Category Archives: speaking

Mirroring known vulnerability data globally, for free.

by

If you just want the answer to “where do I find a reliable global mirror of NVD vulnerability data?” or “Where should I get a list of CVEs if NVD is down?” the answer is https://cveb.in/ . It is being mirrored on the same servers used for major open source projects so you’re probably already trusting them, and they should be fast and may be very close to you. Please go ahead and use it and let us know how it works for you!

I co-presentented a talk about this work at BSidesPDX on Saturday, October 26, 2024:

Often when I write about talks I’ve given, I try to kind of recreate them in blog posts to be a bit of a director’s cut were I add in a bit of extra material that didn’t make the talk but they’re pretty similar to what I said on stage. This time, though, since I didn’t give the second half of the talk and John and I have very different ways of telling a story, I’m just gonna tell a story in this blog post and maybe toss in a few slides. If you want to watch us both tell the story from our own perspectives, check out the video. Although we collaborate on a lot of stuff it’s surprisingly rare for us to share a stage.

Still here and not going with the recording? Okay, let me tell you a story…

The US government DDOSed itself

Once upon a time, not so long ago, the US government decided it wanted to raise the bar for software security in their supply chain, and they wrote up an executive order on cybersecurity explaining how they wanted suppliers to do better, including a section on not shipping software with known vulnerabilities. Many other groups followed suit with similar recommendations or requirements.

As a result, a lot of organizations’ security plans started to look a lot like this:

A diagram from my talk about NVD mirroring. The top of the slide is labelled "2024 Corporate Security Policy_final_FINAL.doc" (which is a joke about filenames for things that undergo a lot of revisions). There are then three columns. The first is labelled Step 1 and there is text in a red box that reads "Scan components for vulnerabilities." Step 2 has an orange box which contains the text, "???" and Step 3 has two green boxes, one of which says "EVERYTHING IS SECURE" and has a picture of a closed lock. The second reads, "$$ Profit $$"
Image Description: A diagram from my talk about NVD mirroring. The top of the slide is labelled “2024 Corporate Security Policy_final_FINAL.doc” (which is a joke about filenames for things that undergo a lot of revisions). There are then three columns. The first is labelled Step 1 and there is text in a red box that reads “Scan components for vulnerabilities.” Step 2 has an orange box which contains the text, “???” and Step 3 has two green boxes, one of which says “EVERYTHING IS SECURE” and has a picture of a closed lock. The second reads, “$$ Profit $$”

There is a lot to say about steps 2 and 3 here, but our problem starts at the beginning of Step 1. To scan for vulnerabilities, you need a list of software you’re providing (which is a whole talk in and of itself) and a list of known software vulnerabilities.

One of the biggest sources of vulnerability data actually comes from the US government: the NVD (National Vulnerability Database) provided by NIST (National Institute of Standards and Technology). It’s pretty great — they provide it fully free, publicly licensed. This is usually where you go to get information about CVEs (Common Vulnerabilities and Exposures).

But what do you think happens if every single US government supplier and indeed, many other software companies around the world, all try to grab this data at once? And more than that, many of them start enabling regular scanning so they’re grabbing it multiple times per day, or per hour?

A slide from my BSidesPDX 2024 talk which reads "Distributed Denial of Service" and has photo I took of some street signs near the train tracks. The relevant one is a large yellow caution sign that shows a person with a bike getting a wheel stuck in the train tracks and the rider is being launched off the bike over the tracks.
Image Description: A slide from my BSidesPDX 2024 talk which reads “Distributed Denial of Service” and has photo I took of some street signs near the train tracks. The relevant one is a large yellow caution sign that shows a person with a bike getting a wheel stuck in the train tracks and the rider is being launched off the bike over the tracks.

So, yeah, the US government kind of started a denial of service attack against its own agency. And in case that wasn’t bad enough, we started seeing headlines like “NIST Struggles with NVD Backlog as 93% of Flaws Remain Unanalyzed ” where the stories talked about funding cuts at NIST.

The fine folk at NIST have been doing a hard job with not enough resources and some really unfortunate timing, so they’d already been working on keeping things from being overwhelmed. They had introduced rate limits per IP address/API key to keep rogue scanning jobs from ruining things for everyone, and they had started providing an API that allowed people to get just the newest data instead of having to download things every time. Unfortunately, the API combined with rate limits was pretty slow so getting the full database the first time using the API was onerous when it worked at all. Several of my colleagues in the UK and in India had such long delays that they had to give up and bootstrap the “old” way to get started. And a lot of people were running their scanning within ephemeral containers and just didn’t cache the copy of the database at all so they wanted to get all the data fresh with each new scan. When neither the rate limits nor the API was enough to address demand longer-term, and with budget cuts on the horizon, NIST turned to looking for industry partnerships and additional funding.

It was clear that this wasn’t a problem that was getting solved quickly.

That sounds bad, but how is that YOUR problem, Terri?

Why did I care? I mean, obviously I’m a security professional and things that stand in the way of good security choices are a problem for me in general. But in this case, my work open source project involves building a vulnerability scanner called cve-bin-tool: https://pypi.org/project/cve-bin-tool . It’s a free, open source software vulnerability scanner for binary files, git repos, and SBOMs.

(Quick reminder: This is my personal blog and as such, all opinions here are my own and do not necessarily reflect those of my employer.)

In the course of developing software to scan for vulnerabilities, we’d gotten a front row seat to all of the NVD changes: we’d had to start using API Keys and explaining them to our users, we’d had to handle new timeout messages and do appropriate backoffs and rate limits, and we’d started getting reports from users that updates were slow or not working. Many users and contributors located outside of the US were experiencing extensive delays.

Following NVD best practice had been making our code more complex, our software harder to use, and our users unhappy. It’s hard enough to get software developers to care about vulnerabilities, and it was getting uncomfortably hard to do something that had previously been pretty easy to install and try. But while we supported other data sources with vulnerability data, NVD was still the biggest one and the one people wanted the most.

How do we make vulnerability data available to everyone?

We probably could have solved the problem for cve-bin-tool similar to how commercial entities have handled it: make our own copy, query that, keep it updated separately. They often add proprietary data (such as the missing triage of new vulnerabilities) and then sell access to that data as part of their solution. We were already keeping a local copy of the data in github so our CI jobs would quit timing out at inopportune moments. But my goal has long been to make software more secure for everyone. What if we thought bigger than one python application? What if I built a solution that would help the whole world?

A slide from my BSidesPDX 2024 talk. On one side, it reads "what if we helped the *world* get vulnerability data?" and on the other side it has a screenshot of a tumblr post. The first post is from writing-prompt-s and reads "In a game with no consequences, why are you still playing the 'Good' side?". The next post is from raphaeliscoolbutrude and says "Because being mean makes me feel bad." The final post is from user deflare and reads, "Because my no-consequences power fantasy is *being able to help everyone*"
Image description: A slide from my BSidesPDX 2024 talk. On one side, it reads “what if we helped the *world* get vulnerability data?” and on the other side it has a screenshot of a tumblr post. The first post is from writing-prompt-s and reads “In a game with no consequences, why are you still playing the ‘Good’ side?”. The next post is from raphaeliscoolbutrude and says “Because being mean makes me feel bad.” The final post is from user deflare and reads, “Because my no-consequences power fantasy is *being able to help everyone*”

It might have been easy to lay a lot of the blame on people using “ephemeral” continuous integration jobs. They typically grab a mostly empty linux image, install/update some software, download the thing they want to scan, download the vulnerability data, store a report somewhere, then throw the rest of the thing away to start fresh next time. If they just cached the data instead of grabbing it every single time, we wouldn’t be in this mess.

But we could learn from what they were doing too: it was perfectly viable for them to download entire software binaries every single time, and no one batted an eye at that. Why was it easier and faster to get the software than to get meta data about the software? The answer, of course, is that we weren’t all trying to download from a single underfunded government agency. But instead we were downloading from… a bunch of underfunded open source hippies? How was that working but the government servers weren’t?

I am old enough that I knew the answer. Open source had solved their distribution problem by asking people to store a “mirror” (a copy of all the files) on their own servers, then building infrastructure to help people find the one closest to them. It all happened long before anyone had coined the term “cloud service provider” and it had happened on shoestring budgets with people donating a bit of space in a server rack and a bit of bandwidth. A lot of early mirrors were in universities or small internet service providers who had an open source enthusiast on staff. Get enough of them, and suddenly everyone gets software and no one gets stuck with a giant bill or an overloaded server.

It looked like neither government nor industry was going to solve this problem on the timeline I wanted and maybe never on the global scale that would make my life easier. But I have access to resources that a government agency maybe doesn’t: I know where one of the world’s leading experts on open source mirroring lives. It’s in my house. Because I married him. As well as having years of experience in multiple roles, he’s actively involved in running one of the larger open source content distribution networks in the world. So I had access to exactly what I needed to help everyone. I walked upstairs and said, “Hey John, if I wanted to mirror the NVD data on the micro mirrors, could we do that?” and then we figured out how to make it happen.

FCIX Micro Mirrors

This is the point at which I handed the talk over to John. But here’s my truncated version of his half of the story.

John builds infrastructure the way I knit: compulsively and constantly. And when he’s not actually doing something with his infrastructure there’s a good chance he’s thinking about it or talking about it. He hosts people’s websites and emails and mastodon accounts, he accidentally got involved in founding a whole internet exchange, and he’s forever automating and building backends for things in the house that I really wish weren’t internet-enabled. (Look, I’m a security professional, I’m allergic to too much internet.)

One day his friend Kenneth decided it would be fun to run a software mirror for their internet exchange, and he roped John into it, and then into this hare brained idea of maybe running a lot of mirrors on cheap hardware. John had previously run kernel.org and the associated linux mirrors there, and he had done so on big beefy servers with big beefy bandwidth, so he was skeptical that this would work. Still, not only was it cheap to try and see, but thanks to some donations they didn’t even have to lay out much of their own money to get it going. And long story short: it turns out it works incredibly well.

The deal is that they build up these cheap “thin client” boxes with a hard drive in them that have a copy of the data and are managed remotely by John and Kenneth. Then they offer them up to free to data centres who are willing to provide power and internet. It’s kind of a fully managed appliance, so the data centre gets blazing fast downloads of open source software for their customers and anyone else “nearby” and Kenneth and John get a dot on their map and the knowledge that they’re helping distribute open source software. (Also they get to run globally load bearing infrastructure for funsies. Which it really is for them.)

Here’s my favourite picture: since one of our contributors is based in the UK, we turned on the UK-based mirrors first, and one of them is a data center in a box in a field:

A dark green utility box sitting in a beautiful field with yellow summer grass, green bushes, and green trees along the edges. There is a wedge of blue sky with clouds visible. One of the software mirrors is inside the green box.
Image Description: A dark green utility box sitting in a beautiful field with yellow summer grass, green bushes, and green trees along the edges. There is a wedge of blue sky with clouds visible. One of the software mirrors is inside the green box.

What’s been amazing is that this little network of devices is now a major powerhouse of linux mirroring. They estimate that they’re providing 90% of the bandwidth used for VLC, so if you’ve downloaded that or anything else they serve, there’s a good chance you’ve already used one of these mirrors and not known it. https://mirror.fcix.net/ if you want to see the list of projects. Kenneth is giving a talk at SeaGL in November if you want to hear more about the micro mirror story.

Serving the right data: files are better than APIs

The key to using these tiny servers is basically “linux people optimized sending files in order to make mirrors work.” And they did that quite a while ago so it’s really stable and fast now. You might think “oh, couldn’t you use bittorrent?” but that adds a lot of overhead. (That paper is older, but the numbers haven’t made it look more appealing in the time since then.)

If we want to go with what works, then, we can’t mirror the NVD API — that would require processing and these mirrors are not that smart. But it turns out… people didn’t really love the NVD API. It definitely filled a need for some folk, but when they tried to turn off the old file-based data so many people protested that the original deadline for removing the files got pushed out and pushed out. So we can probably guess that many users would like the files as much or better than the API, assuming they could get them faster and without rate limits.

So here’s what it looks like:

  1. We are running our own API crawler
  2. Generating json files compatible to the original ones
  3. Signing those files with possibly the sketchiest gpg key on the planet
  4. Mirroring these files to a worldwide CDN we created
  5. Literally solving the entire API / DDOS problem for… free?

Since cve-bin-tool has to speak API already, we can have cve-bin-tool output valid json files when needed. Although since NVD is still providing the json files at the time of this writing, we can (and do) get their files directly.

I should note that the technical implementation and testing in a live environment took a few months once we decided to do it. Much faster than waiting for funding!

Why should you trust us?

First: we are not affiliated with NIST, and they were not involved in any of this. Although I did email them so they knew who was behind it in case it came up and I got a nice email saying effectively they don’t officially endorse anything, which is fine. I want to joke that I’m the pirate radio of vuln data, but recall that the data is licensed public so there’s no piracy involved. Just fast and efficient transmission of perfectly allowed data.

So why should you trust some internet randos to get you vulnerability data? After all, the software security industry tries to tell you to stop downloading files served by random people on the internet! But these are the same servers that you’re probably using to get security updates, so… you probably already do trust them?

For a lot of the software on these mirrors, it’s a trust-but-verify solution where the packages are signed and package managers validate those so even if one of the data centres wanted to serve up malicious code, it wouldn’t get auto-installed unless they also compromised some build and signing servers. So you’re trusting not just the mirror, but the whole process to make sure the mirror serves up the right data.

If you’re going to build some similar verification into your tool that uses NVD data, you can verify our (sketchy) gpg signatures so you know it came from us, but you can also validate the data against NVD itself. For the json files they provide some metadata you can use. If we’re generating our own json (as we expect to do when they turn off theirs) then it might get a bit more complicated, but you can probably figure something out. For example, if validating all the data is impractical, you could have something that uses the API to double-check only the CVEs you care about. You can also always use us as your “seed” source and then update against NVD directly thus overwriting as needed.

(Incidentally, don’t bother trying to run a json schema check on the data as part of your checks unless you like noise. We did this in cve-bin-tool and had to turn it to just warn instead of halting because NVD themselves produce invalid json files frequently enough that it was a problem. Turns out keeping a giant database full of user-submitted data valid is hard.)

Using the mirror

The instructions are here: https://cveb.in/

Basically, go nuts. Those little thin clients can handle full fedora releases and don’t even max out on release day any more. Please use them! They should be fast, they are probably significantly less overloaded than the main NVD servers, and there’s no rate limits or API keys needed. Plus, you’ll make pretty marks on John’s graphs.

You can also use the mirror data as part of cve-bin-tool so you don’t have to build your own scanning service!

Conclusion

I noticed a problem where software vulnerability data about CVEs was getting harder and harder to access, and roped the fine folk of the FCIX Micro Mirror project into hosting a copy of this publicly available data on https://cveb.in/ which they are doing for free thanks to donations of time, money, and server rack space from a variety of folk. These mirrors are fast, available worldwide, not rate limited, and we would love it if you used them.

Contacting us

The comments for this post will turn off after a few weeks because I don’t feel like dealing with spam, feel free to hit me or John up with questions on the fediverse anytime! We’d also to love to hear how you use https://cveb.in/

Future work

I’m not actively working on mirroring anything else at the moment, but I *do* think it would be super cool if we could get the micro mirror system to help provide files for pypi / pip. So if you’ve got a lead there and global distribution of python packages sounds like a good idea, let us know! And if you’ve got any other way we could make the world a better place for free, that’s cool too.

Vulnerability Scanning for Free (as in Puppies)

by

I’m giving a talk at pyCascades this afternoon and I just wanted to share the slides for folk who like that kind of thing.

PDF: https://drive.google.com/file/d/125cCmmk8k5UtfV3QajNOXml1YW5nxM2i/view?usp=sharing

ODP (LibreOffice Impress) : https://drive.google.com/file/d/1u3_5LQUYYPiv9hSCbcgG_gOGn96a-di2/view?usp=sharing (Contains notes but they’re an early talk draft)

Google Docs version (not the original, probably has minor formatting issues but may be easier to view on your phone) : https://docs.google.com/presentation/d/149coIJnNdIsW7NWkQjv5jaKAHboHBxVLgx2lOS2oZfk/edit?usp=sharing

CVE Binary Tool source repository: https://github.com/intel/cve-bin-tool

CVE Binary Tool documentation: https://cve-bin-tool.readthedocs.io/

The slides below are just images (no alt text or notes — if you want those see the ODP link above). I’m planning to update them with something closer to the talk content after the conference but it might take a while.

Video of my Python Security Tools talk at PyCon 2019

by

I’m hoping to put together a post with all the text of my talk and slides in a non-video format (because I like having my talks in non-talk format!), but in the meantime, enjoy the video of the talk I gave at PyCon this year!

The talk is on Python Security Tools, because I found at work that we didn’t have good training on how to secure Python, and when I went to fix that, I found out that even Google searches for “how do I secure python?” weren’t telling people the things I think they should know about securing their python code.  So clearly there’s a need!

Abstract:

While high-level security concepts may transcend languages, each language has its own sets of tools and edge cases that are worth knowing. Python is one of many popular languages that is rarely the focus in security training, but that doesn’t mean python code is automatically secure (no matter what the internet tells you). Learn why people who say “pylint will help you with security” aren’t doing you any favours, how to use Bandit for security-focused linting and talk about other options for static analysis. Take a deeper look at why scanning for publicly known vulnerabilities is complicated, and how to use Pyup Safety to make it easier. We’ll also explore some language myths and best practices

On a personal note, speaking at PyCon is something I’ve wanted to do since my first PyCon back in Santa Clara in 2012, so I was super excited to get accepted this year!

Is Open Source Software Really More Secure? (Pycon Pune 2017 Keynote)

by

Back in February, I keynoted at Pycon Pune in India. I decided to start with one of the questions that comes up frequently when I tell people that my day job is in open source security: “Is open source software really more secure?” Here’s the video!

Hopefully one of these days I’ll get the slides and a written transcript up, but for today, please just enjoy the video. Note that there’s some silence at the start of the video while we’re setting up. I start talking at the 1m50s mark, and the embedded video should start there.

Pycon Pune Group Photo

Open source security is something I’m very passionate about, and I was really glad that the fine folk at PyCon Pune gave me the chance to tell their attendees more about what it means to be secure and what it will take to make open source security even better. I believe there were over 500 people in the room for my talk, even though I was the the final keynote for the conference, and it was one of the greatest audiences I’ve ever had the privilege to talk to — very responsive, lots of great questions, and lots of great follow-ups after the talk was done. If you ever get a chance to speak at Pycon Pune, I highly recommend it. Keep an eye out for next year’s call for speakers!

This also ticked off a few bucket list items for me:

  1. Visting India! I work with a number of people from India and meet new students from there nearly ever year, so I’ve always been curious, but it’s a long an expensive trip. Thankfully it turns out it was also on J’s bucket list so we found a way to make it happen. It’s a super beautiful country and very different from my own. We were fortunate enough to spend some time being tourists before the conference, as well as lots of time socializing with the conference attendees and volunteers.
  2. Keynoting a conference! I’ve wanted to do this for years but opportunities don’t come up very often and I wasn’t able to accept the last offer I got.

PS – Interested in inviting me to keynote? I’d love to do another one! Send an email to terri (at) toybox.ca to let me know. I have a list of my speaking experience on my website. I talk a lot about security, but I’m happy to talk about open source mentorship, community, artificial intelligence, and quite a few other things, just ask!

Taking No for an Answer (Open Source Bridge 2016 talk)

by

I gave one talk and ran one tutorial at Open Source Bridge 2016 back in June. For those of you not familiar with it, Open Source Bridge is an open source conference with a focus on “open source citizenship” that leads to a great combination of technical and social thought from people who are part of the open source community. My favourite part is actually the super chill hacker lounge, where it’s quiet enough to actually talk, and it’s totally cool to meet new friends around the lego table or bring my knitting. I don’t mind a few alcoholic conference mixers, but I have to say I meet and remember way more people at open source bridge than many other conferences.

Talk I gave this year, entitled “Taking No For an Answer,” isn’t entirely open source specific, since it’s really about a bad community behaviour you see in many other communities, but the focus and my examples come from my work in open source. I can’t seem to find the audio recording they made, so this is reconstructed from my slide notes. You can find the whole slide deck here: Taking No For An Answer (Open Source Bridge 2016) slides.

Taking No for an Answer: a talk by Terri Oda at Open Source Bridge 2016

[Title Slide] Taking No for an Answer: a talk by Terri Oda at Open Source Bridge 2016

Open source (like many fields) rewards people who are confident and even a bit pushy. Those of us who go furthest are often those who offered to fix bugs and followed through, who were ready to argue about their architectural ideas on a mailing list or irc channel. In many ways, open source is do-ocracy, where those with the time and the confidence to do things become leaders. In volunteer led communities, it can often be the case that the quality or merit of the work isn’t the big focus: it’s whether it’s getting done by anyone at all.

[Slide 1] This slide shows a collage of book covers and articles related to confidence: "How to overcome impostor syndrome" "Women don't ask" "Lean in" "Closing the confidence gap" "The impostor syndrome"

[Slide 1] This slide shows a collage of book covers and articles related to confidence: “How to overcome impostor syndrome” “Women don’t ask” “Lean in” “Closing the confidence gap” “The impostor syndrome”

So because of this, In the tech world, there’s been a lot of focus on getting people to step forwards, negotiate, lean in, DO. This can be super valuable — sometimes people do need a reminder, need some tips, need an invitation to speak, need to evaluate their internal censor and not let it stop them. There’s a reason my google image search pulled up a bunch of stuff aimed at women: there’s been a lot of push to encourage folk who are under-represented or socialized not to step forwards.

[Slide 2] Slide shows the phrase "But what about the men?" in a bold, playful font

[Slide 2] Slide shows the phrase “But what about the men?” in a bold, playful font

So clearly, as in all discussions about women and minorities, it’s time to consider what about the men? (room laughs)

[Slide 3] reads "What about self-improvement for leaders?" and shows Superman and The Hulk action figures, apparently in the middle of an argument

[Slide 3] reads “What about self-improvement for leaders?” and shows Superman and The Hulk action figures, apparently in the middle of an argument

Okay, just kidding. But surely self-improvement isn’t just for folk who haven’t stepped up yet. What about self-improvement for people who are already leaders in our communities? What about training confident people to be better? So this talk is aimed not at our most vulnerable but at some of our more powerful, as well as those who want to become more powerful and effective community members.

[Slide 4] reads "So let's talk about NO" and has a picture of a sign with a person holding up a hand to indicate no.

[Slide 4] reads “So let’s talk about NO” and has a picture of a sign with a person holding up a hand to indicate no.

So, it looks like I have a great audience of existing and future community leaders. Let’s talk about no.

[Slide 5] reads "No is a powerful tool" and has a picture of a circular saw

[Slide 5] reads “No is a powerful tool” and has a picture of a circular saw

No is a powerful tool with many uses. In my professional life, I do open source security, and a lot of my job involves saying no: No, this code isn’t right. No, you can’t skip validation. In my volunteer life, one of the things I do is coordinate a large summer mentoring program for the python software foundation. No, you can’t have more students than you have mentors. No, you can’t sign up even though it’s past the deadline. And as a minority in tech, I say a lot of no. No, I’m not available to help you with more diverse hiring. No, I don’t have time to educate you on issues facing minorities in tech. No helps me do my job, manage my time, make my volunteer program better, and so much more.

[Slide 6] reads "Now, I'm a NO professional... But lots of folk are not." there is no image on this slide, only stark text.

[Slide 6] reads “Now, I’m a NO professional… But lots of folk are not.” there is no image on this slide, only stark text.

I get paid to say no: it’s a huge part of my job, and I’ve learned a lot about when to say no, how to say no, techniques to make it easier for people to accept no, when I need backup on saying no, etc. But while I’m a professional naysayer, that’s not true of a lot of other folk in our communities.

[Slide 7] reads "Saying no can be exhausting" with emphasis on the word exhausting. There is a picture of a tired looking kitty on the slide.

[Slide 7] reads “Saying no can be exhausting” with emphasis on the word exhausting. There is a picture of a tired looking kitty on the slide.

And frankly, saying no can get pretty exhausting. It’s not at all helped by all those “but you should put yourself forwards!” self-help books, let me tell you. I had some dude give me a unsolicited pep talk at work about imposter syndrome and seriously, some people need to learn the difference between a lack of confidence and a knowledgable evaluation of personal skill. No is hard, especially if you’ve been socialized to be agreeable, and some people take advantage of that.. There’s a whole talk to be had about how to say no effectively, and maybe some day I’ll give it, but I feel like the people who might need some help saying no are mostly the same people who needed help saying yes, and I want to talk to the other people. The people who make saying no so exhausting, whether they mean to or not.

[Slide 8] reads "That's not really a security bug" and has a picture of a box that has a label that says "enjoy denial" in the style of a coke advertisement, and a "hello my name is denial" sticker in the style of a name sticker

[Slide 8] has a title of “1. denial” and a quote that reads “That’s not really a security bug” and has a picture of a box that has a label that says “enjoy denial” in the style of a coke advertisement, and a “hello my name is denial” sticker in the style of a name sticker

Let’s talk about some common anti-patterns you get when you say no. The first one is denial. I hear this a lot in my professional life: That’s not really a security bug. That’s not exploitable. No one would ever do that.

[Slide 2] has a title that reads "2. Anger" and a quote that says "Failing this will destroy my future career!" over a picture of a young man making weird face that could be interpreted as anger

[Slide 2] has a title that reads “2. Anger” and a quote that says “Failing this will destroy my future career!” over a picture of a young man making weird face that could be interpreted as anger

The second reaction to no is anger. I hit this one a lot when teaching and mentoring: students sometimes have been effortlessly at the top of their class and don’t know how to handle having to work for results. Or they just have no way to handle failure and dust themselves off to try again. So they yell at me. They yell at people who they think have power over me. They blame anyone but themselves for the fact that I’m telling them something they don’t want to hear, and let me tell you they *really* don’t want to hear that I’m not destroying their life, their poor performance is destroying their life. And I wish I could say it’s just students, but try telling a project that they’re going to miss their shipping deadline due to a late breaking security issue or their failure to do due diligence. This is totally an understandable response, but it’s not a productive response.

[Slide 10] has a title of "3. Bargaining" and a quote that says "can't you just do this one thing?" and a picture of an advertisement with a cartoon farmer saying "you'd be crazy to miss this bargains"

[Slide 10] has a title of “3. Bargaining” and a quote that says “can’t you just do this one thing?” and a picture of an advertisement with a cartoon farmer saying “you’d be crazy to miss this bargains”

Next is bargaining. The worst experience I have ever had saying no was to someone who exhibited both the denial and bargaining anti-patterns. She wanted me to run a program that I’d run in previous years, which is a totally reasonable thing to ask, but when I said I wasn’t available because of a more impactful commitment, she would repeatedly come to me with things and it was always “couldn’t you just” — “couldn’t you just look over the wiki?” “couldn’t you just help with this one part of the project” “couldn’t you just help this one person get set up” “couldn’t you just answer this question.” It was exhausting and awful, because I absolutely did not have the time to do these things, and I’d actually made it clear that I didn’t even have time to keep telling her no. And yet, the questions still came.

But bargaining can also be a useful and productive pattern. In my professional life, when I say no, it’s pretty normal to negotiate a solution together with the dev team. Even in that dreadful volunteer experience, my final out came by begging a friend to work with her — negotiating it so that there was a buffer of no between me and her so she had a resource willing to help her and I had the ability to do the other thing I had committed to do.

[Slide 11] has a title of "4. Depression" and a quote that reads "Well, if you can't help me, then this program will die" and a picture of a young woman sitting at a picnic table with her face in her hands

[Slide 11] has a title of “4. Depression” and a quote that reads “Well, if you can’t help me, then this program will die” and a picture of a young woman sitting at a picnic table with her face in her hands

And then there’s depression, which honestly can be both emotional manipulation as well true dismay.

[Slide 12] has a title of "5. Acceptance" and contains an artistic photo of a cheerful looking T Rex toy

[Slide 12] has a title of “5. Acceptance” and contains an artistic photo of a cheerful looking T Rex toy

And finally, of course, acceptance. If you haven’t already recognized them, as well as the 5 stages of no, that was also the 5 stages of grieving. It’s sort of disturbing how much they line up. But why do we need to think about no anti-patterns?

[Slide 13] reads "So few experts, so many asks" and contains no picture

[Slide 13] reads “So few experts, so many asks” and contains no picture

And the answer is that these anti-patterns harm our communities. In a situation where you have very few experts and many people asking, anti-patterns surrounding no contribute to communities denial-of-servicing our few experts. This happens to me as a security expert sometimes: I’ve had weeks where I wind up arguing with people about lousy decisions endlessly, so much so that I then don’t have enough time to do advanced secure code review, or help other groups triage security issues well. It happens to me a lot more than I would like.

[Silde 14] has a title "Causes of burnout" and then a copy of a slide by Cate Huston that has a picture of an owl and reads 1. lack of control 2. insufficient reward 3. lack of community 4. absence of fairness 5. conflict in values 6. work overload"

[Silde 14] has a title “Causes of burnout” and then a copy of a slide by Cate Huston that has a picture of an owl and reads 1. lack of control 2. insufficient reward 3. lack of community 4. absence of fairness 5. conflict in values 6. work overload”

My friend Cate has been giving a great talk on burnout and I just wanted to share this slide, which talks about the fact that burnout isn’t just caused by high workload. No is a great tool for avoiding high workload, but it’s also a great tool for avoiding being put in situations where you’ll be hit by the other 5 things on this list. That’s one of the reasons that it’s absolutely essential that leaders need to learn to take no for an answer so that their communities can actually be *healthy* and not burnout factories.

[Side 15] has a picture of a ballerina in a practice outfit holding a pose that requires strength and below the words "How do I accept a no with strength and grace?"

[Side 15] has a picture of a ballerina in a practice outfit holding a pose that requires strength and below the words “How do I accept a no with strength and grace?”

So how can I learn to accept no with strength and grace?

[Slide 16] has only large text that reads "Step 1: Accept"

[Slide 16] has only large text that reads “Step 1: Accept”

The first step to accepting gracefully is to actually accept that no was in fact the answer given. If you catch yourself doing any of the anti-pattern things, you aren’t really doing a good job at this. Consider the lady who wouldn’t take no for an answer and kept asking me “couldn’t you just…” — if she’d been able to accept the no, we could have had time to help her find a better solution. But instead, the whole experience left me frustrated, exhausted, and telling my friends cautionary tales about the experience. This was a bad outcome for both of us, and for the people she wanted to help.

[Slide 17] has only large text that reads "Step 2: Listen:

[Slide 17] has only large text that reads “Step 2: Listen:

The second step is to listen. If you’re convinced this was the right choice, take time to find out why the answer was no. Be prepared to have that answer challenge your assumptions. One of the things I do at work sometimes is review open source libraries to see if they have good enough security hygiene for inclusion in our products, and I get a lot of push back when I tell people they need to choose a better library. They’ve made assumptions that don’t match up with my metrics, and the only way for them to learn to make better choices and thus get products to market faster is to learn what assumptions are leading them to poor decisions.

[Slide 18] has only large text that reads "Step 3: Plan"

[Slide 18] has only large text that reads “Step 3: Plan”

The last step is to form a new plan. You might be able to do this with the help of the person who said no, but you shouldn’t assume that — No means no, folk. If you want to be a great leader, you need to take responsibility for finding a new plan if you want the thing to be done.

[Slide 19] reads "But I don't want to get a no" with emphasis on the words "don't want"

[Slide 19] reads “But I don’t want to get a no” with emphasis on the words “don’t want”

But I don’t want to get a no.

[Slide 20] reads "But I can't afford to get a no" with emphasis on the words "can't afford"

[Slide 20] reads “But I can’t afford to get a no” with emphasis on the words “can’t afford”

But I can’t afford to get a no.

[Slide 21] says "How do I turn no into a yes?" with no emphasized in red to evoke a "stop" and yes emphasized in green to evoke a "go"

[Slide 21] says “How do I turn no into a yes?” with no emphasized in red to evoke a “stop” and yes emphasized in green to evoke a “go”

How do I turn no into a yes?

[Slide 22] reads "If you want to turn no into yes, first consider: Am I being an asshole?" The phrase "Am I being an asshole?" is emphasized.

[Slide 22] reads “If you want to turn no into yes, first consider: Am I being an asshole?” The phrase “Am I being an asshole?” is emphasized.

If you want to turn a no into yes, first consider: Am I being an asshole? (audience at OSB laughs, pulls out smart phones to take pictures of the slide). This is a legit thing you should ask yourself pretty regularly as a community leader, actually. For example, sometimes you’ll be asking for things to be done in a way that makes them easier for you at the cost of others. Sometimes you’re just demanding that things be done the first way you thought of when that’s not the important part of the request.

[Slide 23] reads "If you want to turn no into yes, first consider: What do I really need?" The phrase "What do I really need?" is emphasized.

[Slide 23] reads “If you want to turn no into yes, first consider: What do I really need?” The phrase “What do I really need?” is emphasized.

But perhaps more usefully, ask yourself what you really need. The answer is almost certainly not “I need to irritate my valuable volunteers” but what is the answer?

[Slide 24] has an image of a hand raised as if to ask a question and reads "How do I improve my ask?"

[Slide 24] has an image of a hand raised as if to ask a question and reads “How do I improve my ask?”

So, if you’re getting a no and you want a yes, clearly you are doing something wrong in the way you ask. How can you improve your ask to get better results for your community even if you have to get a no sometimes?

[Slide 25] has a picture of a woman looking into a microscope in a scientific lab and reads "Step 1: do your research"

[Slide 25] has a picture of a woman looking into a microscope in a scientific lab and reads “Step 1: do your research”

Step 1: do your research.

[Slide 26] repeats the title from the previous slide "Step 1: do your research" and follows it with a list of questions: What do you really need? Who else can you ask? Where else can you get more information? How long will what you’re asking for actually take? How stressful is it?

[Slide 26] repeats the title from the previous slide “Step 1: do your research” and follows it with a list of questions: What do you really need?
Who else can you ask?
Where else can you get more information?
How long will what you’re asking for actually take?
How stressful is it?

  • What do you really need?
  • Who else can you ask?
  • Where else can you get more information?
  • How long will what you’re asking for actually take?
  • How stressful is it?

[Slide 27] has a picture of two kids sharing and reads "Step 2: use your empathy"

[Slide 27] has a picture of two kids sharing and reads “Step 2: use your empathy”

Step 2: Use your empathy

[Slide 28] repeats the title from the previous slide "Step 2: use your empathy" and asks a range of questions (will appear in text below this caption) The emphasis is on the final sentence, which reads "Empathy is not about what you want, but what they want."

[Slide 28] repeats the title from the previous slide “Step 2: use your empathy” and asks a range of questions (will appear in text below this caption) The emphasis is on the final sentence, which reads “Empathy is not about what you want, but what they want.”

  • How can you make saying yes more beneficial to the person you’re asking?
    • Can you pay them?
    • Can you provide other rewards?
    • Can you make it align better with their career or life goals?
    • Can you make sure they get more thanks, recognition?
  • How can you make it easier for them to say yes?
    • Do they need childcare?
    • Do they need a better schedule?
    • Does the task need to be better-defined?
    • Could they help with something smaller?
  • Should you just leave them alone if they say no?
  • Empathy is not about what you want, but what they want.

If you don’t know how to empathize, you’re going to end up with asks that are utterly unappealing or outright insulting to the people whose help you want.

[Slide 29] has a picture of a snowy scene with my mom and her dog Buster and reads, "I'm Canadian. People die of exposure"

[Slide 29] has a picture of a snowy scene with my mom and her dog Buster and reads, “I’m Canadian. People die of exposure”

And in a striking example of that, one thing I and many others often get offered for my time is “exposure” — I’m from Canada. My people DIE of exposure. But jokes aside, exposure is often a double-edged sword for people in your community, and you need your empathy and knowledge of your community of volunteers to know when that’s something they might want and when it’s something they want to avoid at all costs.

[Slide 31] has a title of "Step 3: make a backup plan (or several)" and a Foxtrot comic about the need to make computer backups *before* doing something on the computer

[Slide 31] has a title of “Step 3: make a backup plan (or several)” and a Foxtrot comic about the need to make computer backups *before* doing something on the computer

Make a backup plan (hopefully this will be easier with the research!) If getting a yes is really important to you, you should try to do all of these things in advance.

[Slide 32] is a summary slide described in detail below.

[Slide 32] is a summary slide described in detail below.

Refusing to take no for an answer is damaging behaviour: it contributes to burnout, denial of service, assholism.

Steps to graceful acceptance of no:

  1. Accept
  2. Listen
  3. Plan

If you really need a yes

  1. Do your research
  2. Use your empathy
  3. Make a backup plan

And do all of this before you ask if you want the best results and the happiest community. If you’re asking for something, the onus is upon you to figure out who might want to do this and find a way to make them feel great about saying yes.

Learning to accept no well and productively will make you a more effective leader.

nopetopus
Nopetopus source

Photo credits:
“Superman vs Hulk (131/365)” by JD Hancock https://www.flickr.com/photos/jdhancock/4600608792
“Talk to the hand” by Bridget McKenzie https://www.flickr.com/photos/bridgetmckenz/7822818160/
“Power tool” by Helen Cook https://www.flickr.com/photos/hvc/2681974174/
“Sleepy” by Sera Photography https://www.flickr.com/photos/seraphing/15305580251/
“Denial pack” by andres musta https://www.flickr.com/photos/andresmusta/6175939561/
“Anger” by kunkelstein https://www.flickr.com/photos/21370407@N08/2091127037
“You’d be crazy to miss these bargains” by Christian Heilmann https://www.flickr.com/photos/codepo8/1309725237
“Acceptance” by Kitty Mao https://www.flickr.com/photos/kwseah/21683299393
“Beautiful Ballerina” by Grace Trivino https://www.flickr.com/photos/graceyheartphotography/4741052547
“Raised hand” by usdagov https://www.flickr.com/photos/usdagov/22484527807/
“Sharing” by Binny V A https://www.flickr.com/photos/binnyva/8600465534
“Out for a walk in the woods” by Terriko https://www.flickr.com/photos/terrio/8304718546/

OSB 2015 – Internet of Things Militia: Paramilitary Training for your IoT devices (Video & Slides)

by

As previously mentioned, I gave two talks at Open Source Bridge this year, and they’ve recently put the videos online. Here’s the more frivolous and silly of the two:

Internet of Things Militia: Paramilitary Training for your IoT devices

Abstract: Security folk generally talk about how the Internet of Things is bad for security, but it also brings new sensors and connected devices that could co-operate in new and interesting ways. Could we use internet things to enhance security?

Video embedded below:

[Confreaks.tv video link] [Youtube video link]

I was honestly pretty surprised that open source bridge accepted two talks (especially when I found many colleagues who are pretty decent speakers didn’t get in!). This was a bit of a joke talk, meant to poke fun at how security people talk doom and gloom about internet of things, but also a way to talk sideways about how internet things are both terrible and terrific if you think like a hacker. I’m not sure I would have pitched this talk if I’d known that OSB audiences are notoriously quiet and not big on participation, but I was lucky enough to get a crowd who was willing to get into it and come up with some fun suggestions on how to “better” use internet things.

Remember, don’t try this at home!

[Internet of Things Militia: Paramilitary Training for your IoT devices (Slides)] To be honest, there’s not much in these other than pictures to get people talking, but you can see my notes underneath each slide to see what I was planning on saying. The slides are also in the video.

Again, one day I hope to transcribe this and put up a nice blog post with the slides for those who don’t love video, but I the perfect is the enemy of the good and all, so I’m sharing what I have instead of pining for what I don’t have done yet.

OSB 2015 – Bringing Security to Your Open Source Project (Video & Slides)

by

I gave two talks at Open Source Bridge this year, and they’ve recently put the videos online. Here’s the more serious and informative of the two:

Bringing Security to Your Open Source Project

Abstract: With high profile breaches in open source projects, the issue of security has become one of great import to many people. But many projects, especially smaller ones, are intimidated by the idea of a security audit. This talk will discuss ways for smaller projects to experiment, learn, and even have fun improving their security. No PhDs in security required!

Video embedded below:

[Confreaks.tv video Link] [youtube link]

I’m a bit sad that they cut out the introduction I got; it was pretty hilarious.

The motivation behind this talk is that when I tell people in open source communities that I do security for open source projects, I get a lot of interest but people always say they don’t know where to start and quite a lot of them buy into the idea that somehow just being open source makes you secure. That can be a big push towards security for some projects, but it’s not a panacea, so this talk is an intro to how to do a security hackathon and be welcoming to folk who want to help with your security.

[Bringing Security to Your Open Source Project (Slides)] The slides are in the video as well, but sometimes this is easier! If you look at the slides, you can also see a rough version of what I’d planned to say in the notes section.

One of these days I’ll transcribe the talk and set up a blog post with slides as images for folk who don’t aren’t into videos for whatever reason (I know I don’t watch very many myself unless I’m multitasking), but I thought I’d share the video first rather than wait. Hope you like it!