cncf-toc@lists.cncf.io

Home Messages Hashtags Subgroups

Messages

Between

and

Dear CNCF TOC, We are happy to share that the annual review for KEDA is open on https://github.com/cncf/toc/pull/607. Kind regards, Tom Kerkhove Microsoft Azure MVP & Advisor - GitHub Star – CNCF

By Tom Kerkhove · #5677 ·

Vote - renaming CNCF SIGs to TAGs

In this week's meeting we talked about renaming CNCF SIGs to TAGs (Technical Advisory Group) to avoid confusion with the pre-existing Kubernetes SIGs. As discussed, the current confusion is real,

By Liz Rice · #5676 ·

Re: security & CNCF projects

Not on the TOC, so hope it's ok to comment. I have the same concerns as Liz, quite often metrics are gathered without all factors considered. Take kubernetes for example, huge code base, huge user

By Luke A Hinds <lhinds@...> · #5675 ·

Re: security & CNCF projects

thanks Liz this is a *terrific resource* that costs lots of money & time, and it is useless if we don't make it public and prune out old stuff

By alexis richardson · #5674 ·

Re: security & CNCF projects

I've realised that one reason the results look so damning for the projects is that they are the sum of vulnerabilities found over a period of time (and an arbitrary period of time at that). For

By Liz Rice · #5673 ·

Re: security & CNCF projects

I understand this is Beta I believe all of the CNCF community should have equal access.

By alexis richardson · #5672 ·

Re: security & CNCF projects

Alexis, the tool is freely available just like a variety of other security tools that CNCF projects use, from LFX Security (white labeled Snyk), Snyk, FOSSA, CodeQL, WhiteSource etc, lots of great

By Chris Aniszczyk · #5671 ·

Re: security & CNCF projects

I strongly disagree Chris, this is a great resource that all should be aware of. Now that we don’t have FPs, can we just publish the data? Please do not assume that end users will not run their own

By alexis richardson · #5670 ·

Re: security & CNCF projects

+1 to what Liz said here, this should be opt-in for project maintainers like any tool Can we please just leave this as a per project decision as any other tool as we decided last time this came up,

By Chris Aniszczyk · #5669 ·

Re: security & CNCF projects

The scan data from Snyk right now is fairly clean as they curate and weed out false positives proactively. In the tool, we do have flags on the bugs to dismiss it (in case it's still a false

By Shubhra Kar · #5668 ·

Re: security & CNCF projects

I have an idea that there were concerns about making the data publicly available because of false positives, and the worry that if projects appear (incorrectly) to be unsafe that will impede adoption.

By Liz Rice · #5667 ·

Re: security & CNCF projects

Idea: It would be cool if all CNCF projects had the same metadata for representing "maintainers". If that was standardized, some tool could ingest and compare against LFIDs. -- Stephen

By Stephen Augustus · #5666 ·

Re: security & CNCF projects

Essentially we want them to create LFIDs to grant access. Shubhra

By Shubhra Kar · #5665 ·

Re: security & CNCF projects

Thanks Stephen. We have granted access to given access to stefan@.... We are unable to find accounts forhidde@... and michael@... . Regards, Vasu From:Stephen Augustus

By Vasu Naidu <vnaidu@...> · #5664 ·

Re: security & CNCF projects

Hi Alexis, You should have access to the security reports of the flux project. Please let me know if you have any questions.

By Vasu Naidu <vnaidu@...> · #5663 ·

Re: security & CNCF projects

As I understand it, https://maintainers.cncf.io/ holds the aggregate maintainers for CNCF project. For flux, specifically: https://github.com/fluxcd/flux/blob/master/MAINTAINERS -- Stephen

By Stephen Augustus · #5662 ·

Re: security & CNCF projects

I would suggest we add access for all the maintainers of the project and anyone on the governance committees (example TSCs). Do you maintain a maintainers.md file or better for us to just scan the

By Shubhra Kar · #5661 ·

Re: security & CNCF projects

thanks, how do I share these with the flux maintainers and community

By alexis richardson · #5660 ·

Re: security & CNCF projects

Yes, please. To your general point -- I have a view that if Snyk (or similar) offers a free scanning service to CNCF projects, then the community should benefit. These are completely standard

By alexis richardson · #5659 ·

Re: security & CNCF projects

Jim, We are looking into, let me get back to you with an update. Regards, Vasu --- Sr. Director, Head Of Engineering Cell: 1.408.420.0404 Slack:@Vasu From:St Leger, Jim

By Vasu Naidu <vnaidu@...> · #5658 ·

2341 - 2360 of 8012

Home Hashtags Subgroups Terms