Community Meetings

[cx-antero-silva]

Hi,

We’re very excited to announce that we’re promotion community meetings. These meetings will start on August 11th at 15h30 GMT+1 timezone, and will occur every two weeks.

The topics associated will change accordingly to the community interests. The first one will be:
In these sessions we will

• Show plans for the next KICS 1.6 release.
• Focus on some of the release topics.
• Open discussion about plans and ongoing topics.
• Hear your feedback for improvements.
• … and much more!

Here are the details for the meeting:
Join us via the following link:

https://checkmarx.zoom.us/j/83997253951?pwd=V3o1ZklveHBLV3BaZURmZXBaNTZjUT09&from=addon

Meeting ID: 839 9725 3951
Passcode: 778724

KICSCommunityMeeting_2022_08_11.pdf

Regards,
Antero Silva
KICS - Product Manager

[kaplanlior]

Will be happy to see you in this meeting.

KICS contributors in 1.5.x.
@rndmh3ro @Churro @jplanckeel @AlexEndris @liorj-orca @lipeavelar @roi-orca @LupovichRan @ramprasathasokan @nv35 @konstruktoid @jaevans @roock @tspearconquest @jycamier @floh96 @rams3sh

KICS upcoming contributors (PR pending):
@sluetze @gafnit-lightspin

[rams3sh]

@kaplanlior Thanks alot for the invite. Really appreciate it. Am really sorry , I was in between something and couldn't attend the meet. I hope it went well and everyone had a great time.

[kaplanlior]

Thank you for everyone who joined the community meeting.
We'll meet again in two weeks - August 25th, same time - 14:30 UTC
to talk on progress with KICS 1.6

[cx-nuno-oliveira]

Hi everyone!

Our 2nd community meeting is just around the corner!
Notice the slight time change: August 25th at 14h00 UTC.

In this session we will

• talk about the advances for KICS 1.6 release
• address a few community bugs and explain what we are doing for 1.5.x minor versions
• demo on KICS VSCode Extension for auto-scan and auto-remediation
• hear your feedback for improvements.
  … and more!

KICS contributors, don't miss out :)
@rndmh3ro @Churro @jplanckeel @AlexEndris @liorj-orca @lipeavelar @roi-orca @LupovichRan @ramprasathasokan @nv35 @konstruktoid @jaevans @roock @tspearconquest @jycamier @floh96 @rams3sh @sluetze @gafnit-lightspin

Join us via the following link:

https://checkmarx.zoom.us/j/81786258712?pwd=WTY3c2ZFZXhmclg1cWpQZlB2SnRwQT09&from=addon

Meeting ID: 817 8625 8712
Passcode: 957397

KICSCommunityMeeting_2022_08_25.pdf

[cx-nuno-oliveira]

Hi everyone!

Our 3rd community meeting is just around the corner!
When: September 8th at 14h30 UTC +0.
Where: https://checkmarx.zoom.us/j/85336870805?pwd=Vmw0Nm1lNU45eXdiRnMxZjdBdzV5Zz09&from=addon

In this session we will

• Present initial plans for KICS 1.6.1
• Discuss about our preparation for HacktoberFest
• Talk about the issues we are currently working on
• Hear about your feedback
• And more…

KICS contributors, don't miss out :)
@rndmh3ro @Churro @jplanckeel @AlexEndris @liorj-orca @lipeavelar @roi-orca @LupovichRan @ramprasathasokan @nv35 @konstruktoid @jaevans @roock @tspearconquest @jycamier @floh96 @rams3sh @sluetze @gafnit-lightspin

Meeting ID: 853 3687 0805
Passcode: 433190

KICSCommunityMeeting_2022_09_08.pdf

[cx-nuno-oliveira]

Hi everyone!

Our 4th community meeting is just around the corner!
When: September 22nd at 15h00 UTC +0.
Where: https://checkmarx.zoom.us/j/84701317570?pwd=QlpPRlNEWXRscjUxMkNVMnV3K1BYQT09&from=addonddon
Meeting Slides : KICSCommunityMeeting_2022_09_22.pdf

In this session we will

• Discuss about our preparation for HacktoberFest
• Discuss about Github Action versions
• Hear about your feedback
  And more…

KICS contributors, don't miss out :)
@rndmh3ro @Churro @jplanckeel @liorj-orca @lipeavelar @roi-orca @LupovichRan @ramprasathasokan @nv35 @konstruktoid @jaevans @roock @tspearconquest @jycamier @rams3sh @sluetze @gafnit-lightspin

NOTE for security reason, you'll need to:

• sign in to zoom, in order to participate
• wait in the waiting room before entering
• use the passcode below to access the meeting:

Meeting ID: 847 0131 7570
Passcode: 718911

[jycamier]

Is it possible to get a summary of what was said at the meeting ?

[cx-nuno-oliveira]

Hi @jycamier I've attached the slides used in the meeting. Feel free to go over them.
In summary, we discussed our hacktoberfest plans, github actions versions and the possibility of KICS scan github workflows.
Regarding the github actions we have three different ways of approaching this:

1. Use an argument on the action that allows the user to specify which version of KICS to use
2. Create a specific version of the action to use KICS1.5.15 and keep going with another version that always uses the latest KICS version
3. Create a version that always uses the latest KICS, and at the same time create versions of GHA that uses a fixed version of KICS.

We are thinking of this because of the breaking changes introduced in KICS1.6.0. We don't want to break all users of our GHA by updating automatically everyone to KICS1.6.0.

WDYT?

[jycamier]

Hello @nunoocx

KICS scan github workflows

Today we're analyzing our GH workflows with KICS and it's very important because we are running self-managed runners on a Kubernetes cluster with actions-runner-controller. We have 2 queries:

• the first one is an INFO query: it detects the use of the strategy matrix and exposes all significant side effects:
  • coupling between tasks
  • financial issues
  • the possible high expectation of the availability of a runner (for all teams)
• the second one is an HIGH query : if a matrix is use, the max-parallel attribute must be set as low as possible

We are thinking of this because of the breaking changes introduced in KICS1.6.0

I didn't know about BC introduce in KICS1.6.0. Of course, I need to test auto-remediation feature, so I cannot wait. 😄
IMHO, maintained a gh-action tag is a bit confusing for every body wants to know what's a the current version which is available in the GHA.

I like the option #2

[cx-nuno-oliveira]

@jycamier you should definitely join one of our community meetings and share your insights on using KICS for GH Workflows! Amazing to see you already taking advantage of it!

Regarding GHActions, we will soon reach to a conclusion and will take your likings into account. Thanks for the feedback!

[jycamier]

Until now, all community meetings were held when I was unavailable.

[cx-nuno-oliveira]

Hi everyone!

Our 5th community meeting is today!!
When: October 6th at 15h00 UTC +0.
Where: https://tinyurl.com/kics-community
Slides: KICSCommunityMeeting_2022_10_06.pdf

KICS contributors, don't miss out :)
@rndmh3ro @Churro @jplanckeel @liorj-orca @lipeavelar @roi-orca @LupovichRan @ramprasathasokan @nv35 @konstruktoid @jaevans @roock @tspearconquest @jycamier @rams3sh @sluetze @gafnit-lightspin @patrickpichler

---

Summary

• Revision of KICS 1.6.0 and 1.6.1 releases
• Update on the Hacktoberfest: 6 contributions so far by @patrickpichler and @JoaoDanielRufino! Amazing work, keep them coming!
• Description and discussion of the KICS Github Action upgrade process
• Discussion about KICS scanning Github workflows for finding issues like script injection or lack of permission restrictions...

[cx-nuno-oliveira]

Hi everyone!

Our 6th community meeting is today!!
When: November 3rd at 15h00 UTC +0.
Where: https://tinyurl.com/kics-community
Slides: KICSCommunityMeeting_2022_11_03.pdf

KICS contributors, don't miss out :)
@rndmh3ro @Churro @jplanckeel @liorj-orca @lipeavelar @roi-orca @LupovichRan @ramprasathasokan @nv35 @konstruktoid @jaevans @roock @tspearconquest @jycamier @rams3sh @sluetze @gafnit-lightspin @patrickpichler

---

Summary:

• Revision of KICS 1.6.2 and 1.6.3
• Presentation of work done for detection of OpenSSL vulnerability (CVE-2022-3786; CVE-2022-3602)
• Session with @jycamier, who shared his experience and stories so far with KICS!