*** voodookid has quit IRC | 00:01 | |
*** salv-orlando has joined #openstack-security | 00:27 | |
*** gabriela has joined #openstack-security | 00:27 | |
*** valver has joined #openstack-security | 00:29 | |
*** valver has quit IRC | 00:29 | |
*** gabriela has quit IRC | 00:34 | |
*** valver has joined #openstack-security | 00:46 | |
*** nkinder has joined #openstack-security | 00:46 | |
*** tmcpeak has quit IRC | 00:56 | |
*** valver has quit IRC | 00:58 | |
*** salv-orlando has quit IRC | 01:30 | |
*** tmcpeak has joined #openstack-security | 01:40 | |
*** tmcpeak has quit IRC | 01:45 | |
*** bdpayne_ has quit IRC | 01:46 | |
*** mohitsharma has joined #openstack-security | 01:58 | |
*** jursey has joined #openstack-security | 02:01 | |
*** bdpayne has joined #openstack-security | 02:17 | |
*** salv-orlando has joined #openstack-security | 02:21 | |
*** mohitsharma has quit IRC | 02:33 | |
*** mohitsharma has joined #openstack-security | 02:36 | |
openstackgerrit | Lana Brindley proposed openstack/security-doc: Some minor bug fixes in the Dashboard chapter https://review.openstack.org/149056 | 03:16 |
---|---|---|
*** salv-orlando has quit IRC | 03:23 | |
*** mohitsharma has quit IRC | 04:02 | |
*** mohitsharma has joined #openstack-security | 04:05 | |
*** salv-orlando has joined #openstack-security | 04:24 | |
*** jursey has quit IRC | 05:33 | |
*** mohitsha_ has joined #openstack-security | 06:00 | |
*** mohitsharma has quit IRC | 06:03 | |
*** mohitsha_ has quit IRC | 06:30 | |
*** mohitsharma has joined #openstack-security | 07:11 | |
*** mohitsharma has quit IRC | 07:40 | |
*** mohitsharma has joined #openstack-security | 07:41 | |
*** jamielennox is now known as jamielennox|away | 08:09 | |
*** bdpayne has quit IRC | 08:40 | |
*** bdpayne has joined #openstack-security | 08:45 | |
*** bdpayne has quit IRC | 09:15 | |
*** mohitsharma has quit IRC | 09:53 | |
*** mohitsharma has joined #openstack-security | 09:57 | |
*** lionelz has joined #openstack-security | 10:35 | |
*** zenwalker_ru has joined #openstack-security | 10:37 | |
*** zenwalker_ru has quit IRC | 10:39 | |
*** openstackgerrit has quit IRC | 10:50 | |
*** openstackgerrit has joined #openstack-security | 10:50 | |
*** mohitsharma has quit IRC | 12:39 | |
*** mohitsharma has joined #openstack-security | 12:55 | |
*** lionelz has quit IRC | 13:24 | |
*** lionelz has joined #openstack-security | 13:27 | |
*** lionelz has quit IRC | 13:32 | |
*** bknudson has joined #openstack-security | 13:35 | |
*** lionelz has joined #openstack-security | 13:35 | |
*** lionelz has quit IRC | 13:40 | |
*** lionelz has joined #openstack-security | 13:44 | |
*** lionelz has quit IRC | 13:48 | |
*** lionelz has joined #openstack-security | 13:52 | |
*** lionelz has quit IRC | 13:57 | |
*** lionelz has joined #openstack-security | 14:00 | |
*** lionelz has quit IRC | 14:05 | |
*** lionelz has joined #openstack-security | 14:08 | |
*** lionelz has quit IRC | 14:13 | |
*** lionelz has joined #openstack-security | 14:17 | |
*** lionelz has quit IRC | 14:21 | |
*** lionelz has joined #openstack-security | 14:25 | |
*** salv-orlando has quit IRC | 14:26 | |
*** salv-orlando has joined #openstack-security | 14:26 | |
*** mvangund has joined #openstack-security | 14:27 | |
*** lionelz has quit IRC | 14:30 | |
*** lionelz has joined #openstack-security | 14:33 | |
*** lionelz has quit IRC | 14:38 | |
*** lionelz has joined #openstack-security | 14:41 | |
*** lionelz has quit IRC | 14:46 | |
*** lionelz has joined #openstack-security | 14:49 | |
*** lionelz has quit IRC | 14:54 | |
*** lionelz has joined #openstack-security | 14:58 | |
*** tmcpeak has joined #openstack-security | 15:01 | |
*** mohitsharma has quit IRC | 15:02 | |
*** mohitsharma has joined #openstack-security | 15:02 | |
*** lionelz has quit IRC | 15:02 | |
*** salv-orlando has quit IRC | 15:02 | |
*** mohitsharma has quit IRC | 15:03 | |
*** lionelz has joined #openstack-security | 15:06 | |
*** lionelz has quit IRC | 15:11 | |
*** bdpayne has joined #openstack-security | 15:11 | |
*** lionelz has joined #openstack-security | 15:14 | |
*** lionelz has quit IRC | 15:19 | |
*** ChanServ sets mode: +o bdpayne | 15:24 | |
*** bdpayne_ has joined #openstack-security | 15:24 | |
*** bknudson has quit IRC | 15:27 | |
*** bdpayne has quit IRC | 15:28 | |
*** tkelsey has joined #openstack-security | 15:42 | |
*** bknudson has joined #openstack-security | 15:47 | |
*** salv-orlando has joined #openstack-security | 15:58 | |
*** tkelsey has quit IRC | 15:59 | |
*** salv-orlando has quit IRC | 16:03 | |
*** amrith is now known as _amrith_ | 16:06 | |
*** _amrith_ is now known as amrith | 16:07 | |
*** salv-orlando has joined #openstack-security | 16:30 | |
*** bknudson has quit IRC | 16:41 | |
*** tkelsey has joined #openstack-security | 17:05 | |
*** chair6 has quit IRC | 17:07 | |
*** chair6 has joined #openstack-security | 17:20 | |
*** salv-orlando has quit IRC | 17:28 | |
*** salv-orlando has joined #openstack-security | 17:29 | |
*** salv-orlando has quit IRC | 17:34 | |
*** openstackgerrit has quit IRC | 18:14 | |
*** openstackgerrit has joined #openstack-security | 18:14 | |
*** bknudson has joined #openstack-security | 18:30 | |
*** jursey has joined #openstack-security | 18:41 | |
*** tkelsey has quit IRC | 19:17 | |
*** bpokorny has joined #openstack-security | 19:27 | |
*** salv-orlando has joined #openstack-security | 20:09 | |
*** jursey has quit IRC | 20:20 | |
*** mvangund is now known as singlethink | 20:52 | |
bdpayne_ | hey there elmiko | 21:02 |
elmiko | bdpayne_: hey =) | 21:02 |
bdpayne_ | I'm not seeing nathan in here atm | 21:02 |
elmiko | maybe give him 5min? | 21:03 |
bdpayne_ | yeah | 21:03 |
* bdpayne_ takes this time to eat lunch | 21:03 | |
elmiko | ooh, a luxury ;) | 21:03 |
bdpayne_ | brb | 21:04 |
*** sicarie has joined #openstack-security | 21:06 | |
bdpayne_ | there he is | 21:07 |
sicarie | Sorry. | 21:07 |
elmiko | no worries | 21:07 |
sicarie | I'm on my phone as my client is timing out | 21:07 |
bdpayne_ | ok | 21:08 |
bdpayne_ | so I'll get us rolling | 21:08 |
bdpayne_ | Let's just work through some more tickets from https://bugs.launchpad.net/openstack-manuals/+bugs?field.tag=sec-guide | 21:08 |
elmiko | i added a bug for data processing chapter | 21:08 |
bdpayne_ | one sec while I figure out where we left off | 21:08 |
bdpayne_ | ok, I think we are here: https://bugs.launchpad.net/openstack-manuals/+bug/1342240 | 21:09 |
bdpayne_ | this is just a general statement that the nova intro needs better wording | 21:10 |
bdpayne_ | I actually think it looks find | 21:10 |
bdpayne_ | The Compute service (nova) is one of the more complex OpenStack services. It runs in many locations throughout the cloud and interacts with a variety of internal services. For this reason, most of our recommendations regarding best practices for Compute service configuration are distributed throughout this book. We provide specific details in the sections on Management, API Endpoints, Messaging, and Database. | 21:10 |
elmiko | i'm gonna update the chapter in the title, looks like it's now chap 8. | 21:11 |
bdpayne_ | I'm inclined to close this one as invalid | 21:11 |
sicarie | I have a bug against that chapter as a whole as well | 21:11 |
bdpayne_ | unless you guys have a thought on how that should be improved | 21:11 |
elmiko | i'm unsure as to what the reporter is looking for out of that paragraph | 21:11 |
sicarie | As with the ossns/ossas against nova I think this whole chapter can use more detail | 21:12 |
bdpayne_ | sure, the chapter as a whole can be improved | 21:12 |
bdpayne_ | this bug is just about the text that I pasted | 21:12 |
sicarie | Possibly to link to those second? | 21:12 |
sicarie | Second -》sections | 21:12 |
bdpayne_ | ? | 21:13 |
bdpayne_ | link to those sections from the intro? | 21:13 |
elmiko | sicarie: ok, that's concrete i can dig that | 21:13 |
sicarie | Yeah I'm not sure either | 21:13 |
bdpayne_ | ok, I'll close this one then | 21:13 |
elmiko | maybe instead of closing mark as needs info | 21:13 |
elmiko | and ask the reporter to give more feedback? | 21:13 |
openstackgerrit | Merged openstack/security-doc: Some minor bug fixes in the Dashboard chapter https://review.openstack.org/149056 | 21:14 |
elmiko | yay | 21:14 |
bdpayne_ | ok | 21:14 |
bdpayne_ | moved it to invalid, needs info | 21:15 |
bdpayne_ | "After reading the intro, it is not clear what the reported is looking to be changed. Please provide more specific details about your concern." | 21:15 |
sicarie | +1 | 21:15 |
elmiko | hopefully we'll get a response =) | 21:15 |
bdpayne_ | https://bugs.launchpad.net/openstack-manuals/+bug/1342338 | 21:15 |
bdpayne_ | yeah, that's always the tricky part | 21:15 |
bdpayne_ | ok with this one it sounds like it may be fixed, checking now | 21:16 |
*** kombatkoala has joined #openstack-security | 21:17 | |
bdpayne_ | ok, so not entirely fixed | 21:17 |
*** sicarie has left #openstack-security | 21:17 | |
bdpayne_ | thoughts? | 21:17 |
*** kombatkoala is now known as sicarie | 21:17 | |
bdpayne_ | I'm not too worried about providing links as references | 21:17 |
elmiko | yea me neither, seems appropriate if you have that issue | 21:18 |
sicarie | +1 | 21:18 |
bdpayne_ | ok, so perhaps this one gets closed? | 21:18 |
elmiko | +1 | 21:18 |
sicarie | It was definitely something that I was confused about as well, but I spoke to someone in the docs room and they said raw urls are fine, etc... | 21:19 |
sicarie | So yeah, I'm good with that being closed | 21:19 |
bdpayne_ | ok | 21:19 |
bdpayne_ | https://bugs.launchpad.net/openstack-manuals/+bug/1342345 | 21:20 |
sicarie | Will this fit in with a possible Barbican section? | 21:20 |
bdpayne_ | I think that this is a good suggestion | 21:20 |
elmiko | seems like a valid bug to me | 21:20 |
bdpayne_ | I think it is distinct from Barbican | 21:20 |
bdpayne_ | b/c it is about managing the cert db at the OS level | 21:21 |
elmiko | yea, agreed about different than barbican | 21:21 |
sicarie | Right | 21:21 |
sicarie | I guess i was thinking more a general cert section, under whcih barbican would have a heading/description | 21:21 |
elmiko | almost borders on a discussion of DogTag/Anchor/etc... | 21:21 |
bdpayne_ | ok, and Medium feel right to you guys on this one? | 21:21 |
elmiko | +1 medium | 21:22 |
sicarie | yeah | 21:22 |
bdpayne_ | I think Medium is right | 21:22 |
bdpayne_ | so yeah, TLS is broad | 21:22 |
bdpayne_ | there's TLS in general | 21:22 |
bdpayne_ | which covers TLS for network communication, TLS setup, etc | 21:22 |
bdpayne_ | there's TLS backend stuff which would be Barbican / Anchor / etc | 21:22 |
bdpayne_ | I think that we've largely covered the former in this book so far | 21:22 |
bdpayne_ | and could use more on the latter | 21:23 |
bdpayne_ | could one of you file a ticket on the need for that? | 21:23 |
elmiko | sure, i can take that | 21:23 |
bdpayne_ | thanks | 21:23 |
bdpayne_ | https://bugs.launchpad.net/openstack-manuals/+bug/1342993 | 21:23 |
bdpayne_ | oh look | 21:24 |
bdpayne_ | I didn't see that Priti had uploaded this | 21:24 |
bdpayne_ | so I think that this would be a very nice addition | 21:24 |
bdpayne_ | perhaps as an appendix | 21:24 |
bdpayne_ | I think Medium is right for this too | 21:25 |
bdpayne_ | thoughts? | 21:25 |
elmiko | that would be a nice addition | 21:25 |
sicarie | +1 - dynamic creation would be cool | 21:25 |
elmiko | i wonder if it would be appropriate to have checklists per chapter, then a master list generated from those? | 21:25 |
bdpayne_ | yeah, that would be super nice | 21:26 |
bdpayne_ | yeah, or perhaps call outs at places where there's a checklist item defined | 21:26 |
elmiko | that might work even better | 21:26 |
bdpayne_ | and then a collection of them at the end | 21:26 |
bdpayne_ | I'll need to read up on docbook for this a bit | 21:26 |
bdpayne_ | and/or sync with Andreas | 21:26 |
elmiko | i'm ok with medium on this one | 21:26 |
sicarie | yep | 21:26 |
bdpayne_ | ok, let's do 2 more | 21:27 |
bdpayne_ | https://bugs.launchpad.net/openstack-manuals/+bug/1343523 | 21:27 |
sicarie | Is the chapter still accurate? | 21:28 |
bdpayne_ | I'm +1 on this one | 21:28 |
sicarie | I'm guessing no - it doesn't look to be the new format | 21:28 |
bdpayne_ | chapter num is wrong | 21:28 |
bdpayne_ | fixed it | 21:28 |
bdpayne_ | ok, and medium feels good here to me | 21:29 |
elmiko | i'd almost go to high, just because grammatical errors and all | 21:29 |
bdpayne_ | I'd be ok with that | 21:29 |
bdpayne_ | this is also kind of low handing fruit | 21:29 |
sicarie | Yep, I'll ping her about this - she got two things dropped on her this weekend, but it's on her list | 21:29 |
elmiko | unless this is just a strong opinion, i'm still reading the parts in question | 21:29 |
elmiko | yea | 21:29 |
bdpayne_ | I think high is good | 21:30 |
elmiko | +1 | 21:30 |
bdpayne_ | ok, last one is the one that actually needs to be triaged | 21:30 |
bdpayne_ | https://bugs.launchpad.net/openstack-manuals/+bug/1415218 | 21:30 |
elmiko | ;) | 21:30 |
sicarie | Meh, opinion | 21:31 |
sicarie | :) | 21:31 |
sicarie | +1, Medium? | 21:31 |
bdpayne_ | so... confirmed | 21:31 |
bdpayne_ | Medium | 21:31 |
bdpayne_ | ... medium works with me | 21:31 |
elmiko | yea medium is fine with me. i really want to get it in for kilo, but it's taking awhile :/ | 21:31 |
bdpayne_ | sure | 21:31 |
sicarie | Once you get the content, I'd be more than happy to help draft a section or two in format | 21:31 |
bdpayne_ | ok, so we're in good shape | 21:32 |
bdpayne_ | we should have these all triaged by the mid-cycle meetup | 21:32 |
elmiko | sicarie: thanks, i'll hit you up when i get there | 21:32 |
elmiko | cool | 21:32 |
bdpayne_ | perhaps I asked this before... but are you both coming to the meetup? | 21:32 |
sicarie | Yes | 21:32 |
elmiko | unfortunately no | 21:32 |
sicarie | and I'm signed up for the docs track :) | 21:33 |
bdpayne_ | ok good to know | 21:33 |
bdpayne_ | for planning and such | 21:33 |
sicarie | elmiko too bad! | 21:33 |
bdpayne_ | so thanks again, another productive session | 21:33 |
elmiko | i'd like to, but i'm not sure it will fit in our travel budget... yet ;) | 21:33 |
sicarie | Sorry again for being late - I have a new client now that allegedly is free | 21:33 |
bdpayne_ | I need to run, but I'll catch you later! | 21:34 |
sicarie | bye! | 21:34 |
elmiko | bdpayne_: later | 21:34 |
elmiko | sicarie: no prob, i'm just hacking away anyways =) | 21:34 |
*** bpokorny has quit IRC | 21:47 | |
*** bpokorny_ has joined #openstack-security | 21:47 | |
elmiko | bdpayne_, sicarie, https://bugs.launchpad.net/openstack-manuals/+bug/1415656 i hope that's enough for a start | 21:57 |
bdpayne_ | lgtm | 21:58 |
openfly | is anyone working on porting OSSN's to yaml as well? | 21:58 |
bdpayne_ | ^^ is a good question for nkinder | 21:59 |
openfly | also is there any interest in submitting some code to gnuplot the yaml we have for ossas? | 21:59 |
bdpayne_ | what does it plot? | 21:59 |
openfly | right now just some basic stats... like vulns per project / per release | 21:59 |
bdpayne_ | sounds useful | 22:00 |
openfly | might be nice to integrate it into to stackalyticsw actually to compare against code count / devs | 22:00 |
bdpayne_ | yeah | 22:00 |
openfly | is stackalytics on review yet? | 22:00 |
bdpayne_ | if/when we move to a more structured format for the OSSNs, we could probably just drop such a tool into a tool directory in the security-doc repo | 22:01 |
nkinder | openfly: there has been some discussion of different parse-able formats | 22:01 |
openfly | https://stackalytics.readthedocs.org/en/latest/ | 22:02 |
nkinder | I think the addition/design of a tool would really drive the format change | 22:02 |
openfly | nkinder yeah i'd assume it'd be a bit tough to pick a format | 22:02 |
openfly | especially for the ossns | 22:02 |
nkinder | openfly: I'm all ears for ideas, but the format change would go in tandem with the development of a tool. | 22:06 |
nkinder | openfly: A tool ideas I've thought of is a OSSN monitor tool that operators can use to search for OSSNs that affect their deployment. | 22:06 |
nkinder | monitor and notify basically | 22:07 |
openfly | yeah i thought of that a while back | 22:08 |
openfly | i came to the conclusion that what openstack really needs is a light weight flexible metadata api | 22:08 |
openfly | glance tried to do that... but ... glance is the wrong pplace for that | 22:08 |
openfly | if hp ever got off their asses and open sourced their cmdb... that'd be a good place to start | 22:09 |
*** sicarie has quit IRC | 22:09 | |
openfly | the reality is from an operator standpoint you need to keep a local catalogue and probably feed it from multiple sources... and tie it into cmdb assets | 22:09 |
openfly | =/ | 22:09 |
openfly | non-trivial | 22:09 |
openfly | but at the very least... a parseable list of our alerts is a good starting point | 22:11 |
openfly | much love to the yaml repo of OSSAs | 22:12 |
*** salv-orlando has quit IRC | 22:12 | |
openstackgerrit | Patrick Amor proposed openstack/security-doc: Fix awkward sentence in Verified Boot section https://review.openstack.org/151006 | 22:18 |
*** bknudson has quit IRC | 22:29 | |
*** salv-orlando has joined #openstack-security | 22:34 | |
*** bknudson has joined #openstack-security | 22:51 | |
*** jursey has joined #openstack-security | 22:53 | |
tmcpeak | test | 22:56 |
*** sarnold007 has joined #openstack-security | 23:04 | |
*** openstackgerrit has quit IRC | 23:06 | |
*** openstackgerrit has joined #openstack-security | 23:06 | |
sarnold007 | knudson: I am working on this bandit spec/blueprint and I am trying to get a bit more context on what is expected | 23:07 |
tmcpeak | bknudson: ^ | 23:07 |
sarnold007 | oops | 23:07 |
bknudson | sarnold007: need an example spec? | 23:08 |
tmcpeak | bknudson: is a spec needed? | 23:08 |
tmcpeak | we really aren't altering any code of other projects, we're just proposing to use Bandit as a gate process | 23:09 |
bknudson | tmcpeak: I don't know if a spec is required or not. | 23:09 |
tmcpeak | sarnold007 and I read and it doesn't seem one is | 23:09 |
bknudson | great, now I get ims from jursey. | 23:09 |
tmcpeak | oh, dammit | 23:09 |
tmcpeak | bdpayne_: around? | 23:09 |
bknudson | we should give this channel a different name. | 23:09 |
tmcpeak | somehow he's back | 23:10 |
tmcpeak | was banned | 23:10 |
bknudson | sarnold007: here's the current openstack-specs: https://review.openstack.org/#/q/project:openstack/openstack-specs,n,z | 23:12 |
tmcpeak | bknudson: sarnold007 was going to work on a spec but we can't remember who asked for it or why | 23:13 |
tmcpeak | thought it was you, but maybe not | 23:13 |
bknudson | I suggested is since I think it's the best way to get feedback from the community | 23:13 |
sarnold007 | bknudson: ok, I have seen those, however it is still unclear to me what is exactly needed | 23:13 |
tmcpeak | oh cool | 23:13 |
tmcpeak | :) at least we remembered that right | 23:14 |
bknudson | sarnold007: you can always wait and maybe nobody will ask for one. | 23:14 |
sarnold007 | ok super, well. its done anyway. | 23:14 |
bknudson | tmcpeak: sarnold007: have you been working with infra to get jobs set up or anything? | 23:14 |
tmcpeak | bknudson: I have, Bandit has the required requirements checking job | 23:14 |
bknudson | I haven't seen a change in keystone for it. | 23:14 |
tmcpeak | it's about to get into global requirements, which will be required for Keystone to use it | 23:15 |
tmcpeak | next step is getting it into Keystone | 23:15 |
tmcpeak | not into, but used with | 23:15 |
bknudson | is it on pypi? | 23:15 |
*** bdpayne_ has quit IRC | 23:15 | |
bknudson | https://pypi.python.org/pypi/bandit/0.0.1 ! | 23:16 |
tmcpeak | hmm, crap | 23:16 |
tmcpeak | that's not us | 23:16 |
tmcpeak | the current step we're on is getting versioning and into pypi, then we can pin the version and get it merged in global reqs | 23:16 |
bknudson | tmcpeak: might need a new name. | 23:18 |
tmcpeak | bandit_sec or something? | 23:18 |
bknudson | oslo.bandit | 23:19 |
tmcpeak | bknudson: yeah, do you know if there is any requirement to fly the oslo flag? | 23:19 |
bknudson | tmcpeak: no, we have all sorts of things that don't have oslo in the name. | 23:19 |
tmcpeak | bknudson: oh, I mean can I just call myself oslo whatever or will there be some process to approve that | 23:20 |
bknudson | tmcpeak: oh, sorry... I don't know. Probably ask the oslo folks if they wouldn't like it. | 23:21 |
tmcpeak | wish that other bandit project would delist :) | 23:21 |
tmcpeak | bknudson: ok cool, thanks. I'll poke at that | 23:21 |
tmcpeak | sarnold007: probably hold off on spec for now. Thank you for your effort thus far | 23:22 |
tmcpeak | sarnold007: if it looks required we'll have you dust it off | 23:22 |
bknudson | tmcpeak: it didn't find any potential security problems in keystone. | 23:22 |
tmcpeak | awesome | 23:22 |
tmcpeak | bknudson: then it's a perfect gate. If anything new gets developed in it will flag it, otherwise stay quiet | 23:23 |
tmcpeak | I should say anything new with a security issue :) | 23:23 |
bknudson | tmcpeak: there's no bandito | 23:25 |
bknudson | on pypi | 23:25 |
bknudson | https://www.google.com/search?q=bandit+synonym&ie=utf-8&oe=utf-8 | 23:25 |
bknudson | might be culturally insensitive, though | 23:26 |
tmcpeak | bknudson: lol | 23:26 |
bknudson | tmcpeak: how about rustler? | 23:28 |
tmcpeak | bknudson: hmm, sounds cool | 23:28 |
tmcpeak | I'll have to get chair6 to weigh in, it's his baby | 23:28 |
*** sarnold007 has quit IRC | 23:29 | |
*** singlethink has quit IRC | 23:52 | |
*** salv-orlando has quit IRC | 23:59 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!