rights

109
00:04:09.585 --> 00:04:11.885
<00:04:09.585>as <00:04:09.818>all <00:04:10.051>the <00:04:10.285>other <00:04:10.518>libraries <00:04:10.751>right <00:04:10.985>in.net

110
00:04:11.885 --> 00:04:12.925
<00:04:11.885>because <00:04:12.072>I'm <00:04:12.259>a <00:04:12.446>do <00:04:12.633>net <00:04:12.821>guy.

111
00:04:13.145 --> 00:04:15.205
<00:04:13.145>The <00:04:13.378>the <00:04:13.611>main <00:04:13.845>bootstrapping <00:04:14.078>process <00:04:14.311>that <00:04:14.545>starts,

112
00:04:15.225 --> 00:04:17.365
<00:04:15.225>the <00:04:15.505>CLR <00:04:15.785>will <00:04:16.065>have <00:04:16.344>resource <00:04:16.625>access,

113
00:04:17.545 --> 00:04:19.765
<00:04:17.545>but <00:04:17.700>every <00:04:17.856>library <00:04:18.011>that's <00:04:18.167>included <00:04:18.322>will <00:04:18.478>have <00:04:18.633>the <00:04:18.789>same, <00:04:18.945>right?

114
00:04:19.945 --> 00:04:21.565
<00:04:19.945>The <00:04:20.100>keys <00:04:20.256>will <00:04:20.411>be <00:04:20.567>shared <00:04:20.722>as <00:04:20.878>you <00:04:21.033>see <00:04:21.189>in <00:04:21.344>this

115
00:04:21.565 --> 00:04:22.685
<00:04:21.565>picture, <00:04:21.817>you <00:04:22.069>can <00:04:22.321>access <00:04:22.573>anything.

116
00:04:23.345 --> 00:04:25.565
<00:04:23.345>And <00:04:23.545>of <00:04:23.745>course <00:04:23.945>packages <00:04:24.145>will <00:04:24.345>get <00:04:24.545>malicious, <00:04:24.745>right?

117
00:04:25.565 --> 00:04:27.405
<00:04:25.565>It <00:04:25.705>will <00:04:25.844>wear <00:04:25.985>a <00:04:26.125>cape, <00:04:26.265>like <00:04:26.405>it <00:04:26.545>will <00:04:26.685>become <00:04:26.825>a <00:04:26.965>villain

118
00:04:27.585 --> 00:04:28.885
<00:04:27.585>and <00:04:27.752>it <00:04:27.919>will <00:04:28.086>try <00:04:28.253>to <00:04:28.420>do <00:04:28.587>bad <00:04:28.755>stuff.

119
00:04:29.185 --> 00:04:31.605
<00:04:29.185>And <00:04:29.360>that <00:04:29.535>happens <00:04:29.710>in <00:04:29.885>all <00:04:30.060>types <00:04:30.235>of <00:04:30.410>ecosystems, <00:04:30.585>right?

120
00:04:31.755 --> 00:04:34.765
<00:04:31.755>This <00:04:31.895>is <00:04:32.034>about <00:04:32.175>MPM, <00:04:32.315>there's <00:04:32.455>a <00:04:32.594>lot <00:04:32.735>of <00:04:32.875>stuff <00:04:33.015>on <00:04:33.155>Newgate,

121
00:04:34.765 --> 00:04:37.285
<00:04:34.765>on <00:04:34.920>the <00:04:35.076>others <00:04:35.231>on <00:04:35.387>pi, <00:04:35.542>pi, <00:04:35.698>it's <00:04:35.853>all <00:04:36.009>there, <00:04:36.164>right?

122
00:04:37.345 --> 00:04:39.765
<00:04:37.345>And <00:04:37.625>this <00:04:37.905>focuses <00:04:38.185>on <00:04:38.465>development <00:04:38.745>machines

123
00:04:39.765 --> 00:04:42.565
<00:04:39.765>and <00:04:39.965>maybe <00:04:40.164>harvesting <00:04:40.365>some <00:04:40.565>cryptocurrency <00:04:40.765>wallets <00:04:40.965>of <00:04:41.164>people

124
00:04:42.665 --> 00:04:43.885
<00:04:42.665>and <00:04:42.848>stealing <00:04:43.031>the <00:04:43.214>money <00:04:43.397>out <00:04:43.580>of <00:04:43.763>that.

125
00:04:45.145 --> 00:04:46.605
<00:04:45.145>But <00:04:45.582>it <00:04:46.021>happens, <00:04:46.459>right?

126
00:04:47.065 --> 00:04:49.205
<00:04:47.065>The <00:04:47.205>other <00:04:47.344>thing <00:04:47.485>we <00:04:47.625>need <00:04:47.765>to <00:04:47.905>be <00:04:48.045>aware <00:04:48.185>of <00:04:48.325>is <00:04:48.465>something

127
00:04:49.205 --> 00:04:53.965
<00:04:49.205>that <00:04:49.380>was, <00:04:49.555>um, <00:04:49.729>published <00:04:49.905>on, <00:04:50.080>uh, <00:04:50.255>in <00:04:50.430>2021, <00:04:50.604>university

128
00:04:53.965 --> 00:04:56.965
<00:04:53.965>of <00:04:54.140>Minnesota <00:04:54.315>looked <00:04:54.490>into <00:04:54.665>a <00:04:54.840>thing <00:04:55.015>called <00:04:55.190>hypocrite <00:04:55.365>commits.

129
00:04:56.965 --> 00:04:59.565
<00:04:56.965>That's <00:04:57.120>how <00:04:57.276>they <00:04:57.431>call <00:04:57.587>the <00:04:57.742>project, <00:04:57.898>which <00:04:58.053>in <00:04:58.209>essence <00:04:58.365>means

130
00:04:59.565 --> 00:05:02.525
<00:04:59.565>that <00:04:59.720>they <00:04:59.876>moved <00:05:00.031>themselves <00:05:00.187>into <00:05:00.342>a <00:05:00.498>contributor <00:05:00.653>group <00:05:00.809>of <00:05:00.965>one

131
00:05:02.525 --> 00:05:03.605
<00:05:02.525>of <00:05:02.768>the <00:05:03.010>Linux <00:05:03.254>kernel <00:05:03.497>modules

132
00:05:03.945 --> 00:05:05.885
<00:05:03.945>and <00:05:04.224>they <00:05:04.505>started <00:05:04.784>participating, <00:05:05.065>helping <00:05:05.344>out,

133
00:05:06.145 --> 00:05:07.885
<00:05:06.145>and <00:05:06.300>then <00:05:06.456>at <00:05:06.611>some <00:05:06.767>point <00:05:06.922>they <00:05:07.078>put <00:05:07.233>their <00:05:07.389>mask <00:05:07.544>on

134
00:05:07.905 --> 00:05:09.685
<00:05:07.905>and <00:05:08.184>they <00:05:08.465>became <00:05:08.744>malicious <00:05:09.025>or <00:05:09.304>rogue.

135
00:05:10.185 --> 00:05:12.085
<00:05:10.185>And <00:05:10.360>that <00:05:10.535>was <00:05:10.710>the <00:05:10.885>research <00:05:11.060>they <00:05:11.235>wanted <00:05:11.410>to <00:05:11.585>prove.

136
00:05:12.085 --> 00:05:13.725
<00:05:12.085>Like, <00:05:12.318>hey, <00:05:12.551>if <00:05:12.784>you <00:05:13.018>gain <00:05:13.251>somebody's <00:05:13.484>trust

137
00:05:14.065 --> 00:05:15.605
<00:05:14.065>and <00:05:14.342>if <00:05:14.619>people <00:05:14.896>are <00:05:15.173>involved, <00:05:15.451>right?

138
00:05:15.835 --> 00:05:17.245
<00:05:15.835>Hopefully <00:05:16.152>we <00:05:16.469>can <00:05:16.786>trust <00:05:17.104>people.

139
00:05:17.365 --> 00:05:18.685
<00:05:17.365>I <00:05:17.563>think <00:05:17.761>that's <00:05:17.959>still <00:05:18.157>the <00:05:18.355>best <00:05:18.553>outcome,

140
00:05:18.745 --> 00:05:20.725
<00:05:18.745>but <00:05:19.025>these <00:05:19.305>things <00:05:19.585>will <00:05:19.865>happen, <00:05:20.145>right?

141
00:05:21.115 --> 00:05:23.805
<00:05:21.115>They <00:05:21.290>got <00:05:21.465>banned <00:05:21.640>for <00:05:21.815>life <00:05:21.990>from <00:05:22.165>contributing, <00:05:22.340>which <00:05:22.515>is,

142
00:05:23.865 --> 00:05:25.645
<00:05:23.865>and <00:05:24.040>people <00:05:24.215>were <00:05:24.390>a <00:05:24.565>bit <00:05:24.740>like <00:05:24.915>upset <00:05:25.090>about <00:05:25.265>it,

143
00:05:25.645 --> 00:05:27.565
<00:05:25.645>but <00:05:26.111>is <00:05:26.578>this <00:05:27.044>reality?

144
00:05:28.385 --> 00:05:29.405
<00:05:28.385>Yes <00:05:28.691>it <00:05:28.996>is, <00:05:29.303>right?

145
00:05:29.405 --> 00:05:32.285
<00:05:29.405>Because <00:05:29.560>with <00:05:29.716>xe, <00:05:29.871>that's <00:05:30.027>something <00:05:30.182>that's <00:05:30.338>part <00:05:30.493>of <00:05:30.649>the <00:05:30.804>SSH.

146
00:05:32.665 --> 00:05:33.565
<00:05:32.665>You <00:05:32.867>probably <00:05:33.070>have <00:05:33.272>seen <00:05:33.475>this,

147
00:05:33.565 --> 00:05:34.885
<00:05:33.565>this <00:05:33.763>happened <00:05:33.961>in <00:05:34.159>March <00:05:34.357>of <00:05:34.555>this <00:05:34.753>year.

148
00:05:35.385 --> 00:05:37.645
<00:05:35.385>We <00:05:35.664>saw, <00:05:35.945>um, <00:05:36.224>a <00:05:36.505>library <00:05:36.784>being

149
00:05:37.915 --> 00:05:39.445
<00:05:37.915>infiltrated <00:05:38.190>by <00:05:38.465>a <00:05:38.741>group <00:05:39.016>of <00:05:39.292>people.

150
00:05:39.845 --> 00:05:41.205
<00:05:39.845>I <00:05:39.981>think <00:05:40.117>it <00:05:40.253>was <00:05:40.389>a <00:05:40.525>time <00:05:40.661>span <00:05:40.797>of <00:05:40.933>three <00:05:41.068>years

151
00:05:41.205 --> 00:05:43.525
<00:05:41.205>that <00:05:41.360>they <00:05:41.516>spent <00:05:41.671>on <00:05:41.827>this <00:05:41.982>project <00:05:42.138>on <00:05:42.293>doing <00:05:42.449>the <00:05:42.604>things

152
00:05:43.525 --> 00:05:46.045
<00:05:43.525>that <00:05:43.700>they <00:05:43.875>wanted <00:05:44.049>to <00:05:44.224>achieve, <00:05:44.400>which <00:05:44.575>is <00:05:44.750>once <00:05:44.924>again,

153
00:05:46.265 --> 00:05:48.245
<00:05:46.265>cannot <00:05:46.465>imagine <00:05:46.664>that <00:05:46.865>this <00:05:47.065>is <00:05:47.265>a <00:05:47.465>one-off <00:05:47.664>thing.

154
00:05:48.265 --> 00:05:50.165
<00:05:48.265>We <00:05:48.392>need <00:05:48.519>to <00:05:48.646>keep <00:05:48.774>a <00:05:48.901>close <00:05:49.028>eye <00:05:49.155>on <00:05:49.283>these <00:05:49.410>kinds <00:05:49.537>of <00:05:49.664>things.

155
00:05:50.585 --> 00:05:53.205
<00:05:50.585>But <00:05:50.740>they <00:05:50.896>were <00:05:51.051>able <00:05:51.207>to <00:05:51.362>build <00:05:51.518>stuff <00:05:51.673>inside <00:05:51.829>of <00:05:51.984>xxi

156
00:05:53.235 --> 00:05:54.605
<00:05:53.235>that <00:05:53.543>became <00:05:53.851>a <00:05:54.159>backdoor, <00:05:54.468>right?

157
00:05:55.145 --> 00:05:57.805
<00:05:55.145>And <00:05:55.300>are <00:05:55.456>you <00:05:55.611>aware <00:05:55.767>of <00:05:55.922>how <00:05:56.078>this <00:05:56.233>was <00:05:56.389>figured <00:05:56.544>out?

158
00:05:58.105 --> 00:06:02.205
<00:05:58.105>So <00:05:58.245>a <00:05:58.385>developer <00:05:58.525>at, <00:05:58.665>uh, <00:05:58.805>Postgres <00:05:58.945>for <00:05:59.085>Azure <00:05:59.225>was <00:05:59.365>running <00:05:59.505>some

159
00:06:02.205 --> 00:06:03.725
<00:06:02.205>of <00:06:02.433>his <00:06:02.661>tests <00:06:02.889>or <00:06:03.117>a <00:06:03.345>Microsoft <00:06:03.573>developer

160
00:06:04.065 --> 00:06:05.565
<00:06:04.065>and <00:06:04.257>saw <00:06:04.450>the <00:06:04.643>timing <00:06:04.836>was <00:06:05.029>a <00:06:05.222>bit <00:06:05.415>off,

161
00:06:06.025 --> 00:06:08.005
<00:06:06.025>and <00:06:06.200>then <00:06:06.375>he <00:06:06.549>decided <00:06:06.724>to <00:06:06.900>look <00:06:07.075>into <00:06:07.250>what <00:06:07.424>happens.

162
00:06:08.505 --> 00:06:11.165
<00:06:08.505>And <00:06:08.632>then <00:06:08.759>he <00:06:08.886>saw <00:06:09.014>the <00:06:09.141>binaries <00:06:09.268>was <00:06:09.395>doing <00:06:09.523>big, <00:06:09.650>some <00:06:09.777>funky <00:06:09.905>stuff

163
00:06:11.385 --> 00:06:12.645
<00:06:11.385>and <00:06:11.668>that's <00:06:11.952>how <00:06:12.235>it <00:06:12.519>surfaced.

164
00:06:13.225 --> 00:06:14.325
<00:06:13.225>And <00:06:13.555>eventually <00:06:13.885>the <00:06:14.215>team

165
00:06:14.345 --> 00:06:17.205
<00:06:14.345>who <00:06:14.500>put <00:06:14.656>the <00:06:14.811>effort <00:06:14.967>in <00:06:15.122>even <00:06:15.278>downgraded <00:06:15.433>the <00:06:15.589>security <00:06:15.745>testing

166
00:06:17.205 --> 00:06:19.005
<00:06:17.205>that <00:06:17.438>the <00:06:17.671>project <00:06:17.905>did, <00:06:18.138>they <00:06:18.371>really <00:06:18.604>were

167
00:06:19.005 --> 00:06:20.645
<00:06:19.005>sophisticatedly <00:06:19.471>targeting <00:06:19.938>this, <00:06:20.405>right?

168
00:06:20.705 --> 00:06:22.685
<00:06:20.705>So <00:06:21.055>these <00:06:21.405>things <00:06:21.755>happen, <00:06:22.104>right?

169
00:06:23.305 --> 00:06:24.445
<00:06:23.305>And <00:06:23.476>the <00:06:23.647>other <00:06:23.818>thing <00:06:23.989>that <00:06:24.159>might <00:06:24.331>happen

170
00:06:24.445 --> 00:06:26.525
<00:06:24.445>with <00:06:24.645>packages <00:06:24.844>over <00:06:25.045>time <00:06:25.245>is <00:06:25.445>vulnerabilities <00:06:25.645>are <00:06:25.844>found.

171
00:06:27.155 --> 00:06:28.935
<00:06:27.155>And <00:06:27.294>that's <00:06:27.434>a <00:06:27.575>good <00:06:27.715>thing. <00:06:27.854>Even <00:06:27.994>if <00:06:28.135>you <00:06:28.275>look <00:06:28.414>at <00:06:28.554>this

172
00:06:28.935 --> 00:06:29.975
<00:06:28.935>as <00:06:29.169>a <00:06:29.403>net <00:06:29.637>example, <00:06:29.871>right?

173
00:06:29.975 --> 00:06:31.815
<00:06:29.975>But <00:06:30.255>if <00:06:30.535>you <00:06:30.815>have <00:06:31.095>a <00:06:31.375>vulnerability,

174
00:06:31.835 --> 00:06:33.775
<00:06:31.835>you <00:06:32.114>can <00:06:32.395>hopefully <00:06:32.674>publicly <00:06:32.955>disclose <00:06:33.234>it

175
00:06:33.795 --> 00:06:35.255
<00:06:33.795>or <00:06:34.057>reach <00:06:34.320>out <00:06:34.583>to <00:06:34.846>the <00:06:35.109>maintainers

176
00:06:35.595 --> 00:06:37.335
<00:06:35.595>and <00:06:35.795>if <00:06:35.995>there's <00:06:36.195>a <00:06:36.395>security <00:06:36.595>policy <00:06:36.795>in <00:06:36.995>place,

177
00:06:37.335 --> 00:06:39.215
<00:06:37.335>they <00:06:37.510>will <00:06:37.685>tell <00:06:37.859>you, <00:06:38.034>Hey, <00:06:38.210>reach <00:06:38.385>out <00:06:38.560>to <00:06:38.734>us.

178
00:06:39.355 --> 00:06:42.175
<00:06:39.355>Or <00:06:39.471>if <00:06:39.588>you <00:06:39.705>share <00:06:39.821>it <00:06:39.938>in <00:06:40.055>this <00:06:40.171>way, <00:06:40.288>you <00:06:40.405>might <00:06:40.521>even <00:06:40.638>be <00:06:40.755>eligible

179
00:06:42.175 --> 00:06:43.975
<00:06:42.175>to <00:06:42.330>for <00:06:42.486>bug <00:06:42.641>bounties <00:06:42.797>and <00:06:42.952>make <00:06:43.108>money <00:06:43.263>out <00:06:43.419>of <00:06:43.575>it.

180
00:06:44.315 --> 00:06:45.375
<00:06:44.315>But <00:06:44.505>that's <00:06:44.696>a <00:06:44.887>cool <00:06:45.078>thing, <00:06:45.269>right?

181
00:06:45.395 --> 00:06:47.255
<00:06:45.395>But <00:06:45.674>libraries <00:06:45.955>need <00:06:46.234>to <00:06:46.515>be <00:06:46.794>updated.

182
00:06:47.685 --> 00:06:49.695
<00:06:47.685>Luckily, <00:06:47.918>if <00:06:48.151>you <00:06:48.385>do <00:06:48.618>net, <00:06:48.851>for <00:06:49.085>example,

183
00:06:49.955 --> 00:06:53.575
<00:06:49.955>the <00:06:50.110>CLI <00:06:50.266>can <00:06:50.421>already <00:06:50.577>ex <00:06:50.732>exactly <00:06:50.888>tell <00:06:51.043>you <00:06:51.199>what's <00:06:51.354>happening.

184
00:06:53.935 --> 00:06:56.375
<00:06:53.935>I <00:06:54.075>think <00:06:54.215>even <00:06:54.355>from <00:06:54.495>do <00:06:54.635>net <00:06:54.775>eight, <00:06:54.915>the <00:06:55.055>build <00:06:55.195>will <00:06:55.335>break.

185
00:06:56.595 --> 00:06:57.735
<00:06:56.595>It <00:06:56.800>will <00:06:57.005>show <00:06:57.210>you <00:06:57.415>like, <00:06:57.621>hey,

186
00:06:57.735 --> 00:06:59.495
<00:06:57.735>you've <00:06:57.910>got <00:06:58.085>some <00:06:58.260>issues, <00:06:58.435>you <00:06:58.610>need <00:06:58.785>to <00:06:58.960>fix <00:06:59.135>it.

187
00:07:00.035 --> 00:07:03.335
<00:07:00.035>Um, <00:07:00.190>but <00:07:00.346>not, <00:07:00.501>that's <00:07:00.657>not <00:07:00.812>transitive <00:07:00.968>from <00:07:01.123>do <00:07:01.279>net <00:07:01.435>nine.

188
00:07:03.415 --> 00:07:04.415
<00:07:03.415>I <00:07:03.565>will <00:07:03.715>believe <00:07:03.865>they <00:07:04.015>will <00:07:04.165>do <00:07:04.315>this

189
00:07:04.415 --> 00:07:05.895
<00:07:04.415>transitively <00:07:04.859>for <00:07:05.303>all <00:07:05.746>dependencies.

190
00:07:05.895 --> 00:07:07.975
<00:07:05.895>So <00:07:06.034>that's <00:07:06.174>cool. <00:07:06.315>You <00:07:06.455>get <00:07:06.594>this <00:07:06.734>for <00:07:06.875>free <00:07:07.015>on <00:07:07.155>your <00:07:07.294>development

191
00:07:07.975 --> 00:07:09.895
<00:07:07.975>machine <00:07:08.175>if <00:07:08.375>you're <00:07:08.575>building <00:07:08.775>stuff <00:07:08.975>for <00:07:09.175>do <00:07:09.375>net

192
00:07:10.655 --> 00:07:12.135
<00:07:10.655>MPM <00:07:10.988>is <00:07:11.320>MPM <00:07:11.654>audit, <00:07:11.986>right?

193
00:07:12.435 --> 00:07:14.855
<00:07:12.435>Can <00:07:12.590>do <00:07:12.746>almost <00:07:12.901>similar <00:07:13.057>things. <00:07:13.212>I <00:07:13.368>think <00:07:13.523>this <00:07:13.679>is <00:07:13.835>cool.

194
00:07:14.855 --> 00:07:17.095
<00:07:14.855>The <00:07:15.010>tools <00:07:15.166>are <00:07:15.321>there. <00:07:15.477>As <00:07:15.632>a <00:07:15.788>developer, <00:07:15.943>you <00:07:16.099>can <00:07:16.255>always

195
00:07:17.115 --> 00:07:18.935
<00:07:17.115>of <00:07:17.315>course <00:07:17.515>rely <00:07:17.715>on <00:07:17.915>commercial <00:07:18.115>ones <00:07:18.315>as <00:07:18.515>us

196
00:07:18.935 --> 00:07:20.295
<00:07:18.935>or <00:07:19.139>one <00:07:19.343>of <00:07:19.547>the <00:07:19.751>competitors, <00:07:19.955>that's <00:07:20.159>fine.

197
00:07:20.675 --> 00:07:22.375
<00:07:20.675>But <00:07:20.850>these <00:07:21.025>are <00:07:21.200>the <00:07:21.375>things <00:07:21.550>you <00:07:21.725>can <00:07:21.900>already <00:07:22.075>do.

198
00:07:23.515 --> 00:07:25.535
<00:07:23.515>And <00:07:23.670>the <00:07:23.826>third <00:07:23.981>variant <00:07:24.137>of <00:07:24.292>things <00:07:24.448>is <00:07:24.603>that <00:07:24.759>you <00:07:24.914>need

199
00:07:25.535 --> 00:07:27.495
<00:07:25.535>to <00:07:25.815>have <00:07:26.095>some <00:07:26.375>tough <00:07:26.655>visible <00:07:26.935>knowing

200
00:07:27.495 --> 00:07:28.735
<00:07:27.495>what's <00:07:27.867>inside <00:07:28.239>the <00:07:28.611>package.

201
00:07:29.035 --> 00:07:32.415
<00:07:29.035>And <00:07:29.175>I'm <00:07:29.315>gonna <00:07:29.455>briefly <00:07:29.595>like <00:07:29.735>shorten <00:07:29.875>this <00:07:30.015>one <00:07:30.155>up <00:07:30.295>a <00:07:30.435>bit,

202
00:07:32.435 --> 00:07:35.655
<00:07:32.435>but <00:07:32.575>a <00:07:32.715>do <00:07:32.855>net <00:07:32.995>package <00:07:33.135>can <00:07:33.275>rely <00:07:33.415>on <00:07:33.555>an <00:07:33.695>unmanaged <00:07:33.835>library.

203
00:07:35.965 --> 00:07:38.695
<00:07:35.965>That <00:07:36.120>might <00:07:36.276>be <00:07:36.431>a <00:07:36.587>intro <00:07:36.742>that <00:07:36.898>does <00:07:37.053>stuff <00:07:37.209>on <00:07:37.365>Windows,

204
00:07:38.795 --> 00:07:39.975
<00:07:38.795>for <00:07:39.326>example, <00:07:39.857>but

205
00:07:39.975 --> 00:07:42.375
<00:07:39.975>that <00:07:40.102>doesn't <00:07:40.229>surface <00:07:40.356>if <00:07:40.484>you <00:07:40.611>look <00:07:40.738>at <00:07:40.865>it <00:07:40.993>from <00:07:41.120>a <00:07:41.247>new <00:07:41.375>GA

206
00:07:42.485 --> 00:07:43.815
<00:07:42.485>ecosystem <00:07:43.083>perspective, <00:07:43.682>right?

207
00:07:44.275 --> 00:07:47.975
<00:07:44.275>If <00:07:44.382>I <00:07:44.490>do <00:07:44.598>a <00:07:44.705>GIP <00:07:44.813>that's <00:07:44.921>based <00:07:45.028>on <00:07:45.136>a <00:07:45.244>c <00:07:45.351>plus <00:07:45.459>plus <00:07:45.567>library <00:07:45.674>that's

208
00:07:48.055 --> 00:07:50.255
<00:07:48.055>inside, <00:07:48.255>it's <00:07:48.455>not <00:07:48.655>a <00:07:48.855>dependency <00:07:49.055>that <00:07:49.255>I <00:07:49.455>see.

209
00:07:50.545 --> 00:07:53.775
<00:07:50.545>Heart <00:07:50.778>linked <00:07:51.011>DLLs <00:07:51.245>are <00:07:51.478>hard <00:07:51.711>to <00:07:51.945>reproduce.

210
00:07:53.795 --> 00:07:55.455
<00:07:53.795>You <00:07:54.028>have <00:07:54.261>no <00:07:54.495>clue <00:07:54.728>of <00:07:54.961>what's <00:07:55.195>inside.

211
00:07:55.675 --> 00:07:57.215
<00:07:55.675>And <00:07:55.906>that's <00:07:56.137>the <00:07:56.368>biggest <00:07:56.599>problem <00:07:56.830>they <00:07:57.061>showed.

212
00:07:57.445 --> 00:07:59.055
<00:07:57.445>Reversing <00:07:57.724>Labs <00:07:58.005>show <00:07:58.284>with <00:07:58.565>this <00:07:58.844>research,

213
00:07:59.055 --> 00:08:01.215
<00:07:59.055>like <00:07:59.335>you <00:07:59.615>have <00:07:59.895>additional <00:08:00.175>baggage <00:08:00.455>inside,

214
00:08:01.215 --> 00:08:03.015
<00:08:01.215>which <00:08:01.390>might <00:08:01.565>be <00:08:01.739>executables <00:08:01.914>that <00:08:02.090>you're <00:08:02.265>not <00:08:02.440>aware <00:08:02.614>of.

215
00:08:03.015 --> 00:08:04.255
<00:08:03.015>And <00:08:03.154>that's <00:08:03.294>the <00:08:03.433>thing <00:08:03.573>we <00:08:03.712>need <00:08:03.852>to <00:08:03.991>look <00:08:04.131>into.

216
00:08:04.485 --> 00:08:08.095
<00:08:04.485>This <00:08:04.601>is <00:08:04.718>a <00:08:04.835>good <00:08:04.951>paper. <00:08:05.068>So <00:08:05.185>could <00:08:05.301>we <00:08:05.418>not <00:08:05.535>have <00:08:05.651>a <00:08:05.768>better <00:08:05.885>thing

217
00:08:08.095 --> 00:08:10.375
<00:08:08.095>that <00:08:08.250>we <00:08:08.406>could <00:08:08.561>just <00:08:08.717>grab <00:08:08.872>stuff <00:08:09.028>and <00:08:09.183>look <00:08:09.339>at <00:08:09.495>it

218
00:08:10.395 --> 00:08:13.265
<00:08:10.395>and <00:08:10.594>see <00:08:10.794>what's <00:08:10.995>inside <00:08:11.195>like <00:08:11.395>a <00:08:11.594>nutrition <00:08:11.794>label

219
00:08:13.325 --> 00:08:14.345
<00:08:13.325>for <00:08:13.784>software, <00:08:14.243>right?

220
00:08:14.885 --> 00:08:17.425
<00:08:14.885>And <00:08:15.060>in <00:08:15.235>my <00:08:15.409>first <00:08:15.585>version <00:08:15.760>of <00:08:15.935>this <00:08:16.110>presentation <00:08:16.284>deck,

221
00:08:17.505 --> 00:08:19.825
<00:08:17.505>I <00:08:17.680>used <00:08:17.855>the <00:08:18.030>club <00:08:18.205>mate <00:08:18.380>label <00:08:18.555>of <00:08:18.730>the <00:08:18.905>bottle.

222
00:08:20.205 --> 00:08:22.225
<00:08:20.205>And <00:08:20.380>on <00:08:20.555>the <00:08:20.729>right <00:08:20.905>side, <00:08:21.080>you <00:08:21.255>see <00:08:21.430>a <00:08:21.604>picture

223
00:08:22.225 --> 00:08:23.985
<00:08:22.225>of <00:08:22.400>me <00:08:22.575>holding <00:08:22.750>one <00:08:22.925>yesterday <00:08:23.100>evening <00:08:23.275>at <00:08:23.450>the <00:08:23.625>local

224
00:08:23.985 --> 00:08:27.545
<00:08:23.985>hackerspace, <00:08:24.140>which <00:08:24.296>if <00:08:24.451>you <00:08:24.607>look <00:08:24.762>on <00:08:24.918>on, <00:08:25.073>on <00:08:25.229>those <00:08:25.385>labels,

225
00:08:27.565 --> 00:08:31.145
<00:08:27.565>you <00:08:27.720>will <00:08:27.876>see, <00:08:28.031>hey, <00:08:28.187>this <00:08:28.342>thing <00:08:28.498>based <00:08:28.653>on <00:08:28.809>serving, <00:08:28.965>right?

226
00:08:31.145 --> 00:08:32.905
<00:08:31.145>That's <00:08:31.378>the <00:08:31.611>US <00:08:31.844>version. <00:08:32.078>They <00:08:32.311>do <00:08:32.544>servings.

227
00:08:32.905 --> 00:08:36.425
<00:08:32.905>And <00:08:33.079>luckily, <00:08:33.255>Europe, <00:08:33.429>Germany, <00:08:33.605>the <00:08:33.780>Netherlands <00:08:33.954>will <00:08:34.130>have, <00:08:34.304>uh,

228
00:08:36.425 --> 00:08:37.705
<00:08:36.424>100 <00:08:36.808>meals, <00:08:37.193>100 <00:08:37.577>grams,

229
00:08:37.705 --> 00:08:39.625
<00:08:37.705>but <00:08:37.880>it <00:08:38.055>will <00:08:38.230>have <00:08:38.405>X <00:08:38.580>amount <00:08:38.755>of <00:08:38.930>sugar, <00:08:39.105>right?

230
00:08:39.625 --> 00:08:42.185
<00:08:39.625>You <00:08:39.780>can <00:08:39.936>decide <00:08:40.091>for <00:08:40.247>yourself <00:08:40.402>if <00:08:40.558>it's <00:08:40.713>a <00:08:40.869>good <00:08:41.025>idea

231
00:08:42.185 --> 00:08:43.465
<00:08:42.184>to <00:08:42.415>drink <00:08:42.645>or <00:08:42.876>eat <00:08:43.106>this, <00:08:43.337>right?

232
00:08:43.725 --> 00:08:46.105
<00:08:43.725>That's <00:08:43.958>a <00:08:44.191>nice <00:08:44.425>thing <00:08:44.658>about <00:08:44.891>nutrition <00:08:45.125>labels.

233
00:08:46.205 --> 00:08:48.585
<00:08:46.205>It <00:08:46.345>shows <00:08:46.485>us <00:08:46.625>immediately <00:08:46.765>if <00:08:46.905>we <00:08:47.045>are <00:08:47.185>in <00:08:47.325>a <00:08:47.465>grocery <00:08:47.605>store,

234
00:08:48.735 --> 00:08:50.505
<00:08:48.735>this <00:08:48.890>this <00:08:49.046>is <00:08:49.201>something <00:08:49.357>you <00:08:49.512>want <00:08:49.668>to <00:08:49.823>eat <00:08:49.979>or <00:08:50.135>not.

235
00:08:51.305 --> 00:08:53.965
<00:08:51.305>Are <00:08:51.444>we <00:08:51.584>able <00:08:51.724>to <00:08:51.864>do <00:08:52.005>the <00:08:52.145>same <00:08:52.285>with <00:08:52.425>open <00:08:52.564>source <00:08:52.704>software?

236
00:08:54.065 --> 00:08:57.325
<00:08:54.065>The <00:08:54.192>answer <00:08:54.319>is <00:08:54.446>yes. <00:08:54.574>This <00:08:54.701>is <00:08:54.828>where <00:08:54.955>open <00:08:55.083>SSF <00:08:55.210>scorecard <00:08:55.337>comes <00:08:55.465>in

237
00:08:57.785 --> 00:09:00.645
<00:08:57.785>and <00:08:57.940>it's <00:08:58.096>a, <00:08:58.251>it's <00:08:58.407>a <00:08:58.562>way <00:08:58.718>to <00:08:58.873>quickly <00:08:59.029>assess, <00:08:59.185>uh,

238
00:09:00.645 --> 00:09:02.165
<00:09:00.645>open <00:09:01.101>source, <00:09:01.557>uh, <00:09:02.012>security.

239
00:09:02.465 --> 00:09:05.525
<00:09:02.465>If <00:09:02.592>you <00:09:02.719>go <00:09:02.846>to <00:09:02.974>open <00:09:03.101>security <00:09:03.228>scorecard <00:09:03.355>dev, <00:09:03.483>you <00:09:03.610>will <00:09:03.737>get <00:09:03.865>here,

240
00:09:06.165 --> 00:09:08.205
<00:09:06.165>I <00:09:06.305>have <00:09:06.444>a <00:09:06.584>notes <00:09:06.724>version <00:09:06.865>of <00:09:07.005>my <00:09:07.145>slides <00:09:07.285>at <00:09:07.425>the <00:09:07.564>end

241
00:09:08.265 --> 00:09:10.125
<00:09:08.265>and <00:09:08.372>you <00:09:08.480>can <00:09:08.588>grab <00:09:08.695>it <00:09:08.803>and <00:09:08.911>it <00:09:09.018>will <00:09:09.126>have <00:09:09.234>all <00:09:09.341>the <00:09:09.449>links <00:09:09.557>for <00:09:09.665>you.

242
00:09:10.125 --> 00:09:11.125
<00:09:10.125>So <00:09:10.305>don't <00:09:10.485>worry <00:09:10.665>about <00:09:10.845>the <00:09:11.025>links.

243
00:09:11.545 --> 00:09:13.325
<00:09:11.545>Um, <00:09:11.778>but <00:09:12.011>if <00:09:12.245>you <00:09:12.478>look <00:09:12.711>into <00:09:12.944>it,

244
00:09:13.325 --> 00:09:15.885
<00:09:13.325>it <00:09:13.525>will <00:09:13.725>do <00:09:13.925>automated <00:09:14.125>checks <00:09:14.325>on <00:09:14.525>GitLab <00:09:14.725>GitHub

245
00:09:15.885 --> 00:09:19.005
<00:09:15.885>and <00:09:16.025>it <00:09:16.165>will <00:09:16.305>tell <00:09:16.444>you <00:09:16.585>about <00:09:16.725>security <00:09:16.865>controls <00:09:17.005>that <00:09:17.145>are <00:09:17.285>done.

246
00:09:19.505 --> 00:09:21.605
<00:09:19.505>And <00:09:19.680>it <00:09:19.855>will <00:09:20.030>then <00:09:20.205>do <00:09:20.380>a <00:09:20.555>whole <00:09:20.730>scoring <00:09:20.905>system.

247
00:09:21.785 --> 00:09:23.805
<00:09:21.785>And <00:09:21.959>there <00:09:22.135>are <00:09:22.310>certain <00:09:22.485>checks <00:09:22.660>that <00:09:22.834>we're <00:09:23.010>gonna <00:09:23.185>offer.

248
00:09:23.855 --> 00:09:24.965
<00:09:23.855>We're <00:09:24.104>gonna <00:09:24.354>offer <00:09:24.604>them <00:09:24.854>quickly,

249
00:09:25.105 --> 00:09:27.845
<00:09:25.105>but <00:09:25.245>you <00:09:25.385>will <00:09:25.525>see <00:09:25.665>certain <00:09:25.805>levels <00:09:25.945>of <00:09:26.085>risks <00:09:26.225>that <00:09:26.365>we're <00:09:26.505>facing.

250
00:09:28.385 --> 00:09:31.405
<00:09:28.385>But <00:09:28.501>the <00:09:28.618>end <00:09:28.735>result <00:09:28.851>will <00:09:28.968>be <00:09:29.085>a <00:09:29.201>score <00:09:29.318>varying <00:09:29.435>from <00:09:29.551>zero <00:09:29.668>to <00:09:29.785>10.

251
00:09:32.105 --> 00:09:34.165
<00:09:32.105>10 <00:09:32.338>is <00:09:32.571>good, <00:09:32.805>zero <00:09:33.038>is <00:09:33.271>really <00:09:33.505>bad,

252
00:09:34.585 --> 00:09:36.125
<00:09:34.585>but <00:09:34.862>it <00:09:35.139>will <00:09:35.416>check <00:09:35.693>certain <00:09:35.971>areas.

253
00:09:36.425 --> 00:09:38.845
<00:09:36.425>It <00:09:36.625>will <00:09:36.824>look <00:09:37.025>into, <00:09:37.224>does <00:09:37.425>it <00:09:37.625>use <00:09:37.824>any

254
00:09:39.405 --> 00:09:40.565
<00:09:39.405>liabilities <00:09:39.665>that <00:09:39.927>are <00:09:40.188>known <00:09:40.449>vulnerable?

255
00:09:41.065 --> 00:09:43.965
<00:09:41.065>How <00:09:41.220>is <00:09:41.376>it <00:09:41.531>being <00:09:41.687>maintained <00:09:41.842>from <00:09:41.998>a <00:09:42.153>project <00:09:42.309>perspective <00:09:42.465>like

256
00:09:44.325 --> 00:09:45.845
<00:09:44.325>contributors, <00:09:44.598>maintainers, <00:09:44.872>that <00:09:45.145>kind <00:09:45.419>of <00:09:45.693>thing.

257
00:09:45.845 --> 00:09:48.045
<00:09:45.845>We <00:09:46.020>saw <00:09:46.195>that <00:09:46.370>before. <00:09:46.545>Do <00:09:46.720>they <00:09:46.895>do <00:09:47.070>any <00:09:47.245>testing?

258
00:09:48.455 --> 00:09:51.725
<00:09:48.455>Continuous <00:09:48.735>testing? <00:09:49.015>Uh, <00:09:49.295>what <00:09:49.575>about <00:09:49.855>Fuzzing

259
00:09:52.275 --> 00:09:54.685
<00:09:52.275>doesn't <00:09:52.508>do <00:09:52.741>anything <00:09:52.975>bad <00:09:53.208>with <00:09:53.441>source, <00:09:53.675>right?

260
00:09:54.685 --> 00:09:55.965
<00:09:54.685>Because <00:09:54.915>we <00:09:55.145>always <00:09:55.376>run <00:09:55.606>with <00:09:55.837>source.

261
00:09:55.965 --> 00:09:57.965
<00:09:55.965>If <00:09:56.140>we <00:09:56.315>develop <00:09:56.490>and <00:09:56.665>we <00:09:56.840>have <00:09:57.015>build <00:09:57.190>servers <00:09:57.365>involved,

262
00:09:57.965 --> 00:10:00.565
<00:09:57.965>those <00:09:58.092>are <00:09:58.219>the <00:09:58.346>builds, <00:09:58.474>uh, <00:09:58.601>that <00:09:58.728>we <00:09:58.855>also <00:09:58.983>need <00:09:59.110>to <00:09:59.237>look <00:09:59.365>into.

263
00:10:01.025 --> 00:10:03.005
<00:10:01.025>So <00:10:01.258>I'm <00:10:01.491>gonna <00:10:01.725>go <00:10:01.958>over <00:10:02.191>them <00:10:02.425>quickly

264
00:10:03.225 --> 00:10:04.925
<00:10:03.225>and <00:10:03.400>just <00:10:03.575>explain <00:10:03.750>to <00:10:03.925>you <00:10:04.100>what <00:10:04.275>we're <00:10:04.450>checking <00:10:04.625>for.

265
00:10:04.925 --> 00:10:07.405
<00:10:04.925>First <00:10:05.099>of <00:10:05.275>all, <00:10:05.449>does <00:10:05.625>it <00:10:05.800>have <00:10:05.974>any <00:10:06.150>known <00:10:06.324>vulnerabilities?

266
00:10:08.725 --> 00:10:11.365
<00:10:08.725>OSV <00:10:08.865>Dev <00:10:09.005>is <00:10:09.145>a <00:10:09.285>website <00:10:09.425>you <00:10:09.565>can <00:10:09.705>go <00:10:09.845>to <00:10:09.985>right <00:10:10.125>now.

267
00:10:11.705 --> 00:10:13.685
<00:10:11.705>You <00:10:11.905>can <00:10:12.105>check <00:10:12.305>if <00:10:12.505>a <00:10:12.705>library <00:10:12.905>has <00:10:13.105>something

268
00:10:13.785 --> 00:10:16.045
<00:10:13.785>and <00:10:14.018>it's, <00:10:14.251>um, <00:10:14.485>it's <00:10:14.718>for <00:10:14.951>different <00:10:15.185>ecosystems.

269
00:10:16.045 --> 00:10:19.085
<00:10:16.045>This <00:10:16.172>one <00:10:16.299>shows <00:10:16.426>a <00:10:16.554>list <00:10:16.681>of, <00:10:16.808>of <00:10:16.935>it <00:10:17.063>might <00:10:17.190>not <00:10:17.317>be <00:10:17.444>readable,

270
00:10:19.105 --> 00:10:20.805
<00:10:19.105>but <00:10:19.305>go <00:10:19.505>there, <00:10:19.705>you <00:10:19.905>can <00:10:20.105>find <00:10:20.305>it, <00:10:20.505>right?

271
00:10:20.805 --> 00:10:22.125
<00:10:20.805>This <00:10:20.974>is <00:10:21.144>the <00:10:21.314>first <00:10:21.483>check. <00:10:21.653>It <00:10:21.823>will <00:10:21.992>be

272
00:10:22.125 --> 00:10:23.245
<00:10:22.125>high <00:10:22.326>in <00:10:22.528>part <00:10:22.729>of <00:10:22.931>the <00:10:23.133>system.

273
00:10:24.065 --> 00:10:25.245
<00:10:24.065>The <00:10:24.242>second <00:10:24.419>thing <00:10:24.596>a <00:10:24.773>checks <00:10:24.950>for <00:10:25.127>is

274
00:10:25.245 --> 00:10:27.565
<00:10:25.245>that <00:10:25.525>any <00:10:25.805>dependency <00:10:26.085>update <00:10:26.365>tool <00:10:26.645>available,

275
00:10:27.795 --> 00:10:30.885
<00:10:27.795>like <00:10:27.969>depend <00:10:28.145>bott <00:10:28.319>would <00:10:28.495>get <00:10:28.670>up <00:10:28.844>or <00:10:29.020>renovate <00:10:29.194>bot.

276
00:10:31.705 --> 00:10:33.965
<00:10:31.705>Um, <00:10:31.880>because <00:10:32.055>out <00:10:32.230>of <00:10:32.405>day <00:10:32.580>dependencies, <00:10:32.755>as <00:10:32.930>I <00:10:33.105>said,

277
00:10:33.965 --> 00:10:35.485
<00:10:33.965>based <00:10:34.193>on <00:10:34.421>the <00:10:34.649>report <00:10:34.877>is <00:10:35.105>an <00:10:35.333>issue.

278
00:10:35.585 --> 00:10:38.685
<00:10:35.585>So <00:10:35.712>if <00:10:35.839>you <00:10:35.966>have <00:10:36.094>depend <00:10:36.221>bott <00:10:36.348>inside <00:10:36.475>it <00:10:36.603>will <00:10:36.730>be <00:10:36.857>high <00:10:36.985>score.

279
00:10:38.875 --> 00:10:42.445
<00:10:38.875>Unfortunately, <00:10:39.075>it <00:10:39.275>doesn't <00:10:39.475>check <00:10:39.675>for <00:10:39.875>any <00:10:40.075>actions <00:10:40.275>taken

280
00:10:42.455 --> 00:10:45.285
<00:10:42.455>after <00:10:42.610>depend <00:10:42.766>bot <00:10:42.921>was <00:10:43.077>run, <00:10:43.232>which <00:10:43.388>can <00:10:43.543>be <00:10:43.699>an <00:10:43.855>improvement,

281
00:10:45.465 --> 00:10:46.805
<00:10:45.465>but <00:10:45.766>that's <00:10:46.068>a <00:10:46.369>good <00:10:46.670>thing.

282
00:10:48.025 --> 00:10:50.165
<00:10:48.025>The <00:10:48.165>other <00:10:48.305>thing <00:10:48.444>that <00:10:48.584>they <00:10:48.725>look <00:10:48.865>for <00:10:49.005>is <00:10:49.145>the <00:10:49.285>security <00:10:49.425>process.

283
00:10:50.915 --> 00:10:54.445
<00:10:50.915>Does <00:10:51.070>it <00:10:51.226>disclose <00:10:51.381>any <00:10:51.537>information <00:10:51.692>how <00:10:51.848>you <00:10:52.003>as <00:10:52.159>a <00:10:52.314>developer

284
00:10:54.465 --> 00:10:56.805
<00:10:54.465>or <00:10:54.605>as <00:10:54.745>a <00:10:54.885>security <00:10:55.025>researcher <00:10:55.165>can <00:10:55.305>reach <00:10:55.445>out <00:10:55.585>to <00:10:55.725>the <00:10:55.865>project

285
00:10:56.905 --> 00:10:59.765
<00:10:56.905>and <00:10:57.021>say, <00:10:57.138>Hey, <00:10:57.255>I <00:10:57.371>found <00:10:57.488>this <00:10:57.605>issue <00:10:57.721>and <00:10:57.838>this <00:10:57.954>is <00:10:58.071>a <00:10:58.188>serious <00:10:58.305>one.

286
00:10:59.765 --> 00:11:02.205
<00:10:59.765>You <00:10:59.920>need <00:11:00.076>to <00:11:00.231>fix <00:11:00.387>this, <00:11:00.542>right? <00:11:00.698>It <00:11:00.853>will <00:11:01.009>help <00:11:01.165>out.

287
00:11:02.985 --> 00:11:05.285
<00:11:02.985>It <00:11:03.140>will <00:11:03.296>also <00:11:03.451>look <00:11:03.607>into <00:11:03.762>stuff <00:11:03.918>like <00:11:04.073>this, <00:11:04.229>a <00:11:04.385>project,

288
00:11:05.285 --> 00:11:07.765
<00:11:05.285>have <00:11:05.485>a <00:11:05.685>license, <00:11:05.885>because <00:11:06.084>if <00:11:06.285>there's <00:11:06.485>no <00:11:06.685>license,

289
00:11:07.835 --> 00:11:09.605
<00:11:07.835>that <00:11:08.010>might <00:11:08.185>also <00:11:08.360>be <00:11:08.535>a <00:11:08.710>risk <00:11:08.885>for <00:11:09.060>your <00:11:09.235>company.

290
00:11:09.705 --> 00:11:12.405
<00:11:09.705>You <00:11:09.832>might <00:11:09.959>not <00:11:10.086>be <00:11:10.214>able <00:11:10.341>to <00:11:10.468>use <00:11:10.595>it, <00:11:10.723>right? <00:11:10.850>That's <00:11:10.977>the <00:11:11.105>thing.

291
00:11:13.145 --> 00:11:16.605
<00:11:13.145>Um, <00:11:13.272>the <00:11:13.399>other <00:11:13.526>thing <00:11:13.654>that <00:11:13.781>they, <00:11:13.908>uh, <00:11:14.035>also <00:11:14.163>adopted <00:11:14.290>is <00:11:14.417>a <00:11:14.545>ci

292
00:11:17.145 --> 00:11:19.445
<00:11:17.145>ci <00:11:17.378>uh, <00:11:17.611>CI <00:11:17.845>ICD <00:11:18.078>best <00:11:18.311>practices <00:11:18.545>project.

293
00:11:19.985 --> 00:11:22.805
<00:11:19.985>And <00:11:20.125>this <00:11:20.265>is <00:11:20.405>one <00:11:20.545>that <00:11:20.685>involves <00:11:20.825>an <00:11:20.965>assessment <00:11:21.105>of <00:11:21.245>a <00:11:21.385>person.

294
00:11:22.905 --> 00:11:24.525
<00:11:22.905>So <00:11:23.185>a <00:11:23.464>project <00:11:23.745>can <00:11:24.025>sign <00:11:24.305>up

295
00:11:24.745 --> 00:11:26.525
<00:11:24.745>and <00:11:24.945>it <00:11:25.145>will <00:11:25.345>have <00:11:25.545>a <00:11:25.745>checklist <00:11:25.945>that <00:11:26.145>you,

296
00:11:26.525 --> 00:11:27.645
<00:11:26.525>that <00:11:26.776>the <00:11:27.029>project <00:11:27.281>fills <00:11:27.533>in,

297
00:11:27.745 --> 00:11:29.925
<00:11:27.745>and <00:11:27.900>then <00:11:28.056>somebody <00:11:28.211>from <00:11:28.367>an <00:11:28.522>open <00:11:28.678>SSF <00:11:28.833>will <00:11:28.989>sign <00:11:29.145>off

298
00:11:29.925 --> 00:11:31.085
<00:11:29.925>for <00:11:30.074>it <00:11:30.223>and <00:11:30.372>you <00:11:30.521>will <00:11:30.670>earn <00:11:30.819>a <00:11:30.969>badge.

299
00:11:31.385 --> 00:11:32.565
<00:11:31.385>And <00:11:31.597>this <00:11:31.809>is <00:11:32.022>related <00:11:32.234>to, <00:11:32.447>hey,

300
00:11:32.565 --> 00:11:33.725
<00:11:32.565>how <00:11:32.826>the <00:11:33.087>build <00:11:33.348>system's <00:11:33.609>locked

301
00:11:33.725 --> 00:11:34.765
<00:11:33.725>down, <00:11:33.912>that <00:11:34.099>kind <00:11:34.286>of <00:11:34.473>thing, <00:11:34.661>right?

302
00:11:34.765 --> 00:11:37.885
<00:11:34.765>There's <00:11:34.892>a <00:11:35.019>whole <00:11:35.146>group <00:11:35.274>maybe <00:11:35.401>it <00:11:35.528>looks <00:11:35.655>into <00:11:35.783>as <00:11:35.910>well, <00:11:36.037>like, <00:11:36.165>uh,

303
00:11:38.065 --> 00:11:39.565
<00:11:38.065>supply <00:11:38.515>chain <00:11:38.965>SLSA <00:11:39.415>stuff.

304
00:11:39.565 --> 00:11:41.845
<00:11:39.565>There's <00:11:39.705>a, <00:11:39.845>there's <00:11:39.985>some <00:11:40.125>checks <00:11:40.265>and <00:11:40.405>you <00:11:40.545>can <00:11:40.685>earn <00:11:40.825>a <00:11:40.965>batch.

305
00:11:42.065 --> 00:11:43.365
<00:11:42.065>That's <00:11:42.357>an <00:11:42.650>indicator <00:11:42.942>as <00:11:43.235>well.

306
00:11:44.755 --> 00:11:47.205
<00:11:44.755>Does <00:11:44.910>the <00:11:45.066>project <00:11:45.221>run <00:11:45.377>unit <00:11:45.532>test <00:11:45.688>once <00:11:45.843>it <00:11:45.999>does <00:11:46.155>a

307
00:11:47.205 --> 00:11:48.245
<00:11:47.205>pull <00:11:47.439>or <00:11:47.673>merge <00:11:47.907>request, <00:11:48.141>right?

308
00:11:48.245 --> 00:11:50.365
<00:11:48.245>If <00:11:48.420>there <00:11:48.595>is <00:11:48.770>a <00:11:48.945>workflow <00:11:49.120>done, <00:11:49.295>does <00:11:49.470>it <00:11:49.645>check

309
00:11:50.385 --> 00:11:51.725
<00:11:50.385>for <00:11:50.686>quality <00:11:50.988>again <00:11:51.289>in <00:11:51.591>order

310
00:11:51.725 --> 00:11:53.045
<00:11:51.725>to <00:11:51.894>make <00:11:52.064>sure <00:11:52.234>we're <00:11:52.403>doing <00:11:52.573>the <00:11:52.743>right <00:11:52.913>thing?

311
00:11:53.185 --> 00:11:56.605
<00:11:53.185>And <00:11:53.312>there <00:11:53.439>are <00:11:53.566>certain <00:11:53.694>checks <00:11:53.821>on <00:11:53.948>this <00:11:54.075>and <00:11:54.203>does <00:11:54.330>it <00:11:54.457>do <00:11:54.584>fuzzing

312
00:11:56.745 --> 00:11:58.085
<00:11:56.745>and <00:11:57.046>that's <00:11:57.348>security <00:11:57.649>testing, <00:11:57.951>right?

313
00:11:58.145 --> 00:12:01.125
<00:11:58.145>So <00:11:58.319>fuzzing <00:11:58.495>in <00:11:58.670>general <00:11:58.845>will <00:11:59.020>mean <00:11:59.194>like <00:11:59.370>unstructured <00:11:59.545>data

314
00:12:01.185 --> 00:12:04.565
<00:12:01.185>thrown <00:12:01.324>against <00:12:01.464>it <00:12:01.604>and <00:12:01.744>um, <00:12:01.885>and <00:12:02.025>then <00:12:02.165>see <00:12:02.305>how <00:12:02.444>it <00:12:02.584>behaves.

315
00:12:05.105 --> 00:12:06.605
<00:12:05.105>And <00:12:05.375>it's <00:12:05.645>based <00:12:05.915>on <00:12:06.185>certain <00:12:06.455>projects.

316
00:12:06.605 --> 00:12:08.045
<00:12:06.605>And <00:12:06.767>once <00:12:06.929>again, <00:12:07.091>this <00:12:07.253>is <00:12:07.415>based <00:12:07.577>on <00:12:07.738>the <00:12:07.901>present.

317
00:12:08.045 --> 00:12:09.205
<00:12:08.045>There <00:12:08.305>are <00:12:08.567>some <00:12:08.828>additions <00:12:09.089>done

318
00:12:09.205 --> 00:12:12.125
<00:12:09.205>because <00:12:09.405>keep <00:12:09.605>in <00:12:09.805>mind, <00:12:10.005>scorecards <00:12:10.205>itself <00:12:10.405>is <00:12:10.605>evolving.

319
00:12:12.235 --> 00:12:14.165
<00:12:12.235>It's <00:12:12.468>a <00:12:12.701>dynamic <00:12:12.935>product, <00:12:13.168>but, <00:12:13.401>uh, <00:12:13.635>project,

320
00:12:14.345 --> 00:12:16.445
<00:12:14.345>but <00:12:14.625>there's <00:12:14.905>definitely <00:12:15.185>checks <00:12:15.465>for <00:12:15.745>this.

321
00:12:16.865 --> 00:12:18.725
<00:12:16.865>And <00:12:17.020>then <00:12:17.176>you <00:12:17.331>could <00:12:17.487>question <00:12:17.642>yourself, <00:12:17.798>does <00:12:17.953>it <00:12:18.109>make <00:12:18.265>sense

322
00:12:18.725 --> 00:12:19.845
<00:12:18.725>to <00:12:18.977>do <00:12:19.229>foing <00:12:19.481>on <00:12:19.733>Java?

323
00:12:19.845 --> 00:12:21.245
<00:12:19.845>Do <00:12:20.160>net <00:12:20.475>project <00:12:20.790>manage <00:12:21.105>ones

324
00:12:21.245 --> 00:12:24.085
<00:12:21.245>because <00:12:21.445>there's <00:12:21.645>no <00:12:21.845>c <00:12:22.045>plus <00:12:22.245>plus <00:12:22.445>like <00:12:22.645>unmanaged,

325
00:12:24.085 --> 00:12:25.765
<00:12:24.085>like <00:12:24.435>buffer <00:12:24.785>overflow <00:12:25.135>problems, <00:12:25.485>right?

326
00:12:26.425 --> 00:12:27.525
<00:12:26.425>I'm <00:12:26.548>gonna <00:12:26.672>touch <00:12:26.796>that <00:12:26.920>in <00:12:27.043>a <00:12:27.167>bit <00:12:27.291>as <00:12:27.415>well

327
00:12:27.525 --> 00:12:29.405
<00:12:27.525>because <00:12:27.725>I <00:12:27.925>can <00:12:28.125>already <00:12:28.324>tell <00:12:28.525>you <00:12:28.725>there <00:12:28.925>is

328
00:12:30.075 --> 00:12:32.565
<00:12:30.075>doesn't <00:12:30.275>do <00:12:30.475>any <00:12:30.675>static <00:12:30.875>code <00:12:31.075>analysis <00:12:31.275>or <00:12:31.475>SaaS.

329
00:12:33.625 --> 00:12:35.965
<00:12:33.625>Um, <00:12:33.905>once <00:12:34.185>again, <00:12:34.465>just <00:12:34.745>the <00:12:35.025>presence

330
00:12:35.965 --> 00:12:38.205
<00:12:35.965>of <00:12:36.198>the <00:12:36.431>tools <00:12:36.665>definitely <00:12:36.898>room <00:12:37.131>for <00:12:37.365>improvement

331
00:12:38.205 --> 00:12:40.805
<00:12:38.205>because <00:12:38.345>I <00:12:38.485>see <00:12:38.625>one <00:12:38.765>vendor <00:12:38.905>that's <00:12:39.045>not <00:12:39.185>on <00:12:39.325>this <00:12:39.465>list, <00:12:39.605>right?

332
00:12:40.825 --> 00:12:43.445
<00:12:40.825>But <00:12:41.000>um, <00:12:41.175>it <00:12:41.350>will <00:12:41.525>check <00:12:41.700>if <00:12:41.875>it's <00:12:42.050>present, <00:12:42.225>right?

333
00:12:43.445 --> 00:12:45.645
<00:12:43.445>There <00:12:43.600>will <00:12:43.756>be <00:12:43.911>a <00:12:44.067>strong <00:12:44.222>indicator <00:12:44.378>of <00:12:44.533>good <00:12:44.689>stuff <00:12:44.845>happening.

334
00:12:46.185 --> 00:12:51.165
<00:12:46.185>The <00:12:46.340>same <00:12:46.496>counts <00:12:46.651>for <00:12:46.807>um, <00:12:46.962>being <00:12:47.118>able <00:12:47.273>to <00:12:47.429>um, <00:12:47.584>um,

335
00:12:51.505 --> 00:12:54.245
<00:12:51.505>see <00:12:51.680>if <00:12:51.855>there's <00:12:52.030>any <00:12:52.205>binary <00:12:52.380>checked <00:12:52.555>into <00:12:52.730>the <00:12:52.905>repo

336
00:12:54.245 --> 00:12:57.005
<00:12:54.245>because <00:12:54.420>as <00:12:54.595>I <00:12:54.770>said <00:12:54.945>before, <00:12:55.120>reproducible <00:12:55.295>builds <00:12:55.470>is <00:12:55.645>key.

337
00:12:57.025 --> 00:12:59.765
<00:12:57.025>And <00:12:57.165>if <00:12:57.305>there <00:12:57.444>is <00:12:57.584>an <00:12:57.725>executable <00:12:57.865>in, <00:12:58.005>we <00:12:58.145>cannot <00:12:58.285>reproduce <00:12:58.425>it.

338
00:12:59.825 --> 00:13:02.525
<00:12:59.825>We <00:13:00.000>cannot <00:13:00.175>know <00:13:00.350>exactly <00:13:00.525>what's <00:13:00.700>inside. <00:13:00.875>That's <00:13:01.050>a <00:13:01.225>risk.

339
00:13:03.345 --> 00:13:05.815
<00:13:03.345>And <00:13:03.578>the <00:13:03.811>same <00:13:04.045>count <00:13:04.278>for <00:13:04.511>branch <00:13:04.745>protection.

340
00:13:05.835 --> 00:13:07.855
<00:13:05.835>So <00:13:06.035>in <00:13:06.235>GitHub <00:13:06.435>you <00:13:06.635>can <00:13:06.835>protect <00:13:07.035>your <00:13:07.235>branches

341
00:13:07.875 --> 00:13:08.935
<00:13:07.875>for <00:13:08.193>not <00:13:08.511>being <00:13:08.829>overwritten.

342
00:13:08.935 --> 00:13:11.735
<00:13:08.935>There's <00:13:09.074>a <00:13:09.214>force, <00:13:09.354>there's <00:13:09.494>a <00:13:09.635>force <00:13:09.775>push <00:13:09.915>that <00:13:10.055>you <00:13:10.194>can <00:13:10.334>do,

343
00:13:11.905 --> 00:13:14.215
<00:13:11.905>which <00:13:12.032>will <00:13:12.159>take <00:13:12.286>care, <00:13:12.414>which <00:13:12.541>will <00:13:12.668>get <00:13:12.795>rid <00:13:12.923>of <00:13:13.050>all <00:13:13.177>the <00:13:13.305>history.

344
00:13:14.215 --> 00:13:15.775
<00:13:14.215>And <00:13:14.415>that's <00:13:14.615>a <00:13:14.815>risk. <00:13:15.015>You <00:13:15.215>don't <00:13:15.415>want <00:13:15.615>that.

345
00:13:16.155 --> 00:13:18.055
<00:13:16.155>So <00:13:16.295>there <00:13:16.435>are <00:13:16.574>certain <00:13:16.714>things <00:13:16.855>you <00:13:16.995>want <00:13:17.135>to <00:13:17.275>do <00:13:17.415>in <00:13:17.555>that.

346
00:13:18.555 --> 00:13:20.695
<00:13:18.555>And <00:13:18.788>GitHub <00:13:19.021>has <00:13:19.255>a <00:13:19.488>whole <00:13:19.721>blog <00:13:19.954>post

347
00:13:20.705 --> 00:13:23.215
<00:13:20.705>where <00:13:20.880>they <00:13:21.055>talk <00:13:21.230>about <00:13:21.405>best <00:13:21.580>practices <00:13:21.755>for <00:13:21.930>their <00:13:22.105>platform.

348
00:13:23.515 --> 00:13:25.255
<00:13:23.515>And <00:13:23.689>one <00:13:23.865>of <00:13:24.040>the <00:13:24.215>other <00:13:24.390>text <00:13:24.564>is <00:13:24.740>also <00:13:24.915>related

349
00:13:25.255 --> 00:13:27.015
<00:13:25.255>to <00:13:25.955>dangerous <00:13:26.655>workflows.

350
00:13:27.235 --> 00:13:28.815
<00:13:27.235>So <00:13:27.515>if <00:13:27.795>there's <00:13:28.075>a <00:13:28.355>workflow <00:13:28.635>executed

351
00:13:29.315 --> 00:13:31.655
<00:13:29.315>and <00:13:29.548>it <00:13:29.781>does <00:13:30.015>not, <00:13:30.248>uh, <00:13:30.481>validate <00:13:30.715>parameters

352
00:13:31.655 --> 00:13:33.415
<00:13:31.655>or <00:13:31.855>it <00:13:32.055>gets <00:13:32.255>stuff <00:13:32.454>from <00:13:32.655>an <00:13:32.855>external <00:13:33.055>source,

353
00:13:33.685 --> 00:13:35.815
<00:13:33.685>then <00:13:33.812>it <00:13:33.939>will <00:13:34.066>be <00:13:34.194>flagged <00:13:34.321>and <00:13:34.448>it <00:13:34.575>might <00:13:34.703>be <00:13:34.830>filled <00:13:34.957>in <00:13:35.084>code

354
00:13:35.815 --> 00:13:37.975
<00:13:35.815>execution, <00:13:36.048>for <00:13:36.281>example, <00:13:36.515>during <00:13:36.748>the <00:13:36.981>build <00:13:37.215>workflow.

355
00:13:38.435 --> 00:13:40.535
<00:13:38.435>So <00:13:38.635>there <00:13:38.834>are <00:13:39.035>certain <00:13:39.234>scenarios <00:13:39.435>that <00:13:39.635>they've <00:13:39.834>covered.

356
00:13:40.875 --> 00:13:41.895
<00:13:40.875>And <00:13:41.058>that's <00:13:41.242>also <00:13:41.425>part <00:13:41.609>of <00:13:41.793>the,

357
00:13:41.895 --> 00:13:43.015
<00:13:41.895>and <00:13:42.063>this <00:13:42.231>is <00:13:42.399>the <00:13:42.567>critical <00:13:42.735>check, <00:13:42.903>right?

358
00:13:43.015 --> 00:13:44.895
<00:13:43.015>This <00:13:43.215>is <00:13:43.415>the, <00:13:43.615>uh, <00:13:43.814>the <00:13:44.015>the <00:13:44.215>big <00:13:44.415>one.

359
00:13:46.435 --> 00:13:48.375
<00:13:46.435>One <00:13:46.562>other <00:13:46.689>thing <00:13:46.816>we <00:13:46.944>want <00:13:47.071>to <00:13:47.198>know, <00:13:47.325>if <00:13:47.453>you <00:13:47.580>look <00:13:47.707>at <00:13:47.834>source,

360
00:13:48.835 --> 00:13:50.255
<00:13:48.835>do <00:13:49.090>they <00:13:49.346>do <00:13:49.601>code <00:13:49.857>reviews, <00:13:50.113>right?

361
00:13:50.275 --> 00:13:52.855
<00:13:50.275>And <00:13:50.475>it's <00:13:50.675>based <00:13:50.875>on <00:13:51.074>an <00:13:51.275>implicit <00:13:51.475>code <00:13:51.675>review.

362
00:13:52.955 --> 00:13:55.535
<00:13:52.955>So <00:13:53.155>let's <00:13:53.355>say <00:13:53.555>I <00:13:53.755>commit <00:13:53.955>to <00:13:54.155>a <00:13:54.355>repo,

363
00:13:55.685 --> 00:13:58.015
<00:13:55.685>then <00:13:55.859>I <00:13:56.035>want <00:13:56.209>somebody <00:13:56.385>else <00:13:56.560>to <00:13:56.734>review <00:13:56.910>it, <00:13:57.084>right?

364
00:13:58.015 --> 00:13:59.735
<00:13:58.015>So <00:13:58.215>if <00:13:58.415>it's <00:13:58.615>the <00:13:58.814>pull <00:13:59.015>merge <00:13:59.215>sequence <00:13:59.415>done

365
00:13:59.735 --> 00:14:02.095
<00:13:59.735>or <00:13:59.875>it's <00:14:00.015>a <00:14:00.155>workflow <00:14:00.295>done, <00:14:00.435>hey <00:14:00.575>you <00:14:00.715>want <00:14:00.855>make <00:14:00.995>sure <00:14:01.135>that

366
00:14:02.775 --> 00:14:04.495
<00:14:02.775>multiplies <00:14:02.949>look <00:14:03.125>at <00:14:03.300>it <00:14:03.475>before <00:14:03.650>it <00:14:03.824>gets <00:14:04.000>pushed <00:14:04.175>out.

367
00:14:05.635 --> 00:14:07.975
<00:14:05.635>And <00:14:05.810>the <00:14:05.985>same <00:14:06.160>counts <00:14:06.335>for <00:14:06.510>the <00:14:06.685>amount <00:14:06.860>of <00:14:07.035>contributors.

368
00:14:07.975 --> 00:14:09.615
<00:14:07.975>And <00:14:08.130>this <00:14:08.286>is <00:14:08.441>a <00:14:08.597>bit <00:14:08.752>of <00:14:08.908>a <00:14:09.063>double <00:14:09.219>edged <00:14:09.375>sword.

369
00:14:09.775 --> 00:14:12.215
<00:14:09.775>I <00:14:09.930>was <00:14:10.086>not <00:14:10.241>completely <00:14:10.397>sure <00:14:10.552>how <00:14:10.708>I <00:14:10.863>thought <00:14:11.019>about <00:14:11.175>this,

370
00:14:12.355 --> 00:14:13.775
<00:14:12.355>but <00:14:12.568>we <00:14:12.781>are <00:14:12.994>gonna <00:14:13.207>walk <00:14:13.420>this <00:14:13.633>through.

371
00:14:13.875 --> 00:14:16.255
<00:14:13.875>So <00:14:14.108>a <00:14:14.341>single <00:14:14.575>contributor <00:14:14.808>is <00:14:15.041>not <00:14:15.275>good

372
00:14:16.255 --> 00:14:17.855
<00:14:16.255>as <00:14:16.455>we <00:14:16.655>saw <00:14:16.855>in <00:14:17.055>the <00:14:17.255>first <00:14:17.455>picture, <00:14:17.655>right?

373
00:14:17.875 --> 00:14:20.135
<00:14:17.875>But <00:14:18.075>is <00:14:18.275>a <00:14:18.475>big <00:14:18.675>group <00:14:18.875>of <00:14:19.075>contributors <00:14:19.275>good.

374
00:14:20.635 --> 00:14:22.335
<00:14:20.635>You <00:14:20.985>could <00:14:21.335>question <00:14:21.685>yourself, <00:14:22.035>right?

375
00:14:23.205 --> 00:14:25.415
<00:14:23.205>This <00:14:23.438>is <00:14:23.671>a <00:14:23.905>dependency <00:14:24.138>tree <00:14:24.371>of <00:14:24.605>electron

376
00:14:25.415 --> 00:14:26.815
<00:14:25.415>and <00:14:25.625>you <00:14:25.835>probably <00:14:26.045>cannot <00:14:26.255>fully <00:14:26.465>read <00:14:26.675>this,

377
00:14:26.815 --> 00:14:29.935
<00:14:26.815>but <00:14:26.942>if <00:14:27.069>you <00:14:27.196>go <00:14:27.324>to <00:14:27.451>M-P-M-J-S, <00:14:27.578>you <00:14:27.705>can <00:14:27.833>find <00:14:27.960>the, <00:14:28.087>the <00:14:28.215>graph

378
00:14:29.955 --> 00:14:33.775
<00:14:29.955>of <00:14:30.095>electron <00:14:30.235>which <00:14:30.375>is <00:14:30.515>used <00:14:30.655>for <00:14:30.795>Slack <00:14:30.935>and <00:14:31.075>VS <00:14:31.215>code, <00:14:31.355>right?

379
00:14:33.845 --> 00:14:36.295
<00:14:33.845>It's <00:14:34.125>electron <00:14:34.405>based. <00:14:34.685>There <00:14:34.965>are <00:14:35.245>98

380
00:14:37.135 --> 00:14:38.415
<00:14:37.135>maintainers <00:14:37.519>on <00:14:37.903>this <00:14:38.286>project.

381
00:14:38.415 --> 00:14:41.655
<00:14:38.415>98 <00:14:38.615>people <00:14:38.814>that <00:14:39.015>help <00:14:39.214>out <00:14:39.415>creating <00:14:39.615>other <00:14:39.814>dependencies

382
00:14:41.655 --> 00:14:43.535
<00:14:41.655>that <00:14:41.855>turn <00:14:42.055>into <00:14:42.255>electron <00:14:42.454>that <00:14:42.655>turn <00:14:42.855>into <00:14:43.055>VS.

383
00:14:43.535 --> 00:14:47.495
<00:14:43.535>Code <00:14:43.735>on <00:14:43.935>your <00:14:44.135>machine. <00:14:44.334>There <00:14:44.535>are <00:14:44.735>1100 <00:14:44.935>maintainers

384
00:14:47.495 --> 00:14:49.655
<00:14:47.495>that <00:14:47.775>help <00:14:48.055>out <00:14:48.335>as <00:14:48.615>well <00:14:48.895>contributors

385
00:14:49.675 --> 00:14:50.895
<00:14:49.675>to <00:14:49.949>the <00:14:50.223>whole <00:14:50.498>thing, <00:14:50.773>right?

386
00:14:51.145 --> 00:14:52.605
<00:14:51.145>So <00:14:51.364>there's <00:14:51.583>a <00:14:51.802>group <00:14:52.021>of <00:14:52.240>1100 <00:14:52.459>people

387
00:14:52.865 --> 00:14:54.365
<00:14:52.865>and <00:14:53.015>is <00:14:53.165>that <00:14:53.315>a <00:14:53.465>good <00:14:53.615>thing <00:14:53.765>or <00:14:53.915>a <00:14:54.065>bad <00:14:54.215>thing?

388
00:14:54.805 --> 00:14:57.405
<00:14:54.805>I <00:14:54.932>have <00:14:55.059>some <00:14:55.186>metrics <00:14:55.314>to <00:14:55.441>show <00:14:55.568>it's <00:14:55.695>one <00:14:55.823>way <00:14:55.950>or <00:14:56.077>the <00:14:56.204>other.

389
00:14:57.405 --> 00:14:59.235
<00:14:57.405>We're <00:14:57.605>gonna <00:14:57.805>do <00:14:58.005>that <00:14:58.204>in <00:14:58.405>a <00:14:58.605>bit. <00:14:58.805>Um,

390
00:14:59.585 --> 00:15:02.195
<00:14:59.585>does <00:14:59.865>it <00:15:00.145>do <00:15:00.425>pin <00:15:00.705>dependencies, <00:15:00.985>right?

391
00:15:02.615 --> 00:15:04.915
<00:15:02.615>You <00:15:02.742>want <00:15:02.869>to <00:15:02.996>know <00:15:03.124>for <00:15:03.251>sure <00:15:03.378>that <00:15:03.505>a <00:15:03.633>certain <00:15:03.760>version <00:15:03.887>is <00:15:04.015>used

392
00:15:04.915 --> 00:15:08.035
<00:15:04.915>because <00:15:05.089>let's <00:15:05.265>say <00:15:05.439>for <00:15:05.615>example, <00:15:05.790>uh, <00:15:05.964>something <00:15:06.140>auto <00:15:06.314>updates,

393
00:15:08.095 --> 00:15:09.875
<00:15:08.095>but <00:15:08.328>it <00:15:08.561>it <00:15:08.795>is <00:15:09.028>because <00:15:09.261>it's <00:15:09.495>vulnerable.

394
00:15:09.875 --> 00:15:10.915
<00:15:09.875>That's <00:15:10.187>the <00:15:10.499>opposite <00:15:10.810>side.

395
00:15:11.255 --> 00:15:13.715
<00:15:11.255>So <00:15:11.371>for <00:15:11.488>do <00:15:11.605>net, <00:15:11.721>you <00:15:11.838>can <00:15:11.955>lock <00:15:12.071>down <00:15:12.188>the <00:15:12.305>versions <00:15:12.421>that <00:15:12.538>are <00:15:12.655>used.

396
00:15:14.135 --> 00:15:16.715
<00:15:14.135>And <00:15:14.310>also <00:15:14.485>if <00:15:14.660>you <00:15:14.835>run <00:15:15.010>a <00:15:15.185>GitHub <00:15:15.360>actions <00:15:15.535>pipeline,

397
00:15:16.775 --> 00:15:19.195
<00:15:16.775>you <00:15:16.949>should <00:15:17.125>never <00:15:17.300>rely <00:15:17.475>on <00:15:17.650>versions <00:15:17.824>in <00:15:18.000>your <00:15:18.175>actions.

398
00:15:19.215 --> 00:15:21.955
<00:15:19.215>You <00:15:19.415>should <00:15:19.615>rely <00:15:19.815>on <00:15:20.015>on <00:15:20.215>hashes <00:15:20.415>over <00:15:20.615>actions

399
00:15:21.955 --> 00:15:23.035
<00:15:21.955>because <00:15:22.927>actions

400
00:15:23.035 --> 00:15:24.995
<00:15:23.035>with <00:15:23.175>the <00:15:23.314>same <00:15:23.454>version <00:15:23.594>can <00:15:23.735>just <00:15:23.875>be <00:15:24.015>replaced <00:15:24.155>by <00:15:24.295>another <00:15:24.435>one.

401
00:15:25.015 --> 00:15:27.115
<00:15:25.015>You <00:15:25.248>don't <00:15:25.481>know <00:15:25.715>for <00:15:25.948>sure <00:15:26.181>which <00:15:26.415>happens.

402
00:15:28.725 --> 00:15:30.435
<00:15:28.725>We're <00:15:28.900>getting <00:15:29.075>close <00:15:29.250>to <00:15:29.425>the <00:15:29.600>end, <00:15:29.775>so <00:15:29.950>don't <00:15:30.125>worry.

403
00:15:30.815 --> 00:15:32.595
<00:15:30.815>Now <00:15:31.048>we're <00:15:31.281>looking <00:15:31.515>into <00:15:31.748>like <00:15:31.981>tokens, <00:15:32.215>right?

404
00:15:32.615 --> 00:15:35.115
<00:15:32.615>In <00:15:32.755>order <00:15:32.895>to <00:15:33.035>build <00:15:33.175>our <00:15:33.315>stuff, <00:15:33.455>we <00:15:33.595>need <00:15:33.735>to <00:15:33.875>have <00:15:34.015>access

405
00:15:35.115 --> 00:15:36.275
<00:15:35.115>to <00:15:35.376>systems <00:15:35.637>and <00:15:35.898>other <00:15:36.159>systems,

406
00:15:36.645 --> 00:15:38.395
<00:15:36.645>which <00:15:36.845>in <00:15:37.045>GI <00:15:37.245>up <00:15:37.444>is <00:15:37.645>based <00:15:37.845>on <00:15:38.045>tokens.

407
00:15:38.735 --> 00:15:41.155
<00:15:38.735>We <00:15:38.862>need <00:15:38.989>to <00:15:39.116>make <00:15:39.244>sure <00:15:39.371>that <00:15:39.498>we <00:15:39.625>do <00:15:39.753>low <00:15:39.880>privileged <00:15:40.007>ones <00:15:40.135>right?

408
00:15:41.175 --> 00:15:42.635
<00:15:41.175>In <00:15:41.306>order <00:15:41.437>to <00:15:41.569>do <00:15:41.700>the <00:15:41.832>stuff <00:15:41.963>that <00:15:42.094>we <00:15:42.226>need <00:15:42.357>to <00:15:42.489>do.

409
00:15:42.635 --> 00:15:43.755
<00:15:42.635>Nothing <00:15:42.971>more, <00:15:43.307>nothing <00:15:43.643>less.

410
00:15:45.825 --> 00:15:47.525
<00:15:45.825>And <00:15:46.105>what <00:15:46.385>about <00:15:46.665>packaging <00:15:46.945>in <00:15:47.225>general?

411
00:15:47.925 --> 00:15:50.205
<00:15:47.925>I <00:15:48.052>want <00:15:48.179>my <00:15:48.306>package, <00:15:48.434>if <00:15:48.561>I'm <00:15:48.688>part <00:15:48.815>of <00:15:48.943>the <00:15:49.070>new <00:15:49.197>GA <00:15:49.324>ecosystem,

412
00:15:50.325 --> 00:15:51.445
<00:15:50.325>I <00:15:50.493>want <00:15:50.661>to <00:15:50.829>publish <00:15:50.997>the <00:15:51.165>new <00:15:51.333>GA

413
00:15:51.445 --> 00:15:54.085
<00:15:51.445>because <00:15:51.600>that's <00:15:51.756>the <00:15:51.911>whole <00:15:52.067>thing <00:15:52.222>that <00:15:52.378>allows <00:15:52.533>people <00:15:52.689>to <00:15:52.845>update

414
00:15:54.145 --> 00:15:55.525
<00:15:54.145>and <00:15:54.393>see <00:15:54.641>if <00:15:54.890>there's <00:15:55.138>new <00:15:55.387>versions

415
00:15:55.585 --> 00:15:57.965
<00:15:55.585>and <00:15:55.760>maybe <00:15:55.935>even <00:15:56.110>report <00:15:56.285>if <00:15:56.460>there's <00:15:56.635>a <00:15:56.810>vulnerability, <00:15:56.985>right?

416
00:15:58.135 --> 00:16:01.005
<00:15:58.135>Being <00:15:58.290>part <00:15:58.446>of <00:15:58.601>a <00:15:58.757>bigger <00:15:58.912>ecosystem <00:15:59.068>allows <00:15:59.223>people <00:15:59.379>to <00:15:59.535>update

417
00:16:01.005 --> 00:16:02.005
<00:16:01.005>and <00:16:01.185>that's <00:16:01.365>key <00:16:01.545>thing <00:16:01.725>as <00:16:01.905>well.

418
00:16:03.065 --> 00:16:06.005
<00:16:03.065>And <00:16:03.298>what <00:16:03.531>about, <00:16:03.765>um, <00:16:03.998>signed <00:16:04.231>releases, <00:16:04.465>right?

419
00:16:06.545 --> 00:16:09.045
<00:16:06.545>You <00:16:06.745>can <00:16:06.944>sign <00:16:07.145>releases <00:16:07.344>based <00:16:07.545>on <00:16:07.745>a <00:16:07.944>certificate

420
00:16:09.045 --> 00:16:11.645
<00:16:09.045>or <00:16:09.185>like <00:16:09.324>a <00:16:09.464>public <00:16:09.604>private <00:16:09.745>key <00:16:09.885>pair <00:16:10.025>where <00:16:10.165>you <00:16:10.305>take <00:16:10.444>and,

421
00:16:11.665 --> 00:16:12.805
<00:16:11.665>and <00:16:11.921>that's <00:16:12.178>being <00:16:12.434>signed <00:16:12.690>off.

422
00:16:13.145 --> 00:16:15.245
<00:16:13.145>It <00:16:13.345>doesn't <00:16:13.545>necessarily <00:16:13.745>say <00:16:13.944>something <00:16:14.145>about <00:16:14.345>what's <00:16:14.545>inside,

423
00:16:15.245 --> 00:16:16.805
<00:16:15.245>but <00:16:15.478>it <00:16:15.711>believe <00:16:15.945>gives <00:16:16.178>you <00:16:16.411>some <00:16:16.645>assurance

424
00:16:16.875 --> 00:16:19.405
<00:16:16.875>that <00:16:17.030>at <00:16:17.186>this <00:16:17.341>moment <00:16:17.497>in <00:16:17.652>time <00:16:17.808>this <00:16:17.963>package <00:16:18.119>was <00:16:18.275>created

425
00:16:19.425 --> 00:16:21.005
<00:16:19.425>and <00:16:19.625>it <00:16:19.824>was <00:16:20.025>signed <00:16:20.224>by <00:16:20.425>me, <00:16:20.625>Neil <00:16:20.824>Stanis.

426
00:16:21.005 --> 00:16:22.845
<00:16:21.005>And <00:16:21.180>that's <00:16:21.355>the <00:16:21.530>guarantee <00:16:21.705>I <00:16:21.880>can <00:16:22.055>give <00:16:22.230>you, <00:16:22.405>right?

427
00:16:22.865 --> 00:16:25.645
<00:16:22.865>So <00:16:22.992>that's, <00:16:23.119>that's <00:16:23.246>a <00:16:23.374>given <00:16:23.501>fact <00:16:23.628>that <00:16:23.755>you <00:16:23.883>can <00:16:24.010>work <00:16:24.137>from <00:16:24.265>that.

428
00:16:25.805 --> 00:16:27.525
<00:16:25.805>I <00:16:26.038>think <00:16:26.271>that's <00:16:26.505>cool. <00:16:26.738>The <00:16:26.971>same <00:16:27.204>counts

429
00:16:27.525 --> 00:16:29.885
<00:16:27.525>for <00:16:27.665>Bill <00:16:27.805>Provenance <00:16:27.944>if <00:16:28.084>you <00:16:28.225>look <00:16:28.365>at <00:16:28.505>it <00:16:28.645>from <00:16:28.785>a <00:16:28.925>uh,

430
00:16:29.905 --> 00:16:30.965
<00:16:29.905>supply <00:16:30.382>chain <00:16:30.859>perspective.

431
00:16:32.465 --> 00:16:33.965
<00:16:32.465>Enough <00:16:32.802>said, <00:16:33.140>right? <00:16:33.477>Enough <00:16:33.815>talking.

432
00:16:34.185 --> 00:16:36.605
<00:16:34.185>So <00:16:34.385>let <00:16:34.584>me <00:16:34.785>quickly <00:16:34.984>show <00:16:35.185>you <00:16:35.385>some <00:16:35.584>output

433
00:16:36.605 --> 00:16:38.925
<00:16:36.605>and <00:16:36.760>I'm <00:16:36.916>not <00:16:37.071>gonna <00:16:37.227>um, <00:16:37.382>uh, <00:16:37.538>show <00:16:37.693>you <00:16:37.849>the <00:16:38.005>tool

434
00:16:38.925 --> 00:16:39.965
<00:16:38.925>because <00:16:39.081>we <00:16:39.237>need <00:16:39.393>to <00:16:39.549>wait <00:16:39.705>for <00:16:39.861>it.

435
00:16:40.065 --> 00:16:44.045
<00:16:40.065>But <00:16:40.205>let <00:16:40.345>me <00:16:40.485>go <00:16:40.625>back <00:16:40.765>a <00:16:40.905>bit <00:16:41.045>to <00:16:41.185>um, <00:16:41.325>vs <00:16:41.465>code.

436
00:16:44.265 --> 00:16:47.765
<00:16:44.265>So <00:16:44.392>this <00:16:44.519>morning <00:16:44.646>I <00:16:44.774>already <00:16:44.901>run <00:16:45.028>scorecard <00:16:45.155>on <00:16:45.283>a <00:16:45.410>new <00:16:45.537>GA <00:16:45.665>repo,

437
00:16:47.825 --> 00:16:50.085
<00:16:47.825>the <00:16:48.058>mostly <00:16:48.291>used, <00:16:48.525>that's <00:16:48.758>Newton <00:16:48.991>soft <00:16:49.225>json.

438
00:16:50.425 --> 00:16:52.405
<00:16:50.425>You <00:16:50.564>can <00:16:50.704>get <00:16:50.844>the <00:16:50.984>bins <00:16:51.125>on <00:16:51.265>your <00:16:51.405>machine, <00:16:51.545>it <00:16:51.685>will <00:16:51.824>run,

439
00:16:52.455 --> 00:16:55.085
<00:16:52.455>it'll <00:16:52.595>do <00:16:52.735>all <00:16:52.875>the <00:16:53.015>checks <00:16:53.155>which <00:16:53.295>start, <00:16:53.435>which <00:16:53.575>we <00:16:53.715>talked <00:16:53.855>about.

440
00:16:55.385 --> 00:16:57.765
<00:16:55.385>And <00:16:55.525>then <00:16:55.665>at <00:16:55.805>the <00:16:55.944>end <00:16:56.085>hopefully <00:16:56.225>you're <00:16:56.365>able <00:16:56.505>to <00:16:56.645>see <00:16:56.785>it.

441
00:16:58.345 --> 00:16:59.485
<00:16:58.345>New <00:16:58.601>GA <00:16:58.858>has <00:16:59.114>an <00:16:59.371>uh,

442
00:16:59.485 --> 00:17:02.645
<00:16:59.485>or <00:16:59.601>a <00:16:59.718>Newton <00:16:59.835>t <00:16:59.951>JSON <00:17:00.068>has <00:17:00.185>an <00:17:00.301>aggregate <00:17:00.418>score <00:17:00.535>three <00:17:00.651>out <00:17:00.768>of <00:17:00.885>10.

443
00:17:02.665 --> 00:17:05.205
<00:17:02.665>And <00:17:02.805>then <00:17:02.944>underneath <00:17:03.084>here <00:17:03.224>you <00:17:03.365>can <00:17:03.505>see <00:17:03.645>it <00:17:03.785>has <00:17:03.925>no <00:17:04.065>binary

444
00:17:05.315 --> 00:17:07.845
<00:17:05.315>artifacts <00:17:05.548>in <00:17:05.781>it <00:17:06.015>does <00:17:06.248>run <00:17:06.481>CI <00:17:06.715>tests,

445
00:17:07.985 --> 00:17:11.205
<00:17:07.984>but <00:17:08.140>out <00:17:08.296>of <00:17:08.451>five <00:17:08.607>out <00:17:08.762>of <00:17:08.918>21 <00:17:09.073>merge <00:17:09.229>pr, <00:17:09.385>uh,

446
00:17:11.235 --> 00:17:12.285
<00:17:11.234>it's <00:17:11.471>not <00:17:11.707>as <00:17:11.943>good, <00:17:12.180>right?

447
00:17:12.785 --> 00:17:13.965
<00:17:12.785>10 <00:17:13.050>out <00:17:13.316>of <00:17:13.581>10 <00:17:13.847>contributors.

448
00:17:13.965 --> 00:17:15.805
<00:17:13.964>There <00:17:14.244>are <00:17:14.524>15 <00:17:14.804>different <00:17:15.084>organizations <00:17:15.365>involved,

449
00:17:15.805 --> 00:17:17.205
<00:17:15.805>which <00:17:16.057>hopefully <00:17:16.309>is <00:17:16.560>a <00:17:16.812>good <00:17:17.065>thing.

450
00:17:17.715 --> 00:17:19.645
<00:17:17.714>This <00:17:17.994>allows <00:17:18.274>you <00:17:18.554>to <00:17:18.834>quickly <00:17:19.115>review,

451
00:17:19.745 --> 00:17:21.445
<00:17:19.744>but <00:17:19.919>is <00:17:20.094>this <00:17:20.270>something <00:17:20.444>that <00:17:20.619>you <00:17:20.794>can <00:17:20.969>work <00:17:21.145>with?

452
00:17:21.445 --> 00:17:22.805
<00:17:21.444>Because <00:17:21.648>if <00:17:21.853>you <00:17:22.057>need <00:17:22.261>to <00:17:22.465>run <00:17:22.669>this

453
00:17:22.825 --> 00:17:25.605
<00:17:22.825>for <00:17:23.000>every <00:17:23.175>dependency <00:17:23.350>on <00:17:23.525>a <00:17:23.700>tool <00:17:23.875>on <00:17:24.050>your <00:17:24.225>machine,

454
00:17:26.065 --> 00:17:27.165
<00:17:26.065>that's <00:17:26.312>a <00:17:26.560>hard <00:17:26.807>thing, <00:17:27.055>right?

455
00:17:27.435 --> 00:17:29.885
<00:17:27.435>Luckily <00:17:27.714>there <00:17:27.994>are <00:17:28.274>some <00:17:28.554>APIs <00:17:28.835>available

456
00:17:30.105 --> 00:17:32.445
<00:17:30.105>and <00:17:30.221>the <00:17:30.338>cool <00:17:30.455>thing <00:17:30.571>is <00:17:30.688>that <00:17:30.805>you <00:17:30.921>can <00:17:31.038>just <00:17:31.155>grab <00:17:31.271>the <00:17:31.388>same <00:17:31.505>data

457
00:17:32.625 --> 00:17:35.085
<00:17:32.625>in <00:17:32.780>a <00:17:32.936>JSON <00:17:33.091>document, <00:17:33.247>which <00:17:33.402>I <00:17:33.558>think <00:17:33.713>this <00:17:33.869>is <00:17:34.025>cool.

458
00:17:35.585 --> 00:17:39.765
<00:17:35.585>Um, <00:17:35.712>then <00:17:35.839>you <00:17:35.966>still <00:17:36.094>need <00:17:36.221>to <00:17:36.348>correlate <00:17:36.475>it <00:17:36.603>back <00:17:36.730>to <00:17:36.857>um, <00:17:36.985>um,

459
00:17:39.895 --> 00:17:41.845
<00:17:39.895>which <00:17:40.095>repo <00:17:40.295>or <00:17:40.495>which <00:17:40.695>package <00:17:40.895>it <00:17:41.095>belongs <00:17:41.295>to

460
00:17:41.845 --> 00:17:45.245
<00:17:41.845>because <00:17:42.020>um, <00:17:42.195>the <00:17:42.370>scorecard <00:17:42.545>itself <00:17:42.720>relies <00:17:42.895>on <00:17:43.070>a <00:17:43.245>GitLab

461
00:17:45.245 --> 00:17:46.565
<00:17:45.245>or <00:17:45.640>GI <00:17:46.037>help <00:17:46.433>URL.

462
00:17:46.905 --> 00:17:49.845
<00:17:46.905>Um, <00:17:47.012>I <00:17:47.120>wrote <00:17:47.228>a <00:17:47.335>tool <00:17:47.443>and <00:17:47.551>you <00:17:47.658>can <00:17:47.766>find <00:17:47.874>the <00:17:47.981>tool <00:17:48.089>in <00:17:48.197>the <00:17:48.305>repo

463
00:17:49.845 --> 00:17:51.325
<00:17:49.845>and <00:17:50.011>you <00:17:50.178>can <00:17:50.344>find <00:17:50.511>it <00:17:50.677>on <00:17:50.844>my <00:17:51.010>other <00:17:51.177>presentations.

464
00:17:51.355 --> 00:17:54.205
<00:17:51.355>It's <00:17:51.510>called <00:17:51.666>fentech. <00:17:51.821>And <00:17:51.977>there's <00:17:52.132>another <00:17:52.288>one <00:17:52.443>which <00:17:52.599>does <00:17:52.755>a

465
00:17:54.205 --> 00:17:56.045
<00:17:54.205>transitive <00:17:54.671>three <00:17:55.138>of <00:17:55.605>scorecards.

466
00:17:56.045 --> 00:17:58.885
<00:17:56.045>And <00:17:56.185>in <00:17:56.325>this <00:17:56.465>case <00:17:56.605>I've <00:17:56.745>run <00:17:56.885>it <00:17:57.025>for <00:17:57.165>uh, <00:17:57.305>dash <00:17:57.445>blog,

467
00:17:58.885 --> 00:18:00.525
<00:17:58.885>which <00:17:59.085>is <00:17:59.285>a <00:17:59.485>do <00:17:59.685>net <00:17:59.885>based <00:18:00.085>blog <00:18:00.285>engine.

468
00:18:00.745 --> 00:18:04.325
<00:18:00.745>But <00:18:00.900>you <00:18:01.056>will <00:18:01.211>get <00:18:01.367>a <00:18:01.522>whole <00:18:01.678>list <00:18:01.833>of <00:18:01.989>of <00:18:02.145>documents

469
00:18:04.325 --> 00:18:07.285
<00:18:04.325>that <00:18:04.500>will <00:18:04.675>allow <00:18:04.850>you <00:18:05.025>to <00:18:05.200>easily, <00:18:05.375>hopefully <00:18:05.550>review, <00:18:05.725>right?

470
00:18:07.285 --> 00:18:09.365
<00:18:07.285>That's <00:18:07.425>the <00:18:07.565>first <00:18:07.705>start. <00:18:07.845>And <00:18:07.985>I'm <00:18:08.125>not <00:18:08.265>saying <00:18:08.405>it's <00:18:08.545>the <00:18:08.685>end

471
00:18:09.365 --> 00:18:12.365
<00:18:09.365>result, <00:18:09.520>but <00:18:09.676>you <00:18:09.831>can <00:18:09.987>see <00:18:10.142>in <00:18:10.298>this <00:18:10.453>case <00:18:10.609>there's <00:18:10.765>a

472
00:18:12.365 --> 00:18:13.405
<00:18:12.365>whole <00:18:12.599>check <00:18:12.833>set <00:18:13.067>being <00:18:13.301>done.

473
00:18:13.405 --> 00:18:14.965
<00:18:13.405>And <00:18:13.605>I <00:18:13.805>think <00:18:14.004>underneath <00:18:14.205>there <00:18:14.405>you <00:18:14.605>will <00:18:14.805>see

474
00:18:14.965 --> 00:18:17.485
<00:18:14.965>that <00:18:15.105>auto <00:18:15.245>mapper <00:18:15.385>in <00:18:15.524>this <00:18:15.665>case <00:18:15.804>has <00:18:15.945>a <00:18:16.084>score <00:18:16.225>of <00:18:16.365>6.1

475
00:18:17.865 --> 00:18:19.405
<00:18:17.865>and <00:18:18.038>you <00:18:18.211>can <00:18:18.384>look <00:18:18.558>into <00:18:18.731>each <00:18:18.904>of <00:18:19.077>the <00:18:19.251>checks

476
00:18:19.405 --> 00:18:20.605
<00:18:19.405>that <00:18:19.621>matter <00:18:19.837>the <00:18:20.053>most <00:18:20.269>to <00:18:20.485>you.

477
00:18:20.705 --> 00:18:22.245
<00:18:20.705>And <00:18:20.936>I <00:18:21.167>think <00:18:21.398>this <00:18:21.629>is <00:18:21.860>quite <00:18:22.091>valuable.

478
00:18:22.265 --> 00:18:25.165
<00:18:22.265>So <00:18:22.372>if <00:18:22.480>you <00:18:22.588>go <00:18:22.695>to <00:18:22.803>the <00:18:22.911>repo, <00:18:23.018>which <00:18:23.126>I <00:18:23.234>will <00:18:23.341>share <00:18:23.449>at <00:18:23.557>the <00:18:23.665>end,

479
00:18:25.185 --> 00:18:27.325
<00:18:25.185>you <00:18:25.360>will <00:18:25.534>see <00:18:25.710>that <00:18:25.885>there <00:18:26.060>is <00:18:26.235>a <00:18:26.409>tool <00:18:26.585>directory

480
00:18:27.325 --> 00:18:28.765
<00:18:27.325>that <00:18:27.541>will <00:18:27.757>do <00:18:27.973>the <00:18:28.189>same <00:18:28.405>for <00:18:28.621>Maven

481
00:18:29.225 --> 00:18:31.045
<00:18:29.225>and <00:18:29.504>there's <00:18:29.784>MPM <00:18:30.064>support <00:18:30.344>as <00:18:30.625>well.

482
00:18:32.535 --> 00:18:34.525
<00:18:32.535>Let's <00:18:32.710>move <00:18:32.885>on <00:18:33.060>because <00:18:33.235>we <00:18:33.410>have <00:18:33.585>seven <00:18:33.760>minutes <00:18:33.935>left.

483
00:18:34.605 --> 00:18:36.405
<00:18:34.605>I <00:18:34.805>want <00:18:35.005>to <00:18:35.205>quickly <00:18:35.405>move <00:18:35.605>into <00:18:35.805>some <00:18:36.005>measurements

484
00:18:36.405 --> 00:18:38.445
<00:18:36.405>because <00:18:36.638>I <00:18:36.871>said <00:18:37.105>something <00:18:37.338>about <00:18:37.571>industry <00:18:37.805>standards

485
00:18:38.785 --> 00:18:40.125
<00:18:38.785>and <00:18:39.026>comparing <00:18:39.267>how <00:18:39.508>good <00:18:39.749>it <00:18:39.991>is.

486
00:18:40.705 --> 00:18:42.165
<00:18:40.705>So <00:18:40.924>open <00:18:41.143>as <00:18:41.361>SF <00:18:41.581>has <00:18:41.800>a <00:18:42.019>report

487
00:18:42.185 --> 00:18:44.165
<00:18:42.185>and <00:18:42.385>they <00:18:42.585>say <00:18:42.784>we <00:18:42.985>scan <00:18:43.185>1 <00:18:43.385>million <00:18:43.585>open

488
00:18:44.165 --> 00:18:45.325
<00:18:44.165>source <00:18:44.513>projects <00:18:44.861>each <00:18:45.209>year.

489
00:18:46.185 --> 00:18:47.325
<00:18:46.185>We <00:18:46.390>have <00:18:46.595>the <00:18:46.800>state <00:18:47.005>of <00:18:47.211>software

490
00:18:47.485 --> 00:18:48.605
<00:18:47.485>security <00:18:47.736>and <00:18:47.989>Julian <00:18:48.241>touched <00:18:48.493>it.

491
00:18:48.605 --> 00:18:50.645
<00:18:48.605>And <00:18:48.745>if <00:18:48.885>you <00:18:49.025>were <00:18:49.165>in, <00:18:49.305>in <00:18:49.445>this <00:18:49.585>uh, <00:18:49.725>keynote <00:18:49.865>this <00:18:50.005>morning

492
00:18:50.645 --> 00:18:53.205
<00:18:50.645>with <00:18:50.820>Chris <00:18:50.995>Wallace <00:18:51.170>Opal, <00:18:51.345>he <00:18:51.520>also <00:18:51.695>mentioned <00:18:51.870>this <00:18:52.045>report,

493
00:18:53.505 --> 00:18:56.045
<00:18:53.505>we <00:18:53.705>scan <00:18:53.905>1 <00:18:54.105>million <00:18:54.305>apps <00:18:54.505>a <00:18:54.705>year, <00:18:54.905>um,

494
00:18:56.345 --> 00:18:57.765
<00:18:56.345>and <00:18:56.527>we <00:18:56.710>have <00:18:56.892>a <00:18:57.075>big <00:18:57.257>set <00:18:57.440>of <00:18:57.623>data

495
00:18:57.865 --> 00:19:00.445
<00:18:57.865>and <00:18:58.040>what <00:18:58.215>my, <00:18:58.390>what <00:18:58.565>our <00:18:58.740>chiefs <00:18:58.915>research <00:18:59.090>officer <00:18:59.265>did,

496
00:19:00.445 --> 00:19:05.125
<00:19:00.445>Chris <00:19:00.585>Ang, <00:19:00.725>he <00:19:00.865>looked <00:19:01.004>into <00:19:01.145>our <00:19:01.284>data <00:19:01.425>and <00:19:01.564>open <00:19:01.705>SSF <00:19:01.845>scorecard

497
00:19:05.185 --> 00:19:07.485
<00:19:05.185>and <00:19:05.312>then <00:19:05.439>you <00:19:05.566>looked <00:19:05.694>into <00:19:05.821>like <00:19:05.948>this <00:19:06.075>is <00:19:06.203>the <00:19:06.330>set <00:19:06.457>that's <00:19:06.585>covered

498
00:19:07.485 --> 00:19:09.925
<00:19:07.485>by <00:19:07.685>scorecard <00:19:07.885>and <00:19:08.084>we <00:19:08.284>look <00:19:08.485>into <00:19:08.685>business <00:19:08.885>apps

499
00:19:09.945 --> 00:19:11.405
<00:19:09.945>and <00:19:10.164>this <00:19:10.383>smaller <00:19:10.601>dot <00:19:10.821>are <00:19:11.040>the <00:19:11.259>apps

500
00:19:11.405 --> 00:19:12.525
<00:19:11.405>that <00:19:11.657>we <00:19:11.909>have <00:19:12.161>seen <00:19:12.413>ourselves.

501
00:19:13.025 --> 00:19:15.325
<00:19:13.025>And <00:19:13.165>based <00:19:13.305>on <00:19:13.445>that <00:19:13.585>we <00:19:13.725>are <00:19:13.865>able <00:19:14.005>to <00:19:14.145>look <00:19:14.285>into, <00:19:14.425>hey,

502
00:19:15.705 --> 00:19:19.085
<00:19:15.705>how <00:19:15.860>good <00:19:16.016>do <00:19:16.171>the <00:19:16.327>scorecards <00:19:16.482>relate <00:19:16.638>to <00:19:16.793>the <00:19:16.949>scan <00:19:17.105>results

503
00:19:19.545 --> 00:19:20.765
<00:19:19.545>and <00:19:19.764>see <00:19:19.984>how <00:19:20.203>it <00:19:20.423>works <00:19:20.643>out.

504
00:19:21.225 --> 00:19:22.845
<00:19:21.225>So <00:19:21.574>this <00:19:21.925>is <00:19:22.274>a <00:19:22.625>lot

505
00:19:22.845 --> 00:19:25.245
<00:19:22.845>and <00:19:23.045>there's <00:19:23.245>a <00:19:23.445>presentation <00:19:23.645>at <00:19:23.845>RSA <00:19:24.045>down <00:19:24.245>bikers

506
00:19:25.245 --> 00:19:27.605
<00:19:25.245>and <00:19:25.385>you <00:19:25.524>can <00:19:25.665>see <00:19:25.804>the <00:19:25.945>video <00:19:26.084>and <00:19:26.225>there's <00:19:26.364>an <00:19:26.504>hour <00:19:26.645>stretch

507
00:19:27.605 --> 00:19:28.725
<00:19:27.605>of <00:19:27.857>talking <00:19:28.109>about <00:19:28.360>this <00:19:28.612>data.

508
00:19:28.825 --> 00:19:31.565
<00:19:28.825>So <00:19:28.952>I'm <00:19:29.079>just <00:19:29.206>gonna <00:19:29.334>explain <00:19:29.461>to <00:19:29.588>you <00:19:29.715>quickly <00:19:29.843>what <00:19:29.970>you <00:19:30.097>see <00:19:30.225>here.

509
00:19:32.105 --> 00:19:35.445
<00:19:32.105>The <00:19:32.221>red <00:19:32.338>bars <00:19:32.455>in <00:19:32.571>this <00:19:32.688>one <00:19:32.805>are <00:19:32.921>the <00:19:33.038>ones <00:19:33.155>that <00:19:33.271>are <00:19:33.388>not <00:19:33.505>observed

510
00:19:35.445 --> 00:19:36.525
<00:19:35.445>by <00:19:35.639>us, <00:19:35.833>the <00:19:36.028>blue <00:19:36.222>ones <00:19:36.417>are.

511
00:19:36.525 --> 00:19:40.165
<00:19:36.525>And <00:19:36.652>if <00:19:36.779>you <00:19:36.906>see <00:19:37.034>and <00:19:37.161>then <00:19:37.288>you <00:19:37.415>see <00:19:37.543>the <00:19:37.670>X <00:19:37.797>one, <00:19:37.925>uh,

512
00:19:40.165 --> 00:19:42.765
<00:19:40.165>you <00:19:40.281>see <00:19:40.398>the <00:19:40.514>scores <00:19:40.631>and <00:19:40.748>you <00:19:40.865>see <00:19:40.981>that <00:19:41.098>the <00:19:41.215>blue <00:19:41.331>bars <00:19:41.448>are <00:19:41.565>more

513
00:19:42.765 --> 00:19:44.765
<00:19:42.765>to <00:19:42.920>the, <00:19:43.076>to <00:19:43.231>the <00:19:43.387>highest <00:19:43.542>scores, <00:19:43.698>which <00:19:43.853>mean <00:19:44.009>the <00:19:44.165>apps

514
00:19:44.765 --> 00:19:48.205
<00:19:44.765>that <00:19:44.920>we <00:19:45.076>have <00:19:45.231>seen <00:19:45.387>in <00:19:45.542>in <00:19:45.698>general <00:19:45.853>have <00:19:46.009>higher <00:19:46.165>uh,

515
00:19:48.315 --> 00:19:51.125
<00:19:48.315>open <00:19:48.470>scorecard <00:19:48.626>scores <00:19:48.781>on, <00:19:48.937>on <00:19:49.092>the <00:19:49.248>dependencies <00:19:49.403>that <00:19:49.559>they <00:19:49.715>use.

516
00:19:51.865 --> 00:19:53.605
<00:19:51.865>The <00:19:52.040>other <00:19:52.215>thing <00:19:52.390>that <00:19:52.565>they <00:19:52.740>also <00:19:52.915>did <00:19:53.090>is <00:19:53.265>they

517
00:19:53.605 --> 00:19:54.645
<00:19:53.605>looked <00:19:53.839>into <00:19:54.073>get <00:19:54.307>commit <00:19:54.541>data.

518
00:19:54.665 --> 00:19:56.085
<00:19:54.665>And <00:19:54.847>this, <00:19:55.030>I <00:19:55.212>think <00:19:55.395>this <00:19:55.577>is <00:19:55.760>pretty <00:19:55.943>cool.

519
00:19:56.625 --> 00:19:59.485
<00:19:56.625>Um, <00:19:56.780>on <00:19:56.936>the <00:19:57.091>left <00:19:57.247>hand <00:19:57.402>side, <00:19:57.558>you <00:19:57.713>see <00:19:57.869>the <00:19:58.025>amount

520
00:19:59.485 --> 00:20:01.125
<00:19:59.485>of <00:20:00.185>contributors, <00:20:00.885>uh,

521
00:20:01.195 --> 00:20:02.645
<00:20:01.195>this <00:20:01.358>is <00:20:01.521>the <00:20:01.684>one <00:20:01.847>I <00:20:02.010>was <00:20:02.173>worried <00:20:02.336>about, <00:20:02.500>right?

522
00:20:02.645 --> 00:20:03.845
<00:20:02.645>More <00:20:02.915>contributors <00:20:03.185>is <00:20:03.455>a <00:20:03.725>risk,

523
00:20:03.905 --> 00:20:06.165
<00:20:03.905>but <00:20:04.045>the <00:20:04.185>left <00:20:04.325>hand <00:20:04.465>side, <00:20:04.605>you <00:20:04.745>see <00:20:04.885>there's <00:20:05.024>a <00:20:05.165>dotted <00:20:05.305>graph,

524
00:20:06.265 --> 00:20:09.285
<00:20:06.265>but <00:20:06.465>the <00:20:06.665>more <00:20:06.865>contributors <00:20:07.065>you <00:20:07.265>have, <00:20:07.465>the <00:20:07.665>likelihood

525
00:20:09.305 --> 00:20:11.085
<00:20:09.305>of <00:20:09.538>a <00:20:09.771>higher <00:20:10.005>score <00:20:10.238>is <00:20:10.471>definitely <00:20:10.705>true.

526
00:20:11.145 --> 00:20:12.805
<00:20:11.145>That's <00:20:11.345>what <00:20:11.545>they <00:20:11.745>saw <00:20:11.945>based <00:20:12.145>on <00:20:12.345>that <00:20:12.545>data.

527
00:20:13.025 --> 00:20:15.845
<00:20:13.025>And <00:20:13.152>this <00:20:13.279>is <00:20:13.406>uh, <00:20:13.534>not, <00:20:13.661>uh, <00:20:13.788>this <00:20:13.915>is <00:20:14.043>GI <00:20:14.170>commit <00:20:14.297>data, <00:20:14.425>right?

528
00:20:16.425 --> 00:20:20.045
<00:20:16.425>The <00:20:16.625>same <00:20:16.825>counts <00:20:17.024>for <00:20:17.225>um, <00:20:17.425>like <00:20:17.625>even <00:20:17.825>uh,

529
00:20:20.045 --> 00:20:21.685
<00:20:20.045>development <00:20:20.395>done <00:20:20.745>by <00:20:21.095>different <00:20:21.445>people.

530
00:20:21.745 --> 00:20:23.365
<00:20:21.745>That's <00:20:21.978>the <00:20:22.211>one <00:20:22.445>in <00:20:22.678>the <00:20:22.911>lower <00:20:23.145>part.

531
00:20:23.665 --> 00:20:25.245
<00:20:23.665>You <00:20:23.945>want <00:20:24.225>to <00:20:24.504>have <00:20:24.784>multiple <00:20:25.065>maintainers

532
00:20:25.265 --> 00:20:27.325
<00:20:25.265>and <00:20:25.420>everybody <00:20:25.576>needs <00:20:25.731>to <00:20:25.887>do <00:20:26.042>an <00:20:26.198>X <00:20:26.353>amount <00:20:26.509>of <00:20:26.665>work

533
00:20:27.345 --> 00:20:28.845
<00:20:27.345>and <00:20:27.615>there's <00:20:27.885>a <00:20:28.155>whole <00:20:28.425>calculation <00:20:28.695>done,

534
00:20:29.225 --> 00:20:30.765
<00:20:29.225>but <00:20:29.502>even <00:20:29.779>if <00:20:30.056>it's <00:20:30.333>evenly <00:20:30.611>balanced

535
00:20:30.785 --> 00:20:31.885
<00:20:30.785>and <00:20:31.032>there's <00:20:31.280>some <00:20:31.527>people <00:20:31.775>involved,

536
00:20:31.885 --> 00:20:32.965
<00:20:31.885>the <00:20:32.047>score <00:20:32.209>will <00:20:32.370>go <00:20:32.533>up <00:20:32.695>as <00:20:32.857>well.

537
00:20:32.965 --> 00:20:35.245
<00:20:32.965>That's <00:20:33.092>good. <00:20:33.219>And <00:20:33.346>the <00:20:33.474>two <00:20:33.601>on <00:20:33.728>the <00:20:33.855>right <00:20:33.983>has <00:20:34.110>to <00:20:34.237>do <00:20:34.365>with

538
00:20:35.785 --> 00:20:37.805
<00:20:35.785>no <00:20:36.065>active <00:20:36.345>development <00:20:36.625>means <00:20:36.905>lower <00:20:37.185>score.

539
00:20:38.145 --> 00:20:41.725
<00:20:38.145>And <00:20:38.320>if <00:20:38.495>there's <00:20:38.670>um, <00:20:38.845>uh, <00:20:39.020>let's <00:20:39.195>see, <00:20:39.370>more <00:20:39.545>activity

540
00:20:41.785 --> 00:20:44.875
<00:20:41.785>or <00:20:42.135>like, <00:20:42.485>um, <00:20:42.835>active <00:20:43.185>repositories

541
00:20:44.895 --> 00:20:47.765
<00:20:44.895>and <00:20:45.095>like <00:20:45.295>more <00:20:45.495>recent <00:20:45.695>activity <00:20:45.895>done <00:20:46.095>on <00:20:46.295>repost

542
00:20:48.075 --> 00:20:49.165
<00:20:48.075>results <00:20:48.402>in <00:20:48.729>better <00:20:49.056>scores.

543
00:20:49.165 --> 00:20:51.405
<00:20:49.165>So <00:20:49.305>I <00:20:49.445>think <00:20:49.585>this <00:20:49.725>is <00:20:49.865>cool. <00:20:50.004>And <00:20:50.145>then <00:20:50.284>at <00:20:50.425>the <00:20:50.565>end

544
00:20:51.405 --> 00:20:52.605
<00:20:51.405>they <00:20:51.764>dissected <00:20:52.125>this <00:20:52.485>vision.

545
00:20:52.605 --> 00:20:54.765
<00:20:52.605>This <00:20:52.712>is <00:20:52.820>a <00:20:52.928>bit <00:20:53.035>of <00:20:53.143>a <00:20:53.251>weird <00:20:53.358>graph, <00:20:53.466>but <00:20:53.574>I <00:20:53.681>wanted <00:20:53.789>to <00:20:53.897>show <00:20:54.005>this.

546
00:20:55.065 --> 00:20:58.285
<00:20:55.065>So <00:20:55.220>if <00:20:55.376>you <00:20:55.531>take <00:20:55.687>all <00:20:55.842>the <00:20:55.998>checks <00:20:56.153>of <00:20:56.309>open <00:20:56.465>scorecard

547
00:20:58.385 --> 00:20:59.685
<00:20:58.385>and <00:20:58.619>then <00:20:58.853>say <00:20:59.087>there's <00:20:59.321>a <00:20:59.554>true

548
00:20:59.685 --> 00:21:01.565
<00:20:59.685>or <00:20:59.860>false <00:21:00.034>to <00:21:00.210>it, <00:21:00.385>you <00:21:00.560>can <00:21:00.735>create <00:21:00.909>this <00:21:01.085>list.

549
00:21:01.825 --> 00:21:04.365
<00:21:01.825>And <00:21:01.941>what <00:21:02.058>it <00:21:02.175>turns <00:21:02.291>out <00:21:02.408>is <00:21:02.525>that <00:21:02.641>the <00:21:02.758>red <00:21:02.875>bar, <00:21:02.991>if <00:21:03.108>it's <00:21:03.225>red,

550
00:21:04.825 --> 00:21:05.845
<00:21:04.825>it <00:21:05.054>means <00:21:05.284>there's <00:21:05.513>a <00:21:05.743>lot

551
00:21:05.845 --> 00:21:08.165
<00:21:05.845>of <00:21:06.078>public <00:21:06.311>vulnerabilities <00:21:06.545>disclosed <00:21:06.778>on <00:21:07.011>the <00:21:07.245>project.

552
00:21:08.345 --> 00:21:10.405
<00:21:08.345>If <00:21:08.545>it's <00:21:08.745>blue, <00:21:08.945>it's <00:21:09.145>in <00:21:09.345>a <00:21:09.545>better <00:21:09.745>shape.

553
00:21:10.405 --> 00:21:14.125
<00:21:10.405>There's <00:21:10.560>nothing <00:21:10.716>happening. <00:21:10.871>If <00:21:11.027>there <00:21:11.182>is <00:21:11.338>an <00:21:11.493>update <00:21:11.649>tool, <00:21:11.805>uh,

554
00:21:14.185 --> 00:21:16.045
<00:21:14.185>if <00:21:14.340>there <00:21:14.496>is <00:21:14.651>no <00:21:14.807>update <00:21:14.962>tool <00:21:15.118>detected <00:21:15.273>in <00:21:15.429>a <00:21:15.585>project,

555
00:21:16.225 --> 00:21:17.885
<00:21:16.225>the <00:21:16.504>likelihood <00:21:16.784>of <00:21:17.064>a <00:21:17.344>vulnerability <00:21:17.625>being

556
00:21:17.885 --> 00:21:19.165
<00:21:17.885>inside <00:21:18.115>of <00:21:18.345>it <00:21:18.576>is <00:21:18.806>high, <00:21:19.037>right?

557
00:21:19.165 --> 00:21:21.365
<00:21:19.165>That's <00:21:19.320>what <00:21:19.476>we <00:21:19.631>see <00:21:19.787>in <00:21:19.942>the <00:21:20.098>first. <00:21:20.253>The <00:21:20.409>second <00:21:20.565>one,

558
00:21:21.365 --> 00:21:23.005
<00:21:21.365>I <00:21:21.540>think <00:21:21.715>this <00:21:21.890>is, <00:21:22.065>this <00:21:22.240>is <00:21:22.415>a <00:21:22.590>cool <00:21:22.765>one.

559
00:21:23.465 --> 00:21:26.165
<00:21:23.465>If <00:21:23.620>there <00:21:23.776>is <00:21:23.931>a <00:21:24.087>security <00:21:24.242>policy <00:21:24.398>defined <00:21:24.553>within <00:21:24.709>a <00:21:24.865>project,

560
00:21:26.705 --> 00:21:29.325
<00:21:26.705>the <00:21:26.845>likelihood <00:21:26.985>of <00:21:27.125>it <00:21:27.264>having <00:21:27.405>a <00:21:27.544>vulnerability <00:21:27.685>is <00:21:27.824>high <00:21:27.965>as <00:21:28.105>well,

561
00:21:29.335 --> 00:21:31.725
<00:21:29.335>which <00:21:29.510>makes <00:21:29.685>sense <00:21:29.860>because <00:21:30.035>people <00:21:30.210>can <00:21:30.385>disclose <00:21:30.560>it, <00:21:30.735>right?

562
00:21:31.945 --> 00:21:33.885
<00:21:31.945>You <00:21:32.120>open <00:21:32.294>the <00:21:32.470>door <00:21:32.645>and <00:21:32.820>allow <00:21:32.995>people <00:21:33.169>to <00:21:33.345>explain

563
00:21:33.885 --> 00:21:35.005
<00:21:33.885>to <00:21:34.053>you <00:21:34.221>like, <00:21:34.389>this <00:21:34.557>is <00:21:34.725>a <00:21:34.893>problem.

564
00:21:35.385 --> 00:21:36.445
<00:21:35.385>And <00:21:35.543>I <00:21:35.703>think <00:21:35.862>that's <00:21:36.021>a <00:21:36.179>good <00:21:36.339>thing.

565
00:21:36.585 --> 00:21:37.765
<00:21:36.585>And <00:21:36.736>if <00:21:36.888>we <00:21:37.040>go <00:21:37.191>to <00:21:37.343>the <00:21:37.495>other, <00:21:37.647>right,

566
00:21:37.865 --> 00:21:40.965
<00:21:37.865>and <00:21:37.992>we <00:21:38.119>will <00:21:38.246>see <00:21:38.374>that <00:21:38.501>there's <00:21:38.628>uh, <00:21:38.755>if <00:21:38.883>you <00:21:39.010>do <00:21:39.137>static <00:21:39.265>analysis,

567
00:21:40.965 --> 00:21:42.005
<00:21:40.965>that <00:21:41.277>will <00:21:41.589>improve, <00:21:41.901>right?

568
00:21:42.225 --> 00:21:44.725
<00:21:42.225>It <00:21:42.380>will <00:21:42.536>be <00:21:42.691>less <00:21:42.847>vulnerabilities <00:21:43.002>found. <00:21:43.158>So <00:21:43.313>this <00:21:43.469>is <00:21:43.625>cool.

569
00:21:44.725 --> 00:21:46.245
<00:21:44.725>There's <00:21:45.067>a <00:21:45.408>lot <00:21:45.751>more <00:21:46.092>statistics

570
00:21:46.245 --> 00:21:47.405
<00:21:46.245>and <00:21:46.394>there's <00:21:46.543>a <00:21:46.692>lot <00:21:46.841>more <00:21:46.990>to <00:21:47.139>dig <00:21:47.289>into

571
00:21:47.425 --> 00:21:49.085
<00:21:47.425>and <00:21:47.625>I <00:21:47.825>have <00:21:48.024>not <00:21:48.225>got <00:21:48.425>plenty <00:21:48.625>of <00:21:48.825>time.

572
00:21:49.725 --> 00:21:51.445
<00:21:49.725>I <00:21:49.880>was <00:21:50.036>telling <00:21:50.191>a <00:21:50.347>bit <00:21:50.502>like, <00:21:50.658>Hey, <00:21:50.813>are <00:21:50.969>there <00:21:51.125>areas

573
00:21:51.455 --> 00:21:52.645
<00:21:51.455>where <00:21:51.669>I <00:21:51.883>think <00:21:52.097>we <00:21:52.311>can <00:21:52.526>improve?

574
00:21:52.645 --> 00:21:55.565
<00:21:52.645>And <00:21:52.785>I <00:21:52.925>think <00:21:53.065>there <00:21:53.205>is, <00:21:53.345>if <00:21:53.485>you <00:21:53.625>look <00:21:53.764>at <00:21:53.905>fuzzing, <00:21:54.045>um,

575
00:21:56.405 --> 00:21:58.005
<00:21:56.405>I <00:21:56.580>think <00:21:56.754>the, <00:21:56.930>the <00:21:57.105>the <00:21:57.280>key <00:21:57.455>thing <00:21:57.629>we <00:21:57.805>need

576
00:21:58.005 --> 00:22:00.925
<00:21:58.005>to <00:21:58.180>look <00:21:58.355>into <00:21:58.530>is <00:21:58.705>focus <00:21:58.880>on <00:21:59.055>coverage <00:21:59.230>based <00:21:59.405>foing.

577
00:22:00.925 --> 00:22:02.725
<00:22:00.925>Meaning <00:22:01.100>that <00:22:01.274>you <00:22:01.450>need <00:22:01.625>to <00:22:01.800>use <00:22:01.975>a <00:22:02.149>library <00:22:02.325>as

578
00:22:02.745 --> 00:22:04.405
<00:22:02.745>how <00:22:02.919>it <00:22:03.094>would <00:22:03.270>be <00:22:03.445>used <00:22:03.620>in <00:22:03.794>the <00:22:03.969>app, <00:22:04.145>right?

579
00:22:04.985 --> 00:22:07.925
<00:22:04.985>And <00:22:05.101>in <00:22:05.218>this <00:22:05.334>case, <00:22:05.451>um, <00:22:05.568>this <00:22:05.685>is <00:22:05.801>a <00:22:05.918>a <00:22:06.034>do <00:22:06.151>net <00:22:06.268>snippet, <00:22:06.385>right?

580
00:22:07.925 --> 00:22:09.245
<00:22:07.925>Because <00:22:08.094>I'm <00:22:08.264>a <00:22:08.434>DO <00:22:08.603>net <00:22:08.773>guy, <00:22:08.943>I'm <00:22:09.112>sorry,

581
00:22:09.505 --> 00:22:12.005
<00:22:09.505>but <00:22:09.660>this <00:22:09.816>will <00:22:09.971>look <00:22:10.127>into <00:22:10.282>a <00:22:10.438>JS <00:22:10.593>ON <00:22:10.749>decentralization <00:22:10.905>action

582
00:22:12.025 --> 00:22:14.685
<00:22:12.025>and <00:22:12.141>this <00:22:12.258>is <00:22:12.375>a <00:22:12.491>test <00:22:12.608>bench <00:22:12.725>and <00:22:12.841>you <00:22:12.958>put <00:22:13.075>the <00:22:13.191>app <00:22:13.308>on <00:22:13.425>it

583
00:22:14.825 --> 00:22:16.245
<00:22:14.825>and <00:22:14.984>then <00:22:15.144>the <00:22:15.304>FSS <00:22:15.464>will <00:22:15.623>do <00:22:15.783>all <00:22:15.943>the <00:22:16.102>work.

584
00:22:16.505 --> 00:22:19.005
<00:22:16.505>It <00:22:16.645>would <00:22:16.785>be <00:22:16.925>nice <00:22:17.065>if <00:22:17.205>we're <00:22:17.345>able <00:22:17.485>to <00:22:17.625>recognize <00:22:17.765>these <00:22:17.905>types

585
00:22:19.005 --> 00:22:21.085
<00:22:19.005>of <00:22:19.205>FOSS <00:22:19.405>because <00:22:19.605>these <00:22:19.805>are <00:22:20.005>high <00:22:20.205>quality <00:22:20.405>foss.

586
00:22:21.085 --> 00:22:22.925
<00:22:21.085>If <00:22:21.285>they're <00:22:21.485>done <00:22:21.685>and <00:22:21.885>if <00:22:22.085>then <00:22:22.285>the <00:22:22.485>output

587
00:22:22.925 --> 00:22:24.085
<00:22:22.925>is <00:22:23.186>being <00:22:23.447>produced, <00:22:23.708>that's <00:22:23.969>cool.

588
00:22:24.785 --> 00:22:26.325
<00:22:24.785>And <00:22:25.016>even <00:22:25.247>to <00:22:25.478>throw <00:22:25.709>in <00:22:25.940>some <00:22:26.171>ai,

589
00:22:26.325 --> 00:22:27.805
<00:22:26.325>there's <00:22:26.658>a <00:22:26.991>project <00:22:27.324>called <00:22:27.657>matic,

590
00:22:27.805 --> 00:22:29.245
<00:22:27.805>which <00:22:28.021>is <00:22:28.237>part <00:22:28.453>of <00:22:28.668>the <00:22:28.885>rust <00:22:29.101>ecosystem.

591
00:22:29.635 --> 00:22:32.165
<00:22:29.635>They <00:22:29.790>use <00:22:29.946>an <00:22:30.101>LLM <00:22:30.257>to <00:22:30.412>generate <00:22:30.568>test <00:22:30.723>cases <00:22:30.879>for <00:22:31.035>you.

592
00:22:32.165 --> 00:22:34.285
<00:22:32.165>And <00:22:32.305>this <00:22:32.445>is <00:22:32.585>good <00:22:32.725>uses <00:22:32.865>of <00:22:33.004>an <00:22:33.145>LLM <00:22:33.284>for <00:22:33.425>sure, <00:22:33.565>right?

593
00:22:34.505 --> 00:22:37.325
<00:22:34.505>Having <00:22:34.660>you <00:22:34.816>explain <00:22:34.971>code <00:22:35.127>like <00:22:35.282>s <00:22:35.438>Julian <00:22:35.593>showed <00:22:35.749>like, <00:22:35.905>Hey,

594
00:22:37.365 --> 00:22:38.445
<00:22:37.365>I <00:22:37.608>want <00:22:37.851>to <00:22:38.094>understand <00:22:38.337>this.

595
00:22:38.625 --> 00:22:40.725
<00:22:38.625>You <00:22:38.752>can <00:22:38.879>do <00:22:39.006>the <00:22:39.134>same <00:22:39.261>with <00:22:39.388>test <00:22:39.515>cases. <00:22:39.643>I <00:22:39.770>think <00:22:39.897>that's <00:22:40.025>cool.

596
00:22:41.355 --> 00:22:43.215
<00:22:41.355>The <00:22:41.588>same <00:22:41.821>counts <00:22:42.055>for <00:22:42.288>static <00:22:42.521>analysis, <00:22:42.755>right?

597
00:22:43.555 --> 00:22:47.295
<00:22:43.555>If <00:22:43.730>we <00:22:43.905>look <00:22:44.080>into <00:22:44.255>this <00:22:44.430>deep <00:22:44.605>of <00:22:44.780>this <00:22:44.955>code,

598
00:22:47.355 --> 00:22:48.575
<00:22:47.355>we <00:22:47.574>see <00:22:47.794>that <00:22:48.013>that's <00:22:48.233>one <00:22:48.453>problem.

599
00:22:48.745 --> 00:22:52.215
<00:22:48.745>It'll <00:22:48.900>probably <00:22:49.056>flag <00:22:49.211>the <00:22:49.367>share <00:22:49.522>one, <00:22:49.678>but <00:22:49.833>even <00:22:49.989>a <00:22:50.145>linter

600
00:22:52.215 --> 00:22:53.775
<00:22:52.215>or <00:22:52.389>a <00:22:52.564>compiler <00:22:52.740>could <00:22:52.915>tell <00:22:53.090>you <00:22:53.264>this <00:22:53.439>is <00:22:53.615>a

601
00:22:53.775 --> 00:22:54.815
<00:22:53.775>wrong <00:22:54.009>thing <00:22:54.243>to <00:22:54.477>do, <00:22:54.711>right?

602
00:22:55.395 --> 00:22:57.455
<00:22:55.395>We <00:22:55.628>want <00:22:55.861>to <00:22:56.095>have <00:22:56.328>data <00:22:56.561>flow <00:22:56.795>based

603
00:22:57.775 --> 00:22:58.935
<00:22:57.775>analysis, <00:22:57.924>and <00:22:58.073>this <00:22:58.222>is <00:22:58.371>what <00:22:58.520>I'm <00:22:58.669>showing <00:22:58.819>you.

604
00:22:58.935 --> 00:23:02.495
<00:22:58.935>So <00:22:59.075>this <00:22:59.215>is <00:22:59.355>a, <00:22:59.495>a, <00:22:59.635>a <00:22:59.774>controller <00:22:59.915>ASP <00:23:00.054>net <00:23:00.195>MVC <00:23:00.335>controller

605
00:23:02.495 --> 00:23:05.055
<00:23:02.495>that <00:23:02.669>gets <00:23:02.844>exposed, <00:23:03.020>but <00:23:03.195>the <00:23:03.370>data <00:23:03.544>that <00:23:03.719>comes <00:23:03.895>in

606
00:23:05.055 --> 00:23:07.975
<00:23:05.055>with <00:23:05.195>customer <00:23:05.335>is <00:23:05.475>used <00:23:05.615>into <00:23:05.755>the <00:23:05.895>report <00:23:06.035>that <00:23:06.175>is <00:23:06.315>then <00:23:06.455>used

607
00:23:07.975 --> 00:23:09.495
<00:23:07.975>to <00:23:08.203>open <00:23:08.430>a <00:23:08.658>file <00:23:08.887>on <00:23:09.114>the <00:23:09.342>system.

608
00:23:09.875 --> 00:23:12.175
<00:23:09.875>And <00:23:10.030>that's <00:23:10.186>the <00:23:10.341>static <00:23:10.497>analysis <00:23:10.652>that <00:23:10.808>really <00:23:10.963>hurt <00:23:11.119>your <00:23:11.275>app

609
00:23:12.175 --> 00:23:14.135
<00:23:12.175>because <00:23:12.455>that's <00:23:12.735>a <00:23:13.014>file <00:23:13.294>problem, <00:23:13.575>right?

610
00:23:14.595 --> 00:23:16.295
<00:23:14.595>And <00:23:14.750>these <00:23:14.906>are <00:23:15.061>the <00:23:15.217>things <00:23:15.372>we <00:23:15.528>need <00:23:15.683>to <00:23:15.839>focus <00:23:15.995>on

611
00:23:16.355 --> 00:23:17.975
<00:23:16.355>and <00:23:16.635>not <00:23:16.915>only <00:23:17.195>presence <00:23:17.475>of <00:23:17.755>tools.

612
00:23:17.995 --> 00:23:19.295
<00:23:17.995>And <00:23:18.189>you <00:23:18.385>need <00:23:18.580>to <00:23:18.775>understand <00:23:18.970>the <00:23:19.165>library,

613
00:23:19.475 --> 00:23:20.935
<00:23:19.475>as <00:23:19.694>I <00:23:19.913>said <00:23:20.131>before <00:23:20.351>with <00:23:20.570>the <00:23:20.789>skeleton.

614
00:23:23.275 --> 00:23:26.135
<00:23:23.275>The <00:23:23.475>other <00:23:23.675>thing <00:23:23.875>I <00:23:24.075>mentioned <00:23:24.275>is, <00:23:24.475>uh, <00:23:24.675>reproducibility,

615
00:23:26.325 --> 00:23:28.655
<00:23:26.325>it's <00:23:26.500>key <00:23:26.675>to <00:23:26.850>be <00:23:27.025>able <00:23:27.200>to <00:23:27.375>rebuild <00:23:27.550>a <00:23:27.725>package

616
00:23:28.835 --> 00:23:29.975
<00:23:28.835>and <00:23:29.091>have <00:23:29.348>exactly <00:23:29.604>the <00:23:29.860>same

617
00:23:29.975 --> 00:23:31.655
<00:23:29.975>because <00:23:30.208>then <00:23:30.441>you <00:23:30.675>have <00:23:30.908>to <00:23:31.141>guarantee <00:23:31.375>that

618
00:23:31.675 --> 00:23:34.215
<00:23:31.675>that's <00:23:31.850>the <00:23:32.024>binary <00:23:32.200>you're <00:23:32.375>using <00:23:32.550>and <00:23:32.725>inside <00:23:32.899>your <00:23:33.075>app.

619
00:23:34.635 --> 00:23:37.375
<00:23:34.635>And <00:23:34.810>there's <00:23:34.985>a <00:23:35.160>real <00:23:35.335>good <00:23:35.510>source <00:23:35.685>on <00:23:35.860>reproducible <00:23:36.035>bills.org

620
00:23:37.375 --> 00:23:38.895
<00:23:37.375>that <00:23:37.603>will <00:23:37.831>have <00:23:38.059>tools <00:23:38.287>for <00:23:38.514>you <00:23:38.743>available

621
00:23:38.895 --> 00:23:41.895
<00:23:38.895>because <00:23:39.035>you <00:23:39.175>maybe <00:23:39.315>want <00:23:39.455>to <00:23:39.595>do <00:23:39.735>diffing <00:23:39.875>at <00:23:40.014>a <00:23:40.155>lower <00:23:40.295>level.

622
00:23:42.275 --> 00:23:44.815
<00:23:42.275>You <00:23:42.475>should <00:23:42.675>look <00:23:42.875>into <00:23:43.075>this. <00:23:43.275>And <00:23:43.475>uh, <00:23:43.675>one

623
00:23:44.815 --> 00:23:46.485
<00:23:44.815>of <00:23:44.990>the <00:23:45.165>other <00:23:45.340>projects <00:23:45.515>I <00:23:45.690>think <00:23:45.865>is <00:23:46.040>really <00:23:46.215>cool

624
00:23:46.505 --> 00:23:48.125
<00:23:46.505>and <00:23:46.705>we're <00:23:46.905>getting <00:23:47.105>close <00:23:47.305>to <00:23:47.505>the <00:23:47.705>end <00:23:47.905>is

625
00:23:48.125 --> 00:23:49.165
<00:23:48.125>something <00:23:48.437>called <00:23:48.749>App <00:23:49.061>inspector.

626
00:23:49.225 --> 00:23:51.405
<00:23:49.225>And <00:23:49.365>I'm <00:23:49.504>still <00:23:49.645>keen <00:23:49.784>on <00:23:49.925>creating <00:23:50.064>a <00:23:50.205>new <00:23:50.344>version <00:23:50.485>of <00:23:50.625>this,

627
00:23:51.425 --> 00:23:54.245
<00:23:51.425>but <00:23:51.580>what <00:23:51.736>this <00:23:51.891>does, <00:23:52.047>it <00:23:52.202>looks <00:23:52.358>into <00:23:52.513>a <00:23:52.669>code <00:23:52.825>base.

628
00:23:54.275 --> 00:23:55.565
<00:23:54.275>This <00:23:54.507>is <00:23:54.739>tool <00:23:54.971>you <00:23:55.203>can <00:23:55.436>download

629
00:23:55.785 --> 00:23:57.965
<00:23:55.785>and <00:23:55.960>it <00:23:56.135>will <00:23:56.310>then <00:23:56.485>tell <00:23:56.660>you <00:23:56.835>what's <00:23:57.010>happening <00:23:57.185>inside.

630
00:23:58.305 --> 00:23:59.525
<00:23:58.305>So <00:23:58.671>this <00:23:59.037>uses <00:23:59.403>authentication,

631
00:23:59.525 --> 00:24:01.325
<00:23:59.525>this <00:23:59.991>uses <00:24:00.458>authorization <00:24:00.925>cryptography,

632
00:24:01.865 --> 00:24:03.405
<00:24:01.865>and <00:24:02.142>then <00:24:02.419>you <00:24:02.696>could <00:24:02.973>question <00:24:03.251>yourself,

633
00:24:03.735 --> 00:24:06.725
<00:24:03.735>would <00:24:03.862>I <00:24:03.989>expect <00:24:04.116>a <00:24:04.244>library <00:24:04.371>to <00:24:04.498>do <00:24:04.625>this <00:24:04.753>kind <00:24:04.880>of <00:24:05.007>things, <00:24:05.135>right?

634
00:24:07.345 --> 00:24:09.565
<00:24:07.345>Or <00:24:07.485>is <00:24:07.625>it <00:24:07.765>not <00:24:07.905>needed? <00:24:08.045>I <00:24:08.185>think <00:24:08.325>that's <00:24:08.465>the <00:24:08.605>key <00:24:08.745>thing.

635
00:24:09.625 --> 00:24:11.685
<00:24:09.625>So <00:24:09.858>having <00:24:10.091>some <00:24:10.325>sense <00:24:10.558>of <00:24:10.791>what's <00:24:11.025>inside,

636
00:24:11.685 --> 00:24:13.205
<00:24:11.685>this <00:24:11.856>is <00:24:12.027>a <00:24:12.197>tool <00:24:12.369>that's <00:24:12.540>gonna <00:24:12.711>help <00:24:12.881>you <00:24:13.053>out.

637
00:24:13.665 --> 00:24:16.685
<00:24:13.665>Um, <00:24:13.781>and, <00:24:13.898>and <00:24:14.014>if <00:24:14.131>you <00:24:14.248>look <00:24:14.365>at <00:24:14.481>my <00:24:14.598>NIC <00:24:14.715>tooling, <00:24:14.831>I'm, <00:24:14.948>I'm, <00:24:15.065>I'm,

638
00:24:16.705 --> 00:24:17.925
<00:24:16.705>I'm <00:24:16.979>keen <00:24:17.254>on <00:24:17.528>creating <00:24:17.803>similar

639
00:24:17.925 --> 00:24:19.045
<00:24:17.925>things <00:24:18.177>that <00:24:18.429>will <00:24:18.681>have <00:24:18.933>statistics.

640
00:24:19.065 --> 00:24:21.405
<00:24:19.065>You <00:24:19.345>already <00:24:19.625>can <00:24:19.905>dump <00:24:20.185>APIs <00:24:20.465>of.net,

641
00:24:21.625 --> 00:24:23.045
<00:24:21.625>but <00:24:21.838>this <00:24:22.051>will <00:24:22.264>be <00:24:22.477>the <00:24:22.690>next <00:24:22.903>thing.

642
00:24:23.625 --> 00:24:26.005
<00:24:23.625>And <00:24:23.765>the <00:24:23.905>other <00:24:24.045>thing <00:24:24.185>that <00:24:24.325>I <00:24:24.465>looked <00:24:24.605>into, <00:24:24.745>which <00:24:24.885>is <00:24:25.025>something

643
00:24:26.005 --> 00:24:28.965
<00:24:26.005>that, <00:24:26.180>uh, <00:24:26.355>rust <00:24:26.530>Ecosystem <00:24:26.705>is <00:24:26.880>doing <00:24:27.055>called <00:24:27.230>Cargo <00:24:27.405>Vet.

644
00:24:29.425 --> 00:24:31.925
<00:24:29.425>And <00:24:29.600>this <00:24:29.774>is <00:24:29.950>a <00:24:30.125>project <00:24:30.300>that's <00:24:30.475>community <00:24:30.649>reviewing <00:24:30.825>packages

645
00:24:31.925 --> 00:24:33.285
<00:24:31.925>and <00:24:32.129>then <00:24:32.333>sharing <00:24:32.537>the <00:24:32.741>data <00:24:32.945>with <00:24:33.149>everybody.

646
00:24:33.305 --> 00:24:35.285
<00:24:33.305>And <00:24:33.445>this <00:24:33.585>is <00:24:33.725>cool, <00:24:33.865>right? <00:24:34.005>This <00:24:34.145>is <00:24:34.285>the <00:24:34.425>power <00:24:34.565>of <00:24:34.705>community.

647
00:24:35.785 --> 00:24:37.765
<00:24:35.785>Um, <00:24:35.940>I <00:24:36.096>would <00:24:36.251>love <00:24:36.407>to <00:24:36.562>see <00:24:36.718>similar <00:24:36.873>things <00:24:37.029>in <00:24:37.185>different

648
00:24:37.765 --> 00:24:39.165
<00:24:37.765>ecosystems, <00:24:39.025>especially.net,

649
00:24:39.165 --> 00:24:41.725
<00:24:39.165>but <00:24:39.320>Cargo <00:24:39.476>is <00:24:39.631>definitely <00:24:39.787>on <00:24:39.942>the <00:24:40.098>best <00:24:40.253>track <00:24:40.409>on <00:24:40.565>that.

650
00:24:42.065 --> 00:24:45.525
<00:24:42.065>So <00:24:42.265>with <00:24:42.465>59 <00:24:42.665>seconds <00:24:42.865>left, <00:24:43.065>let's <00:24:43.265>wrap <00:24:43.465>up.

651
00:24:45.585 --> 00:24:47.725
<00:24:45.585>Um, <00:24:45.818>I <00:24:46.051>think <00:24:46.285>scorecard <00:24:46.518>helps <00:24:46.751>out, <00:24:46.985>right?

652
00:24:48.175 --> 00:24:50.885
<00:24:48.175>Especially <00:24:48.302>if <00:24:48.429>you <00:24:48.556>have <00:24:48.684>a <00:24:48.811>tool <00:24:48.938>to <00:24:49.065>be <00:24:49.193>able <00:24:49.320>to <00:24:49.447>grab <00:24:49.575>stuff

653
00:24:50.905 --> 00:24:52.525
<00:24:50.905>and <00:24:51.138>see <00:24:51.371>the <00:24:51.605>status <00:24:51.838>quo <00:24:52.071>of <00:24:52.305>projects.

654
00:24:52.525 --> 00:24:54.765
<00:24:52.525>You <00:24:52.652>can <00:24:52.779>look <00:24:52.906>into <00:24:53.034>the <00:24:53.161>stuff <00:24:53.288>that <00:24:53.415>matters <00:24:53.543>the <00:24:53.670>most <00:24:53.797>to <00:24:53.925>you

655
00:24:55.145 --> 00:24:56.485
<00:24:55.145>and <00:24:55.295>you <00:24:55.446>could <00:24:55.597>use <00:24:55.748>it <00:24:55.898>for <00:24:56.049>your <00:24:56.200>own <00:24:56.351>benefit,

656
00:24:57.105 --> 00:24:58.525
<00:24:57.105>but <00:24:57.247>it <00:24:57.389>should <00:24:57.531>not <00:24:57.673>be <00:24:57.815>a <00:24:57.957>goal <00:24:58.099>on <00:24:58.241>its <00:24:58.383>own.

657
00:24:59.305 --> 00:25:01.365
<00:24:59.305>And <00:24:59.480>I <00:24:59.655>definitely <00:24:59.830>agree <00:25:00.005>that <00:25:00.180>there's <00:25:00.355>room <00:25:00.530>for <00:25:00.705>improvement

658
00:25:01.365 --> 00:25:04.525
<00:25:01.365>for <00:25:01.481>tools, <00:25:01.598>how <00:25:01.715>you <00:25:01.831>can <00:25:01.948>use, <00:25:02.065>I <00:25:02.181>want <00:25:02.298>to <00:25:02.415>have <00:25:02.531>a <00:25:02.648>trust <00:25:02.765>graph.

659
00:25:04.625 --> 00:25:06.485
<00:25:04.625>You <00:25:04.905>saw <00:25:05.185>the <00:25:05.465>transitive <00:25:05.745>three <00:25:06.025>before.

660
00:25:06.985 --> 00:25:09.525
<00:25:06.985>It <00:25:07.101>would <00:25:07.218>be <00:25:07.334>nice <00:25:07.451>if <00:25:07.568>you <00:25:07.685>see <00:25:07.801>the <00:25:07.918>scores <00:25:08.034>of <00:25:08.151>all <00:25:08.268>your <00:25:08.385>packages

661
00:25:09.525 --> 00:25:11.525
<00:25:09.525>with, <00:25:09.805>with <00:25:10.085>the <00:25:10.365>transitive <00:25:10.645>three <00:25:10.925>displayed

662
00:25:11.525 --> 00:25:12.925
<00:25:11.525>as <00:25:11.840>well, <00:25:12.155>working <00:25:12.470>on <00:25:12.784>that.

663
00:25:13.025 --> 00:25:15.085
<00:25:13.025>That's <00:25:13.258>gonna <00:25:13.491>be <00:25:13.725>cool. <00:25:13.958>And <00:25:14.191>it's <00:25:14.425>good

664
00:25:15.085 --> 00:25:17.565
<00:25:15.085>to <00:25:15.260>always <00:25:15.435>also <00:25:15.610>contribute <00:25:15.785>back <00:25:15.960>to <00:25:16.135>the <00:25:16.310>project, <00:25:16.485>right?

665
00:25:17.565 --> 00:25:18.685
<00:25:17.565>So <00:25:17.733>that's <00:25:17.901>one <00:25:18.069>of <00:25:18.237>the <00:25:18.405>other <00:25:18.572>goals.

666
00:25:19.465 --> 00:25:22.205
<00:25:19.465>So <00:25:19.605>with <00:25:19.745>22 <00:25:19.885>seconds <00:25:20.024>left, <00:25:20.165>I <00:25:20.304>don't <00:25:20.445>think <00:25:20.584>there's <00:25:20.725>much <00:25:20.865>time

667
00:25:22.205 --> 00:25:24.005
<00:25:22.205>for <00:25:22.360>questions, <00:25:22.516>but <00:25:22.671>I <00:25:22.827>do <00:25:22.982>want <00:25:23.138>to <00:25:23.293>share <00:25:23.449>the <00:25:23.605>links.

668
00:25:24.425 --> 00:25:25.965
<00:25:24.425>The <00:25:24.702>top <00:25:24.979>one <00:25:25.256>is <00:25:25.533>the <00:25:25.811>repo.

669
00:25:26.385 --> 00:25:28.405
<00:25:26.385>If <00:25:26.618>you <00:25:26.851>go <00:25:27.085>to <00:25:27.318>the <00:25:27.551>slides <00:25:27.785>directory,

670
00:25:28.405 --> 00:25:30.085
<00:25:28.405>you <00:25:28.685>will <00:25:28.965>have <00:25:29.245>the <00:25:29.524>normal <00:25:29.805>ones

671
00:25:30.105 --> 00:25:31.925
<00:25:30.105>and <00:25:30.232>the <00:25:30.359>ones <00:25:30.486>that <00:25:30.614>has <00:25:30.741>notes <00:25:30.868>in <00:25:30.995>it <00:25:31.123>with <00:25:31.250>all <00:25:31.377>the <00:25:31.505>links.

672
00:25:32.345 --> 00:25:34.765
<00:25:32.345>You <00:25:32.472>can <00:25:32.599>reach <00:25:32.726>me <00:25:32.854>on <00:25:32.981>my <00:25:33.108>email <00:25:33.235>or <00:25:33.363>on, <00:25:33.490>I'm <00:25:33.617>on <00:25:33.745>methadone.

673
00:25:35.145 --> 00:25:38.045
<00:25:35.145>Um, <00:25:35.300>and <00:25:35.456>otherwise <00:25:35.611>there's <00:25:35.767>my <00:25:35.922>two <00:25:36.078>blog <00:25:36.233>posts, <00:25:36.389>uh, <00:25:36.545>websites.

674
00:25:38.105 --> 00:25:40.845
<00:25:38.105>Uh, <00:25:38.245>and <00:25:38.385>yeah, <00:25:38.525>with <00:25:38.665>that <00:25:38.805>said, <00:25:38.945>I'm <00:25:39.085>gonna <00:25:39.225>say <00:25:39.365>thank <00:25:39.505>you.

675
00:25:40.855 --> 00:25:42.125
<00:25:40.855>Enjoy <00:25:41.083>the <00:25:41.312>rest <00:25:41.540>of <00:25:41.769>the <00:25:41.998>conference

676
00:25:42.185 --> 00:25:44.525
<00:25:42.185>and <00:25:42.325>I'm <00:25:42.465>gonna <00:25:42.605>be <00:25:42.745>around <00:25:42.885>here <00:25:43.024>at <00:25:43.165>stage <00:25:43.304>for <00:25:43.445>any <00:25:43.585>questions.

677
00:25:44.655 --> 00:25:45.085
<00:25:44.655>Thank <00:25:45.042>you.