Vulnerability disclosures WG meeting 11/16/2020

[MarcinHoppe]

Time

Monday November 16th, 2020 4:00 PM GMT / 8:00 AM Pacific

Links

• Zoom link: https://auth0.zoom.us/j/96101652486?pwd=SXNJaE1yK1hGd0ZaRHJZQW1RZG4zdz09

The invite is also available on the OpenSSF Community Calendar.

Agenda

• @knqyf263: Embed CPE names into binaries (Embed CPE names into binaries #76)
• Art, Emily, and @RedHatCRob: CERT/CC VINCE
• @stevespringett CycloneDX support for vulnerability disclosure and remediation

Notes

• Google Doc with meeting minutes

[itaysk]

you could update that the presenter is @knqyf263 , and some context here: #76

[MarcinHoppe]

@itaysk Done, thanks for the update!

[dcmiddle]

Topic: Opportunity to discuss vuln reporting with another open source project to get a feel for requirements. (discussed briefly on slack as well)

[MarcinHoppe]

Topic: Opportunity to discuss vuln reporting with another open source project to get a feel for requirements. (discussed briefly on slack as well)

We discussed this briefly in the meeting and @dcmiddle created #77 to move the discussion forward.

[rarkins]

I had to drop a little early and missed the last presentation. Is the recording available for viewing?

[MarcinHoppe]

Yes: https://www.youtube.com/watch?v=7LN5ytkkJ2M.

I will add a link to the meeting minutes later on.