All right. Well, I will call the March 11th airport advisory board meeting to order. Good evening everyone. It's nice to see you all. Michelle, can you please call the roll? Yeah. Board members Steve Blitt. Here. Malcolm Dean. I'm here. Harrison Earl. Yeah. Ken Jacobson. Here. Melinda Jordan. Here. Russell Robison. Here. Orion Wiseman. Here. Council Member Peck. You have a forum. Wonderful. Thank you. First item on the agenda is our public invited to be heard. So in just a moment, Michelle, I'll ask you to unmute anyone who wishes to speak. Same rules as previously. We'll have three minutes for anyone who wants to give a comment and ask them to state name and address to start the comments. Address comments to the board, please. OK. Heather, just one meeting. So maybe he wants to make his comment later in the meeting? Yes. There we go. OK. All right. Seeing no one wishing to comment at this time, we'll move next agenda topic of approval of minutes. Any moments from the board tweaks anything on the minutes from our February 11, 2021 meeting? Having read and reviewed the minutes, I move that they be approved as written. I'll second that. Thank you. So moved by the Vice Chair Jordan and seconded by Board Member Bliss. Any discussion from anyone on the board? I had a quick question. Yes, sir. David Splater, he mentioned last month about the leasing of all the hangers. Does anybody own the hangers outright so that they're not paying a lease or are all the hangers being leased along the airport? Board Member, can I ask you to hold that till a little bit later? Just hold the minutes and come back to it if that's OK. OK. On the minutes, then, any other comments? All right. So I am going to call roll for each of our votes in accordance with the new participation policy we're going to discuss in a little bit just so we're ahead of that. So Vice Chair Jordan. I approve. Is that a yes or a OK? Yes, I vote yes. Board Member Bliss. I approve. Board Member Dean. I approve. Board Member Jacobson. I approve. Board Member Rubison. I. Board Member Weisman. I'm going to abstain because I wasn't here at the last meeting. Thank you. And the chair will also vote to approve. So that is six approve one abstention. The motion carries and we approve the minutes. Next item on the agenda is old business financial update. Mr. Slater, would you like to kick us off? Sure. Revenue to date is $160,556.49. Expended and or encumbered is $57,394.43. Expended and encumbered $26,220. That $26,220 is for the upcoming work that we're going to do on the detention pond, the water quality pond to bring in the blast with stormwater quality. And then so the total difference between revenue and expanded and encumbered is $76,942.06 to the good. Nice. There was $4,495 under professional contract services to pet ditch company that had to do with the runway safety area project that we did last year. And we are finalizing payments on those items and should be getting close to closing that out financially and completely. Currently, the snow removal services were at $14,217.50. And obviously this weekend that will probably go up fairly significantly due to the upcoming snowstorm. Maybe you hold just for a second. Board Member Bliss, you had a question there. Say that first item that you for professional contract services, what was that? The engineering review that's done by pet ditch company. OK, got you. That answers the question. Thank you. Sure. That $68,877 was for a couple of months of cleaning at the public restroom. We have decided to do away. They keep raising their rates on cleaning that. And so we decided to do away with that contract for the airport. That's just one restroom, one room that needs cleaning and maintaining and the amount that they were wanting to charge for maintaining that had increased significantly. So there's another department in the city that has a full-time cleaning person on staff. And we are going to borrow there. Well, I say borrow. We're going to use that employee to clean each week. And it shouldn't take them very long. So we'll do an interdepartmental billing memo for that going forward, I suspect. Is that somebody that's moving around in the other buildings in the area and will hit us as they go by? Nice. That's good. Yes. That's correct. Yeah. And the Port of Potty Service, that's kind of they had increased their rates as well, but not outrageously. So that's where we're at 344 on that through February. Any other questions? Yeah, can we pause for any more questions from that part? Barbara or Bliss? Yes. You talked about this peck-ditch company, the Engineering Review. And in 2020, there's a peck-ditch company. And it says RSA Plan Review. What is RSA? That's Runway Safety Area. Runway Safety Area. OK. Could I make a request that any time you put an acronym in there that you write it out? Because there's so many acronyms. I don't know what they are. I'll make that change. Thank you. OK. Wouldn't be aviation without them, would it? No, it wouldn't be. Mr. Slater, do you think you can address Board Member Dean's previous questions? Since we're on, I asked him to talk about the, I guess, hanger rental and business model, maybe. Right. So the airport ground is owned and operated by the city along my, so we just lease the property. And the individual hangers and structures of the lessees or airport owners, investors, and people like that that have a hanger or whatever out here, those are from the foundation up belong to the private owner. So the buildings themselves are privately owned. And the only exception to that is the electrical vault and the building that I'm in. OK. Let me sit down with those two buildings. OK. That makes sense. I was just curious. Sure. Other questions from any board members at this point? Well, I'm sorry. I have one more question. And this goes back to 2019 on the professional contract. What is the safety risk management analysis for $27,000? That was during the time that we were addressing concerns with safety regarding skydiving. And so we hired a professional consultant to do a safety risk analysis. And that was the fee. If you missed a heck of a public meeting on that one. I guess I did. Well, right below it. OK, I understand that now. Right below it. What's the stakeholder meeting facilitator? What is that? That was part of that process. That was part of the same process. And the city thought it would be best if they hired an independent third party facilitator to facilitate between. To stop the fights? Pretty much. OK. That answers that. Thank you. Board Member Jacobson, did you have a question there? Just a question on snow removal with the upcoming weekend storm, how much do you anticipate that number going up because of it? And are you making any special preparations for it? So yes, I've spoken with the contractor. They are going to have additional equipment on standby as needed, meaning if they have to bring in a dump truck and load big piles of snow to move to the dump locations, they'll be able to do that. And just planning on hitting it and keeping up with it as much as we can when it gets heavy. My biggest concern with the upcoming storm is how much rain is going to be often on mixed and alternating between snow showers, rain showers, or a mix of the two, which could possibly create icing conditions. And we don't use chemicals at this airport. So there is the potential for runway closures at certain periods of time, but we're just going to wait and see how that goes and what kind of friction value that we have on the runway before making that decision. As far as the price, I couldn't even guess. I would certainly say it's going to double, but if you're going to have them out there making more passes, as the snow continues to fall, it is probably going to be more than double what their normal bill would be, which is anywhere from $28 to $3,200 an event. That's kind of the range, I guess, depending on how long it takes them to get stuff done. And with additional equipment, that will probably also spark a little bit more in the price. So I couldn't even want to begin to guess. And I just don't like to speculate and then have somebody say, well, you told us this amount. Well, it was the best guess. And I would say that it's going to be at least double what our normal bill is. So I'm guessing probably around $6,000. Maybe I'm thinking more than that, but don't hold me to that. We won't.  I'm watching out the window to see the first flakes in case they happen. Last I saw it was midnight, but it looks like snow. It's gray and dropping, and it's looking like snow. So we'll take the moisture, that's for sure. David, broadly, we're on snow topic really quick. Just that dollar amount in 2021 so far is approaching full year 2020 and substantially higher than full year 2019. Right. You wanted a response to that. No, I'm just kidding. So in those years, there was a time a few years ago that there was a lot of people suggesting and requesting that we go and get a plow from the Denver auction to get things covered because there was a previous contractor a while back that seemed to be having a lot of breakdowns. And I would have to go borrow a truck from next door at Public Works. And so during that time, I was doing a lot of snow plowing, which saved a lot of money. But the snow plowing I started doing was either because there were stuff missed or lots of breakdowns with snow plow equipment and wasn't getting done in a timely manner. So that's all in the past. We have a contractor. And they seem to be doing well so far. And after meeting with LOPA, which is the Longmont Owners and Policy Association, I've had some comments back from them that they said that people seem to be happy with how things are going now. So we're just kind of looking forward and moving forward. Helpful context. Thank you. Sure. Board Member Bliss, did you have another question? Well, it was on the same lines as what you were talking about already, David. But could you just for me, because probably the other board members know this, but will you go over who does the snow plowing? Does the FAA do any of it? No. This is the only items that the FAA takes care of on the airport for maintenance is the, excuse me, the Bassies. They are owned and maintained by the FAA. Outside of that, the city through the airport has a contract with Mountain West Landscapes. And there are other people, individuals out here that have snow plows that do their portion up right up against their hangar and take care of those areas that are not city responsibility. But outside of that, our contractor is Mountain West Landscapes. So the HOAs do not cover their hangars at all? No, they do. Well, they do. Yeah, the HOAs have their own either contractor or someone that is a lessie who has plow equipment on that row or in that group of hangars. To the plowing for those areas, it's their responsibility. OK, thank you. Sure. Any of your questions from the board? They'll let you go into the last page of the financial update since we kind of got stuck in the middle here. Right. Not much to tell on that one for this year. There will be some expenditures that eventually come out and reimbursements under the grant from last year. But that's only to close out the actual grant that carried the financial part that carried from last year into this year. So for now, there's nothing there. As soon as there is, I'll update that page. comments, questions from the board on financial update? They're specific on the capital and the grants or just broadly. I've got one then. I guess on the grant side specifically, two questions on grants. One, the airport's coronavirus relief grants relief and recovery grants program basically cares act two. It looked like $23,000 come in the airport's way. That's correct. And that's a formula set up by the FAA. And they determine how much each airport gets based off of their form. OK. Is there thoughts on how that's going to be used for in 2021? It's even more restrictive than the first glance. So there's not a whole lot we can use it on other than to cover operational cost at the airport. If we do extra cleanings, then it helps cover those costs to do the cleanings like the public restrooms and things like that. And eligible for other operational costs, whether it's salary or otherwise. But it's always take full advantage of it. In other words, it just won't be right to a particular project. Correct. OK. Still good. The other is part of that question that's I think somewhat related to the measure that President Biden signed earlier today. But my understanding is the matching the airport matches on AAP projects is basically covered for the rest of the year for 2021. So given that, I assume that means we save a decent amount on projects. And so one, hopefully, we'll be able to use those on future projects and or accelerate projects. But two, CDOT also is saving some of that money. And my understanding is at least they're giving some of that back to airports and other grants. And I don't know. I honestly don't know the details there, but I don't know what opportunity there is for us to seek out some of the CDOT dollars. Right. So through our CIP process, when we plan out, they require us to plan out ahead the CIP process. We are carrying over our 150,000 non-permer entitlement towards our next CIP project. So we don't have any projects planned for 2021. So and what is covered by that is the CARES Act would cover the state's 5% and it would cover the sponsor, which is the city's or the airport fund, it would cover that 5% if we had a project. But since we don't, we don't get to take advantage of that. Correct. So like last year on the runway safety air project, it was 100% FAA grant. And we received, I don't remember the numbers that I gave you guys. It was the total amount of grants we received in 2020. If you count $69,000 for the CARES Act, the runway safety air project to 100% and the 400,000 towards the Southside utilities was a little over $1 million that we received in grant funds last year. No way to accelerate a project to take advantage of nomad 2021. No, generally you have your business, your engineer estimate, and your engineering at least 75% because we have to plan out based off of what funding they would have available for us. Generally, I mean, we're already in the year that that's available when it became available. Just piece of it not taking advantage of any of the hands. Yeah, right. For whenever Jacob said, did you have a question? Yes, and as a follow up to Russell's question to you last week, David, what about accelerating the paving that we brought up last month? Is that a possibility to figure into grant money? So in our discussion that we had on that, the pavement that Board Member Robinson was talking about was actually areas of tenant responsibility. So that and some of the areas of payment, like the joint sale for the ramp and things like that, the FAA, I mean, if it could we accelerate it earlier on, we could, but we would have to push off the other priorities that we have that are eligible for funds to a different year. So we could swap them around and accelerate them, but you're pushing the other priority projects further down the road. Unfortunately, the FAA in this region kind of does things their own way. And most ADOs are the same way in most aspects. But how they look at runway extensions and things like that is a little bit different in this region than it is in other regions. As far as those eligible items, they all pretty much operate the same way. And the only opportunities that we have to apply for funding is like that $23,000 that they've basically allocated for us. As far as just coming up and doing a project, it has to be planned out further in advance than that because there is a whole process to go through generally starting at least a year and a half out with getting categorical exclusions for environmental, getting the engineering done all the way up through going out to bed and submitting the application, which is SF-424. So it's generally a year and a half process on most projects. If you've already got plans on the shell that are updated, that would be helpful. But we don't have the budget just to hire an engineer to sit there and pump out plans and put them on the shell. And the event money might come up. Any other questions or comments from the board? Mr. Bliss? Yes, David. Another question for you. I was reading something in the Capital Improvement Plan where there was some unforeseen circumstances with engineering. And I think you've addressed this before, but I forgot what you said that that was all about. Is that the sewer system that you're talking about? Yes, the sewer and the water. They were provided all the information back in around October of 2019. They didn't get started on it until the spring of 2020. And the person that did it retired mid-year, just kind of middle of summer, he retired and provided the project plans and everything. And it was set up for an on-call contractor, which we needed to go out to bid on-call contractors not set up for installation. They're set up for repairs. And so the more we looked at the plans, the more we realized it wasn't the layout that we had discussed on multiple occasions. And so the new engineer that took over started not completely over, but did a significant amount of work redoing the plans for that project, which has just recently been completed. But because we carried from 2020 into 2021, we now have to go back to council with mid-year appropriations and get that airport fund money match reappropriated towards the project. Did we pay the first engineer? It was a city engineer. So any payment would be in arrears through the administrative management fee if they charge us at all. And we did it that way because of the limited budget that we had to go towards this, the projected cost of the project. But now we're not using the city engineer, correct? No, we are because they're the ones that designed it. Oh. That's what I'm saying. The new engineer that took over for the city engineer that retired, he's with the city as well. So we've got a good engineer on the project now. And he's got that done and ready to go when we get the appropriations for 2021. Okay. Thank you. Sure. Last call for any questions on the update here. Then I'll move us on to airport needs recommendations to council. Does any board members have anything they'd like to raise? Mr. Ruben, please. Thank you, Mr. Chairman. David, I didn't see any vote on our parks on the lease rate for this year. Did we just go ahead and go with keeping it the same or are we doing that another time? No, we're going to pick it up another month. There's just still too much internal discussion left on that that it wasn't ready to come back to you guys. It will come back again when we're ready to send it to council. Okay. Anyone? Prior to sending it to council, it will go through the board first. Anyone else have anyone? Anything, Mayor? I have one. Last month, council member Peck mentioned in budget process, she's going to again ask for an operations employee for the airport in addition to David, so two employees. Given the budget impact of that, I think it would be appropriate for us to at least discuss whether we'd like to present an opinion to council and that may be an agenda topic for a future meeting that is more appropriate than just open discussion now, but if anyone has any thoughts off the bat, just wanted to throw it out there. So is that, go ahead. Russell, go ahead. Thank you, Mr. Chairman. I guess if you're asking for initial thoughts, I would say David knows if he needs an employee and he knows his budget. So I'll probably take his recommendation on whether it's worth it to him or not. Mr. Slater. I would definitely love some help. And I think that hopefully by 2022 we should have enough for at least a part-time operations agent. I don't know if full-time is gonna be doable, but I will know more in the next few months prior to submitting a request or generally when you submit a request for an employee, it's around the same time as you submit your budget to the city for the following year, which is generally in the June time frame. So I'm hoping the next month or two to have a better idea of how to best capture the funds for another employee. And if it's doable for full-time or just part-time. David, would it be appropriate maybe to add this as a May agenda topic then, knowing that we don't have a June meeting likely and that we can send a letter to council either supporting, expressing the board's opinion so that as they consider it in the fall, they have our advice. Sure. And in fact, if we can do it next month, I'll let you know, but for now I'll have it planned for May. That's great, thank you. And David, you and I were at one of those council meetings I think two years back where it kind of came up and then immediately was taken off. So just wanna make sure we have the opportunity to influence the conversation in advance and provide full contact. So it's not just kind of one-off when it gets out. Any other questions or comments from the board on airport needs recommendations to council? Mr. Bliss. Yeah, I was looking at some of the data on the operation of the airport. And I saw this 75,102 takeoffs and landings. How do you get that figure?  It's well sort of, it's a very complex method of what we call a guesstimate. There are days that I'll go through and count operations at different days, different times of the year and then kind of see what the average looks like. I don't count every single day. I don't have time to do that, but... I just wondered how you got 102,75,102. It's a guesstimate based off of other days. If I know one day I had 140-something operations, then another day I had 98 operations or something like that, then I just kind of look at it and see where in that range do we think that fits? And it's kind of an average type deal, but not exactly. Okay, well, I expected that sort of was, but... And what's most important is, therefore, says how it works. How does that compare to past years? It's certainly lower. We had a lot of operations that were limited during COVID, or at least the initial phases of COVID. There was a lot of activities that were very limited. We even had a point to where my high didn't operate for a while. Some of the flight training did not break for a while. So I would say that it's probably 8,000 to 10,000 lower. That's big. Yeah, I just looked at airnav.com, which gives us an estimate of daily operations, and they had 88,000 for 2019. So that's about 15% less based on David's count last year. I noticed the difference. And like I said, I'm right off the airport, and I work from home, and I definitely know that Scott, I was shut down. The instructors I know were not flying when we were really locked down, and then people just weren't, they weren't going up. They couldn't go anywhere. They couldn't do anything. So they just weren't doing much. It was definitely, it was noticeable. Days where there were absolutely no operations down. So it looks like it's getting back to more normal. So that normal will take, it's good. Anyone else questions, comments, items for council? Hearing none, we'll move on to new business. First item there is adoption of the electronic participation policy during City of Longmont Board and Commission meetings. David or Michelle, I don't know if either of you want to kind of open this up or describe what this is for us. I don't want to put Michelle on the spot, although she would probably be better at doing it, but basically the board, the city has many or several boards and commissions and as well as the city council meetings. And so they want to put in place a written policy that everyone is aware of that basically outlines how and why virtual meetings would be done or electronic or telephonic. And so this policy is just that and kind of encapsulates what the city expects and how they run, how they operate, why it's done that way to the greatest extent possible, I guess. I don't know a whole lot more to say about that other than just going paragraph by paragraph, which I don't think is necessary. No, I don't think that's necessary. I think that was helpful just to get the context for board members and I guess we'll maybe see if any board members have questions beyond that and then entertain a motion to adopt it. So I did read it, but I didn't catch doing an audible vote instead of Gayne. I don't recall seeing that in there. So is that? Yeah, it's, you mean the roll call vote? Yeah, was it? I was gonna comment on that. Go ahead, Ms. Nets. So I talked to our city clerk today and as we don't have to do that, as long as it's clear in the video who voted for what or how they voted, then you don't have to do it one by one like that. Okay. You could just say, you know, all in favor, I, anybody oppose me and then name if anybody says, you know, vote against or something like that. That's all you need to do. So if it sounds like we've got all eyes like on passing the minutes, we wouldn't need to do it. But if we're voting, probably specifically on issues, we'd wanna go around and do it for that. Wouldn't even have to do that. You can just say all in favor, say I and then all opposed, say nay. Okay.  And then you'd be fine. Just as long as it's specific of who made the motion, who seconded the motion and then who voted which way. Okay. Given that information, then it kinda sounds like if you have more than one nay and you don't know who said it and it seems like the vote may be closed, then you might wanna do the roll call. You could do that or you could just hold your hand up as well and then make sure that everybody, because that's what I, when they do council meetings, that does that for what they do.  But it's totally up to you to make it easier and, you know, quicker. Thank you. I appreciate that. I don't wanna call Errol. You can really go with hands. I like that suggestion, most board disagrees. Right. Board member Weislin, did you have a question or comment there? Well, it sounds like you've already stated your preference. I was going to say that whatever adds clarity and whatever is easier for you to administer is probably the direction we should go, but I like hands as well. So I'll speak in favor of that. But I think what matters is that it's something that facilitates the meeting and keeps us moving forward. So what, what you're most comfortable with. Agreed. Thank you. And, you know, if we end up where it's close then we may do a roll call and just make sure it's very clear, but approval of the minutes. I'm not gonna worry terribly since generally those are pretty easy votes. Do we need to move to accept this? I don't, I don't consider it to adopt it. So I move that we adopt the electronic participation policy during City of Longmont Board and Commission meetings as spelled out. I'll second the motion. Thank you. So moved by Vice Chair Jordan seconded by Member Jacobson. Any further questions or discussion prior to voting? Mr. Bliss. Is this something we're going to do forever or is this just the guidelines for the electronic meetings? You know, I don't want to speak for city management nor will I, but in my viewpoint I suspect that if it ever becomes something that's not needed or needs to be changed, they'll either amend it and send it back out or do away with it. But I suspect as far as technology has come these days that they'll probably just leave it in place. Even if we go back to meeting in person should there be an event come up again later where, or if the Board chooses to do virtual meetings for some other emergency. My understanding from City Attorney is that it's only during emergencies, a pandemic or some kind of unforeseen emergency, yeah. So it'll probably be in place forever just for when you do have an emergency. Once Council meetings, Council goes back to meetings in person, then all boards will go back to meetings in person, and that's what it sounds like they're doing. And then this will just be a point at that point, hopefully. Hopefully, I'd like to go back to person, Michelle, just since you mentioned it, is there any timeline for when Council is thinking of that at the moment? We're hoping June, but it could be August it depends on vaccines, really. But aiming for June is what we're aiming for right now. That's helpful, Anderson, thank you. Board Member Robeson, did you have a question there? Thanks, yeah, I was gonna ask basically the same thing. I was just looking at the health levels for Boulder County and I don't know if we'd qualify as a seated event there in the Council chambers, but it would appear that we could convene in person based on that, but I guess it sounds like we're waiting for everyone to have the vaccine. Is that the threshold? Not necessarily. Us, Board Members having vaccines, but just getting more and more. Be nice to have members of the public be able to participate safely too, I imagine. Exactly.  Yeah, I mean, just looking at it, if everybody's sitting six feet apart and wearing masks, unless I'm reading it wrong, it would appear we could do it in person now, but maybe I'm missing something. Yeah. I think we could, the upside is we don't have to wear masks when we're meeting like this, which is... That is nice. Yeah, I do appreciate that. Nobody understands me anyway, so... Add a mask to it. Anyway, we're so close to general availability of the vaccine. It seems kind of silly to rush if we're really just talking about a matter of month. Yeah, I think we're getting close. We have a motion on the floor to adopt the policy. Any further questions before we vote? Hearing none, we'll try our hand raising here. So all board members in favor of adopting the policy, raise your hands please. Okay, anyone opposed? Or Dean, I could not see your hand in either one of those. I'm sorry, can you either aye or nay? Who was that for? Malcolm. Oh, I'm sorry, I had my hand raised. Yeah, that's it, I said aye. I thank you. I just couldn't see your hand on the screen. So I think that was everyone in favor of adopting. So thank you all. Next topic there then is the advisory board and a report to council. So you all have had this in the packet in advance. The idea here is a vote to approve and send it to council. Any discussion from the board prior to that? Mr. Robison. I didn't hear anybody immediately lodging any major complaints. So I'll skip right down to minor and pedantic on the just the formatting at the bottom of the goals on the airport goals and accomplishment. Some of the headers are all caps and some are regular capitalization. So just for consistency, I guess if we could change that to one or the other that would please me. I will make those adjustments. Thank you. On a positive note, our pilots and pause made the newspaper if you saw that and got there were a lot of calls, TC line and open editorial and received a lot of praise. I think I saw probably three, six, nine at least calls in or compliments to the pilots that are flying to rescue animals. And that was sort of a, I think I don't know how the paper found out about it. I had talked to James and interviewed him for the annual report. And then they caught wind of it and went out and got some photos and they've just really got, netted some really good community engagement, really positive. And of course, the medical flights that are flown with the phenom that way tag flies. Nobody's really ever asked about those. And I think everybody assumes those are business flights, but he does do quite a bit with that. And he'd had some really nice write-ups in national publications as well. So some nice visibility for our airport and to kind of remind people in the area that see the jets and maybe want to complain about it or the helicopters when we're doing training. I really look at this report. I hope that it's where the public can get to it to see that and kind of understand some of the justification behind the use of the airport and how it contributes back to the community. I know we produce it, it goes to council, it'll be a part of the record there. And I just am really pleased with the coverage that we got on some really positive stuff on what was otherwise a pretty quiet year for the airport. Like was Linda, I think that was, it's great to highlight it here as well. Yeah. Really positive. Any other questions, comments, concerns? Then I would entertain a motion to approve the report and send to council. With the caveat that I'm changing the head. Yes, motion to approve as amended. There you go. I make a motion that we approve the 2020 annual report for the airport with the amendment. I actually, I'm going to withdraw that. One more thing, in the 2020 airport data, the total flight operations is 66,318, but in the sidebar, it's 75, 102. Yeah, I need to make that change. Sorry. Okay. So I move that with that change and the header font changes that we approve the 2020 airport annual report as written and for presentation to council. Second. Move in seconded. Any last discussion on the motion? Sorry, who seconded that? That's it. Thank you. All right, hearing no further discussion, let's vote. So all those in favor of adopting the report as amended, raise your hand please. Aye. Aye. Thank you. Anyone opposed, raise your hand. And Michelle, just for the record, it looks like a board member bliss dropped off here. So we are six in favor and board member bliss not present. Thank you. All right. So then we will move right along to our final public invited to be heard. Michelle, if you can unmute, if there is someone who wishes to provide comment, same rules, three minutes for comment, please state name and address at the beginning and address your comments to the board. This is Don Dolcy and 335 Pratt Street, Longmont. Hopefully you can hear me. My question concerns the noise complaint log. And I think that's a very nice summary that's been presented in the body of the presentation that's going to council. Mike, I've delved deeply into noise for a number of years and looked at the nature of the noise complaints. And so I'm wondering if I could get some additional information, it would be in the form of detailing how many times individuals complained about the various things they could complain about, which would be a general aviation, skydiving, helicopter and et cetera, those categories that they do have a tick mark in. As an example, we have one complainer that complained 31 times. So individual number one complained 31 times, what? Sorry, it all somehow it froze, so I just got back. What happened? Not sure, but we're all back here. Okay, so the question was on the number of complaints. I'm still here. I think so. You're still there, you were. The last time I heard was the word what. What? Sir, we did go ahead and unmute you back again. Go ahead. Okay, thank you, I'm on. I'm not sure where the word what was in the list. You were gonna ask you had one complainer, one person with 31 complaints and you were gonna ask a question about that, the nature of the complaints, I think. Okay, here was the information I needed if I could get it. So we have one person that complained 31 times. I'm interested in what did that one person actually complain about? Did that person complain about the whole spectrum of things that are tallied in the report already or did that one person complain only about skydiving? And as you work your way back up through the list, person number two complained four times, but what did they complain about? And so in the end, there would be 34 different individuals and they all complained about something or a variety of things and that information would allow an expected and observed statistical analysis to be made to see if there are any statistical outliers in the data that tend to bias these reports. So that's the kind of information I would like to have if possible. Thank you, Mr. Olson for the comment. Mr. Slater, perhaps in the final staff comments here, you might be able to address that a little bit. So with that then, hearing nobody else wishing to make public comment, we will move on to board council representative and or staff comments and I'll start with the board. Any board members wish to make additional comments? Mr. Slater, would you like to make any comments? David, you're muted, unfortunately. Thank you. Sorry. With regards to the questions that was posed and public about it to be heard, there is an analysis by complaint type. It just doesn't break it out by each individual complainer, which I guess that could be a curiosity question for some people. I think this is more of a presentation to council over just going into the overall generalities of the noise complaint system and how that helps me as the manager. This is just information that they've wanted to see. You could put the extra work into coming up with many different various tables and graphs and charts from any amount of information that comes from that system. I'll be happy to provide Mr. Dulce with the data that we have from that system. And typically he, each year he generally makes a public records request for that data. Just haven't seen one this year, but I will get with him and see about getting him that data so that he can go through it as he likes. But as far as the format of this information, this is the format and the information that council looks at. And we do break it down. We do have an analysis by complaint type. Specifically the one person that complained 31 times is was about skydiving. And generally when you have one person complain that often, that's historically been the case. Right, there's a lot that goes into breaking all this data down and figuring out how many complained about what category as well as the last table on the last page that you see there. How many people complained how many times? Which is the kind of information that we're wanting to clarify. Outside of that, the way it helps me is I look at the areas that seem to be the most affected or hardest hit if you will and try to put that information out to the politics to ask for being good neighbors and being courteous as much as possible. The one thing I will note for this report is if you look at general aviation, it comes a lot closer percentage wise to skydiving than it has in the past because people have been at home more working from home because of COVID and believe it or not, a lot of the complaints are about touching go operations and generally it's from somebody that was next to the airport. Phone calls that I've received that people are asking about touching goes that they may have found a complaint here or may not have. I've actually had people under the downwind leg for two nine complaint. I've had people off the approach end of, or sorry, the departure end of one one approach end of two nine complaint and then again some to the south and the other hotspot areas that we typically had but now we're getting more under the downwind and there's not a whole lot that can be done about that. Actually nothing really can be done about that because it's under the pattern. That's the established traffic pattern and that's what I tell them. So a lot of what you see under general aviation has been people complaining about touching go operations and generally they're living right next door to the airport. I did see a flurry of chatter on next door from Southmore Park, the area closer to Pike Road during the lockdown and claiming 500 feet overhead and pilots coming in from other airports to use ours and there was quite a bit of chatter that I kind of just watched and then Trevor Bear was also watching it and he helps us with our social media as well. So the Skydive complaints kind of speak for themselves the single helicopter three on the jet some people get frightened when it comes in solo on final there but the GA complaints is the one that we really can do something about if there's something to be done but I think we're gonna see it was really people being at home and actually not directly under the pattern and that was part of the complaint but when I lived at Pike Road, I was in the path I was right in the path with that Mitsubishi and it would go over all the time. So that into town does get traffic coming in and I know I think that generated some complaints from down there but it's good to see them down overall just to see that number be so much smaller and you get the odd complaints and so I think it's really if we know more about the GA complaints or if there's anything spectacular out of the Skydive other than just them going up and getting out to you then that would be interesting information but otherwise it's really good to see them be down especially in a year where everybody was home. Agreed, Linda and David that was a really helpful comment, thank you. Any, David, did you have any other topics you wanted to raise in common section here? I don't think so. All right, well, since we don't have a council member tonight last call for any board members. All right, then we will adjourn the March 11th, 2021 airport advisory board meeting. Thank you everyone for participating tonight and we'll see you next month. All right. Good night. Take care. Good night. Good night. Sorry, I left.


The past few days have seen developments on the COVID-19 front. On the one hand, after the rise in cases, Chinese authorities imposed a regime of lockdown and testing in the city of Shanghai. This is in continuation of its zero COVID-19 policy, which has seen a strong focus on identification of every case. We have also seen a rise in cases in European countries, which have of course followed a very different strategy in dealing with COVID-19. A lot of this is attributable to particularly transmissible strains of Omicron. Immunologist Dr. Satyajit Rath analyzes the recent developments and what it means for the battle against the pandemic. Hello and in this week's COVID pandemic roundup, it's quite obvious by now that COVID cases have begun to explode in two different and interesting places in the world. One, everybody is concerned with the news that COVID cases have been growing to the point of three, four, five thousand cases a day in Shanghai, in China. And the Chinese government's public health policy response is interesting to take note of. The second piece of news, of course, is that COVID cases have begun to grow once again. The numbers have begun to grow once again across Europe and this includes France, this includes Germany, this includes the United Kingdom, this includes Italy. So in all of these places in Europe, when cases had gone up to very high numbers a couple of months back and numbers had come down, case numbers have begun to go up again. And it's interesting to look at the implications of these case numbers. So in the first place, the increase in case numbers in China, especially in Shanghai, needs to be seen on the background that China, like New Zealand had adopted a zero COVID policy. New Zealand, of course, has now begun to set that policy aside. The Chinese public health authorities are still very much pursuing a zero COVID policy. What is a zero COVID policy? A zero COVID policy is that all cases are going to be identified, meaning that all infections are going to be identified. Since increasingly, a very large proportion of these infections are asymptomatic, that means that testing does not depend on people going voluntarily because they feel unwell to get tested for the virus with an RTPCR test. Instead, it means that you are doing intensive testing in communities. To the point that the Chinese authorities have now adopted a shutdown of half of Shanghai, the new area, the airport and the financial district have been closed down for a few days. And intensive testing is going to be done, followed by the other half of the city being closed down and intensive testing being done there, so as to keep case numbers extremely low. We should keep in mind that when we say Chinese COVID case numbers are going up, that doesn't mean that those case numbers are matching as infections per million population. Anything like what even India has seen, leave alone what the global North, Europe and North Canada and the US have seen. These are still very small numbers and that's why it needs to be kept in mind that this is on the background of a zero COVID policy. So it's worthwhile asking, why are Shanghai numbers going up? And there are three factors at play here. One, even though China's vaccination numbers are significantly higher, not just significantly higher than Indian numbers, but significantly higher than European numbers. 85 plus percent of the population that has been vaccinated. Despite that, there are always going to be dropouts and therefore there are always going to be a few scattered vulnerable people. That's one. A second is, as we keep noting in many of these conversations, the current strains of the COVID virus that are circulating, strains that belong to the Omicron family, are strains that can infect vaccinated people. And that's the key difference why these new strains of the virus have essentially overcome the Chinese zero COVID policy barrier and have begun to infect people. So it's not simply the non-vaccinated people that are getting infected. Vaccinated people are also getting infected. But in Shanghai, in these numbers, a very large proportion of the people who are getting infected are asymptomatic, meaning that they're being detected only because of intensive testing is being done and very few people are lining up in hospitals. Even though these infected numbers are in the thousands, the numbers of people in hospital are a few score are in 40, 50, 80, 100 kind of numbers. And this is because the vaccines are providing protection against severe illness, hospitalization, leave alone death. But transmission is not stopping. Add to this the last factor, which is that the Omicron strain of the virus, particularly the current strain of the Omicron family, which is called the BA2 strain, is extremely infectious. It's very easily transmissible. In fact, it's very efficiently transmitted. It's the most efficiently transmissible strain that we've seen over the past two and a half years. And all of these factors put together, even China's zero COVID policy is being repeatedly put under strain. And it remains to be seen how China responds, whether this response that they adopted is going to be successful or not. We can, in another episode, debate whether the zero COVID policy, what it costs, what it takes as a public health infrastructure, has a precondition and just how much it saves in terms of lives and how much it saves in terms of lives saved from COVID, as well as lives saved from non-COVID illnesses, treatment of which is also put under stress in the COVID pandemic. And finally, of course, the economic costs of these intensive non-COVID policies. The European situation is a little bit different. Keep in mind that Europe first saw the Omicron family BA1 strain of the virus spreading. And that spread is, again, a consequence of significant non-vaccinated clusters in the community. So this is not statistically random individuals who forgot or who dropped out of vaccination. This is people who have cultural connections to each other, who meet each other and so on and so forth, and who've chosen not to be vaccinated across the global north. There are communities like that. And the virus will spread extremely rapidly in these communities and will cause severe illness hospitalization requirements. So if you look at the numbers in European communities, these are quite rapidly going up in hospitalizations as well, but nowhere near the same rates of increase as infection numbers. Because intensive testing is not being done as a public health policy measure in Europe, the case numbers themselves are not as deeply meaningful as the Chinese numbers are. It does show up clearly, and they are going up and they are going up because now it's the BA2 strain of the virus that's much more easily transmissible, coupled to the fact that physical distancing measures have now been largely withdrawn. People are coming out, people are sitting together to the point that good efficient masking is also less and less in evidence and therefore transmission is happening. Hospitalization is going up, but hospitalization has not exceeded so far the ability of the critical healthcare systems to respond to the needs of COVID related severe illnesses. Again and again, this comes down to how much strength and resilience the critical healthcare system has, how much has been invested, how much has been provided, how much is available, both in terms of personnel and in terms of hospital beds and related instrumentation resources. Clearly the BA2 strain is likely to spread elsewhere, but equally clearly these are all local outbreaks that are going up, coming down then moving somewhere else and they will go up and come down somewhere. So again and again we are seeing the local outbreak nature more and more in evidence of this virus, where it will go next, in all likelihood it will go to North America from Europe, if previous experience is any guide, whether we will see these numbers and India remains to be seen. What's even more concerning is the fact that we don't have any information on this large scale because of a lack of that level of testing in Africa and in Latin America and those numbers are important. It remains to be seen whether those numbers will incorporate, increases in hospitalization numbers and in critical healthcare systems being put under strain and that's going to be the next step this much for this week.


All right. Welcome everybody to the February 9th hyperledger technical oversight committee call as you are all aware. We've all been on this call before two things that we must abide by. The first is the antitrust policy that is currently being displayed on the screen. And the second is our code of conduct, which is linked in the agenda. So as far as announcements today we have the standard hyperledger definitely developer newsletter goes out each Friday. If you have anything that you would like to include in that newsletter. Please leave a comment on the newsletter wiki page that is linked in the agenda. The last announcement that we have may have seen this showing up on some of your socials but hyperledger is the winner of the 2023 devies award for the best innovation in blockchain cryptocurrency Web three. I understand that we have Bobby to thank for this for nominating hyperledger so congratulations to everybody on this award. And then the last announcement that is on the agenda here is the hyperledger mentorship program has been kicked off. So that we're currently looking for mentorship project proposals to be submitted. If you do have something that you would like to propose please do so by March 15. Any other announcements that anybody has or would like to make. I will take that as you know. So for quarterly reports I did see a number of people reviewing reports this morning on GitHub there's been a lot of back and forth. A lot of comments happening on these different reports that have come in. We still do have people who are outstanding as far as the reviews for both of these reports so we will continue to leave them in an open state. I did not specifically see anything that we need to discuss on the TOC call but is there anything that anybody has to bring up on the Indie or the noncredge report at this point. Okay. And then as far as the soft tooth report I think we have eight of the 11 people who've reviewed that one that came in a couple weeks ago, maybe last week. Please if you haven't had a chance to review that yet please do so. We'll again wait until everybody clicks on the approve, or has a chance to review that for us to merge that into the into the repo. So there has been on the Ursa report. I just wanted to mention that there has been activity in Ursa in the last couple of days, the last couple of weeks and so I've asked Brett Zundle who's been doing some of the updates to put in the report so I'm hoping that we'll get that soon so he has some guidance on how to do it and hopefully we'll provide it soon. All right, I appreciate the update on that Steven, I did see that as well the chat going on there in the Ursa channel so but I appreciate you bringing that up here. I think it's important, as we kick this project back up for us to start, you know, at least understanding what's going on there so appreciate that. Any other comments on the quarterly reports at this point. All right, as you probably noticed there was a fourth report there, Iroha did submit the report yesterday. It is not linked here but it will be linked for next week's agenda since it was due today. We'll make sure that gets out there so that if you haven't had a chance to take a look at that you'll at least remember to do that based on the agenda. And then we do have the bevel report that comes due next week. So we'll look forward to seeing that hopefully sometime next week. Yes or no. Yes, hi. I had a very practical question on the reports, managing the reports and GitHub. So, I mean one thing that I liked in the week is I could go to the task I had then I could see which one I had not reviewed yet. I mean, right, do you know any magic query that I can use to see which one I haven't reviewed yet. So the link that's in the agenda will actually pull up the ones that you haven't reviewed. So, if you've reviewed them already they won't show up in this list if you haven't reviewed them they will show up in this list. Thank you. I didn't realize that was the link in there so I would just go to pull requests and I'm like oh shoot which one I have. All days it's not obvious to remember. So the trick is to go back to link. Thank you. You won't find anything for that name because there is nobody with that name but yeah anyway, the that link I tried to mimic what I had in the other agenda where we had it on the wiki where you can see like your outstanding I tried to do that for the outstanding quarterly report so there's a few things that I'm doing or I noticed what I did on one of the reports is I'm adding the quarterly report label to them so that we know their quarterly reports. And also making sure that we add all 11 POC members unless of course they submitted the PR to the reviewer list so that each of you should get an individual email for each of them saying that you're been at it as a reviewer for them, assuming that you are subscribed to receive the emails from GitHub. So, hoping that will help people to recognize that they have outstanding tasks for themselves to do. That is great. Thank you. I'm also trying to figure out a way to make these to have embedded in the template, the label. So I know it's possible. I just haven't figured out how to get to work yet. I did add a code owner's file, which has everyone listed individually. My hope is that that the next PR comes in will be given to everyone individually to review. All right, we will keep you informed about right. See whether or not that happens. Thank you for trying to make it as easy as possible on us all. All right, any other comments are tactical or on the reports themselves. Yeah, Peter. Thank you, Tracy. Hi, everyone. Sorry, I was away for long. I had a lot of travel doing what I wanted to highlight is what I put in the chat, which is that there's this pull request merge key feature coming out from GitHub and I think everyone should check it out because it will drive efficiency of CI pipelines that all the projects have. Basically, what it does is that it orders the pull requests into a stack and then the CI and the tests and the build everything within the CI only checks can be executed against a revision of that pull request that it will have at the time of its merging, which can be known if there is a queue or stack structure queue. I guess not stacks are because that way you can always compute what other pull requests will be merged before your own. And then the source code revision can be figured out that will be the final revision that will be merged onto the project's main branch. And so instead of having to run the CI end times because of other pull requests getting merged before yours, the number of times you have to run the CI will be just the one as long as you have a place in the queue. I don't know how clearly I explained this, but the bottom line is that it's more efficient and I highly recommend using it when it becomes generally available. I will definitely use it in its current state in the public beta because I'm really curious about it and I'm very excited about it. That's it. Thank you. So for those that have been with us for a while, this is Garrett functionality where you would have a bunch of changes in a stack and then you would merge the parent one and then everything would happen. So, if you own or if you are an admin, the setting is in your repo settings branch protection. If you have any questions, please ask on discord and I would be happy to enable us for everyone. I also, I mentioned this in the maintainers channel. I turned on for the entire org the private security disclosure feature. So if you get any disclosures, and you're surprised by that, please get in contact. All right. Thank you, Peter. Thank you right for bringing our attention to some new features. Good news for for us as maintainers of project. Any other comments at this point. All right, so I think for discussion, we didn't have any specific topics for the doc to discuss today as a whole. So, as you have, as we discussed last week, the beginning of the round Robin for the different task forces. And so we've got first up the security vulnerability disclosure task force that we will be discussing today unless anybody else has a discussion item before we get to the task force discussion. Okay, then I think we are up to the task force discussion. So, Aaron, I know you have volunteered to be the leader for this particular task force. Do you want to, I don't know, walk us through kind of what the this task force is all about and what the plans are for how we approach this particular work item. All right. Thanks, Tracy. And hey, everyone. And so, before I begin right so some disclosures. So previously when we had security update task force was proposed early last year. The, the what we lacked over there is to scope it down into specific activities that are specific expectations that we wanted out of it. We started with some agenda and it eventually evolved into security being a wide domain. The discussion spread all over from having a threat modeling for a specific project and all the way. It's definitely started with vulnerability disclosure topic. And eventually it landed up to the topic where how do we do a threat modeling of a project and which parameter should be considered. And it also led into discussions into how do we tackle if a project is unable to deal with a high severe, I mean, high or severe issues that were reported. And what's the process that we should set up in terms of addressing these and do we need a formal way of announcing to every every graduated project that there is a process of type ledger and then this is that process. And follow these guidelines right. So, as you can understand the discussions went all over the place. Now, one of the topic that that we had to address or that we could have started with is of course on the vulnerability disclosure.  Right now today and all the projects we do have security MD file markdown file that we add into our repositories in terms of letting people know that if they have any concerns, which they would like to discuss in terms of security. We are telling them, hey, we are responsible cities and then come follow these process that we have either send an email to the security mailing list that goes to a bunch of people or report it in a way. And that in a in a responsible way that you still track it for completion or you still follow up with the maintainers of the project, but there was a way of communication. Is this sufficient or is this probably is not a sufficient model in terms of how we go about and any vulnerability disclosures right and that's where the discussion started and how we even start how do we even standardize the process across all the projects. And at the same time open SSF had the working group it started put putting down a collective information that they could get across all the different open source initiatives. And they created a bunch of checklist and a playbook for how a vulnerability disclosure can be addressed or how it can be treated by the maintainers of each project. So that's that's the brief background of what this topic is all about. And specifically in this task force that we have for now, we will scope it down to what it is meant to do in a sense. We will try to address how vulnerability disclosure would happen and what actions would a particular maintainer have and what actions but the project overall have. And what's the responsibility that we hold from within hyper ledger and what's the like all these questions that we try to address. And as a starting point, we do have a reference that is recommended from the open SSF. So there was a call and if you were part of the previous task force where we went over each of these items. And I remember like having discussions were hard proposed that some of the, let's say the containing things right some of the subjective terms, which are part of open SSF recommendation. We keep them away, but we try to see the rest of those recommendations from open SSF are good point to get started with. And probably as part of this task force will will try to start from there and will definitely start from there. And what we will do eventually is to like address as part of these discussions, whatever questions that come up right. And then we will selectively pick those subjective terms, but our goal should be to have a vulnerability disclosure approach for all hyper ledger projects. And one thing that we will intentionally try to keep away for now is I know like there were also discussions from the previous task force where we were debating on. Should we have additional questions that would gauge severity of a bug or an effect that was reported in terms of security relevance right. And if we were to gauge those, then should we introduce the questions that are like blockchain threat modeling specific. So we will try to keep those questions away in our task force, and that could be like an extended task force or the next task force from within the security scope that we can pick up. So without the limited scope and a set agenda or a set expectation from the task force, we could get started. Before I start sharing the screen and go through the open SSF recommendations that we had previously discussed. Do we have any questions on the scope, the topic or the background. Yeah, my question is, I saw in the chat that was set up for this task force hearts thought on creating a template that would be used by all the hyper ledger projects, and then only changed it for some reason that it felt necessary is that part of the scope of this as well. I'm sure. I think the template so hard correct me if I'm wrong here so I think by template you wanted to say that the the disclosures I mean, did you want to introduce the reporting template or did you mean like a template that we give, give out as a way to tell community that this is the way that you should report vulnerability stores. I believe it was the latter, and I'm pretty sure that it's in line with what you're saying. So maybe using template was just a poor word choice by me. So if I may interject I mean I think, you know, the idea is, we develop the policy because the thing that hard pointed out right is that in the documentation provided by open SSF, they go, it's pretty extensive in terms of what you expected to do. At the end of the day they don't put it all together into a document, they say hey, and by the way you must document all of you know this stuff on your website part of your repository. And so we have to do that hot said, I come they don't provide a template so we, you know, we could already start from that. And so I think hot is right. His idea was, basically, once we have developed our own policy, following the recommendations, we can then submit this to be basically a template for others to use and maybe open SF could leverage that and, you know, publish it. Did I get that right hot. Yeah, absolutely that was perfect. I mean, I do wish the open SSF had a better starting point. And I think if we if we do this work, then yeah I think we can contribute it back. They have expressed interest in this so Yeah, I mean, just just to comment, I like the framing of templates and I think we could think about templates and other cases I know we have the inactivity policy right that we put together that projects can somewhat override if they need to write based on what it is that they're doing. But if projects don't have this document it then this is this is the default and this is what you're going to end up using as the mechanism I think this falls in line with a lot of other things that we should probably think about for our projects. So, I'm perfectly happy with direction I just wanted to make sure that we we had that in mind as we were going through. Yeah, I mean to answer your question I do think this is in scope. Absolutely. Okay. So what I'll probably do, I don't know how to take notes at the same time on screen share so I'll probably take notes on a separate note that I had, and later I'll attach those notes to the meeting minutes. So, so to get started, right. So, one of the repository that I put in the chat on the top under the task force chart group is it has extensive information as are not pointed out right so it has everything from what should an open source maintainer do or a community do in terms of setting up a process as well as it has information on what should you do if you have discovered vulnerability and what's your responsibility to participate in open source collaboration from an individual or a individual's perspective and what kind of recommendations that we have for you in order to get better response from the maintainers right so they they're both topics over here. And what we will focus on to get started with is on the process that we have to set up and eventually all the discussions that lead lead from I mean that evolves from these conversations, we will convert them into a template that we were discussing back. So, the process that we are going to discuss right now is in terms of what open SSF recommends for our setting up a process being an open source community. So, the guide. The guide starts with all the information such as why should we need a process like this right and what's the information that the security researcher or a user of a project be expecting from us, and then how, how should we make it available for them like all of that information in the introductory section. So, how do we go about it like I remember in the previous task force meetings we went through different sections of paragraphs and then we debated on each of them. Should we follow the same approach on this call as well. I think it's up to you, right, I find that useful so that we, we could debate on the topic and then we could finalize on the things that we all agree upon. And then and then and then it also reminds us in future that we did have a discussion on some topics like that. So, initial section of this document at all talks about what's the what does the glossary and other things right so what I will get started with would be Right, I think some of these explanation are all towards what's an expectation from a reporter that they would recognize they would want a recognition or probably they would they are expecting a fix because they have it in their production and and all of that aspect. So, I would suggest that we also incorporate if possible, these kind of information somewhere in our documentation maybe as a central at the central place, saying that we care about security and the we could give this as advisory notice saying that this is your role as an reporter. Right, so somebody who walks in and then says that hey, I thought I found an issue. But how do I go about it what's my right and how do you want me to report it so probably we should list these kind of responsibilities and then give that importance to the security researcher. I know not all of that information can be found on this page some of this can also be captured from the other place, such as this one, which is all about guidance for the researchers on what that means for them to report disclosures right. So I recommend I mean I would propose to have this section documented in a central place. Yeah, I wouldn't interject here. I mean the idea behind this is that you know, they, they wanted to try to point out the motivations of the reporters and they are different kinds of them right. But there are people that's all they do they're like say, security researchers, they focus on one software today another one tomorrow, and they look for vulnerabilities to report.  And so the whole point of this section really is about trying to establish her, you know, some kind of understanding of what you're dealing with so that, you know, basically trying to diffuse any possible tension and avoid conflict, trying to communicate with some communication with the reporter.  Unfortunately, I think there are quite a few cases where that relationship is pretty bad in general, which is why there is this other I just pointed to that was then published later on, which was also to try to tell the reporters hey guys, maybe you should know a little bit more about how, you know what it's like to be on the other side, when you approach projects open source specifically, you know, with your reports, and it's all about trying to, you know, help with the communication establishing a positive communication between those different parties. Go ahead Tracy. Yeah I guess my question is how do we distinguish between what we're trying to do and what's already available. What I'm hearing is there's already documentation about information around the finders who they are, what their motivations are, there's information to the finders about why and how they should report open source security vulnerabilities. My question is like, I don't want to recreate what's already existing and open SSF I want to add to that and make it valuable for hyperledger and so I want to want to see if we can understand better where the lines are between what open SSF has and what we're trying to do in this task force. Yeah, so that's a great question Tracy. So what I view the open SSF is having done is sort of come up with a, you know, very broad commentary, you know, set of best practices set of suggestions, all about stuff on what you sort of sort of should do for a good vulnerability disclosure program. But, you know, my perspective is this is sort of, it's sort of people who already know what they're talking about writing stuff down. And it's not as useful if you're a new project or if you're a project that maybe isn't as familiar with security to try to you know actually figure out a consistent set of rules and policy, and what should be done. But what I'd like to see is something that's much more user friendly. So, hence a template. So something that people could just take and apply and say as a project we are going to do X these are the rules we're going to follow right.  But basically, you know, have a set of rules that people who aren't as familiar with this sort of thing and who, you know, haven't done it before, can just follow, and essentially be, you know, in the good zone, if you will. And, and, you know, I would have thought that the open SSF would have done this but you know it doesn't appear that they have this. So that that's my thought and I hope that makes sense. I guess the question is, to me rules mean, here's some things that you should follow, right, versus here's some background information that you should know before you follow these rules. To me the background information before you follow these rules are already documented viewing open SSF versus the rules aren't documented well enough for us to be able to just go ahead and implement. So I want to make sure that that is the line that we're drawing of the background information is here. Go read that if you want background information. Here's the rules for the project to follow that's what this is focused on. That's exactly right. So here, the open SSF documentation how tells you what you should think about when you're generate when you're building a policy right. And that's sort of what you're referring to is the background, but it doesn't, you know, give you a policy it doesn't say do this, right. And we just sort of want to bare bones document that says do this and this and this. I completely agree with heart and I don't think we should duplicate this content. We should have a pointer for people to read as background. I think that's, I think, as a hot says what we want to do is really have a kind of a roadbook for how a project handles security disclosures. So this is, you know, in our project we're doing this, the securities are reported there. Once we receive the security, the clock start ticking. This is what we do next. And this is what we do next and so on. Yeah, I agree. So to summarize that the recommendation is that we still point everybody to a document that is put up by the open SSF, but then say here is a state transition some similar to what we had for a project life cycle, right. So this is the process that we are going to follow and this is the approximate timelines that you maybe are waiting in these phases. And for us, when you reference this document, these are the resources where you can do certain things because open SSF blindly talks about all the available options. Right. That is one thing that I would probably skip as part of this discussion. And probably that's also because that it is like a debatable topic, right. So we'll start the discussion on that by depending on based on the feedback that we receive on this call. We'll try to see if we need to include this in our first phase or maybe take this up as a latest task. So one of the recommendations from open SSF is around having a vulnerability management team, right. Let's review the current process that we have. And in the current process, there is high reliance on the staff. So somebody in the staff or maybe somebody on the security mailing list should notify the corresponding maintainers and maintainers should go and review a reported issue. And if they feel to the satisfaction that they reported issue indeed isn't is something that needs to be addressed and it poses a threat. Then, like there is that intake that we can consider a project. I mean, that particular project can consider that issue as an reported issue. Otherwise, there is a possibility that the maintainer whoever has analyzed the issue. Going into a discussion phase with the reporter or the other aspect that can happen is that they will say that, hey, this is not a security issue as you point out to be. This is basically our design that we have or a design assumption that we have in the project. And in our assumption, we do not consider these scenarios. So there are these different possibilities that may occur. Now, in terms of playbook or in terms of different phases that we will have to handle. I know having a central team that will be a single point for all the projects. Maybe too much for that particular team who's trying to handle it. Some of the recommendations previously that came up in the previous task force is to have a representation from each of the graduated project. If they're graduating from labs or if they're entering into incubating under hyperledger, they would need to have a representation into a team. And each of that the person either should delegate when issues reported against their project or they themselves are responsible or accountable for following up on that. I know I brought up a bunch of topic here, but I'll take a pause and then open up for comments. So I think this is where it starts getting interesting and where we have to define the policy for this for our foundation. And I think, you know, I would set some rule that says every project must have identified, you know, named a person to be at least one right to to be the the vulnerability management team for that project. And that should be a condition to be within hyperledger, but frankly, thanks a lot, Tracy. Yeah, I think we have that. I think that was one of the things that came out of the out of the security task force last year. I can't remember if we added it for only graduated projects, or if we added it for incubation but I remember adding it to one of our documents under the to see the hyperledger.org. So I'm trying to find that. I don't know but I think I mean, we may have that in the somewhere, but I'll be curious to hear from right because I think I remember right saying we that there are very few people listening. Hi, so. So I think the one of the topic that came up was a project maintainer who was on vacation and a delayed response to somebody who reported an issue. So without taking names, I guess, I mean, heart is recommending that those scenarios, like even though it's not intentional could happen, like an open source setup. So, yeah, I suggest that we have my thinking. So maybe the policy should be that we should have at least two people per project. At least. So since, since, so he's raising hand so adding on to the suggestion. So since we are talking about the security topic here. I propose that we also we make this process mandatory for all projects, irrespective of whether they are graduated or not. So if they're incubating and the hyperlensher if they're becoming a top level project that they are required to have this in place is Tracy. Yeah, I'd love to hear some of the main painters on the call. My thoughts are on whether or not they would have three people that they will as hard as suggested in the TLC chat, whether or not they have three people that they could actually nominate to be on the security team regardless of whether your project is an incubation or Yeah, I mean, I think it's fine to have three people if you have three people are up and willing to do that but I think even if you have just one person, it can be their job to delegate to somebody else that they go on vacation so all we need is one person who is in charge of receiving notifications and then figuring out what to do. Thanks from David. Yeah, I was going to say two or more would be a good policy for project whether it's incubation or graduated. Thanks to you. Yeah, I think I agree. At least to, we should also make it really clear in a concise manner when we announce this policy. What are the expected activities on this VMT team. I believe it's mainly monitoring the incoming requests. So, which means this team is, there's no like regular activities of this team, most of the time, unless there's a report. It's when they kicking to action. We just need to make that really clear. So, the teams don't think this is yet another, you know, burden on their shoulders on the day to day basis. I agree. So, Steven. The only caveat to that is when someone is appointed or however the team manages it, they do have to understand what their role is. They've got to go through the policies they've got to understand they've got to understand to pass off and things like that. I think that's the only while it's not a active until needed. There are some prerequisite learnings that are half have to be done. Thanks, Steven. Yeah, yeah, I agree with that. I assume there's going to be some at least some minimal trainings with either self reading material packages or a training session for fellow volunteers, or people who got volunteered. Have we talked about monitoring CV reports on dependencies, would that be something that each team do themselves. Each project is expected to do themselves or this is something that the that's the VMT team or that or if that's a different, different team within hyperledger that does that. Good question. So, I would say that that goes down to best practices in in pipelines and things like that like that's more of a project best practices and in particular where hyperledger can really help I think is in tooling and making sure people are aware of what's available and things like that. We're constantly or not constantly but having new approaches come up that we're discovering as a project and would be, I think, valuable to other projects across the way so again that leads to that pipeline best practices. Yeah, yeah, I think there's some some sort of blurring the line between it to supposedly each project should be on top of these things right for example if your JavaScript code base npm does really good reports of these vulnerabilities in different severity levels, having a pipeline that at least looks looks for critical issues would be a good thing and fail to build. And I don't know if that exists for other other languages. But there are going to be escapes, and they will turn into reports on the project themselves. I think far flat have had at least one on Java. So it ended up being a report on the project if we didn't address them soon enough. And that can be costly to the VM team can be costly to the foundation because they may expect a payout because they reported this. So I don't know if there are more things that foundation or the security task force can can think about so we can encourage the team or we can help the team to stay on top of this. Yeah, I do agree this is more of a project best practice thing. Thanks Jim for and thanks Stephen for bringing the topic. In fact, yesterday for the first time I attended the open SSF, the working group call on the vulnerabilities closures. What I learned, at least from that call is there is another working group or at least there is a project with an open SSF that is working towards this question that you brought up in terms of how do we address a dependency CVs within the project, right? There is a way of automatically taking care of fixing them and identifying and then figuring out the dependency versions and upgrading them. I guess some of the objectionable questions that were raised in that meeting where would the project maintainers be happy with those automated CR PRs and to what extent should that be taken care. But that's a valid question. And in these discussions, I think if I were to summarize last two, three minutes, probably last five minutes of conversation and probably bring up few questions that are still unclear is in terms of when we spoke about VMT, I guess. I forgot who brought it up, but I think Jim, it was you asking for trainings to the VMT right in terms of what they should be doing. A similar topic on the training is also what is the responsibility of a VMT apart from being a representative for the project within hyperledger. What else would that VMT be doing, right? So there are few thoughts in terms of what they could be doing. For instance, since they are going to know and they are the facing singles point for the projects, they would know all the things that occur in terms of security, at least for the project. So we could propose that VMT often meet with each other and then share the learnings across to other projects as well. It may be obvious that in few cases, some things that we do in one of the project could be a learning to another project. But hey, we made this decision long back. We thought like this was, this is what we assumed and we started with it. Like now we face this issue. So see if you can avoid doing the same mistake that we did. I'll probably see if you can, if you have such a design in your or such a dependency in your case and see if you can do a work around immediately before somebody else will figure it out. So this is one other thing that a VMT can do. And this will not just encourage the projects to collaborate and like know about each other. But this would also bring up in terms of security standards, higher quality code across all repositories and across all the projects. And it would also encourage security researchers to have these focused group conversations, join these conversations. And I mean the responsible people would also be recommending things to the group. I know it's all going to work out well if executed well, but any thoughts on these things. I think the training can be covered as part of these groups where we can invite an external participation or expert who have expertise on these things. We can have them as a guest speakers and then cover these topics in some of these regular meetings. David. I think the most important outcome here is some very clear guidance to the VMT folks. So I'm thinking like a one page guidelines document that references the open SSF stuff as background, but then it's very crisp about the expectations and guidelines. I don't think we need a lot of training extra meetings that type of thing, but let's make sure we have at least like a very clear one pager of guidelines. So any other thoughts on adding the additional responsibility to the VMT. So I don't know how to treat this response to me. Like all silence. Does it mean what I proposed is fine or what David is talking about is fine or like which one should we follow. Happy to. Yeah, I think it's a good idea. I also just wanted to say that I agree with the points about not making it a huge effort as an extra effort on the maintainers. And you know, with that, the important point made, I think it's okay to add. That's it. So to also answer your question in my case, silence was agreement caught you. So what we are then proposing is, yes, there would be regular interaction among VMT that could be offline. And if needed, it could be on the main basis requested call, which may be even like one call per month, right? Where we get all the VMT representatives. And sure, there will be given guidelines, which are offline references to go through and then they have a clear cut, crisp information available for what their expectations are from the project. But these additional guidelines or additional meetings would be helpful to enhance our learning, sharing sessions, what we can call. So I'll put it up in a proposal and then we'll see if there are any oppositions or any other thoughts right offline. I know we have like five minutes, but the other aspect that I wanted to cover it, like within these discussion points, which is still open as in terms of when does the responsibility of VMT gets, I mean, start, right? So does it start immediately when an issue is reported? Or does it start when a vulnerability is identified to be really an issue? Like what's the taking point when we start considering the timelines, the responsibility on the VMT itself start? What would be that initiation point of how we connect the dots, right? So one thing that I skipped in this discussion is this one, the topic of how to set the policy or how to handle the expectations. Probably this will address some of the opens that I have in terms of initiation. Yes, Tracy. Yeah, I think the, you know, if we look at what had been previously documented for Hyperledger, it was 48 hours to respond. We had the reporter acknowledging that they had reported something. And then one week to triage report and coordinate with the effective project maintainers to plan the fix of the bug. So, I mean, those seem reasonable to me, but I, you know, don't know if people think those are reasonable time frames or we need to extend them or shorten them one way or the other. And that's what was originally documented in the issue that we have for the security vulnerability disclosure. I did include what we previously had documented for timelines. And so I think it's worthwhile for us to just review what we had, see if any of that is still applicable and if it is great and if it's not, how do we need to change it? I agree, Tracy. I think we should start with what we already had. Assume that's still valid until somebody challenges it. So what we, what is stated there, those 48 hours in the 90 days is widely considered standard and sort of the upper limit of what you should have. You know, I'm comfortable if people want to bring those numbers down, particularly the 90 days, but I would say a template would have 90 days. I mean, I think though, like the Linux kernel has like either a week or two weeks now instead of 90 days where they basically, you know, they disclose things immediately, almost.  And, you know, you can still see that those are the established upper bounds if you go through the open SSF content. Right. So, sorry, hard to interrupt. I think the, I got what you're trying to say. So what Hart is saying is with respect to when should the reported CVE be disclosed, right? And then in public, but I think what we were trying to cover is the, like what's the responsibility in terms of VMT team? Like what's their timelines and how much time do they have to respond back? And immediately when the issue is reported. So I, did I understand you correctly? So, I mean, I thought it was the VMT team that was going to respond to the initial people, right? So obviously, but I thought like Tracy is saying one week to try out, are we saying to change it to 90 days? No, the 90 days is to fix it. Yeah, I didn't read the rest of the responsible disclosure piece. I was only trying to answer your question, a room which was what is VMT responsible for initially and what's their timeline, which I thought was the 48 hours to respond and then the one week to triage the 90 days to fix is the next one in the list of things that are documented. And so I think Hart was just reading the whole thing. Yeah, that's right. Sorry for the confusion there. No worries. Yeah, we would have brought this up in some time, but yeah, thanks for bringing that up. Okay, I see we are top of the art, but yeah, this was a good discussion. We'll continue these discussions offline as well. And for the items that we have discussed today, we put them in the meeting minutes and see, yeah. All right. Thanks for taking us through that. We will do it again next week.


So the situation for the third row for the group widget for results is a bit more complicated because it wasn't possible to add the Q-WebView widget for showing the web map from within QP Designer. Instead, I'm just going to set things up so that we can later add this widget from our code. The group box, the content of the group box is organized into two rows, one with the lids widget and later on the web view, and one with the three buttons below it. So the organization will be a vertical layout containing two horizontal layouts for the two different rows. I'm going to start by adding the first horizontal layout. So I'm picking a horizontal layout from the widget list in QT Designer. And I'm going to use the hierarchy to do that. So I'm dragging it over to the hierarchy and dropping it on top of the group box for the third row. So we have now a child of that group box with a horizontal layout. And since this is very important, I'm going to already rename it correctly so that it's clear where you have to do that. So I'm going to call that horizontal layout results list and map HBL for horizontal box layout like this. OK, now we can add the list view widget to it. There we have to pick the list view widget under item views model based. So it's important to pick this one, not the list widget. So the list view, and we drag it over and drop it on top of the horizontal layout we just created like this. That's all we have to do for this first row. As I said, the QWebView will be added later to the right of the list view widget from the code. So now we add a second horizontal layout below the first one. And this is one that should have the three buttons. So I'm now going to drag three push button widgets and dropping them on top of the layout in the hierarchy window. The first one, the second one, and the third one. And the last thing is I'm going to use the horizontal spacer again so that these buttons are all pushed all over to the left. You have to aim very carefully until the blue bar appears on the right of the third button, and then you get the desired layout. So I still have to change the names of the titles of these buttons. The first one should be called clear selection. The second one should be called select all. And the third one should be called invert selection. And that's it. We're done with the third row of our layout.