# 1. Opening Activities ## 1.1 Opening comments (Co-Chair David) ## 1.2 Introduction of participants/roll call (Co-Chair David) | First Name | Last Name | Company | Role(s) | |:-----------|:----------|:-----------------|:------------------------| | Aditya | Sharad | GitHub | Voting Member | | Chris | Meyer | Microsoft | Voting Member | | David | Keaton | Individual | Chair | | James | Spoor | Snyk Ltd | Voting member | | Katrina | O'Neil | Micro Focus | Voting member | | Michael | Fanning | Microsoft | Voting member | | Nathan | Baird | Microsoft | Voting Member | | Paul | Anderson | Grammatech, Inc. | Voting member | | Stefan | Hagen | Individual | Secretary, taking notes | | Thanassis | Avgerinos | ForAllSecure Inc | Member | ## 1.3 Procedures for this meeting (Co-Chair David) ## 1.4 Approval of agenda (Co-Chair David) * https://www.oasis-open.org/committees/download.php/69671/agenda_20220310.html Agenda was approved ## 1.5 Approval of previous minutes (Co-Chair David) * [Minutes of 2022-02-24_Meeting #52](https://www.oasis-open.org/committees/document.php?document_id=69668&wg_abbrev=sarif) Minutes were approved ## 1.6 Review of action items and resolutions (Secretary Stefan) * ACTION David: Find out how to upload content to wikipedia (#507) * IN PROGRESS hopefully finished by the next meeting * ACTION David: To please include an agenda item on the reporting of the two week evaluation effort * COMPLETED ## 1.7 Identification of SARIF TC voting members (Co-Chair David) ### 1.7.1 Prospective members attending their first meeting ### 1.7.2 Members attaining voting rights at the end of this meeting * Thanassis Avgerinos will attain voting rights at the end of this meeting. ### 1.7.3 Members losing voting rights if they have not joined this meeting by the time it ends ### 1.7.4 Members who previously lost voting rights who are attending this meeting ### 1.7.5 Members who have declared a leave of absence # 2. Future Meetings ## 2.1 Future meeting schedule (Co-Chair Keaton) - Scheduled Teleconferences (Thursdays at 08:00 PDT / 15:00 UTC for 1.5 hours) ***On the following date, North America will be on Daylight Savings Time and Europe will not.*** ``` March 24 ``` - Proposed Teleconferences (Thursdays at 08:00 PDT / 15:00 UTC for 1.5 hours) ***On the following date, North America and Europewill be on Daylight Savings Time.*** ``` April 7 April 21 ``` - Possible face-to-face meeting when pandemic permits # 3. Discussion ## 3.1 Review recruitment effort to complete the technical committee * David: Received quite some OASIS requests to meet with interested parties for joining the TC * Appointment March, 21st with JFrog ## 3.2 Review status on finalizing SARIF 2.1 errata [List of next steps - github issue #509](https://github.com/oasis-tcs/sarif-spec/issues/509) * IN PROCESS ## 3.3 Review current state of ecosystem ongoing work * Chris: Major work on Visual Studio and VS Code extensions ## 3.4 Any continued report/discussion on metrics * Michael: Will inspect the samples Paul sent per email to the TC list ## 3.5 Review crash data proof-of-concept * Michael: Next time a demo will be available ## 3.6 Status of Wikipedia page * David: for progress cf. actions of previous meetings section ## 3.7 Discuss end-to-end results management (including code insights protocol) * Michael: Learned about the Code Insights Protocol (CIP) history - essentially that this is more a sketch * Also shared info on the [MagpieBridge](https://linghuiluo.github.io/MagpieBridge-ECOOP19-Talk.pdf) (another sketch of other authors from a 2019 paper) * Comparing to Language Server Protocol (LSP) - a real existing protocol (in production) * Nathan: Interaction between SARIF and LSP might be beneficial albeit difficult to create initially. * Paul: SASP did not evolve since approx. 2019, but he is happy to think about how to integrate or what use cases it might bring * Nathan: Has seen not much standardizing besides Test Anything Protocol (TAP) https://testanything.org * Stefan: Like with TAP streaming capability would be helpful - use case: * fan out the analysis tasks to N nodes * receive back in N streams * triage the problematic reports * not have to wait until complete test reported (like junit.xml) * mostly thinking on fuzzing - where you never know when and what you get back * Nathan: * that streaming use case is a lot like the remote storage interface concept * there is not even a file concept in the current analysis techniques used by them * shares a link to a 2021 paper [Estimating Residual Risk in Greybox Fuzzing](https://mboehme.github.io/paper/FSE21.pdf) by Marcel Böhme, Danushka Liyanage, and Valentin Wüstholz * Thanassis: * Had a similar use case of background testing and these results could be communicated async and * would be nice to be able to aggregate for cumulative visualization for developers * many developer use cases (not sure if these are all in scope for SARIF) * All discuss "fair game" targets for SARIF * Michael: * Work Items * Auditing and Evidence * Stefan: * Fuzzing - dealing both with high initial influx and low exponential decay later * Thanassis: * Async static analysis results maybe including accumulation # 4. Other Business # 5. Resolutions and Decisions reached (by 10 minutes prior to scheduled meeting end) ## 5.1 End debate of other issues by 10 minutes prior to scheduled meeting end and follow the agenda from this point (Co-Chair Keaton) ## 5.2 Review of Decisions Reached (Secretary Hagen) None ## 5.3 Review of Action Items (Secretary Hagen) * ACTION on Michael: Will inspect the samples Paul sent per email to the TC list until next meeting * ACTION on Michael: Next time a demo for crash data proof-of-concept will be available * ACTION on Michael: To send the provided information to David as input for meetings with candidates interested in joining the TC # 6. Next Meeting ``` March 24, 2022 / 08:00-09:30 PT / 15:00-16:30 UTC ``` # 7. Adjournment Meeting was adjourned.