Yes, you can go ahead and jump right on into it. To everyone out there, to our ongoing election coverage by town meeting television, my name is Helen Morgan Parmet, and I'm the Edwin W. Lawrence Professor of Speech and Associate Professor in the Department of English up at the University of Vermont. And tonight, I'll be your moderator of this election forum. So this is one of many forums we're bringing you in advance of local elections and town meeting on the first Tuesday in March, which this year is March 1st, 2022. Now town meeting is traditionally where voters weigh in on local government representation, municipal budgets, school budgets, and local election forums. Town meeting TV election forums introduce you to community decision makers and connect you with the issues that shape your local community. So if you're watching this live, this event live, we welcome your questions. You can give us a call at<PHONE_NUMBER>. And you can also watch town meeting TV on Comcast channel 1087, Burlington Telecom channel 17 and 217, as well as online at town meeting TV's YouTube page. So I'll introduce you to the candidates, the incumbent Megan Emery and Chris Trombly in the South Burlington City Council election. And so each candidate is going to have two minutes to give their opening statement and give their kind of overview of their, of their, why they're running and their positions. So we're going to start with the incumbent Megan Emery. Go ahead when you're ready. Well, thank you very much, Helen. I'm very glad to be here tonight. And I'm a huge supporter of channel 17. So my name is Megan Emery and I have served for 12 years on the South Burlington City Council. And I have lived in South Burlington now for 20 years. And the University of Vermont brought us here. My husband and I arrived in 2002 with two little boys. We now have three children and we have raised all three here two are in their 20s and we have an 11 year old. And we deeply value the school system and the community that is so strong in South Burlington. I got into the community when I, you know, had my sons at the public school Chamberlain Elementary, which is just two blocks from my house. And I was involved in the PTO and introducing foreign language after school programs. And it became quite clear that the city was, was eager to have more control over the city budgets. There had been a referendum to that effect. And I became involved in the charter review committee. And I was appointed there. And after serving for a year, a counselor urged me to run and thought about it and decided I care deeply and I will do so. So I ran for the first time in 2008 and I did win. And my priorities then are my priorities today that is affordability, quality of life, conservation of our open spaces, fiscal and environmental sustainability. I care very deeply about the city. We have worked diligently to reach our community goals. And I know that we are a leader in the state and I will work, I will continue to work in order for us to remain. So thank you. Thanks so much for that, Megan. We'll turn it over to Chris Trompley. Well, good evening, Helen. Good evening, Megan. Glad to be here with you. I think it's the first time that we've been gonna spend together and discuss the city's future. So I'm excited to have this discussion tonight and to continue that discussion of the town meeting day. You know, I got involved with this race when I moved into South Burlington. One of the first opportunities was to join the citizen budget advisory committee at the school. Got to know some great volunteers and get more involved with my school. My children, my two sons also attend Chamberlain and we're very satisfied with the education that we're receiving here. It's one of the reasons that I chose here. I quickly pursued an opportunity for the affordable housing committee where I currently serve as chair for two terms now. Statewide, I'm also a board commissioner for the Vermont State Housing Authority. Vice chair for the board of civil authority and a treasurer on other nonprofits. So service to my community is a priority for me. You know, I think some of the priorities, you know, for this campaign is really going to be affordability focused, balanced leadership, common sense priorities and fiscal responsibility, you know, and it's really fulfilling that vision for South Burlington residents so that they can have a great place to afford a home, pursue a work path, raise a family and enjoy their golden years here. So I look forward to your support on town meeting day and I'm encouraged for this discussion this evening. So thank you. All right, thanks so much for that. So we're gonna jump into questions and just a reminder that if you're watching at home, you can give us a call at<PHONE_NUMBER> and ask your own questions. And until we get a call or I'll just jump right in. And so one of the big issues in South Burlington is housing and growth especially. So South Burlington's facing a lot of pressure as the natural housing site for Chittenden County residents alongside efforts to conserve open space. So what do you see as the guiding principle to manage these conflicting pressures? And I'll let you go first, Chris. Sure, thank you. So as a committee, we have shared values for clean air, clean water, being an inclusive and welcoming community but we're also a growing community. Since our last census, you know, we've expanded up to 20,000 residents and we're feeling that push and pull and tug. And it's something that as a community, we're trying to find out. So, you know, we can't have a robust improvement and meaningful change without that democracy where we're here bottom up from residents about the changes that they wanna see. Early adopter of Article 12 changes that explain that our floodplains conserved a lot of our land, you know, those are state leading changes and you know, we don't wanna see us move backwards on that. And so as we think about where do we go and where do we grow? Some of the things that we should be talking about is where do we build out for our city center along our transit corridors? You know, we hear that we wanna see more about the redevelopment space at University of Mall. There is upcoming opportunity where we might have a new purchaser and with that opportunity, we can revision that area so that it can be mixed use where we can leverage both commercial revenue, sales tax dollars and mixed use housing. The vision for our community center is that we'll be able to continue that build out in that area where it's transit oriented. One of the things we don't talk about with affordable housing or just housing affordable in general is also the network of alternative transportation that will be required to support that. So as we wanna target our emission goals, how do we get more people out of cars and on the bikes or rolling a different way? So that's our housing strategy and if we wanna get into nuance, look forward to that. All right, Megan, what are your thoughts about balancing housing and conservation? Yeah, well, what Chris said, I definitely agree with. And so I'll focus on where we differ. He says that he supports the protection of our natural resources and most of our natural resources are currently protected in fact, the current land development regulations only extend them by a few percentage points. What it does do though, is that it makes sure that there is not encroachment on them. It really specifies what land is billable and what land is to be conserved so that there is no question. And I think that where we differ and perhaps Chris's views have changed, we have talked about our views and our vision for the city, is that I see that it is important for us to use different tools as a priority in order to expand our affordable housing throughout the city, including U-Mall, we hope that that will be the case, but also into open lands that have currently been the hotly debated topic. And Chris's is a huge proponent of inclusionary zoning. I am a proponent of inclusionary zoning. I see it as one tool however. Our city center currently has over 200 perpetually affordable homes and it's not because of inclusionary zoning, it's because we have grants, federal grants and state grants. We are in a unique opportunity here where we have grants. Governor has dedicated $240 million at least to affordable housing. We can use those grants to make more affordable homes than inclusionary zoning would allow. And the catch about inclusionary zoning is that you have to build at least 12 homes to have one owner occupied home, one, okay? Whereas if you want more than 200, that adds up to a lot of homes. Thank you very much, I know I'm out of time. There's a lot more to be said on this topic. Yeah, I mean, this is a really complicated one. I think one of the reasons why we started here is I think this is maybe like the big issue in South Burlington right now. Chris, I just wanna give you a quick 30 seconds to just maybe respond to what Megan was saying since she's sort of pointing out that there's a difference here between the two of you. So I wanna give you a chance to respond to that. Yeah, absolutely. I think one of the challenges that we've seen with the development that we see is, there's a question that's still left answered for some folks is, why don't I see more homes built for people like me? And so when we see new developments, if we are gonna see those traditional neighborhoods that Megan supports next to the cider mill, those larger footprint homes, we do wanna see that a portion of those are set aside that they're affordable. So when you have a large, I guess, my time's up. We'll have ever opportunity to discuss housing here because this is a central topic for the voters here. Yeah, may I respond to that? Yeah, I'll give you 30 seconds to respond as well since I think this is a big issue. Thank you. Megan, not in favor of larger footprint homes. We have enough of them in the city. And if we're gonna use the affordable housing funds available to us through the state and federal grants, they're gonna be small footprint homes. That's what we need. They're environmentally responsible as well. And that's what people who look like me, and I don't know who Chris is referring to, I know where he lives, I know where I live. If I'm talking about the person serving us food in the restaurant, they're not gonna be living in a home that he hopes to make available through the market. And that is where the big catch is. For three years, we didn't deliver any zoning changes in our downtown that would have delivered workforce housing. It's a real mess by the city council and they haven't applied the focus that our workforce deserves. So they have an opportunity for upward mobility. Incorrect. Incorrect, we have inclusionary zoning. I'm gonna jump in here so that we can get to some other issues. Clearly, there are some differences here for the voters to consider about what direction that they wanna go into. Both of you indicated in your opening statements that schools were a big issue for you, one of the main reasons why you got involved in city government in the first place. And so South Burlington's educational infrastructure is aging while the student population is growing. So what do you see as the role of the city council in helping to envision a way forward? And since you went first to last to Chris, I'm gonna let you go first this time, Megan. Yes, it comes down to our planning and zoning. And we definitely need to have injections of new workers for our workforce. And they are going to, of course, I hope settle here and have families providing children for our schools. That is a must and our zoning is a big piece of that. And we need to make sure that the housing available to those new workers and young families is affordable, not $500,000 homes, which the market is currently providing. And I would also add that we need to think about how we manage that growth. Right now we have two elementary schools that are cracking at the seams. We have heard from the school board that they're gonna have to put up what they call trailers. I would call them different, I would call them mobile units where they're gonna put their administrators to make more classrooms. It's clearly not sustainable. Our high school is cracking at the seams. Two years ago, when Chris and I got to know each other, we were facing the voting down of a huge bond, $210 million for middle school and high school campus. We also had the budget voted down. So we are facing very difficult choices here as a community. We have grown beyond our taxing capacity and growth does not add to fiscal sustainability. It's how you grow, it's not just growth. It's how you grow and it has to be managed. And so I truly think that this is worthy of discussion. And thank you for the 30 seconds. I will add that city staff is the same in terms of being stretched thin. And if we need to provide the snow plowing to have our children get to school, we need to make sure that we have highway crew. They are incredibly stretched thin. And so we are what we would call a tipping point. It's what our fire chief as well as our public works director has talked about. And we have to be very careful now. All right, thanks for that. I'm going to let you answer that question, Chris. And then I'm going to take a call. Excellent. I think Megan and I overlap a lot on school values. And as I got to know Megan, I understood her commitment to passing a budget that the voters could support. So and I don't think we disagree in a lot of areas. One area and I think there's some opportunity to explore more is getting the city council out of city hall and into the schools and having regular conversations in the schools and see firsthand the condition of our schools. Strategic planning sessions with the school on a more frequent basis. Where do we meet these changing needs? I see the city manager and superintendent talk more frequently. How can we share resources? Demographics was cited as an issue where they didn't anticipate some of the growth that was coming, largely because of some of the city center growth. And that's growth that we want to see and that we can accommodate. But we can't have competing priorities with the city and the school. So as an economic driver that attracts talent to our school, that investment in the high school, the middle school, and how do we rebalance our elementary school so it meets student outcomes. It's just one thing that gets more attention is policy that would steer more students into the trades and technical training. We have a workforce sorted specifically for the trades. There's a lot of areas where how can the city and the school overlap. Those are positive discussions in an investment out of community. I think that's an area where we have a lot of agreement. Thank you. Love to welcome a caller. If you could just state your name and where you're calling from. I'm calling from South Burlington. With your question. Oh, so I thought I was going. I'm watching as I'm talking. I thought I was going to be talking live to them. No. So listen on the phone. That's what they told me. I can hear you now. I can hear you on the TV. You are talking. Just in the phone. So it's not just the OK. So they're talking and I'm trying to watch them talk. So they're not going to stop talking when I start talking. So listen on the phone. And if you ask your question on the phone, they can hear you right now. You're live right now. But on the on the TV, my name is Lynn Vera. Hi, Lynn. So I have I have a comment and a question. My comment is sorry. There's all kinds of stuff. Let all that go by and ask your question. Here I go. So now I'm lying. So I so I want to know. Lynn, if you turn off your stream so you're not listening to the stream, listen on the phone. So if you ask the question on the phone, you're like my concern and my question has to do with just what Megan was just talking about. The conflict between providing housing and accommodating people who either already live here or want to live here and trying to somehow manage that the point of that is community, not what the market will bear. So I live in Queen City Park. I am just befuddled and shocked by what's happening to the housing value just in my neighborhood. And I know that it's happening all over South Burlington. And I worry that the tax base can't just be what supports our community. So I'm concerned that development of more, quote, affordable housing is looked at in the Southeast Quadrant because maybe one of 12 will be, quote, affordable. But as Megan is saying, what is affordable? That's a huge concern of mine. I am upset by the development in the Southeast Quadrant. I'd like it to sort of slow down. And I do support affordable housing that isn't just high rise. So I'm excited to hear about, perhaps, some changes to redevelop these ridiculous, huge, empty malls. There's another one over on Schobern Road. Yeah, thank you so much for that question. How do each of you? I'm sorry. Thank you so much for that comment and your question about affordable housing. Yeah, I'd love to hear more. My question has to do with school, curriculum, critical race theory. I know it's a big punch word. My concern is let's keep that flag, Black Lives Matter flag up. And let's talk about diversity on a real educational level. Who are the people who built this country? So what are each of your feelings about that catchphrase? Thank you. Yeah, thank you so much for your comment on affordable housing and your question about critical race theory as a classroom curriculum. Let's start with you, Chris. Do you want to give some commentary on both or either of those points? Both. The preservation of the existing housing that we have, we've seen that eroded since our reappraisal. Values went up 27%. So that's good if you own your home and to see your values go up. But folks trying to enter into the market. But also at the same time, we're seeing residents outplaced. So I have residents coming in and they can afford to buy at a higher price. And so our residents are feeling that pinch. And that's all neighborhoods. That's down by Red Rocks. That's Chamberlain Network. It's in the orchards. So just losing the sense of community of what I had, that's impactful. So there's that. On the critical race theory in schools, there's an exciting bill that's in the house that will ensure that race or anti-racism is taught in the schools at a state level. And that was something I've supported by local activists. And it's very exciting to see. It's important that we see what the cause of some of the segregation and the impacts of the institutional issues are. But it's not just that, in the Affordable Housing Committee, we led a discussion regarding the color of law. And with the color of law, you really understand the impact zoning has to opportunity for everyone. Just when we talk about zoning and where we put homes, it's kind of what kind of city are we building in for who? So thank you, Lynn, for that call. I appreciate you making that connection between housing and racial justice, right? That's intimately connected. So Megan, why don't you go ahead and give us your thoughts on these important issues? Yes, this definitely, these are two very linked topics. And this summer, I organized alone and put together a forum on land use and equity because it very much has to do with environmental justice. And we had UVM professors. We also had two Abnaki chiefs attend and a student who is talked about the housing situation for students. And so that is also an equity issue with regard to age. The city terribly lacks housing for students and young professionals. And they do not need a $500,000 house. They need to have a home that is on a route toward either their school or their place of employment. And I would like to see those homes affordable. I would like to see green space around those homes. I would like for the new families and newcomers who can make use of a home out with a yard that could provide to them. I would like that to also be affordable and be able to see that there is access for people of all income levels throughout our city to go on our walking trails and to take advantage of simply the peace. And I think it's really important for us to know that there is a minimum of four units per acre in these land development regulations. So it is built in that these will be affordable. What I would like to say also with regard to environmental justice is that a lot of people move from Burlington to South Burlington when their children are a school age. Chris Chombly is an example of that. And I think that there are some Burlingtonians who are disappointed in his choice of leaving Burlington to attend our schools. We need to make great progress in our schools. And I think that is another topic that I would very much like to take part in, yeah. Thanks, Megan. Chris, I see that you were wanting a chance to respond to one of the points that Megan was making. So I'll go ahead and let you have a short response to that. Yeah, just as a lifelong Vermonter, I've lived in different places across the state. Sometimes your job moves. And so I was happy to live downtown, or not downtown, but out in the new North End. And we were very happy there. We were able to take the bus to work it was a 10 minute commute. We had walking distance to our school that walkable, compact living community is we need more of those. But my job moved, I went to a 45 minute commute that's time away from my family. That's more miles traveled. I value time with my family. So I've worked in South Burlington and this is a great investment in that time. So somebody has a problem with me taking my kids to, I welcome a conversation about that. So thank you. Yeah, I mean, these are tough issues. These are tough issues and they're personal, but also political. So we only have one left. So I think we only have probably time for one more question. And it doesn't look like we have another caller. So I have so many questions that I still wanna get to and ask you. But one of the questions that I think is really pressing for me is the F-35s. So what are you hearing for residents? What's your position? What do you see as the role of the South Burlington city council and kind of responding to resident concerns or what are the resident concerns right now that you wanna be responsive to? Yeah, is that, do I go first this time? Yes, sorry, Megan. Yeah, you go first this time, apologies. No worries. Yes, I have been going door to door. Campaigning is a really good process. So we do receive calls and emails, but there's nothing like knocking on someone's door and talking to them. And sometimes up to an hour, it is definitely on the minds of the residents of South Burlington. People very concerned that they cannot enjoy their property. And there is currently an airport rezoning task force in place and that is a result of homes that were purchased and demolished because primarily of the military jets and the noise envelope that they created that encroached on this neighborhood took away 200 affordable homes. And so we now are faced with a request made by the director of the airport for rezoning 11 of those acres. And what will those acres become is of prime concern to the people who live in the Chamberlain neighborhood. Now, it will not reduce the F-35 noise to zero. But there's also, I wanna add, this program that the airport has just engaged in with the FAA's approval, which is for noise insulation. So new windows, new doors and making it possible for people to have some coolness inside of their homes with the air conditioning and when they cannot open their windows because of the F-35 noise being too, too loud. People are not satisfied with that. They would much rather have open windows and be out in their yards. My view is this is not the place for this kind of jet. It wasn't in the 1980s when we first got our first fighter jets. It's not now. People made a mistake. I am not a senator, I am a city counselor. So all I can do is wrestle back our right to a place at the planning table, which the FAA recognizes. All right, thanks for that. And we're just about out of time. So we're just gonna finish with your, your thoughts on this, Chris. Sure, you know, I think if elected city council, you know, this was a very personal issue for me.  So how do we protect the neighborhood that's there now?  I don't know that's compatible with the existing residential. And so is that gonna compound the issue? You know, the Chamberlain residents have, they've been through a lot. They have a lot of pride in their neighborhood as they should, tried to find a place there, but there wasn't anything available. So, you know, it's just really protect the neighborhoods, make sure their voices are heard and be a staunch advocate for, for your residents. And if that means you gotta stand up and represent more seats on the airport commission, then that's what you gotta do. If it means you have to advocate for different flight schedule and coordinate with different cities, so do that.  So thank you. All right, well, thanks so much for that. This has been awesome to talk to both of you and we're out of time. So I just wanna thank everybody for tuning in to Town Meeting TV and our ongoing coverage of local community candidates, budget and ballot items. You can find this and more forums at www.ch17.tv. So don't forget to vote on or before the first Tuesday in March, Town Meeting Day, which is March 1st, 2022. Early voting by mail is available by contacting your town clerk's office and polls will also be open from 7 a.m. to 7 p.m. Thank you so much for watching and thank you, Megan and Chris, for joining us here tonight and giving the voters, I think, a lot to think about. Thank you very much, Helen. Thank you so much. Take care. Thank you, Chris. Thanks Megan, take care.


Hello everyone. Good afternoon Welcome to my talk Actually quite surprised to see so many people. Thank you for coming The title I wanted to make it a bit catchy Maybe overdramatized but still Let's begin. So some of you already know me But my name is Dominik Mirajewski. I go by the handle Rathen and I Have comic tag the direct comic access to around 100 packages in Fedora Being a proven package Let's me touch a bit more I'm also a proven. I'm also a sponsor Hold or used to hold some other Titles in Fedora over the years because yeah, I've been contributing to Fedora for quite some time I think it's around 13 years now Long time here and Intent to stay So today talking about What What you should not do in the packages and fortunately Fedora guidelines Prevent us from doing that or at least give us clear guidance But still Outside Fedora, there is a whole world of RPM packages that don't follow those rules and I will show you some examples of Things people do in those packages Make you cringe to say the least But first I'll give a brief Overview our best packaging practices as a reminder To reference When going over each case that they have So most of you At least those who are package maintainers should already know the best practices of packaging and of course Disapply not only to Fedora, but to software packaging in general In the package metadata we need to have explicit list of files that the package owns or Wants to touch because as we know RPM can be core RPM database can be great for the list and we can We can ask our PM and database what which package a given file belongs to and so that's very important for discoverability and maintainability of packages and and keeping track of what we have all on the machine on the file system The other important thing which is In some which is in my opinion it has in some in my opinion become a bit more difficult These days is the no band link Policy which we used to have in Fedora, which is now relaxed But it has it has its pros and cons as many of you know but in general We should avoid bundling more than one software project in in our package and try to make use of the libraries and other projects Available in the distribution or if if we are bringing an entire new stack of software Each each each component should be packaged separately so that it can be reused by other new consumers and Following that is the mandate to use shared libraries as much as possible Because as we all know a new detective security vulnerability in a library Updating just that one with a fixed version fixes all its consumers all in theory it should fix all its consumers unless Somebody someone built Against a static version that one is to be rebuilt of course some Software ecosystems like Go or I think Rust as well Not very familiar with either They basically mandate rendering or bundling and are maybe moving towards Shared libraries but not not so fast Everything needs to be rebuilt with with each. Oh, and I think OCaml as well needs to be Everything needs to be rebuilt when when there is a new compiler or there's a new Library version So another thing is well at least in Fedora or in RPM ecosystem We don't really support interactive installations that there is no guarantee that there will be a life user or even a terminal present when an RPM is being installed so that's another thing to avoid in RPM packages and For mostly for security reasons but We cannot assume that the user account under the under a package under which a package is built is in any way privileged so We we do installations in a Sub-directory with where we have access to right, but We don't touch the root file system during build Nor should we This is distribution specific, of course, but in general our PM package should integrate with the rest of the distribution well It should follow the defaults like for example We should follow Cryptographic policy that we have in for Dora The distributions have their own Standards policies or quirks so it depends from this true to this true But as a general rule, you know, we should integrate well, for example, oh Firewall D versus IP tables We have firewall derived as a default Right now. So if your package supports both Well, I mean you should support firewall D as well if possible and and that should be the default but I think with Boolean dependencies we can For example, if we put things in a sub package one for firewall D one for IP tables you could Get those installed automatically depending on what the user has installed Just a thought and of course the builds should be irreproducible. So each time you build from the same exact Source or Commit in this kit you should get the same package So like I think it's also yeah, it is codified in the guidelines that We should actually try to patch out Dates or timestamps from from generated from files that are generated at build time to help reproducible reproducibility Right. So let's move on to the interesting cases which I actually encountered in the wild Mostly during my job So This was actually well, I did edit the excerpts so that the guilty parties are not named but Yeah, this would be most mostly in the scriptlets so this ties very well with the recent proposal to What was it called to to make RPM packages? archives instead of What was the what was the phrase privilege escalation Bombs or something like that Because the script is run as route during installation actual RPM installation So you have to be careful So what what was done wrong in that in that excerpt user interaction, right as I mentioned as The best practices dictate RPM packages are non-interactive by design unlike DPKG for example, so we cannot assume there is a user or terminal and We should provide a Safe working default configuration if there is a need for one or if it really requires manual intervention by an admin or I don't know some configuration management tool then there should be a At least some documentation provided on What parameters need to be specified because they cannot be guessed or Detected Right, so Jamila Of course, you won't you won't see that in Fedora, although I think there's one Maybe couple of packages which tried to be distribution agnostic What's that? We don't do this in Fedora Outside people try to write packages write spec files for multiple Distributions and they end up with with constructs like this and Well, in my opinion, it's not not a good practice Because it well, it's of course nice to have everything in one place But Depending on which with distribution versions you want to support the scripts can get unwieldy and Actually harder to maintain So I think it's better to just have separate Spec files for for each distribution that you want to support Because it also can lead to having Files that I mean dropped on the file system From inside the script that and they will not be owned by rpm unless you take special care to do that using ghost Interactive in the in the in the file section. So yeah, it gets complicated. So it's better One spec file for one distribution unless it's you know, I mean even even between Fedora and entrell There are some differences for many packages. You can have the same spec file and built everything from from the master branch, but Sometimes the dependencies are different and you have to enable disable things in configure or whatever the build the build system is so It gets gets complicated and to do it in one spec file It's this is not not not the worst. What I would suggest Like I said separate branches separate spec files for for each distribution and Doing automated builds Which there are a lot of talks about doing automated builds And these days so choose your poison Yeah, this one was a killer Actually, yeah, I encountered that mean The package did drop files in a specific directory that it was afterwards Removing in a post uninstalled scriptlet, but that Developer didn't take into account that another package might also drop files in the same directory so Actually, I had one Outage when we were insta uninstalling some legacy package from from all servers and a Few minutes after we did it A colleague called me. Hey, this my software stopped working. What were you doing? Installing some other package But all the files are gone and then I went inside Actually, I didn't have I didn't even have a spec file just the binary RPM. I saw this in the script Okay. Yeah, we know what to do. Just use no scripts in this case and never install this again Yeah, so have to be careful with your directories. So let let our PM do his job for list everything in spec in the file section and You know, if there are files generated at runtime You can also list them in files And using the ghost directive You you can specify the expected attributes also as well so that RPM dash capital V also works to the extended can to verify that the File mode and ownership so on so yeah There are better solutions than just running RM dash RF In a scriptlet Yes Yeah, it's it's a big hammer not Not to not run any scriptlets and yes, there is a way to rebuild a binary package. I mean like reverse engineer a binary package together spec file from it There's a tool called RPM rebuild and actually I Was surprised to to to find it. I wasn't aware of it a couple of years ago, but When I found how some of my colleagues were Doing releases of a new package versions using that too That made me cringe a lot But yeah, it's it's a tool and it's it's useful when when you don't have access to to the sources I Don't think it's installed by default, but it's it's there somewhere You can install it by path. I don't remember the package name So yeah There are ways around that. Well, if it's a you know vendor package that cannot be modified because otherwise It's not supported and not much you can do Yeah, this one was so interesting because I I Explained to a colleague how to How to make proper RPM packages and the first of his releases was fine And then he released an update and then I found this in in in his updated package and I What are you doing man? I think I told you how to do things properly I don't even remember the explanation, but yeah, that was terrible because Which which we are more product was it a player, okay, I actually haven't haven't touched that sorry use that Yeah Yeah, I IBM IBM software does that a lot. I I think I tried to to force what was some Tivoli monitoring agents Into into a proper RPM than I found it was actually It was an installer Tarble with an installer script which which also contained RPM binaries and it was Installing RPM during the RPM packages during this install process. So it was it was terrible but it's it's what you have to work with in a in a big company which which uses a lot of proprietary software, so I mean Yeah, I Nothing against IBM's personally just some pieces of it So, yeah Don't do this Just put extract everything in in in the Section where you supposed to which is install if even software is stubborn and for example was asking for route During install because they they were assuming Yet an admin would just run their install script and you can try using fake root or pseudo and it It works in most most cases. So I recommend trying at least and well Worst case, you can you can you can actually run the installer in the install in Post-installed script but but then put every file in the file section and Use ghost, but that that's the absolutely worst case Actually try that one Yeah, exactly there is no no terminal even So But people do things and Yeah, that that's what I first The names of the libraries are of course real the paths are not but we had a package that did something like that and Then I I think I tried to Uninstall curl and it succeeded and then something else stopped working Because the curl was already well lip curl in this case was already provided by my pet So, yeah, I mean this is bundling right and bundling of things that we have been in the main distribution so You can of course do bundling but do it properly and and filter out those library duplicated libraries from from the metadata, so they are not exposed to RPM database and Don't conflict or make your software pretend that it provides something that it's not for general consumption so, yeah That's that's why tools like RPM if RPM inspects can help him also even for non fedora packages Because they will file all the many of the fedora tests But still the output will be useful and since you can select which tests to run Or I guess you can also write your own tests That will be useful That's That's all the cases I had But just before the talk we had a beginning of an interesting discussion with Tom About about tech life being a real monster in in fedora and he did some marvelous Things to make it less horrible So, yeah, if you have any questions or have an interesting cases to discuss Only they require a bunch of 650 of them not So Because it can't be removed from trying to try to contact npm and use these npm's I Pre-download them as I'm packaging Yeah, that's what I would probably do as well when pressed for time because well you can't I mean it would take months to Or maybe years to package 600 dependencies Wow I think I mean to do it properly. I think automated packaging is the only way Like like I think I was I know someone did it with Python just took all of pi pi and Filled rpms out of that automatically was it mirror or someone else? Think also we have a lot of work done for a go ecosystem for this But yeah I mean go also tries to Download all its dependencies during builds unless you already have them That's yeah Then what modern modern language stacks are kind of like that Stories Interesting Oh It's not provided like P-Python over, neither in Pekkin, neither in GDAL, but the GDAL version was like a compile, so it was a different file, while the Pekkin was normal, no arc, so it was in different file, there was no collision, so you were able to install good version, but of course, they didn't have those correct class, so it was masked, but the GDAL version was totally first, so that's one interesting thing which not our QE tool catched. Right, so it was a case of name overlap, it wasn't the same software, just the same name. I have a similar case, just came to my mind when I was trying to package something new and it had a dependency on a Broadly module, there are actually two implementations which are, I think, completely or mostly API compatible, one is Broadly and one is Broadly Py, but they provide the same module name, and one is Infadora, one isn't, or maybe it is already, I haven't checked in the last few months, and the developers of the software I was trying to package, because I think the one Infadora is implemented is pure Python and the one that was a dependency is rewritten in C, so it's a C Python module, so they said they want to use that one, because it's faster, but still there is a name, well, module name clash, but not project name clash, it actually installs into different directory, and yeah, there are the traps you have to watch for and avoid. Yes, Tom? Someone sent me a package a while ago for a review, they figured out why it wasn't building in Koji, and the configured tool was querying GitHub repos to pull down dependencies automatically and failing if it didn't, it wasn't able to succeed, and so the person packaging this attempt at solving this problem by adding a pre-scriptlet that was trying to use nmcli to turn on the network Seriously? Wow. And they were a little disappointed that this wasn't working, and they were wondering if they'd gotten a network manager command line since Accent for Accent. I mean, I respected their attempt to solve that problem, but I set the vote on the stream. The other thing is that they made an earlier story, Chromium has a check for specific fonts with specific checksums, it doesn't need them. It just makes sure that they're in the directory, and it's not in their git tree, so part of a Chromium source file is a download of these font files, shoving them in the directory so it can pass the build check and build them. They're not attached. I guess that was easier than patching the build script. Yes. Yes, it was. Yeah, I know. All right. Any more questions, stories? So thank you all for coming.


All right, thank you, Candace. That is amazing. All right, my name is Steve Shaker. Welcome to Navigating Application Security Landscape. And I was pretty excited to be able to do this one today for, well, reasons that will become obvious shortly. A quick intro to me. Thanks for the already existing intro. I'm gonna change my title. I'm just gonna do that and call myself the Cloud Security Navigator for this one. I've been working at Prisma Cloud for going on two or three years. Boy, time flies. I've been writing code since the 80s, I gotta say. A long time, I was very, very small and C and Java and JavaScript and going beyond there. So I work for the product team. I work on our open source tools. I'll mention that a little later. My specializations are Kubernetes containers, apps I can supply chain security. So kind of a lot to concentrate on. I am based in London, England in spite of my accent. I've got two flags up there because I've got dual citizenship between Canada and the United Kingdom. And if you find yourself in London, I co-organize the DevSecOps London Gathering Meetup there. Big community of 3,000 security enthusiasts. And I also have a cloud native security show on Twitch and YouTube. So you can Google my name and find all sorts of wonderful things. Let's get started. Interesting beginning. So a little bit of a quote. What's interesting about this is that what gets us into trouble is not what we don't know. It's what we know for sure that just ain't so. And when I say ain't, I always want to affect a twang. Just ain't so. Mark Twain. Now, what's interesting about this quote and you're probably thinking, what does this have to do with AppSec? Everything is that it's actually, if you've probably seen it before, it sounds familiar. It's at the beginning of the big short. And it's also at the beginning of an inconvenient truth. And what I found fun and AppSec-y about it is what it's saying. And it's being attributed to Mark Twain. Or was it Mark Twain? Because it's also attributed to four other people. And if you do your homework on it, you find out that Mark Twain didn't really say it. He didn't really even say anything like it. There's other people said something more accurate, but Mark Twain's the most famous. So he's the one that they stick below it. And it's ironic because it is an example of itself. It's kind of meta. What we know for sure that just ain't so. What we know for sure that just ain't so is this quote is not Mark Twain. So it's an example of itself. I thought it was pretty funny. And by the way, I'm just gonna throw this out there. All these images that I'm using, these are all AI generated. If you're wondering like, how did I find an image of somebody putting on a Mark Twain mask? I asked AI and it did it. So cool. So this is where we're gonna start and introduce the concept of a false positive.  This is one of the biggest problems with an application security is noise and false positives and how do we solve these? We're gonna come to that. But I would be remiss if I didn't start with the application. Cause when we talk about application security and the landscape around it, what is the landscape? Well, what is securing it look like? Well, what is the application? And I think it's interesting to try and redefine the application. Now, I mentioned that I've been writing code for 1986 or so, probably if I'd be precise, starting off in C and there was a million ways to do bad code in C, trust me. It is fraught with pitfalls, let's say. And then moving into more languages that have memory management, et cetera. It had to be more creative to start creating bad code. And then that was really how I got into security because I went from writing bad code to doing code craftsmanship and then eventually it was a natural progression into security. But what is the application? What are we talking about? Usually as practitioners of application security, we think of the OWASP top 10. And the OWASP top 10 is a nice guide, certainly to what we're doing wrong. This is, if you're unfamiliar with OWASP and I would imagine some people might still be unfamiliar. It's the open, used to be web application. Now it's a worldwide application security project. And every three to four years, it reboots what we think it was the worst possible thing. It used to be SQL injections at the top. And now it's access control and misconfigurations and data integrity. And the list is always organic and changing. But it does help us to find, if we look at it, what are we considering to be the application? Well, if it's saying outdated components, okay, that implies dependencies. That's not just the code I write. If I'm talking about misconfigurations of the cloud itself, oh, okay, so is the cloud itself part of my application? So it really expands your mind as to where does the application be in an end? And this is what I'm hoping to do today, is actually start by defining the application and the landscape. Because if we don't know what we're talking about, how can we possibly secure it? Now let me muddy the waters even more. In addition to the OWASP top 10, we have in application security, the CWE, the Common Weakness Immigration. And these are also what we look for in terms of application security. If we're looking at our own code, we might scan it with a tool and it often comes back with CWE numbers that are proof that there are recorded weaknesses and we are executing or we have created code that falls into the trap of certain weaknesses. They are becoming more prevalent. And this is directly from the website. More prevalent in vulnerability exposure conversations. Because I think of the OWASP top 10 as styles of vulnerabilities. Whereas CWEs tend to be closer to the root causes. They are the programmatic missteps that can become the OWASP top 10. But on closer analysis, I find the CWE list pretty fascinating in how it is created. Because we had a 2021 top 10 and we have a 2023 top 25 list for the CWEs. So let's take a quick look at the top 11. Yes, only the top 11. And you can see just for reference, I have the OWASP top 10 down there on the side. So you can see what it is with broken access control and secure design. They're all there. And we look at number one. Number one, top of the list. Is it broken access control? No, it's not. It's out of bounds right. I got a old C program in classic that can blow up the whole program. Okay, so let's see we're still making those problems. Now, if you consider CWEs aren't by default connected to security, they just kind of are very often and the conversations around CWEs do tend to trend towards security. So this is a problem to do with our application typically to do with our own code. Let's just quickly pop down. I'm not gonna go over every single one of them but just expose some of them. And you can see improper neutralization of inputs. Okay, that can be injection, for example, or that can lead to remote code execution, use after free classics. The sister to the out of bounds, right? The out of bounds read. And we'll work our way down to number 10. What I do find amazing is that CWE 352 cross set request forgery, which it used to be in the O-Hospitat 10 has fallen completely off, mainly because most programmatic frameworks protect you automatically against it. But it's interesting that it's still present in the top 10 of the CWEs. So there's a bit of a map, but the way I found very curious was this number 11. Missing authentication, which maps directly to number one. So number 11 maps to number one. We had to go all the way to 11 before we got to the number one issue on the O-Hospitat 10. And what's even more amazing and is that it's number 862. So that means we went through documenting 861 programmatic missteps or weaknesses before we got to 862, which is now the number one problem with security and applications. Hmm, interesting.  Upwards almost 1500, I think right now is what we're at. And if you think about that and you wonder why application security has a tendency to be a little bit confusing and noisy, well, that's why. Because if there's 1500 ways I can write bad code and each one of these ways, there's probably five to 10 different ways that you can create a CWE 862, then it's no surprise that when things like static analysis tools are looking at our application, that they make a lot of noise. And that is probably the first big problem with classic application security that we're gonna start talking a little bit about. However, let's go back to what is the application.  The application is the code I write. Okay, yes. This used to be all the application was in our minds. Back in the day when I was writing code, I'd say in the 90s when I wrote a lot of C code, we didn't have any dependencies, barely. Maybe there were some, maybe some drivers that came with integrations and with hardware, but the open source world just wasn't as huge. It wasn't what it is today. But now we have to acknowledge that it's much, much, much bigger than it used to be. It's now the code I write and its dependencies. But does it stop there? I mean, we know if you look at any one of many reports from synopsis or synotype, like the Osprey report, that we can see that modern cloud native applications are upwards of 80% open source dependencies. So we have to consider the dependencies. And that can be troublesome. Why? Because when we talked about noise with CWEs, now we have CVEs to think about there as well, known vulnerabilities in our dependencies. And if we look at the way applications are built, just in a very ad hoc way, developers are a little bit like humans. They are humans, but follow me. When you have, if I'm the application and I live in my house, which says my cloud, I have dependencies and my dependencies might be, I don't know, that bread maker you bought. Remember buying the bread maker? Where's it now? You still have it, but it's in the top shelf in the corner of the kitchen and never really sees the light of day. Or maybe you got two blenders for your, for as wedding gifts and did you get rid of one? Not really, because you need them, their dependencies. And if we look at the way we kind of hoard our dependencies, developers sometimes create applications a little bit like that. I know for sure when I am writing something, I've been writing a lot of Python recently. I add a lot of dependencies that eventually I realized I didn't need. Or sometimes I've got two dependencies that do kind of the same thing and I try both of them and then I realize this one's better and I forget to remove it from my dependency list. So you end up with this potential dependency bloat that can create noise and vulnerabilities that just simply aren't real, that don't matter. So you get a version of false positive, even with something like software composition analysis as opposed to SAST or static analysis, that can create bloat. So we're already creating a lot of noise, but just these two. How about the third one? We looked at cloud misconfiguration being called out in the top 10. So is the cloud part of our application? I would argue, yeah. The cloud has to be probably the first thing you set up securely. Ideally using infrastructure as code like Terraform or CloudFormation or their bicep. And you're doing a good job of making sure that you apply that code. If it's code and it's in a repository, that sounds like an application to me. And the cloud has to be set up very specifically to run my application. Maybe it's running in Kubernetes. Maybe I have a Kubernetes manifest and I have Docker files, et cetera as well. So is that my application? I would argue, yeah, it is. The definition of the application and thus the landscape we are attempting to secure is expanding. Certainly the move to containerization put certainly the infrastructure in the same pocket as the application. And since that happened, we have to start expanding our definition of application. But this can be an advantage when we'll come to that. Now the final thing I think is the least considered part of the application. And that's the pipeline that builds it. You might be thinking, what, Steve, come on? How is that my application? Well, it kind of is because it's actually one of the most vulnerable parts of our application's journey. Now think of it this way.  You're securing all of it. But you don't just stay here. You've got something that takes you on a journey, perhaps your car. That's still part of you and that's sort of part of the application. And as the software gets written, it's the same thing as saying securing data at rest and securing data in transit. The application is data. And the application will be built and constructed and orchestrated via CI CD pipeline and it will be pushed into the cloud. That journey needs to be as secure as the code itself. So let's think about the problem with AppSec at the moment. One of the problems with the way we're executing within application security is this. The code I run, that's a tool. That would be static analysis. So static application security testing, SAS. That's the acronym and it's dependencies. We got a tool for that. That's called software composition analysis or SCA. And these tools, this is almost the order within which tools were created. I used to work at a company called Coverti. They created a static analysis tool, pretty good one. Particularly good with C. Wait, I think it was 2000 and it might have been five? Almost 20 years of static analysis. So that's pretty old. SAS has been around a long time. Then SCA, there are lots of dedicated tools out there that do SCA, some free, some not, to tell you what are the vulnerabilities in my dependencies. And there can be a lot. It can be pretty noisy. So that's a separate tool potentially as well. Maybe some of you are watching this going, yeah, I have a SAS tool. I have my favorite SCA tool. Keep going. Okay. The cloud, it runs in. What are my tools for that? I've got cloud security posture management tool that looks at the configuration of my cloud to make sure I haven't done something silly like leave an S3 bucket unencrypted and exposed. And I've got CWPP, which is cloud workload protection. That's monitoring my Kubernetes and my containers and it's looking at my server lists and it's monitoring all of those things that are running to make sure that there's no anomalous behavior and maybe that I've got a admission controller that's stopping containers with vulnerabilities from running. I've got some of that. So I've got two more tools. Awesome. And of course, the pipeline that builds it. There isn't even really an acronym for that one yet. So now you gotta figure out how do I secure the pipeline? Now there are some open source tools you can use. I work on one of them. Check-off is an open source tool and you can go check that out at checkoff.io. The open SSF has a really open software security foundation, if that's what it is. Open SSF has a tool as well. You can get for free that will check your pipeline and make sure that you've got things like multi-factor authentication turned on and branch protection and all that. So there are options. You can do an open source, but there's not really a acronym per se for that, is there? Which is interesting, but it also implies you do need something in the tool realm for the pipeline that builds it. Now, why am I going on about the pipeline? Well, very good reason. The pipeline that builds it is the emerging threat. Let's take a look back at the past few years. CircleCI, 2023, a malware attack on CircleCI, engineer's laptop, I suppose the secrets. Interesting. Let's look at CodeCov, a supply chain attack that went undetected for months. Look at the NPM, a ubiquitous COA NPM library was hijacked. And then of course, SolarWinds, one of the most sophisticated hacks of all time back in 2020. These are supply chain and pipeline attacks. Like, this is not the application itself. This is the journey that's being affected. And that's really important that we start considering that as part of our application and part of our security strategy. Now, as a reaction to this, if you're unfamiliar, I did talk about the OWASP top 10, the normal one. There are many top 10s on OWASP. Some would say too many, but here's another one. The top 10 CICD security risks. And some of these terms might seem a bit foreign because they're not ones that we're used to. Poison pipeline execution being one. Is there some way, and there is ways to do this in most CI pipelines, that I can submit code that can run simply by creating a pull request? An example of this within Save GitHub is if you submit a workflow file as part of a check-in under very, very weak credential checking, that workflow will actually run before it gets approved as a PR. Very weird, right? There's a whole other talk I've got about how you can abuse that. But these are real threats, and they're really interesting. So if you got, I'm not gonna go through all these, but just making you aware, if you've not heard of the top 10 CICD security risks, go give it a Google, go to the OWASP website and check it out. There's some really important application security learning to be had here. And this is directly as a reaction to some of the hacks that have happened in the past few years. All right, getting back on track. If we recall, we got SAS, SCA, CSPM, CWPP, and that's just for lack of terms, call it a CICD platform security tool. Maybe we have five different tools all attempting to do application security for us. Now, that sounds like a solution, but actually I think it's kind of part of the problem. And I kind of, and I blame myself. I've worked through the past eight years on different styles of these tools. So I've worked with all of them and I've been a contributor to almost all of them. And it wasn't until recently in the past few years, I started to realize that the act of creating individual tools for individual pieces of our application security problem, like a SAS tool to scan my code, SCA tool to look at dependencies and doing them independently has meant that when I visited organizations and I started to talk to them about their security strategy, I found a rather large problem. And that is most organizations as a result of tooling being independent have siloed the security teams to map to that tooling expertise or the technological geographies that was in which they exist. What do I mean by that? Well, SAS tends to exist within the developer pair community because it's analyzing their code. CSPM is within the cloud community and the app sec team and the cloud sec team is almost like InfoSec and AppSec. They aren't the same people. You go into a room, I have been in a room where security was brought in to speak to me and the AppSec and the InfoSec teams shook hands and introduced themselves. This was the first time they'd met. And yet I would argue that this is all the application. The application, the securing the application should not exist in silo. And we have a bit of a problem that we need to overcome but I'm pointing that out. It's almost like a reverse conways law simply because we create individual solutions as vendors. We have actually shaped some organizations in a way that if a tool comes out that can actually combine or be more holistic, then where does it go? Who owns it? So that is essentially what our reality in AppSec is. Now, to expand the AppSec reality and I've been alluding to it the whole time, I would say AppSec in the past few years has made developers cringe. Why is it made developers cringe? It's because it's just noise. We're focusing on what we would call findings. If I've got a large scale application and I run SAST on it and I know there's 1,400 CWEs, maybe I find 1,000 things wrong. Then my SCA reports that I've got another 2,000 vulnerabilities in my dependencies. And I haven't even looked at analyzing my Terraform code to see that I've got 200 misconfigurations there before I've even provisioned my cloud, nor have I even looked at the fact that I probably have issues in my Kubernetes manifests and my containers they're about to go. I'm just creating so many findings that I don't necessarily know what to do with them all. Now, the reality is that a lot of these findings simply don't matter. And that's what we need to find a solution to. The findings themselves are important, but we need a way to be able to dig into it and figure out how do I prioritize and what really represents risk. And I think that's what I wanna introduce is we're looking for risk, not findings. I'll say, for example, this light over here that's telling me my seatbelt isn't on. Okay, well, there's a few other indicators in there. Like, for example, I'm not actually traveling. There's no RPM and I don't even have any fuel in the car. So I'm gonna go ahead and call that a false positive. Alerts without context. Okay, how do I bring context? Well, maybe everything really isn't fine. Maybe in the indicator where I should have my seatbelt on, I need to look at the context of the situation. For example, this context, there's no seatbelt on. Okay, great. What else is wrong? Can I see indicators that might consider this real risk? Yeah, the windows. I'm obviously driving very fast here. That is a problem. I got some loose objects sitting in the seat and she just looks way too happy, you know? What's going on? She's actually focusing. There's an interesting scenario playing out here that makes me feel this represents real risk. And our expectations of our application solutions have this, maybe it's a marketing issue. I don't know, but what we want is we want the application security tools to be able to show us exactly the needle in the needle stack. This is the piece I need to focus on, but they don't. And there's a reason why they don't. What they do, for sure, is they, instead of giving us great results, they give us alert fatigue. And if we have alert fatigue, then we don't work on fixing anything. What we do instead is we think about false positives.  Like take, for example, if you've got a friend that walks up to you and says, hey, in the middle of a conversation, says, you know the moon landing, yeah, yeah, that was fake.  It's okay, all right, conspiracy theorist, great. There's a false positive. A friend just gave you a false positive. Now, do you listen to anything they say after that with any level of seriousness? Yeah, maybe not. And that is the damage a false positive can do in particular when you are already overrun with alerts and findings. All right, let's move on and double down on the application. So just a quick recap, the application is the cloud and all my workloads. So the application, the server list, the Kubernetes, the York straighter, the VMs, the compute storage, IM and data, all of this. As it's running in real time, this is my application. Not just that, it is the repository that is holding my proprietary code, my infrastructure is code that provisioned that cloud and the packages upon which I depend. That is also my application, not just done there, it is also the journey, the continuous integration, the repository, the registry that holds my images, all of this, this is the application and this is the landscape. This is what we need to secure. Why? Because everything can have a threat. We've got things that we're more accustomed to over years, misconfigurations, threats, potential lateral movement, escalations, any all of this can happen in runtime. But our pipeline can be under attack because our pipeline is using the same container images that might be vulnerable to build. If you use GitHub actions, for example, this is a lot of these run in the actions, run in containers. GitHub actions can depend on GitHub actions that can be completely vulnerable. There's an amazing talk that was given at Black Hat and Def Con this back in August called the GitHub worm that was specifically analyzing the top 1,000 GitHub projects that are open source dependencies and showing how simply by dependencies you can have, you can get access to corrupting a lot of them. Vulnerabilities misconfigurations and malware in our own code, in our packages, in our dependencies, the landscape and the attack surface is much bigger than we expect. And what we would hope now, once we realize this, is that we would look for solutions instead of siloing all of the different components of AppSec integrate all of the different solutions. Now, why do we want that? When you think about the context I brought to the seatbelt, how do we bring context to findings? Well, well, it's through basically holistic visibility. If I can combine, could be one example, if I can combine software composition analysis in SAST. Now, we think of SAST as something that is being used to find weaknesses. Well, it's also recording a lot of very important information, for example, it's usually creating an abstract syntax tree and it's walking all the different paths over our own personal code. Now, independent of whether it finds weaknesses or not, that's a very powerful tool. If they can identify, pardon me, if they can identify what dependency calls are being used by my own code, perhaps it can tell me that a vulnerability in a dependency found by an SCA tool is or isn't reachable. That's one huge advantage of combining SAST with SCA, but how many people actually do that? That is the level of context that the future of APHSEC represents, that that's where we're going. Now, what does that look like? Let's take a look at this. Real APHSEC risk, we need to think about it, not as findings, not as vulnerabilities, not necessarily as misconfigurations, but as attack paths. Do is there an attack path that will lead an attacker to the thing I'm defending? What am I defending? I'm defending data most of the time. There's my destination, my storage bucket with personally identifiable information. There's my entry point, the internet. If I can see in one holistic view the combined efforts of all those tools I just talked about, SAST SCA, CSPM, let's add web application firewall in there. Let's add API security. And I can see that there is a path from the internet, publicly exposed to my Kubernetes namespace with a container that has a critical vulnerability that is over provisioned and has access to personal information. I can see this path exists. Why? Because instead of siloing all of my tools, I have one that looks at all of them and brings them all together. Now that's a threat. It's a threat until I'm actually looking at a normally detection and I can see unusual high data volume and data exfiltration. Now I know it's an attack. To be able to have this level of comprehensive visibility, we need to move forward in our definition of application security. And that definition of application security needs to encompass an unsilowing of not just our tools, but an unsilowing of our security organizations as well. We need more conversation. We need to look at maybe what we have already in terms of tools, be it open source or commercial and look how we can bring information together, look at how we can do the data analysis to normalize and rationalize the findings into something that looks more like this. Something that shows us that we have real tangible threats. In our search for the risky needle in the needle stack, we need to be able to distill findings into actual usable data, what code is used and determine reachability of vulnerabilities. Reachability of data at risk. This is the solution. So modern attack, if we're looking at what modern app site does, the goal we're trying to do is take all of the findings, bring them into a central location, uniting DSPM, CWP, CSPM, SCA, all of it, relate it through attack paths and then bring us priority. And then if we can, even in just logs, like we would do with something like Splunk and bring that, the 17, in this particular example, 17,000 alerts, reduce it to critical and actually represent actual real risk. A number as low as 24. And from there, we actually have something actionable. Like how actionable is most of the legacy application to security data, it's very much not in many cases. If I only have certain attack paths and I can see where in the attack path I need to fix something, maybe I don't need to fix the critical vulnerability, maybe I need to change the admin access. Where's my best fix location? How do I fix it now? And how do I fix it permanently? And that's important to know too. And again, when we talk about integrating something like SCA with CSPM, if I find a misconfiguration or let's say IAC analysis, if I find a misconfiguration in a cloud and I can make that change, sure, maybe as a, sorry, I might wanna make that change immediately so that I know this attack path has been cut off. Well, I still need to change on the code. How do I do that? How do I have that conversation? How do I know where that is? And this is what modern application security needs to be represented as. We need it so that if I've reduced all of my findings into something that is tangible, something that has an attack path, I need to fix it twice. Once now to stop the flow, and then I need to be able to create a pull request that sends a message back to the developer in their language, not necessarily via a Jira ticket, and shows them that they can see via PR, okay, I need to bump this version in my package, Jason, or I need to add this particular parameter to my Terraform to say we've fixed it in the cloud, here's the equivalent fix back in code, please approve this pull request, and we're not gonna undo our good work in the cloud. Now this is real application security at its finest. Does it exist yet? Kinda, I work for full disclosure, you know, in the beginning I work for Prisma Cloud, and this is the direction that we are going in terms of approaching application security, and we're not alone in this. This is the direction the industry is going in terms of consolidating what is silent tools and organizations into something that's more platform focused, and more considered to be there's a modern term called cloud native application protection platforms, more platform related, because we suddenly are realizing the power of a platform level application security tool is immense. And then finally, being able to fix things as early as possible, ID integration. So all of that information, we just had all that holistic visibility, if we can bring that and learn from it and start generating new rules and new concepts of what we consider to be threats, and push those definitions directly to a developer as they're writing code, well, we can start to prevent, that's the most important thing, and even predict that attack paths may occur based on code that is being written right now. This can apply to both the creation of infrastructure as code, and code that I write and dependencies. You can see it's a bit of a shameless plug that are powered by Checkoff. Checkoff is the open source tool that I work on with a huge team of amazing engineers, which you can go get for free. It's like a free Checkoff.io tool you can get that will analyze infrastructure as code like Terraform or Kubernetes manifest. Something like that stuff.  And that is proper shift left. That is a definition of proper application security do-sec ops, is to make things happen as early as possible. And that would be great if everybody did that, then we would find that our noise in runtime would be incredibly reduced. We'd only be looking at real risk. We'd have a much quieter world and we'd sleep at night a lot better because application security was finally telling us that only this one needle was important. Okay, I got through that relatively quickly. Plenty of time if you have any questions and yeah, thanks. Weird thank you slide.  Yeah, if anybody has any questions, feel free to drop it in the Q&A box. We have some time that's giving to answer any of your questions. If we wanna give it like a minute and see if anyone has anything. Sure, I figure I either put people to sleep or I answered all their questions, one of the two. All right, looks like we got a few questions then. I'll do them in, well, the reverse order, I think, just cause he cares. What part of the model shown is available now from Prisma Cloud? I'm not sure I understand when you say model, but the screenshots that I showed that are Prisma are current screenshots. So anything I said that I pointed out there as things that are currently, that do work are real within Prisma Cloud. Maybe that answers the question. If not, feel free to let me know. Recommendations for self-study regarding these tools. Yeah, there's a variety of tools out there in terms of SAS and SCA. Interesting, in terms of self-study, Palo Alto, we have partnership with Udemy and there's lots of great courses on Udemy. I know you don't always get it for free, but that's where internally, by default, that's where we go. Various OWASP, any tools that report various OWASP CICD issues? Yes, the, you can, if you have for certain CICD platforms like Bitbucket, GitHub, GitLab, the tool that I just posted into the chat, to everyone at checkout.io, if you have an API key for your repository and it is visible to checkout, does actually will then go and say, if your framework is CICD, it will go and look at your CICD and tell you what you've done wrong. And also the OpenSSF has a thing called Scorecard. So if you look up OpenSSF, actually, I know what I'll do is I will even paste that into the chat so you can see that is a Linux foundation, actually. So go check out OpenSSF and they have some tools that also check the OWASP CICD issues. So definitely go check that out. And then there's one says, how different is APSIC from ASPM? That's a great question. Not that they all work great questions, but ASPM is another one of those hot terms at the moment, which I find I'm uncertain whether it's marketing or real. ASPM stands for Application Security Posture Management. There's a lot of SPMs out there. There's DSPM, Data Security Posture Management. There's a lot of SPMs that are out there. I think I even heard KSPM, Kubernetes Security Posture Management once and I was a little bit unsure, like is that real? But why not, right? Application Security Posture Management at the moment, there's some players out there that are doing a great job of it. It is a thing, but it is monitoring the application running in the cloud very much like you monitor the cloud. So it's looking at, in some instances, it takes information it knows from the repository and it monitors the cloud almost in a gray box kind of way. So it can look at the application and know whether it's doing the things it's supposed to do in terms of it's like open ports, API behaviors, and it also at the same time, takes a little bit of a CSPM approach to it as well. So it is an integrated, it does some of what I said. It takes some of the tools that we are siloing at the moment and it integrates them. I think one of the solutions, which was recently acquired, I think it was called Bionic, they actually did some reverse engineering of the binaries of running applications if it didn't have access, as opposed to access to the source. And so it is a combined runtime application security with a bit of CSPM. So that is what ASPM is. I think it's a pretty cool concept, but at the moment, it doesn't quite complete the application security picture that I'm trying to convey. And for me, that is, if I do find something running in an application that is anomalous, and it's perhaps accessible via knowledge of cloud security, how do I fix it in source? And this is where I think current, this is obviously my opinion and not Prisma Clouds. How do I get a permanent fix out of that? I think as ASPM develops, it will actually just become application security again. But it's an interesting, good question and a very interesting perspective on a way of tackling application security in runtime. I just think there needs to be an extension back to source almost every time for me. Coming from somebody who writes code, both infrastructure as code and application code, I want my life to be made easier by application security and I'm not 100% convinced ASPM is the answer to that. Oh, long question. Okay, existing security standards like, yeah, you have BSOC approved and ISO, they focus on individual vulnerability reports. Too true. With this, playing with your shift towards those standards as well. I would hope we would see a shift in those standards. That's a very good question, Joshua. The industry tends to lag. You probably already know that though. What is, I guess, aware within some of the more platform level tools is that generally we understand, certainly at Prisma Cloud, we definitely understand that these are the SOC2 and the ISO are our reality. But having the overarching full visibility of everything within cloud application, everything, it becomes incredibly easier to generate the reports that are required for those kinds of certifications. So I don't know that the, it would be nice if the certifications changed to be a bit more about risk as opposed to vulnerability because vulnerability is not a real definition of risk, maybe over time, because a lot of the people who create those requirements are people who work in the industry, quite often for vendors. So hopefully we can push towards that. But in the meantime, all of the different tools that even whether it be Prisma Cloud or any of the ESPN solutions, we are very much aware of what we need to create and having larger visibility makes that easier for not just us, but for everyone. See, did I miss any? Good questions, five questions. Okay, well, any last minute ones? I'm here to help. I can be reached by the way if you, I don't know if my name was ever up on the screen, but Jagar is pretty unique. So if you find a Steve Jagar, G-I-G-U-E, you'll find me on LinkedIn. I can't hide, unfortunately. You can ask me questions there. Any reason for not covering SBOM? Because I hear the word SBOM 400 times a day and maybe I was rebelling and decided not to say SBOM. SBOM is almost, SBOM is almost there, I think. I know there's a bit of a mandate, particularly in North America for SBOM generation. I think that's all a great, very good step forward. Software bill of materials for those of you who are like, SBOM, what's he talking about? Generally created by software composition analysis tools and container scanners, et cetera, that are saying this is the list of all my dependencies. This is, here they are, so that full disclosure, these are the dependencies that are in the package that I am shipping to you. It's a great ingredients list. Same as when you buy food, you got all your ingredients there. You know what's in it, you know the calories, you know everything, right? This is an amazing step forward in software to have software bills and materials. However, I don't 100% think that SBOMs solve much because again, these are just packages. Packages have vulnerabilities. Vulnerabilities aren't necessarily threatening unless there's some risk there. There's an additional addition to SBOMs, which is VEX that is looking at bringing context to SBOMs. And I think in combination, once that industry matures a little bit, then that actually will bring more relevance at the moment to SBOMs. But right now, SBOMs almost feel like some certain compliance directives in that. It's a good thing to have, but we're not necessarily leveraging yet. And in particular, if you actually created a real SBOM, in many cases, it doesn't go deep enough. Like if you look at the potential SBOM for Kubernetes itself, if you went through all transitive dependencies and put that on an SBOM, it is unbelievably, unreadably huge. So we need to create SBOMs. I think it's a step in the right direction, but right now, it's a little bit of theater at the moment. So that's not why I didn't mention it, but that's my comment on it. That was a good one. Maybe say something controversial. Okay, maybe we're done. Oh, look at that. Well, thanks, Prakash. All right, all ready to wrap up, Steve? I think we're good. All right, thank you so much, Stephen, for your time today, and thank you everyone for joining us. As a reminder, this recording will be on the Linux Foundation's YouTube page later today. We hope you join us for future webinars. Have a wonderful day.


The NCSSM online Student Summer Symposium is an immersive, research-based, collaborative learning experience for rising seniors in the NCSSM online program. This summer residential program brings these students together for a week, engaging them in a problem-based, face-to-face learning experience that takes them beyond the bounds of their online classes. And each year, students will focus on a completely different contemporary problem. This year, students were divided into teams and worked with experienced NCSSM faculty on several facets of the topic. The symposium project, the theme this year is the Global Energy Crisis, and what we've been working on is each person is put into a different group, and there's three groups that represent three different parts of the world. The U.S. and Australia is one group, China and India is a second group, and then Nigeria and Sudan is a third group. And each of those groups study the problems that each country has with their energy and how the energy is running out. NASA simulation models were used to predict how the global climate is affected by the composition of the atmosphere. Mathematical applications related to the global energy crisis allowed for the extensive use of data analysis. Students also looked at the social, political, and economic influence of the global energy crisis as well as the potential political and diplomatic ways of solving these problems. The research is similar to what we did in AP Environmental Science, but more so. So it's really kind of giving me this opportunity to look deeper into a lot of topics where it's like, oh, I'm really interested in this, but oh, hey, we've got to move on to the next thing. I have learned a lot about India and China, because that's our group, India and China. I've learned all about their energy crisis, their power grids. I was researching alternative energy for Nigeria, and they had an experiment with seven little towns in Nigeria and see the wind speed monthly. And they were collecting data to see if the wind is powerful enough to install term binds. Through this program now, I really want to go to Africa after college or during one of my years in college and to visit and see how they're doing now, economic issue and oil crisis and how they're dealing with it. On a typical day, the teams work together within an aggressive academic schedule.  And class is pretty intense, but depending on your teacher, it can be, you know, you can, you laugh, you have fun, you joke around, but you get a lot done. And you're learning in a very fun environment. And then from class, you'll do maybe some extra stuff that's related to class, but then after that, it's lunch, and then maybe a little more class, maybe something special, a school setup, like a lecture or something. And then you get time to yourself, dinner, and then stuff in there. This has been a lot of time working with me and the other faculty members in a traditional classroom and we brought in guest speakers. The guest speakers were primarily from local universities, scientists and graduate students who were working on developing some really innovative technology in the field of renewable energy. In addition to guest lecturers who address the current topic and the hours of academic sessions per day spent on research, students create web resources that show the results of their experience and demonstrate their problem-solving skills and ability to design 21st century communication models. By applying research skills within the context of a real-life contemporary problem, this in-depth exploration allows students to hone their skills as ethical thinkers and leaders. What I've taken away from this symposium is just all the teamwork aspects that have come out of working together with groups. You get to work with the kids that you work with all year. You can interact, have fun, and it's really cool because they give you free time, but it is strenuous. You have to work really hard, but it's still fun, overall. I think being in such an intense environment with people that you know, that's the best part. And I've made really good friends here and I know that I'm going to keep in touch with them.