| *** dmccowan has quit IRC | 00:09 | |
| *** dmccowan has joined #openstack-security | 00:20 | |
| *** dmccowan has quit IRC | 00:25 | |
| *** dmccowan_ has joined #openstack-security | 00:25 | |
| *** bdpayne has quit IRC | 00:42 | |
| *** voodookid has joined #openstack-security | 01:54 | |
| *** amrith is now known as _amrith_ | 02:41 | |
| *** zz_naotok is now known as naotok | 03:04 | |
| *** dmccowan_ has quit IRC | 03:20 | |
| *** voodookid has quit IRC | 03:36 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/118978 | 06:07 |
|---|---|---|
| *** imam1 has joined #openstack-security | 09:45 | |
| *** imam1 has left #openstack-security | 09:50 | |
| *** _amrith_ is now known as amrith | 10:39 | |
| *** naotok is now known as zz_naotok | 10:45 | |
| *** dmccowan has joined #openstack-security | 11:00 | |
| *** dmccowan_ has joined #openstack-security | 11:30 | |
| *** dmccowan has quit IRC | 11:31 | |
| *** dmccowan_ is now known as dmccowan | 11:31 | |
| *** dmccowan has quit IRC | 11:43 | |
| *** jamielennox has quit IRC | 11:51 | |
| *** jamielennox has joined #openstack-security | 11:51 | |
| *** dmccowan has joined #openstack-security | 12:08 | |
| *** dmccowan_ has joined #openstack-security | 12:12 | |
| *** dmccowan has quit IRC | 12:12 | |
| *** dmccowan_ is now known as dmccowan | 12:12 | |
| *** amrith is now known as _amrith_ | 12:35 | |
| *** nkinder has quit IRC | 13:12 | |
| *** bknudson has joined #openstack-security | 13:35 | |
| *** dmccowan has quit IRC | 13:47 | |
| *** nkinder has joined #openstack-security | 13:57 | |
| *** _amrith_ is now known as amrith | 14:02 | |
| *** tmcpeak has joined #openstack-security | 14:06 | |
| *** dmccowan has joined #openstack-security | 14:17 | |
| tmcpeak | dmccowan: hey, how it goes? | 14:17 |
| *** voodookid has joined #openstack-security | 14:34 | |
| dmccowan | it goes well. thanks for reaching out. | 14:35 |
| tmcpeak | dmccowan: sure, want to tell me a little bit about your background and what your interests are? | 14:38 |
| dmccowan | For openstack, i've been building some proof of concepts locally. I've adding a custom dashboard to horizon and and added a nova scheduler filter. I plan to be more involved in the future, but I have an immediate goal of committing a security related patch. Partly to learn git/gerrit and partly to get "ATC" status before the summit. | 14:41 |
| tmcpeak | dmccowan: in that case a good place to start for you might be the contribute to the OpenStack security guide | 14:42 |
| tmcpeak | *to | 14:42 |
| *** voodookid has quit IRC | 14:42 | |
| openstackgerrit | A change was merged to openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/118978 | 14:43 |
| tmcpeak | such as that one ^ | 14:43 |
| tmcpeak | nevermind, that's not a great example | 14:43 |
| *** voodookid has joined #openstack-security | 14:43 | |
| tmcpeak | dmccowan: check this out - https://review.openstack.org/117596 | 14:44 |
| tmcpeak | there are a backlog of changes that need to be made to the guide, it's usually pretty easy to make the change | 14:45 |
| tmcpeak | I think that should be good for ATC | 14:45 |
| tmcpeak | it's also a great way to get familiar with git/gerrit | 14:45 |
| dmccowan | great. i'll do that first. i noticed from the last meet-up you identified some security vulnerabilities, if there's an unassigned bug (or to be written bug) for one of those i'd be interested in working a patch for one or more of them too. | 14:46 |
| tmcpeak | dmccowan: cool, we definitely have some of those | 14:47 |
| tmcpeak | dmccowan: are you familiar with the shell/command injection vulnerability when using shell=True to a Popen call? | 14:48 |
| tmcpeak | I found a few yesterday I haven't had time to track down yet, want to take one of those? | 14:48 |
| tmcpeak | if you aren't no problem, I can give you a link to read | 14:48 |
| tmcpeak | actually I'm working on this note: https://review.openstack.org/118910 which attempts to explain the issue | 14:48 |
| dmccowan | i saw a mention of that on IRC earlier this week as I was lurking. that sounds just like what i'm looking for. | 14:49 |
| tmcpeak | perfect, I'll give you a couple of locations in code, you can take a look, see if it is a vulnerability or isn't, if so why/why not, file a bug if it is, and take it from there | 14:49 |
| tmcpeak | sounds good? | 14:49 |
| dmccowan | yes, very good! | 14:49 |
| tmcpeak | cool | 14:50 |
| dmccowan | for the security guide. can you help me a cherry pick a bug to grab? | 14:50 |
| tmcpeak | bdpayne is probably a better guy to talk to for that, he should be on in an hour or so | 14:51 |
| tmcpeak | dmccowan: >> Popen call with shell=True identified, security issue. | 14:51 |
| tmcpeak | - ../OpenStack_projects//nova/nova/virt/baremetal/ipmi.py::292 | 14:51 |
| tmcpeak | so on that line in Nova, they are calling a Popen with shell=True. Once you brush up on why that's a bad idea, see if you can trace through the code and figure out if that's a problem or not | 14:51 |
| dmccowan | got it. thanks! | 14:54 |
| tmcpeak | cool, no prob. Let me know if you get stuck | 14:55 |
| openstackgerrit | Travis McPeak proposed a change to openstack/security-doc: Adding OSSN-0026: Unrestricted write permission to config files can allow code execution https://review.openstack.org/118910 | 14:57 |
| *** bdpayne has joined #openstack-security | 15:08 | |
| tmcpeak | bdpayne: dmccowan is interested in doing a little security guide work | 15:17 |
| bdpayne | hey... someone is up early :-) | 15:17 |
| bdpayne | welcome dmccowan | 15:17 |
| bdpayne | any specific interests? | 15:17 |
| dmccowan | my immediate interest to gain ATC status. :-) midterm interest is around trust, such as Trusted Compute Pools. longer term, anything security. | 15:19 |
| tmcpeak | ;) WFH day, don't have to do that *special* commute | 15:19 |
| bdpayne | dmccowan ok, sounds good | 15:20 |
| bdpayne | I don't have insight into the ATC status process, so no guarentees there on the timing and such | 15:21 |
| bdpayne | alas, here's the list of open bugs on the book: https://bugs.launchpad.net/openstack-manuals/+bugs?field.tag=sec-guide | 15:21 |
| bdpayne | are you familiar with using git / gerrit to submit changes? | 15:21 |
| *** amrith is now known as _amrith_ | 15:21 | |
| dmccowan | i've read the how-tos. ready to give it a try. | 15:22 |
| bdpayne | have you done much with git before? | 15:22 |
| dmccowan | enough to be dangerous. i've worked on onther open source project that was git based. | 15:23 |
| bdpayne | ok cool | 15:24 |
| bdpayne | so feel free to grab a bug and assign it to yourself | 15:24 |
| bdpayne | if you have any questions, please don't hesitiate to contact me | 15:24 |
| bdpayne | you can just mention me in this channel | 15:24 |
| dmccowan | can you help me cherry pick one? | 15:24 |
| bdpayne | sure | 15:24 |
| bdpayne | oh, and the guide is actually located at https://github.com/openstack/security-doc/tree/master/security-guide | 15:25 |
| bdpayne | are you new to openstack? | 15:25 |
| bdpayne | this may be a good one: https://bugs.launchpad.net/openstack-manuals/+bug/1343571 | 15:27 |
| bdpayne | you can grep the source code for ssl and make changes to tls where appropriate :-) | 15:27 |
| bdpayne | and it's an important change to get us consistent / up to date | 15:28 |
| dmccowan | i came to atlanta as a total newbie, but have been actively playing with it since. i've done some POC work: custom dashboard in horizon, and a new Nova scheduler filter. i've got a pretty good multi-node setup to use/recreate/play with. | 15:28 |
| bdpayne | ah great, sounds like you're ramping up nicely :-) | 15:30 |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/118747 | 15:30 |
| bdpayne | so yeah, take a look at the bug I mentioned above and let me know if you have any quesitons | 15:30 |
| dmccowan | will do. thanks! | 15:31 |
| tmcpeak | nkinder bdpayne paulmo voodookid: want to have a look at my OSSN if you have a chance? | 15:45 |
| tmcpeak | https://review.openstack.org/118910 | 15:45 |
| bdpayne | sure, I'll do some reviewing later this morning and I'll check it out then | 15:45 |
| tmcpeak | bdpayne: sounds good | 15:45 |
| nkinder | tmcpeak: yeah, it's on my list for today | 15:46 |
| tmcpeak | nkinder: cool | 15:47 |
| paulmo | tmcpeak: Nice, that is a good recommendation! | 15:47 |
| tmcpeak | paulmo: thank you sir | 15:47 |
| voodookid | looks good to me. | 15:48 |
| paulmo | Is there a higher level "umbrella"-like statement that recommends chmod'ing/chown'ing everything to the most locked down possible configuration? It seems like this could happen in other places too. | 15:48 |
| tmcpeak | paulmo: good point | 15:50 |
| tmcpeak | paulmo: general least privilege best practice statement? | 15:51 |
| voodookid | tmcpeak paulmo: perhaps add that to the install documents as well? | 15:58 |
| tmcpeak | voodookid: something like that should be in the security guide already | 15:58 |
| voodookid | also, when the scripts create these files, could they put good ACLs on them? | 15:59 |
| paulmo | I would think so… good practice or it might get forgotten if it is a "manual" process | 16:02 |
| paulmo | (people dropping by to chat, kind of in and out of IRC right now) | 16:02 |
| tmcpeak | voodookid: yeah I think they are generally created with decent permissions | 16:03 |
| tmcpeak | would be something interesting to verify though | 16:03 |
| *** voodookid has quit IRC | 16:12 | |
| *** voodookid has joined #openstack-security | 16:14 | |
| *** bdpayne has quit IRC | 16:20 | |
| *** _amrith_ is now known as amrith | 16:23 | |
| openstackgerrit | Travis McPeak proposed a change to openstack/security-doc: Adding OSSN-0026: Unrestricted write permission to config files can allow code execution https://review.openstack.org/118910 | 16:40 |
| *** Priti has joined #openstack-security | 16:40 | |
| tmcpeak | hey Priti | 16:40 |
| tmcpeak | how it goes? | 16:40 |
| Priti | hey Travis | 16:40 |
| tmcpeak | enjoying the week off? | 16:41 |
| tmcpeak | hopefully you're getting a chance to rest up a bit | 16:41 |
| Priti | yup totally, working on bunch of painting projects :) | 16:44 |
| tmcpeak | nice! I still want to buy one when you're ready to start selling them | 16:45 |
| Priti | yup sure may be in few months | 16:47 |
| tmcpeak | sounds good | 16:47 |
| tmcpeak | coming for the meeting today? | 16:47 |
| Priti | yeah | 16:48 |
| tmcpeak | cool | 16:48 |
| *** sicarie has joined #openstack-security | 16:49 | |
| *** bdpayne has joined #openstack-security | 16:49 | |
| *** rlpple has joined #openstack-security | 17:04 | |
| rlpple | join #openstack-meeting-alt for weekly meeting happening now. | 17:06 |
| tmcpeak | rlpple: +1 | 17:06 |
| tmcpeak | Priti: want to come give status on your OSSN? | 17:07 |
| Priti | Yup, i am wrapping up the write up OSSN-20, finishing writeup on how to detect active connections | 17:08 |
| Priti | thanks to Randy for Pointers | 17:09 |
| tmcpeak | Priti: want to give status in #openstack-meeting-alt ? | 17:10 |
| Priti | yup joining it | 17:10 |
| tmcpeak | cool | 17:10 |
| *** Priti_ has joined #openstack-security | 17:11 | |
| openstackgerrit | A change was merged to openstack/security-doc: OSSN-0023 Keystone logs tokens at INFO levels https://review.openstack.org/114971 | 17:25 |
| openstackgerrit | A change was merged to openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/118747 | 17:25 |
| *** Priti_ has quit IRC | 17:32 | |
| *** voodookid has quit IRC | 17:36 | |
| *** voodookid has joined #openstack-security | 17:37 | |
| bdpayne | tmcpeak just reviewed your OSSN | 17:52 |
| tmcpeak | bdpayne: oh cool | 17:56 |
| tmcpeak | what'd you think? | 17:56 |
| bdpayne | close, but not quite there yet | 17:56 |
| tmcpeak | cool | 17:56 |
| tmcpeak | I'll take a look at the feedback | 17:56 |
| bdpayne | also, I assume this went through the VMT? | 17:56 |
| tmcpeak | you mean I'm not dropping 0 days? | 17:56 |
| bdpayne | b/c I would argue that we should be doing input sanitization on that stuff | 17:57 |
| bdpayne | the fact that we don't is pretty poor programming practices | 17:57 |
| bdpayne | I guess I was just wondering if they at least took it as a longer term hardening task | 17:57 |
| tmcpeak | bdpayne: yeah, in the launchpad bug they said they don't want to declare vulnerabilities for anything involving tampering with config files to get code execution because they think it's a slippery slope | 18:02 |
| bdpayne | yeah... I mean, there could then be lots of vulns | 18:03 |
| bdpayne | well, this is unfortunate | 18:03 |
| paulmo | slippery slope of better security? heh | 18:03 |
| bdpayne | I think we should continue to push for fixes to these kinds of things | 18:03 |
| bdpayne | *all* input should be validated | 18:03 |
| bdpayne | full stop | 18:03 |
| paulmo | +100 bdpayne | 18:03 |
| openstackgerrit | Priti Desai proposed a change to openstack/security-doc: Adding note for OSSN-0020 https://review.openstack.org/113422 | 18:17 |
| *** Priti has quit IRC | 18:20 | |
| *** tmcpeak has quit IRC | 19:30 | |
| *** gabriela2 has joined #openstack-security | 19:45 | |
| *** gabriela2 has left #openstack-security | 19:47 | |
| *** amrith is now known as _amrith_ | 19:53 | |
| *** bdpayne has quit IRC | 19:56 | |
| *** _amrith_ is now known as amrith | 19:56 | |
| *** bdpayne has joined #openstack-security | 19:57 | |
| openstackgerrit | Nathaniel Dillon proposed a change to openstack/security-doc: Submitting new OSSN concerning Swift/Glance public images https://review.openstack.org/117928 | 20:17 |
| *** tmcpeak has joined #openstack-security | 20:20 | |
| *** rlpple has quit IRC | 20:33 | |
| dmccowan | hi tmcpeak | 20:39 |
| bdpayne | dmccowan not sure where he is... anything I can help with? | 20:42 |
| dmccowan | he asked me this morning to look at ipmi.py:292 for potential command injection through config files. i've verified that there are two config parmeters that bring in command injection. looking for next steps in this case. | 20:45 |
| bdpayne | ah, gotcha | 20:45 |
| dmccowan | are we just documenting these for now, or is there a best practice for patching these yet? | 20:45 |
| bdpayne | which project is this in? | 20:46 |
| dmccowan | nova/virt/baremetal | 20:46 |
| bdpayne | ok | 20:46 |
| bdpayne | I would suggest that we should files bugs on this, but probably good to sync with tmcpeak because that may have already been done | 20:47 |
| bdpayne | the bugs would be to track fixing it as a general hardening measure | 20:47 |
| bdpayne | I doubt that they will issue an OSSA/CVE for this | 20:48 |
| dmccowan | this is an especially fun one, since one of the config parameters is the path and filename of an executable to be run. the default is shellinabox (this is for start_console() ) | 20:50 |
| bdpayne | interesting | 20:50 |
| dmccowan | the other config parameter is the standard case, where if it is set to "; cat /etc/passwd" then there is command injection. it's hard to justify fixing that one, when the other opening is there too. | 20:52 |
| bdpayne | both should receive some form of input validation | 20:52 |
| bdpayne | that's what I'd suggest putting into the bug report | 20:53 |
| tmcpeak | back | 20:55 |
| tmcpeak | let me catch up | 20:55 |
| tmcpeak | dmccowan: yeah, let's file some bugs! | 20:56 |
| tmcpeak | dmccowan: have you filed anything in launchpad before? | 20:56 |
| dmccowan | i've made review comments, but not opened a new bug. | 20:57 |
| tmcpeak | where are the review comments? | 20:58 |
| dmccowan | not related to this. i'll open a bug, and then send you a link to see if i got it right. :-) I assume I should reference https://bugs.launchpad.net/nova/+bug/1192971. it appears to be the "parent" bug for these type of issues. | 21:01 |
| tmcpeak | dmccowan: oh yeah, I didn't even know this existed. So they are tracking it already. But go ahead and open a new bug and reference this as the parent bug | 21:02 |
| tmcpeak | the analysis that you have done should be really valuable | 21:02 |
| tmcpeak | it looks like work has stalled out on it | 21:02 |
| *** paulmo has quit IRC | 21:10 | |
| dmccowan | https://bugs.launchpad.net/nova/+bug/1365712 | 21:13 |
| bdpayne | did you file it as private? | 21:14 |
| bdpayne | (that link isn't working) | 21:14 |
| dmccowan | try now | 21:15 |
| tmcpeak | dmccowan: taking a look now | 21:17 |
| bdpayne | ok, I can see it now | 21:18 |
| bdpayne | fwiw, normally I encourage filing security bugs as private... but in this case the discussion is already in the open and I think it makes more sense to just address these as hardening measures in the open | 21:19 |
| tmcpeak | dmccowan: this looks good | 21:20 |
| tmcpeak | bdpayne is right, generally file them as "security; private" | 21:20 |
| tmcpeak | but discussion relating to other bugs has led us to know that VMT doesn't consider this embargo worthy | 21:21 |
| dmccowan | gotcha. it was private, and i needed "security; private". but, i gathered from the IRC discussion today that this class of bug is not private anymore. | 21:22 |
| dmccowan | tmcpeak, do you have any more of these on your list? | 21:22 |
| dmccowan | for this bug, the next thing to happen is a nova core member will triage it? | 21:23 |
| tmcpeak | dmccowan: yeah, I've got a few | 21:24 |
| tmcpeak | there's tons in Trove | 21:25 |
| tmcpeak | dmccowan: I guess it depends what you want to do | 21:25 |
| tmcpeak | do you want to file a bunch of bugs, or do you want to work this one vertically | 21:25 |
| tmcpeak | after this gets verified you could attempt to patch the issue and get the whole chunk | 21:25 |
| tmcpeak | also OSSN and guide work is a good way to get your feet wet while you wait | 21:26 |
| tmcpeak | oh, you assigned it to yourself already? | 21:26 |
| tmcpeak | or does it assign it automatically when you file it? | 21:26 |
| dmccowan | i assigned it to myself. | 21:27 |
| tmcpeak | bdpayne: do you know if he has to wait until somebody verifies it, or can he just start working on the patch now? | 21:27 |
| bdpayne | can certainly start working on it | 21:28 |
| bdpayne | they may not take it without verification | 21:28 |
| bdpayne | but it never hurts to have a patch associated with a bug | 21:28 |
| tmcpeak | cool | 21:28 |
| tmcpeak | so dmccowan: next step is to figure out how to fix it | 21:28 |
| bdpayne | note that the nova review queue is long and back-logged | 21:29 |
| tmcpeak | oh, is it? | 21:29 |
| bdpayne | so, if/when we have a patch up for review, if it isn't getting traction then we may need to gently nudge some people | 21:29 |
| tmcpeak | bdpayne: wow | 21:29 |
| bdpayne | we can cross that bridge when we get there | 21:29 |
| tmcpeak | 1455 items!?! | 21:29 |
| bdpayne | see, I'm not making this stuff up :-) | 21:30 |
| tmcpeak | this is insane | 21:30 |
| tmcpeak | 3 CVE bugs, and they are all from 2013 | 21:31 |
| tmcpeak | good times | 21:31 |
| dmccowan | cinder has an interesting solution. in cinder/utils.py there is the method check_ssh_injection(cmd_list). | 21:32 |
| tmcpeak | ssh_injection? | 21:32 |
| dmccowan | it looks for ['`', '$', '|', '||', ';', '&', '&&', '>', '>>','<'] anywhere in the command list as a sign of injection | 21:33 |
| tmcpeak | yeah, basically blacklist dangerous characters | 21:34 |
| *** dmccowan has quit IRC | 21:55 | |
| *** nkinder has quit IRC | 22:01 | |
| *** dmccowan has joined #openstack-security | 22:17 | |
| *** dmccowan_ has joined #openstack-security | 22:21 | |
| *** amrith is now known as _amrith_ | 22:21 | |
| *** dmccowan has quit IRC | 22:21 | |
| *** dmccowan_ is now known as dmccowan | 22:21 | |
| *** sweston has quit IRC | 22:25 | |
| *** sweston has joined #openstack-security | 22:25 | |
| dmccowan | hi bdpayne | 22:41 |
| bdpayne | hey | 22:41 |
| dmccowan | i see 714 matches of SSL in the current OSSG. Do you envision most of them becoming TLS? (or am I missing a something subtle?) | 22:42 |
| *** nkinder has joined #openstack-security | 22:51 | |
| tmcpeak | dmccowan: generally if you want to get attention from somebody put their name | 22:56 |
| tmcpeak | most IRC clients are configured to do something if that happens | 22:56 |
| tmcpeak | nkinder: you around? | 22:56 |
| *** voodookid has quit IRC | 23:06 | |
| tmcpeak | bdpayne: you there? | 23:09 |
| bdpayne | I am | 23:09 |
| tmcpeak | cool | 23:09 |
| tmcpeak | so for your comment on OSSN-0026 | 23:09 |
| tmcpeak | Trove isn't out yet | 23:09 |
| tmcpeak | so if I mention the version I'd have to put Trove (Juno) | 23:09 |
| tmcpeak | which looks silly | 23:09 |
| tmcpeak | since Juno isn't out yet | 23:09 |
| tmcpeak | I mean technically they could fix them all | 23:09 |
| tmcpeak | but they won't | 23:09 |
| tmcpeak | so what should I put? | 23:09 |
| tmcpeak | bdpayne: ^ | 23:10 |
| bdpayne | part of what wasn't clear was if the , or the / took presidence | 23:10 |
| tmcpeak | yeah | 23:10 |
| tmcpeak | it's kind of a tough problem | 23:10 |
| tmcpeak | most OSSN's really are limited to one service and a couple of versions | 23:11 |
| tmcpeak | our traditional scheme doesn't apply well to this | 23:11 |
| bdpayne | I'm not too picky about what we say there, tbh... just as long as it is clear | 23:12 |
| tmcpeak | what would you recommend for Trove though | 23:12 |
| tmcpeak | if I put version it has to be Juno | 23:12 |
| tmcpeak | because there is no Trove in IceHouse | 23:12 |
| bdpayne | Juno or dev branch | 23:13 |
| tmcpeak | ok cool | 23:13 |
| tmcpeak | bdpayne: about your comment for calling out the specific locations | 23:16 |
| bdpayne | yeeeeees? | 23:16 |
| tmcpeak | bdpayne: I'm hesitant to pick on a project, and also hesitant to list a bunch | 23:16 |
| tmcpeak | maybe list one nova example and one trove? | 23:16 |
| bdpayne | seems reasonable | 23:17 |
| bdpayne | you can make it clear that they are exmplare | 23:17 |
| tmcpeak | I'm just afraid it might be a moving target, I don't want the note to become stale | 23:17 |
| tmcpeak | yeah, that sounds reasonable | 23:17 |
| bdpayne | but that helps to make it more concrete | 23:17 |
| tmcpeak | sure, yeah, sounds good | 23:17 |
| tmcpeak | bdpayne: for the examples, do you think I could just link to two examples in the code at the bottom? If I show a couple of examples and then explain them it's going to get wordy | 23:26 |
| *** sicarie has quit IRC | 23:28 | |
| bdpayne | linking to the code will go stale quickly | 23:32 |
| bdpayne | it may be sufficient to just call our the config param names | 23:32 |
| tmcpeak | how about linking to a couple launchpad bugs | 23:32 |
| bdpayne | and then show the code the execs it | 23:32 |
| bdpayne | linking to launchpad bugs could work | 23:32 |
| tmcpeak | they aren't usually that simple | 23:32 |
| tmcpeak | it would be at least three steps always | 23:32 |
| tmcpeak | I'm kind of thinking linking to launchpad is probably a good middle ground | 23:33 |
| bdpayne | yeah, if there aren't simple / clean examples... then linking to the launchpad bugs is the way to go | 23:33 |
| tmcpeak | cool | 23:33 |
| openstackgerrit | Travis McPeak proposed a change to openstack/security-doc: Adding OSSN-0026: Unrestricted write permission to config files can allow code execution https://review.openstack.org/118910 | 23:40 |
| *** tmcpeak has quit IRC | 23:48 | |
| bdpayne | tmcpeak re-reviewed :-) | 23:51 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!