Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Agenda for later today <https://hackmd.io/FXzTbCOGRtyJrXeHNiGjFg>

mmm I cannot access the document again ^^'

Heads up I'll be travelling so will attempt to join from mobile with camera off.

Thanks! Should be :crossed_fingers: but I'll be driving through an area with limited reception so not sure how smooth joining the meeting will be :slightly_smiling_face:

Reminder: osquery office hours happening in 15 minutes <https://meet.google.com/joi-ukxw-zvv>

I created <https://hackmd.io/R14H8ilCRcOLweaeRBz4OA> for tomorrow’s office hours

<https://www.youtube.com/watch?v=6t66ttoT_tQ>

(office hours now with improved camera and mic right Seph? haha)

Ish. New mic, playing with an iPhone as a camera. Upgraded lights 

iPhone as a camera? nice! how did you do that?

A couple of ways!

The basic idea is that iphone cameras vastly outpace webcams (true!) and people should leverage them.

For iOS, there are at least two different apps. I’m currently using epoccam (from corsair/elgato, it’s like $8). There’a another one, at about the same price. Launch app, and it connects to some macOS software.

Apple also has an announced feature for this, that should land in the next OS release.

I imagine there’s similar for non-Apple ecosystems, but I don’t know the details

It’s akin to folks using digital cameras with HDMI out instead of webcams.

I find the picture quality better than the webcam, not quite as nice as the macbook camera.

Practically speaking, it all feels a little fiddly

Interesting! I can see how a phone can easily beat a webcam

The pace of development is so much faster

It’s strange it seems like there are 2 epoccam both from Corsair

In the app store? One is the free one (watermark and lower res), the other is the paid one. Kinda annoying they have the same name

Oh I see! Interesting. I’ll take a look at it! Thanks!

Agenda doc! <https://hackmd.io/RShDg64rSLiAfPdELOcwzA|https://hackmd.io/RShDg64rSLiAfPdELOcwzA>

FYI for the office hours of Oct 25, I will be on PTO and hopefully one of the other Trail of Bits folks can let everyone into the Meet and hit the REC button

Agenda doc for tomorrow <https://hackmd.io/vyQSI7ehRS-cLv23KkMRhQ>

<https://www.youtube.com/watch?v=CUwtl3-GNUY>

Agenda doc for Tuesday <https://hackmd.io/klyZAgKGTK-W6S2N5Xny_A>

And I might not make it this week. Not sure yet

yea, it's Election Day in the US and our "offices" are closed but we will try to attend

I happen to be flying during the normal time this week so I won't make it. If it's tricky for a lot of folks, perhaps we should look to reschedule?

the following day (Wednesday Nov 9), same time?

If I get a few Yes replies I will move it

:thinks: It might make more sense to cancel, than try for a different day

Yeah actually on review of my calendar I don't think I'd likely be able to make any time this week.

I imagine the most important thing for this time would be declaring 5.6.0 stable? Added my comments in the agenda -- haven't had any issues with 5.6.0 on our end.

Maybe just reviews for <https://github.com/osquery/osquery/pull/7804> and then call 5.6.0 stable, and cancel this week.

<!here> Between elections and travel, it sounds like a big chunk of the US folks are unavailable today. So we are taking the unusual step of canceling office hours this week. See you all November 22nd!

Office hours today! Agenda doc up at <https://hackmd.io/F9uUgvUkQuuyfrPoZbstYg>