| *** tmcpeak has quit IRC | 00:19 | |
| *** jamielennox is now known as jamielennox|away | 00:26 | |
| *** jamielennox|away is now known as jamielennox | 00:30 | |
| *** markvoelker has joined #openstack-security | 01:30 | |
| *** markvoelker has quit IRC | 01:35 | |
| *** dave-mccowan has joined #openstack-security | 02:56 | |
| *** dave-mccowan has quit IRC | 03:15 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 03:15 | |
| *** markvoelker has joined #openstack-security | 03:19 | |
| *** markvoelker has quit IRC | 03:23 | |
| *** sdake has joined #openstack-security | 03:32 | |
| *** sdake has quit IRC | 03:36 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 03:38 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 03:39 | |
| *** sdake has joined #openstack-security | 03:39 | |
| *** sigmavirus24 is now known as sigmavirus24_awa | 03:49 | |
| *** sdake_ has joined #openstack-security | 03:58 | |
| *** sdake has quit IRC | 04:02 | |
| *** browne has joined #openstack-security | 04:22 | |
| *** markvoelker has joined #openstack-security | 05:08 | |
| *** markvoelker has quit IRC | 05:12 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/196543 | 06:01 |
|---|---|---|
| openstackgerrit | Merged openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/196543 | 06:24 |
| *** browne has quit IRC | 06:43 | |
| *** markvoelker has joined #openstack-security | 06:56 | |
| *** markvoelker has quit IRC | 07:01 | |
| *** shohel has joined #openstack-security | 07:03 | |
| *** elo has joined #openstack-security | 07:15 | |
| *** shohel has quit IRC | 07:55 | |
| *** shohel has joined #openstack-security | 08:08 | |
| *** markvoelker has joined #openstack-security | 08:45 | |
| *** markvoelker has quit IRC | 08:50 | |
| *** shohel1 has joined #openstack-security | 09:33 | |
| *** shohel has quit IRC | 09:33 | |
| *** openstackgerrit has quit IRC | 09:53 | |
| *** openstackgerrit has joined #openstack-security | 09:53 | |
| *** sdake_ is now known as sdake | 10:01 | |
| *** shohel1 has quit IRC | 10:03 | |
| *** markvoelker has joined #openstack-security | 10:34 | |
| *** markvoelker has quit IRC | 10:40 | |
| *** markvoelker has joined #openstack-security | 11:35 | |
| *** markvoelker has quit IRC | 11:40 | |
| *** sdake has quit IRC | 11:43 | |
| *** dave-mccowan has joined #openstack-security | 11:49 | |
| *** markvoelker has joined #openstack-security | 11:55 | |
| *** bknudson has quit IRC | 12:16 | |
| *** edmondsw has joined #openstack-security | 12:27 | |
| *** bknudson has joined #openstack-security | 12:36 | |
| *** dave-mccowan has quit IRC | 12:36 | |
| *** dave-mccowan has joined #openstack-security | 13:06 | |
| *** dave-mcc_ has joined #openstack-security | 13:08 | |
| *** dave-mccowan has quit IRC | 13:11 | |
| *** dave-mcc_ has quit IRC | 13:24 | |
| *** singlethink has joined #openstack-security | 13:32 | |
| *** tmcpeak has joined #openstack-security | 13:32 | |
| *** edmondsw has quit IRC | 13:33 | |
| *** dave-mccowan has joined #openstack-security | 13:37 | |
| *** edmondsw has joined #openstack-security | 13:44 | |
| *** deepika has joined #openstack-security | 13:47 | |
| *** sigmavirus24_awa is now known as sigmavirus24 | 13:58 | |
| *** nkinder has joined #openstack-security | 14:09 | |
| *** dave-mccowan has quit IRC | 14:20 | |
| *** jhfeng has joined #openstack-security | 14:23 | |
| *** localloop127 has joined #openstack-security | 14:24 | |
| *** dave-mccowan has joined #openstack-security | 14:34 | |
| *** voodookid has joined #openstack-security | 14:36 | |
| *** sdake has joined #openstack-security | 14:37 | |
| *** sdake_ has joined #openstack-security | 14:40 | |
| *** sdake has quit IRC | 14:43 | |
| *** localloop127 has quit IRC | 15:04 | |
| *** singlethink has quit IRC | 15:31 | |
| *** jhfeng has quit IRC | 15:33 | |
| *** browne has joined #openstack-security | 15:51 | |
| *** dave-mccowan has quit IRC | 16:01 | |
| *** localloop127 has joined #openstack-security | 16:03 | |
| *** singlethink has joined #openstack-security | 16:14 | |
| *** dave-mccowan has joined #openstack-security | 16:21 | |
| *** bpb_ has joined #openstack-security | 16:33 | |
| *** pdesai has joined #openstack-security | 16:57 | |
| *** sicarie has joined #openstack-security | 16:59 | |
| sicarie | hello | 17:00 |
| elmiko | hi | 17:00 |
| pdesai | Hi everyone | 17:00 |
| Daviey | o/ | 17:00 |
| sicarie | So I see two tickets to be triaged, but first I’d like to put Daviey on the spot if he doesn’t mind :) | 17:01 |
| Daviey | uho | 17:01 |
| Daviey | What have i done? | 17:01 |
| elmiko | hehe | 17:01 |
| sicarie | Daviey: in the meeting last week you brought up ticket info and triaging | 17:01 |
| Daviey | Oh yes | 17:02 |
| sicarie | I’d be very interested to know what you’d like to see in a ‘traiged’ ticket | 17:02 |
| sicarie | I saw you and elmiko briefly discussed it | 17:02 |
| elmiko | yea, i've got some ideas too. based on our conversation | 17:02 |
| sicarie | Cool, then we don’t have to put the new guy on the spot! | 17:02 |
| sicarie | elmiko: care to start? | 17:02 |
| elmiko | ok, sure | 17:02 |
| sicarie | Daviey: please jump in if you have something to say :) | 17:02 |
| Daviey | To me, Triaged means that it has passed the barrier of acceptance that it is an issue and contains enough information to allow someone to fix it | 17:03 |
| sicarie | +1 | 17:03 |
| elmiko | i think one big issue is the need for more project domain-specific advice | 17:03 |
| Daviey | Some of the triaged reports fail the second test | 17:03 |
| sigmavirus24 | psst https://wiki.openstack.org/wiki/Bugs#Status | 17:03 |
| * sigmavirus24 disappears just as quickly as he appeared | 17:04 | |
| sicarie | thanks sigmavirus24! | 17:04 |
| elmiko | sigmavirus24: nice | 17:04 |
| Daviey | Ie, I kinda think a triaged report should allow anyone from OSSG doc's to do a drive by fix. So the subject matter notes are present on the bug report. | 17:04 |
| sicarie | “TriagedThe bug comments contain a full analysis on how to properly fix the issue” | 17:04 |
| * Daviey wonders how similar it is to https://wiki.ubuntu.com/Bugs/Bug%20statuses | 17:05 | |
| sicarie | elmiko: does that fit with your thoughts on domain-specific advice? | 17:05 |
| elmiko | i think we should try to fill out https://wiki.openstack.org/wiki/CrossProjectLiaisons#Vulnerability_management and then look to those CPLs to help us with the areas that require more domain-specific advice | 17:05 |
| elmiko | sicarie: yea definitely, if we could get CPLs to post comments it might help us to get further in the process | 17:05 |
| sicarie | Sounds good | 17:06 |
| elmiko | either that, or we will find bugs that *need* to be fixed by the CPLs or the project members | 17:06 |
| Daviey | Encouraging them to post rough notes that can be wordsmithed by this team later, if they prefer | 17:06 |
| sicarie | so we’e previously handled bug traige as a group - do we want to start from the top and go through them with these criteria, ensure they’re set accurately? | 17:06 |
| sicarie | Or should I do an initial pass and we can review next week? | 17:06 |
| elmiko | Daviey: +1 | 17:06 |
| sicarie | And then we can subscribe CPLs to bugs and pester them to assist? | 17:07 |
| Daviey | An idea we were bouncing around during the week was grabbing an issue that we know requires SME input to progress | 17:07 |
| elmiko | works for me sicarie | 17:07 |
| Daviey | Ie, just target 1 each. | 17:07 |
| sicarie | Daviey: that sounds like a good plan once we know where we stand | 17:08 |
| Daviey | i jumped on bug 1329606, and emailed John Griffiths of Cinder | 17:08 |
| openstack | bug 1329606 in openstack-manuals "Security Guide does not document cinder wiping behavior" [High,Confirmed] https://launchpad.net/bugs/1329606 | 17:08 |
| elmiko | agreed, we can select 1 (minimum), and then try to reach out and get some assistance | 17:08 |
| sicarie | My concern is that current bugs may not be set correctly | 17:08 |
| sicarie | So we should level-set the current ~56 bugs and then start grabbing 1 each from there | 17:08 |
| elmiko | sicarie: i think we should continue with what we've been doing as well | 17:08 |
| elmiko | i just feel we need to identify the process for getting outside help | 17:08 |
| elmiko | because some of these need it | 17:09 |
| sicarie | +1 elmiko: I meant more do we want to review what’s there as a group to ensure they’re set to ‘traiged’ per the conventions? Or just on a going-forward basis? | 17:09 |
| elmiko | given the number of new bugs, i'm ok with reviewing as a group | 17:09 |
| sicarie | Daviey and pdesai andy preference? | 17:10 |
| sicarie | andy == any | 17:10 |
| pdesai | +1 to group review | 17:10 |
| Daviey | +1 | 17:11 |
| sicarie | Cool | 17:11 |
| sicarie | So let’s hit RST migration and then we’ll hit the bugs again | 17:11 |
| elmiko | sounds good | 17:11 |
| sicarie | pdesai: care to talk about https://bugs.launchpad.net/openstack-manuals/+bug/1469248 | 17:11 |
| openstack | Launchpad bug 1469248 in openstack-manuals "Create OpenStack Security Specs Repo" [Undecided,In progress] - Assigned to Priti Desai (priti-desai) | 17:11 |
| pdesai | yup, we have a review request, +1 from most of you guys, Rob, Andreas | 17:12 |
| pdesai | waiting for it to get merged | 17:12 |
| Daviey | pdesai: link? | 17:12 |
| sicarie | https://review.openstack.org/#/c/196165 | 17:12 |
| Daviey | ta | 17:12 |
| pdesai | https://review.openstack.org/#/c/196165/ | 17:12 |
| pdesai | i will create a repo based on the spec template | 17:13 |
| pdesai | https://github.com/openstack-dev/specs-cookiecutter | 17:13 |
| * sicarie rushes to login and +1 | 17:13 | |
| elmiko | hehe | 17:13 |
| pdesai | also started with setting up RST build process into our new security-doc-rst repo | 17:13 |
| pdesai | there are changes needed in tox file and some new files to build rst files | 17:14 |
| sicarie | pdesai: thanks for working this! | 17:14 |
| pdesai | sure | 17:14 |
| sicarie | Is there anything we can help with? You seem like you ahve it pretty well in hand | 17:15 |
| Daviey | pdesai: Which tooling did the other teams use to migrate over? | 17:15 |
| *** sigmavirus24 is now known as sigmavirus24_awa | 17:15 | |
| pdesai | pandoc | 17:15 |
| Daviey | ta | 17:15 |
| sicarie | Daviey: more info here as well: https://wiki.openstack.org/wiki/Documentation/Migrate | 17:15 |
| Daviey | Useful! | 17:16 |
| pdesai | but pandoc doesnt comprehensively convert xml to rst when xml has links to section_ :( | 17:16 |
| *** sdake has joined #openstack-security | 17:16 | |
| Daviey | pdesai: Is that sed'able? | 17:16 |
| pdesai | i am trying to propose "how to" for one chapter and we can follow the same process | 17:17 |
| Daviey | Sounds like you have a firm handle on this. | 17:17 |
| pdesai | daviey: yup sed should work as well | 17:17 |
| sicarie | Cool | 17:18 |
| sicarie | so pdesai please let us know if we can do anything - looks like this is moving along | 17:18 |
| pdesai | thanks guys for +1s, yeah i will keep bugging for the same, for few review requests | 17:19 |
| sicarie | +1 | 17:19 |
| elmiko | =) | 17:19 |
| sicarie | So on that note, we should probably traige the bug associated with it | 17:19 |
| sicarie | https://bugs.launchpad.net/openstack-manuals/+bug/1469248 | 17:19 |
| openstack | Launchpad bug 1469248 in openstack-manuals "Create OpenStack Security Specs Repo" [Undecided,In progress] - Assigned to Priti Desai (priti-desai) | 17:19 |
| *** sdake_ has quit IRC | 17:20 | |
| pdesai | yup definitely | 17:20 |
| sicarie | So I think the only thing on this is importance as Priti is already working it | 17:20 |
| elmiko | i'd say high, since it's blocking progress | 17:20 |
| sicarie | I’d personally say high as we’re waiting on this for the bp submission | 17:20 |
| elmiko | jinx ;) | 17:20 |
| pdesai | "1 | 17:20 |
| pdesai | +1 | 17:20 |
| sicarie | :X | 17:20 |
| sicarie | wow that looks like an ANGRY smiley face in my irc window | 17:21 |
| sicarie | :# | 17:21 |
| sicarie | hmm | 17:21 |
| sicarie | anyway | 17:21 |
| elmiko | haha | 17:21 |
| pdesai | hehe | 17:21 |
| sicarie | unless Daviey has any objection I’m setting that at high | 17:21 |
| sicarie | pdesai: can you add notes to it on your next steps? (ie, what you just outlined)? | 17:21 |
| pdesai | sure | 17:21 |
| sicarie | thanks! | 17:22 |
| pdesai | i will add that, sure | 17:22 |
| Daviey | (I have no objections) | 17:22 |
| sicarie | Awesome. Then there is one new bug that also needs to be addressed about encryption | 17:22 |
| sicarie | https://bugs.launchpad.net/openstack-manuals/+bug/1459548 | 17:22 |
| openstack | Launchpad bug 1459548 in openstack-manuals "contradictory info relating to Openstack support of volume encryption" [Undecided,Confirmed] | 17:22 |
| sicarie | So this looks cinder-specific (phew - I didn’t want to get into the Swift/glance encryption specs :) | 17:23 |
| sicarie | So reading through this the confusion is around | 17:24 |
| elmiko | the bug here is that it should be less ambiguous? | 17:24 |
| sicarie | “destruction of data is accomplished by securely deleting the encryption key.” and “destruction of data is as simple as throwing away the key." | 17:24 |
| elmiko | hmm | 17:24 |
| sicarie | elmiko: I think so? | 17:24 |
| sicarie | so my initial response is ‘incomplete’ with a note asking that exact question | 17:25 |
| elmiko | not really destruction, but it's rendered useless | 17:25 |
| sicarie | +1 | 17:25 |
| elmiko | unless cinder will destroy it without having a key | 17:25 |
| sicarie | I’m never a fan of leaving encrypted data around, even if you have gotten rid of the key | 17:25 |
| elmiko | right | 17:25 |
| elmiko | i'm ok with "incomplete" then adding a comment about our questions | 17:25 |
| sicarie | +1 | 17:25 |
| sicarie | Priority? | 17:26 |
| sicarie | low? | 17:26 |
| Daviey | So is the disagrement between "throwing away" vs "securely deleteing the encryption key"? | 17:26 |
| Daviey | Both are questionable advice TBH :) | 17:26 |
| elmiko | Daviey: i think so | 17:26 |
| sicarie | Daviey: exactly | 17:26 |
| sicarie | I think the question is around what the reporter meant | 17:26 |
| sicarie | And if they didn’t mean that wasn’t great advice, then I have a new bug :) | 17:26 |
| elmiko | the advice should talk about the implications of deleting the key, and talk about deleting the data. imo | 17:26 |
| Daviey | Is someone taking the triage of that now? | 17:27 |
| elmiko | yea | 17:27 |
| sicarie | Daviey: yes, that’s what we’re discussing | 17:27 |
| Daviey | super | 17:27 |
| sicarie | I’m in the details right now | 17:27 |
| elmiko | i'm +1 for low | 17:27 |
| Daviey | I mean, is someone taking the following up action.. which i think elmiko just raised his hand ofr | 17:27 |
| Daviey | for* | 17:27 |
| elmiko | yea, i'll add the comment | 17:27 |
| sicarie | Daviey: we hadn’t gotten to volunteers, frequently I take what I think I can handle and then volun-script poeple :) | 17:28 |
| sicarie | elmiko: thanks! | 17:28 |
| Daviey | So the importance is Medium and Incomplete IMO | 17:28 |
| *** browne has quit IRC | 17:28 | |
| pdesai | +1 for low, details can be covered by the new ch. on cinder, volume encryption | 17:29 |
| sicarie | Daviey: there are two states - the status will be incomplete and we’re discussing prirority now | 17:29 |
| sicarie | Daviey: any strong feelings on medium priority vs low? | 17:29 |
| Daviey | sicarie: Just Medium as it is potentially giving poor security advice | 17:30 |
| sicarie | So I can definitely understand that, but I think if the bug only covers the ambiguity then it’s a low priority bug, whereas a new bug on the quality of adice would be higher | 17:30 |
| Daviey | I'd suggest Worst Case Scenario, then lower as we learn more.. But i'm not passionate about it. | 17:31 |
| sicarie | pdesai elmiko any strong feelings on medium? | 17:31 |
| elmiko | i'd have an objection to medium | 17:31 |
| elmiko | i don't | 17:31 |
| elmiko | sorry | 17:31 |
| elmiko | also, added a comment | 17:31 |
| sicarie | and from sigmavirus24_awa’s earlier link | 17:32 |
| *** dontalton has joined #openstack-security | 17:32 | |
| sicarie | MediumFailure of a significant feature, with workaround; Failure of a fringe feature, no workaround | 17:32 |
| sicarie | vs low is insignificant bug or Small issue with an easy workaround | 17:32 |
| sicarie | elmiko: thanks! | 17:32 |
| elmiko | sicarie: does that cover our concerns? | 17:32 |
| sicarie | elmiko: I think so | 17:33 |
| elmiko | cool | 17:33 |
| sicarie | So the more I hope this bug is relating to the ambiguity the more I want to put this at medium as well | 17:33 |
| sicarie | So i’ll set it there and we can circle back around once we get more info | 17:33 |
| elmiko | sounds good | 17:33 |
| sicarie | and on that, sorry for keeping everyone 3 min over | 17:33 |
| sicarie | thanks Daviey pdesai and elmiko! | 17:34 |
| pdesai | no worries, thanks everyone | 17:34 |
| Daviey | Thanks! | 17:34 |
| *** singlethink has quit IRC | 17:34 | |
| Daviey | Just as a comment about triage.. The way we used to handle it in Ubuntu Server, where we got several hundred bugs per week was.. | 17:36 |
| Daviey | Rota of people to bang through the bugs really quickly, setting the worst case scenario importance.. max 2 mins thought. | 17:36 |
| Daviey | Then, when they are all done.. Triage the status, sorting from Importance downwards | 17:36 |
| Daviey | Setting Incomplete if we were waiting on the reporter / details | 17:37 |
| Daviey | Complete if the issue is known, and Triaged if we know how to fix it | 17:37 |
| elmiko | makes sense | 17:37 |
| Daviey | But this isn't that.. and probably have different problems to deal with. | 17:38 |
| sicarie | Daviey: that definitely seems like a reasonable process as well | 17:39 |
| sicarie | I think we’re still doing it this way because 1) this is how it was when we started doing it and 2) haven’t had enough time to think about scaling/updating it :) | 17:40 |
| sicarie | It’s definitely something I noted - if the bugs pick up, we definitely need a better approach | 17:40 |
| Daviey | Yeah, i'm a noob to this effort, so don't listen too much to me :) | 17:40 |
| elmiko | imo, we should consider codifying this on a wiki *and* consider applying for an actual meeting time in an openstack-meeting-* channel | 17:40 |
| elmiko | we could use the meetbot functionality, and it seems like we on-boarding more folks | 17:41 |
| sicarie | elmiko: yeah, not sure why bdpayne was against that - I asked him at one point and he said no | 17:41 |
| sicarie | I think at the time it was a size thing | 17:41 |
| elmiko | yea, i could see that | 17:41 |
| sicarie | if we’ve got 4/5 regular contributors it probably makes sense to start looking at expanding and not putting so much noise in the security room | 17:41 |
| elmiko | i'm not saying we need to do it now, but i think we should talk about it with other openstack folks to learn more about the process. | 17:42 |
| elmiko | sicarie: +1, plus getting the whole meetbot infra is a nice addition | 17:42 |
| elmiko | (eavesdrop, etc...) | 17:42 |
| Daviey | I had no idea this meeting was a thing, as it wasn't on the schedule | 17:42 |
| sicarie | one thing i’d love though is a bot that goes into the meeting rooms and announces the meetings related to that room (ie, in here would be bot announing security project on thurs and sec-guide on monday) | 17:42 |
| sicarie | Daviey: yes, and we’ve been asked by the doc team to codify it as well | 17:42 |
| elmiko | Daviey: right, another good point to help gather more help =) | 17:43 |
| sicarie | =1 | 17:43 |
| sicarie | +1 | 17:43 |
| elmiko | sicarie: at the least we should start researching the process for getting these things | 17:43 |
| sicarie | elmiko: yep, I have a weekly, or bi-weekly depending on who does/doesn’t remember with loquacities (doc lead) so I’ll ask | 17:44 |
| Daviey | BTW, that example bug i looked at.. I had a response from the SME - http://pastebin.com/raw.php?i=zdZW3eY4 More than i hoped for! | 17:44 |
| sicarie | awesome | 17:45 |
| elmiko | sicarie: +1 | 17:45 |
| elmiko | Daviey: that's good info, would be nice to have some of that illuminated in the guide. | 17:46 |
| Daviey | FWIW, #openstack-meeting-alt seemes to have the meeting slot free. | 17:46 |
| elmiko | it at least helps describe why deleting the keys is an acceptable workaround | 17:46 |
| Daviey | elmiko: Right, i've assigned that bug to me - i'll work it in there | 17:46 |
| Daviey | (AH, sorry - that is a different issue to the one we triaged in the meeting) | 17:46 |
| elmiko | oh, oops. was just looking at the bug | 17:46 |
| elmiko | just looked at the clock, should we wrap up soon? | 17:48 |
| *** singlethink has joined #openstack-security | 17:49 | |
| Daviey | i'm going home, cya o/ | 17:50 |
| sicarie | elmiko: sorry, I thought we’d already wrapped up and this was post-meeting discussion :) | 17:50 |
| elmiko | haha | 17:50 |
| elmiko | ! | 17:50 |
| elmiko | Daviey: later | 17:50 |
| sicarie | thanks Daviey! | 17:50 |
| *** sigmavirus24_awa is now known as sigmavirus24 | 18:03 | |
| *** sicarie has quit IRC | 18:07 | |
| *** shohel has joined #openstack-security | 18:19 | |
| *** browne has joined #openstack-security | 18:26 | |
| *** openstackgerrit has quit IRC | 18:30 | |
| *** openstackgerrit has joined #openstack-security | 18:30 | |
| *** pdesai has quit IRC | 18:31 | |
| *** singlethink has quit IRC | 18:38 | |
| *** singleth_ has joined #openstack-security | 18:38 | |
| *** pdesai has joined #openstack-security | 18:40 | |
| *** singleth_ has quit IRC | 18:43 | |
| *** jhfeng has joined #openstack-security | 18:46 | |
| *** deepika has quit IRC | 18:50 | |
| *** markvoelker_ has joined #openstack-security | 18:51 | |
| *** markvoelker has quit IRC | 18:52 | |
| *** dave-mccowan has quit IRC | 18:56 | |
| *** markvoelker_ has quit IRC | 18:57 | |
| *** markvoelker has joined #openstack-security | 18:57 | |
| *** shohel has quit IRC | 19:10 | |
| *** dave-mccowan has joined #openstack-security | 19:21 | |
| tmcpeak | browne: could you have a look at chair6's latest change? we're just waiting on you for final approval | 19:29 |
| browne | tmcpeak: sure, looking at it now | 19:29 |
| tmcpeak | browne: awesome, thank you | 19:29 |
| *** pdesai has quit IRC | 19:31 | |
| openstackgerrit | Jamie Finnigan proposed stackforge/bandit: Address multiline node lineno inaccuracies https://review.openstack.org/195761 | 19:57 |
| chair6 | @browne, @tmcpeak .. fixed ^ | 19:58 |
| sigmavirus24 | browne: I'll let you +A that if you're comfortable with it | 19:59 |
| browne | chair6: thx! | 19:59 |
| * chair6 adds (expected, actual) to the list of conventions i mostly remember.. | 20:00 | |
| sigmavirus24 | chair6: to be fair | 20:01 |
| sigmavirus24 | that's only a testtools convention | 20:01 |
| tmcpeak | is there a reason behind it, or just convention? | 20:02 |
| sigmavirus24 | stdlib unittest library doesn't care about it iirc | 20:02 |
| sigmavirus24 | pytest doesn't care | 20:02 |
| sigmavirus24 | nosetests might care but I don't think it does | 20:02 |
| sigmavirus24 | testtools convention => openstack convention | 20:02 |
| tmcpeak | ahh, ok | 20:03 |
| chair6 | those few tests should be a reasonable pattern to use to add some more result/output-related tests beyond just the counts .. that stupid resstore = OrderedDict() call being at class instead of object level took me far too long to figure out.. | 20:03 |
| Daviey | I think it comes from mandatory parameters coming first with functions, and having an expected is always something you require. Think it is a Java Junit legacy thing mostly. | 20:04 |
| sigmavirus24 | Daviey: that may be the history of why testtools adapted taht convention but https://hg.python.org/cpython/file/97a24bc714ec/Lib/unittest/case.py#l812 | 20:06 |
| sigmavirus24 | "first, second" aren't really descriptive parameter names =P | 20:06 |
| sigmavirus24 | https://hg.python.org/cpython/file/97a24bc714ec/Lib/unittest/case.py#l900 etc | 20:07 |
| Daviey | sigmavirus24: Use the src luke... But by that logic it is > if "bar" == foo <, which doesn't make sense then! | 20:09 |
| openstackgerrit | Merged stackforge/bandit: Address multiline node lineno inaccuracies https://review.openstack.org/195761 | 20:23 |
| tmcpeak | sigmavirus24, browne, chair6: ^ with that it's PyPI time | 20:25 |
| tmcpeak | everybody have one more sanity check if you could please? | 20:25 |
| sigmavirus24 | Go go gadget twine | 20:25 |
| sigmavirus24 | Oh | 20:25 |
| tmcpeak | sigmavirus24: actually I'm using whatever the Stackforge->PyPI linkage is | 20:26 |
| tmcpeak | TBD if that's twine | 20:26 |
| sigmavirus24 | tmcpeak: 99% certain that's twine | 20:26 |
| tmcpeak | I certainly hope so :) | 20:26 |
| *** dontalton has quit IRC | 20:26 | |
| *** Canaima_kawaii has joined #openstack-security | 20:30 | |
| Canaima_kawaii | HOLISSS | 20:31 |
| *** Canaima_kawaii has left #openstack-security | 20:31 | |
| tmcpeak | damnit | 20:34 |
| tmcpeak | :\ | 20:34 |
| openstackgerrit | Jamie Finnigan proposed stackforge/bandit: Downgrade hardcoded /tmp confidence https://review.openstack.org/196851 | 20:36 |
| sigmavirus24 | tmcpeak: senpai noticed us | 20:37 |
| chair6 | ^ one more small tweak proposed after staring at that specific test a little too much last week, quite happy to abandon if folks don't agree or leave it for a future release | 20:37 |
| *** browne has quit IRC | 20:41 | |
| sigmavirus24 | chair6: it seems reasonable | 20:42 |
| *** edmondsw has quit IRC | 20:43 | |
| openstackgerrit | Jamie Finnigan proposed stackforge/bandit: Downgrade hardcoded /tmp confidence https://review.openstack.org/196851 | 20:44 |
| tmcpeak | I'll take a look | 20:45 |
| tmcpeak | chair6: have to disagree.. I think it's at least a solid medium | 20:50 |
| tmcpeak | I've never seen a false positive on it | 20:50 |
| tmcpeak | docstrings aren't included, I can't really think of anywhere you'd have "/tmp" and not be trying to use it that way | 20:50 |
| Daviey | tmcpeak: It might make it more verbose (false positibe), but make Low more accurate IMO if /var/tmp/ and /dev/shm is added to that check? | 20:53 |
| Daviey | chair6: ^ | 20:54 |
| chair6 | i just generally think that if all we're able to to is match a hardcoded string, where we have no context around how it's being used, we should probably call it low confidence | 20:54 |
| Daviey | chair6: Do you have any reports handy where it was a false positive? | 20:56 |
| tmcpeak | chair6: I see your point, but in my usage I have seen it as the entry point to some pretty high severity issues. I have also never seen a false positive from it | 20:57 |
| tmcpeak | since docstrings are no longer processed, I can't think of a use case where somebody would have "/tmp" in a string and not be trying to use it that way | 20:57 |
| chair6 | i do not, i just generally feel uncomfortable with 'medium' confidence for a hardcoded string match .. travis has more experience actually running this test in anger than i do | 20:57 |
| tmcpeak | :) | 20:58 |
| chair6 | happy to drop it, figured it was worth asking about | 20:58 |
| Daviey | chair6: But what are your thoughts on adding /var/tmp and /dev/shm to that plugin? | 20:58 |
| tmcpeak | yeah, TBH it's one of my favorite tests and I've seen it consistently at least find bad coding practices, if not security issues | 20:58 |
| chair6 | daviey: makes sense to expand it to cover other common tmp locations.. | 20:59 |
| tmcpeak | could "/dev/shm" be a separate test? | 20:59 |
| tmcpeak | I guess it's the same idea | 20:59 |
| Daviey | tmcpeak: why seperate? | 20:59 |
| Daviey | I can't think of a reason you'd want to use TMPFILE as a string rather than use tempfile.mkstemp() | 21:00 |
| tmcpeak | I don't know, I guess "shared memory" feels more like it's trying to accomplish IPC, but maybe I have the idea wrong | 21:00 |
| tmcpeak | Daviey: yeah, that's kind of my thought too | 21:01 |
| Daviey | Many apps use shm as a file system based IPC | 21:01 |
| tmcpeak | if we want to get into secure IPC usage, it feels like that could be a good separate module | 21:01 |
| tmcpeak | like combined with other tests too | 21:01 |
| tmcpeak | but I guess it's really all the same thing as /tmp | 21:01 |
| tmcpeak | yeah, I agree.. we should add those | 21:03 |
| tmcpeak | let's do that after pin though… want some time to test and make sure we don't screw up Keystone and others | 21:05 |
| tmcpeak | chair6, Daviey, sigmavirus24: you guys have a few minutes for last minute testing? I can pin this version today | 21:05 |
| * sigmavirus24 doesn't | 21:06 | |
| Daviey | can do | 21:06 |
| tmcpeak | sigmavirus24: ok, no worries, Daviey: cool, thank you | 21:07 |
| Daviey | tmcpeak: Hmm, i don't think i was seeing this last week... http://paste.openstack.org/show/326018/ | 21:13 |
| sigmavirus24 | hm | 21:14 |
| Daviey | Ignore me, i had multiple bandit's in my PYTHONPATH | 21:15 |
| sigmavirus24 | Daviey: https://github.com/stackforge/bandit/blob/master/bandit/core/manager.py#L33 it's definitely there | 21:15 |
| sigmavirus24 | tsk tsk Daviey =P | 21:15 |
| tmcpeak | :) | 21:22 |
| chair6 | passes py27 and py34 tox tests, using py27 it completes runs against keystone/nova/trove/swift without failing.. thats all i've got time for right now | 21:23 |
| tmcpeak | chair6: awesome, thank you | 21:24 |
| *** browne has joined #openstack-security | 21:25 | |
| tmcpeak | browne: you're just in time :) | 21:26 |
| tmcpeak | final kick Bandit up to PyPI sanity testing | 21:27 |
| browne | what's up | 21:27 |
| tmcpeak | we're trying to push a new Bandit version in PyPI today | 21:28 |
| tmcpeak | browne: want to give a last validation | 21:28 |
| tmcpeak | make sure nothing stupid is wrong with the latest? | 21:28 |
| browne | ok sure, let me check | 21:28 |
| tmcpeak | cool | 21:30 |
| Daviey | seems to wfm. | 21:34 |
| tmcpeak | Daviey: cool, thank you | 21:39 |
| tmcpeak | looks good to me as well | 21:43 |
| browne | hmm, i got a keyerror when running on keystone | 21:43 |
| tmcpeak | browne: interesting | 21:44 |
| browne | http://paste.openstack.org/show/326023/ | 21:44 |
| tmcpeak | I just ran on Keystone and didn't | 21:44 |
| browne | i'm running on Mac, which isn't valid though | 21:44 |
| tmcpeak | hmm, did you do a clean uninstall/reinstall? I've seen this before when installing Bandit over an older version that didn't have the stevedore extensions | 21:45 |
| browne | i did a pip uninstall, then ran python setup.py install | 21:45 |
| tmcpeak | try pip uninstall bandit until you can't anymore and then "pip install ." | 21:45 |
| tmcpeak | that should work too | 21:45 |
| tmcpeak | try repeating pip uninstall bandit | 21:45 |
| tmcpeak | you might have to do it a couple of times to get it completely clean | 21:45 |
| browne | yep, looks like i had a leftover /Library/Python/2.7/site-packages/bandit-0.9.0.post70-py2.7.egg-info | 21:46 |
| tmcpeak | woah, 0.9.0, you're oldschool bro | 21:47 |
| browne | ha | 21:47 |
| browne | let me use a real env | 21:47 |
| sigmavirus24 | ^ is why I use virtualenvs for everything | 21:50 |
| browne | that is wise | 21:50 |
| sigmavirus24 | mktmpenv ; cd - ; pip install (stuff) ; do stuff ; deactivate | 21:51 |
| sigmavirus24 | That's even faster now with pip 7.x and auto-wheel caching | 21:52 |
| tmcpeak | I'm opposite, I almost never remember to use venvs :) | 21:55 |
| *** localloop127 has quit IRC | 21:55 | |
| *** bpb_ has quit IRC | 21:55 | |
| sigmavirus24 | There's only a couple things I don't install in venvs because I use it globally | 21:56 |
| sigmavirus24 | Flake8 (and its dependencies) pip, virtualenv, and such | 21:57 |
| tmcpeak | I should probably get on board :) | 21:58 |
| sigmavirus24 | pipsi should make it easier | 21:59 |
| tmcpeak | pipsi? | 22:00 |
| *** sdake_ has joined #openstack-security | 22:01 | |
| sigmavirus24 | yeah it's a mitsuhiko thing | 22:01 |
| sigmavirus24 | it installs everything into its own virtualenv that the tool enforces | 22:01 |
| sigmavirus24 | I don't use it because I don't feel it's necessary | 22:01 |
| sigmavirus24 | But i know some people who do | 22:01 |
| sigmavirus24 | And they want to make it a PyPA project | 22:01 |
| dstufft | https://bpaste.net/show/7142e3466423 that's the only things I install globally | 22:02 |
| dstufft | virtual environments ftw | 22:02 |
| *** sdake has quit IRC | 22:04 | |
| *** bdpayne has joined #openstack-security | 22:06 | |
| tmcpeak | bdpayne: what's up? | 22:12 |
| tmcpeak | long time no see | 22:13 |
| bdpayne | hi! | 22:13 |
| bdpayne | just sitting on the deck cranking out some slides | 22:13 |
| bknudson | bdpayne is living the dream. | 22:14 |
| * bdpayne tries | 22:14 | |
| bdpayne | how are you guys doing? | 22:14 |
| tmcpeak | :) | 22:14 |
| tmcpeak | pretty good | 22:14 |
| bknudson | bdpayne: we fixed all the security in openstack | 22:14 |
| tmcpeak | yeah, all solved | 22:14 |
| bdpayne | oh nice work | 22:14 |
| bdpayne | want to come on over to Netflix then? ;-) | 22:14 |
| bknudson | we added crypto | 22:14 |
| tmcpeak | at least 5 new cryptos now | 22:15 |
| bdpayne | you mean bitcoin, right? | 22:15 |
| bdpayne | you added bitcoin? | 22:15 |
| bknudson | bitcoin and docker | 22:15 |
| bdpayne | excellent | 22:15 |
| bdpayne | how was Vancouver? | 22:16 |
| bknudson | the weather and the city were both really nice. | 22:16 |
| bknudson | if you haven't been I'd put it on my list | 22:16 |
| bdpayne | yeah, I've been | 22:17 |
| bdpayne | was sad to miss it | 22:17 |
| bknudson | next is tokyo | 22:17 |
| *** jhfeng has quit IRC | 22:19 | |
| *** bknudson has quit IRC | 22:20 | |
| * elmiko waves at bdpayne | 22:21 | |
| bdpayne | hey! | 22:21 |
| elmiko | how's netflix treating you? | 22:21 |
| bdpayne | very nicely thus far | 22:22 |
| elmiko | awesome to hear =) | 22:22 |
| bdpayne | lots of work to do | 22:23 |
| tmcpeak | gotta love that stock, huh? :P | 22:23 |
| bdpayne | um, yeah | 22:23 |
| elmiko | i'll bet, saw a bunch of good netflix presos at spark summit | 22:23 |
| bdpayne | notice how it's been doing really well since they hired me? | 22:23 |
| elmiko | lol, nicely done sir | 22:23 |
| bdpayne | thanks, I do what I can | 22:23 |
| tmcpeak | haha | 22:24 |
| browne | tmcpeak: bandit LGTM, i say ship it | 22:24 |
| tmcpeak | browne: cool, I'm glad you said that because… https://pypi.python.org/pypi/bandit/0.12.0 | 22:24 |
| browne | ha! | 22:24 |
| browne | np | 22:24 |
| *** sdake has joined #openstack-security | 23:02 | |
| *** voodookid has quit IRC | 23:03 | |
| *** sdake_ has quit IRC | 23:05 | |
| *** markvoelker has quit IRC | 23:13 | |
| *** edmondsw has joined #openstack-security | 23:24 | |
| *** bdpayne has quit IRC | 23:43 | |
| *** markvoelker has joined #openstack-security | 23:51 | |
| *** edmondsw has quit IRC | 23:51 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!