2020-027-RIPPLE20 Report, supply chain security, responsible disclosure, software development, and vendor care.

<p>Whitepaper: <span style="font-weight: 400;"><a href= "https://www.jsof-tech.com/ripple20/">https://www.jsof-tech.com/ripple20/</a></span></p> <p><span style="font-weight: 400;">[blog] Build your own custom TCP/IP stack:</span> <a href= "https://www.saminiir.com/lets-code-tcp-ip-stack-1-ethernet-arp/"><span style="font-weight: 400;"> https://www.saminiir.com/lets-code-tcp-ip-stack-1-ethernet-arp/</span></a></p> <p><span style="font-weight: 400;">Another custom TCP/IP stack: <a href= "https://github.com/tass-belgium/picotcp">https://github.com/tass-belgium/picotcp</a></span></p> <p><span style="font-weight: 400;">RIPPLE 20 Whitepaper:</span> <a href= "https://drive.google.com/file/d/1d3NNVCRPVFk0-V0HUO5CxWWVn9pYIvmF/view?usp=sharing"> <span style= "font-weight: 400;">https://drive.google.com/file/d/1d3NNVCRPVFk0-V0HUO5CxWWVn9pYIvmF/view?usp=sharing</span></a><span style="font-weight: 400;"> </span></p> <p><span style="font-weight: 400;">Agenda:</span></p> <p><span style="font-weight: 400;">Part 1:</span></p> <p><span style="font-weight: 400;">Background on the report</span></p> <p><span style="font-weight: 400;">Why is it called RIPPLE20? What’s the RIPPLE about? </span></p> <p><span style="font-weight: 400;">Communications with Treck (and it’s Japanese counterpart)</span></p> <p><span style="font-weight: 400;">Were you surprised about the reaction? Positive or negative?</span></p> <p><span style="font-weight: 400;">Types of systems affected?</span></p> <p><span style="font-weight: 400;">IoT</span></p> <p><span style="font-weight: 400;">Embedded systems</span></p> <p><span style="font-weight: 400;">SCADA</span></p> <p><span style="font-weight: 400;">What precipitated the research?</span></p> <p><span style="font-weight: 400;">What difficulties did you face in finding these vulns? Deadlines? </span></p> <p><span style="font-weight: 400;">What tools were used for analysis? (I think you mentioned Forescout --brbr)</span></p> <p><span style="font-weight: 400;">What kind of extensibility are we talking about? TCP siz