Skip to content

Commit 389d9a8

Browse files
shsinghshsingh
committed
chore: archive gh issues
1 parent a422ca9 commit 389d9a8

File tree

3 files changed

+148
-0
lines changed

3 files changed

+148
-0
lines changed

‎issues/2023-09-13.114.issue.open.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# [\#114 Issue](https://github.com/OWASP/www-project-machine-learning-security-top-10/issues/114) `open`: [Fortnightly] Working Group Meeting - 2023-Sep-14
2+
**Labels**: `meeting`
3+
4+
5+
#### <img src="https://avatars.githubusercontent.com/u/412800?v=4" width="50">[shsingh](https://github.com/shsingh) opened issue at [2023-09-13 18:22](https://github.com/OWASP/www-project-machine-learning-security-top-10/issues/114):
6+
7+
## Current agenda
8+
9+
1. General project status [v0.3 - in progress](https://github.com/OWASP/www-project-machine-learning-security-top-10/milestone/3)
10+
2. Notable PRs completed since last meeting:
11+
- #104
12+
- #110
13+
3. Notable discussions:
14+
- #107
15+
- #108
16+
- #109
17+
4. Meetings:
18+
- WG meeting will change forward a few hours to accomodate EU morning time zones
19+
5. Contributions and [current help wanted](https://github.com/OWASP/www-project-machine-learning-security-top-10/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22)
20+
6. Introductions (for new contributors)
21+
22+
## Discussions
23+
24+
* [Join the OWASP Slack group](https://owasp.org/slack/invite) and the [#project-mlsec-top-10 channel](https://owasp.slack.com/archives/C04PESBUWRZ)
25+
* [Github Discussions](https://github.com/OWASP/www-project-machine-learning-security-top-10/discussions)
26+
27+
## Calendar Event
28+
[Download calendar event (ICS)](https://calendar.google.com/calendar/ical/c_f818ec1e3dea1d4c80cb0f872566eccb82c5df9cc1161f3077f93eafc47889dc%40group.calendar.google.com/public/basic.ics)
29+
30+
31+
32+
33+
-------------------------------------------------------------------------------
34+
35+
36+
37+
[Export of Github issue for [OWASP/www-project-machine-learning-security-top-10](https://github.com/OWASP/www-project-machine-learning-security-top-10).]

‎issues/2023-09-26.116.issue.open.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# [\#116 Issue](https://github.com/OWASP/www-project-machine-learning-security-top-10/issues/116) `open`: [FEEDBACK]: Make ML06 more precise and with more Attack Scenarios
2+
**Labels**: `issues/general`, `issues/triage`, `discussions/mltop10`, `discussions/feedback`
3+
4+
5+
#### <img src="https://avatars.githubusercontent.com/u/64902909?u=0d09ff56fe837eafe74b3410ec0eb7dc48fe7d21&v=4" width="50">[mik0w](https://github.com/mik0w) opened issue at [2023-09-26 13:46](https://github.com/OWASP/www-project-machine-learning-security-top-10/issues/116):
6+
7+
### Type
8+
9+
Suggestions for Improvement
10+
11+
### What would you like to report?
12+
13+
**Re-thinking and re-writing ML06 - corrupted packages**
14+
15+
The description of ML05 is quite limited given how complicated the software supply chains are, especially those related to ML-using software.
16+
17+
In the summary of the vulnerability it is written: _This type of attack can be particularly dangerous as it can go unnoticed for a long time, since the victim may not realize that the package they are using has been compromised. The attacker's malicious code could be used to steal sensitive information, modify results, or even cause the machine learning model to fail._. Meanwhile, in the Detectability section in Risk Factors it says, that it's easy to detect this kind of vulns.
18+
19+
What is more, there's nothing said about countermeasures such as SBOM/MLBOM etc. in the description of this vulnerability. In my opinion that should be included.
20+
21+
There's plenty of resources that should be analyzed and used for the description of this specific vulnerability:
22+
- [CycloneDX ML-BOM](https://cyclonedx.org/capabilities/mlbom/)
23+
- [SPDX AI](https://spdx.dev/learn/areas-of-interest/ai/)
24+
- [this article](https://5stars217.github.io/2023-08-08-red-teaming-with-ml-models/)
25+
- [another article](https://stiankri.substack.com/p/distribution-confusion-in-pypi)
26+
- [or this paper](https://www.researchgate.net/publication/372761501_Assessing_the_Vulnerabilities_of_the_Open-Source_Artificial_Intelligence_AI_Landscape_A_Large-Scale_Analysis_of_the_Hugging_Face_Platform)
27+
28+
29+
### Code of Conduct
30+
31+
- [X] I agree to follow this project's Code of Conduct
32+
33+
34+
35+
36+
-------------------------------------------------------------------------------
37+
38+
39+
40+
[Export of Github issue for [OWASP/www-project-machine-learning-security-top-10](https://github.com/OWASP/www-project-machine-learning-security-top-10).]

‎open-issues.md‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,76 @@
11
Export of Github issues for [OWASP/www-project-machine-learning-security-top-10](https://github.com/OWASP/www-project-machine-learning-security-top-10).
22

3+
# [\#116 Issue](https://github.com/OWASP/www-project-machine-learning-security-top-10/issues/116) `open`: [FEEDBACK]: Make ML06 more precise and with more Attack Scenarios
4+
**Labels**: `issues/general`, `issues/triage`, `discussions/mltop10`, `discussions/feedback`
5+
6+
7+
#### <img src="https://avatars.githubusercontent.com/u/64902909?u=0d09ff56fe837eafe74b3410ec0eb7dc48fe7d21&v=4" width="50">[mik0w](https://github.com/mik0w) opened issue at [2023-09-26 13:46](https://github.com/OWASP/www-project-machine-learning-security-top-10/issues/116):
8+
9+
### Type
10+
11+
Suggestions for Improvement
12+
13+
### What would you like to report?
14+
15+
**Re-thinking and re-writing ML06 - corrupted packages**
16+
17+
The description of ML05 is quite limited given how complicated the software supply chains are, especially those related to ML-using software.
18+
19+
In the summary of the vulnerability it is written: _This type of attack can be particularly dangerous as it can go unnoticed for a long time, since the victim may not realize that the package they are using has been compromised. The attacker's malicious code could be used to steal sensitive information, modify results, or even cause the machine learning model to fail._. Meanwhile, in the Detectability section in Risk Factors it says, that it's easy to detect this kind of vulns.
20+
21+
What is more, there's nothing said about countermeasures such as SBOM/MLBOM etc. in the description of this vulnerability. In my opinion that should be included.
22+
23+
There's plenty of resources that should be analyzed and used for the description of this specific vulnerability:
24+
- [CycloneDX ML-BOM](https://cyclonedx.org/capabilities/mlbom/)
25+
- [SPDX AI](https://spdx.dev/learn/areas-of-interest/ai/)
26+
- [this article](https://5stars217.github.io/2023-08-08-red-teaming-with-ml-models/)
27+
- [another article](https://stiankri.substack.com/p/distribution-confusion-in-pypi)
28+
- [or this paper](https://www.researchgate.net/publication/372761501_Assessing_the_Vulnerabilities_of_the_Open-Source_Artificial_Intelligence_AI_Landscape_A_Large-Scale_Analysis_of_the_Hugging_Face_Platform)
29+
30+
31+
### Code of Conduct
32+
33+
- [X] I agree to follow this project's Code of Conduct
34+
35+
36+
37+
38+
-------------------------------------------------------------------------------
39+
40+
# [\#114 Issue](https://github.com/OWASP/www-project-machine-learning-security-top-10/issues/114) `open`: [Fortnightly] Working Group Meeting - 2023-Sep-14
41+
**Labels**: `meeting`
42+
43+
44+
#### <img src="https://avatars.githubusercontent.com/u/412800?v=4" width="50">[shsingh](https://github.com/shsingh) opened issue at [2023-09-13 18:22](https://github.com/OWASP/www-project-machine-learning-security-top-10/issues/114):
45+
46+
## Current agenda
47+
48+
1. General project status [v0.3 - in progress](https://github.com/OWASP/www-project-machine-learning-security-top-10/milestone/3)
49+
2. Notable PRs completed since last meeting:
50+
- #104
51+
- #110
52+
3. Notable discussions:
53+
- #107
54+
- #108
55+
- #109
56+
4. Meetings:
57+
- WG meeting will change forward a few hours to accomodate EU morning time zones
58+
5. Contributions and [current help wanted](https://github.com/OWASP/www-project-machine-learning-security-top-10/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22)
59+
6. Introductions (for new contributors)
60+
61+
## Discussions
62+
63+
* [Join the OWASP Slack group](https://owasp.org/slack/invite) and the [#project-mlsec-top-10 channel](https://owasp.slack.com/archives/C04PESBUWRZ)
64+
* [Github Discussions](https://github.com/OWASP/www-project-machine-learning-security-top-10/discussions)
65+
66+
## Calendar Event
67+
[Download calendar event (ICS)](https://calendar.google.com/calendar/ical/c_f818ec1e3dea1d4c80cb0f872566eccb82c5df9cc1161f3077f93eafc47889dc%40group.calendar.google.com/public/basic.ics)
68+
69+
70+
71+
72+
-------------------------------------------------------------------------------
73+
374
# [\#113 Issue](https://github.com/OWASP/www-project-machine-learning-security-top-10/issues/113) `open`: Model stealing through interaction is not mentioned
475

576
#### <img src="https://avatars.githubusercontent.com/u/796794?v=4" width="50">[robvanderveer](https://github.com/robvanderveer) opened issue at [2023-09-08 21:44](https://github.com/OWASP/www-project-machine-learning-security-top-10/issues/113):

0 commit comments

Comments
 (0)