# 2017-07-31 Meeting Notes

**URL:** <https://forums.mobyproject.org/t/2017-07-31-meeting-notes/119>\
**Category:** scanning\
**Created:** [August 8, 2017, 9:15pm UTC](https://forums.mobyproject.org/t/2017-07-31-meeting-notes/119 "2017-08-08T21:15:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![endophage](https://yyz1.discourse-cdn.com/flex031/user_avatar/forums.mobyproject.org/endophage/32/64_2.png) [@endophage](https://forums.mobyproject.org/u/endophage)\
**Post date:** [August 8, 2017, 9:15pm UTC](https://forums.mobyproject.org/t/2017-07-31-meeting-notes/119/1 "2017-08-08T21:15:12Z")

</div>

Apologies for the delayed notes, I was out of action for much of the last week. Discourse still considers me a “new” user and will only let me include 2 links in a post, hence why the GH repos below aren’t linked 😕

The recording can be found here: [https://docker.zoom.us/recording/play/3aC96B5qJ5Jq35m\_lIT00GRxUjimCKrifLGxF4mFyv9nkRcmpIu0Dy3KRevK9pRb](https://docker.zoom.us/recording/play/3aC96B5qJ5Jq35m_lIT00GRxUjimCKrifLGxF4mFyv9nkRcmpIu0Dy3KRevK9pRb) (meeting starts at about 14:30, I’ll use the manual recording feature next time to capture the right time slice)

Notes:

- William Cox talked on CVEs and CVSS scoring. Some key points:
  - CVSSv3 scores attempt to incorporate more logic around how one can take advantage of a CVE and/or chain multiple CVEs together.
  - CVSS scores change over the lifetime of a CVE.
  - Some vendors provide their own scores which take in to account the context of their platform.
  - Process of issuing a CVE can lack transparency for reporter. DWF (GitHub: distributedweaknessfiling/) is a project aiming to automate and increase transparency of reporting CVEs.

- Liz Rice presented Manifesto (GitHub:aquasecurity/manifesto) a tool for storing image metadata in the registry beside images.
  - Basic functionality in place to set and get data.
  - Uses a single special tag within the image repository to hold a mapping of all other tags to their metadata.

Next meeting scheduled for August 21

Subsequent meeting after that will be at Moby Summit on September 14th in LA ([https://www.eventbrite.com/e/moby-summit-los-angeles-tickets-35930560273](https://www.eventbrite.com/e/moby-summit-los-angeles-tickets-35930560273)). I’m currently uncertain of whether we will have access to video conferencing or sufficiently clear wifi.

---

<div class="post-metadata">

**Author:** ![1605200517](https://avatars.discourse-cdn.com/v4/letter/1/f19dbf/32.png) [@1605200517](https://forums.mobyproject.org/u/1605200517)\
**Post date:** [August 9, 2017, 11:37am UTC](https://forums.mobyproject.org/t/2017-07-31-meeting-notes/119/2 "2017-08-09T11:37:09Z")

</div>

Dear David, may I ask whether this is the only recorded meeting or are there others as well?

---

<div class="post-metadata">

**Author:** ![endophage](https://yyz1.discourse-cdn.com/flex031/user_avatar/forums.mobyproject.org/endophage/32/64_2.png) [@endophage](https://forums.mobyproject.org/u/endophage)\
**Post date:** [August 9, 2017, 5:05pm UTC](https://forums.mobyproject.org/t/2017-07-31-meeting-notes/119/3 "2017-08-09T17:05:56Z")

</div>

Hi, unfortunately I didn’t record the earlier meetings. I’m still somewhat experimenting with the best way to run these meetings. I plan to record all the future meetings. I think one of our members may have recorded the SPDX discussion, I’ll see if we can get that up somewhere.