| *** jamielennox is now known as jamielennox|away | 00:00 | |
| *** tmcpeak has quit IRC | 00:05 | |
| *** tmcpeak has joined #openstack-security | 00:07 | |
| tmcpeak | dave-mccowan: wassup | 00:07 |
|---|---|---|
| dave-mccowan | are you or rob planning on ptl-ing next cycle? there was no nomination made for ocata cycle. | 00:08 |
| dave-mccowan | either way, someone needs to email tc to let them know asap. | 00:10 |
| openstackgerrit | Khanak Nangia proposed openstack/syntribos: Adding nova templates for Syntribos https://review.openstack.org/373478 | 00:10 |
| *** Alexey_Abashkin_ has quit IRC | 00:13 | |
| *** mdong has quit IRC | 00:13 | |
| *** jamielennox|away is now known as jamielennox | 00:14 | |
| *** Alexey_Abashkin_ has joined #openstack-security | 00:14 | |
| openstackgerrit | Rahul U Nair proposed openstack/syntribos: Adding Template files for the compute service https://review.openstack.org/373443 | 00:15 |
| *** Alexey_Abashkin_ has quit IRC | 00:18 | |
| *** Alexey_Abashkin_ has joined #openstack-security | 00:32 | |
| *** ccneill has quit IRC | 00:43 | |
| *** tmcpeak has quit IRC | 01:09 | |
| *** sdake_ has joined #openstack-security | 01:19 | |
| *** sdake has quit IRC | 01:21 | |
| *** zhihui has joined #openstack-security | 01:30 | |
| *** salv-orl_ has joined #openstack-security | 01:42 | |
| *** salv-orlando has quit IRC | 01:44 | |
| *** SuperHappyfornow has joined #openstack-security | 02:03 | |
| SuperHappyfornow | holis | 02:19 |
| *** SuperHappyfornow has left #openstack-security | 02:27 | |
| *** yuanying has quit IRC | 02:52 | |
| *** vinaypotluri has quit IRC | 02:52 | |
| *** knangia has quit IRC | 03:01 | |
| *** dave-mccowan has quit IRC | 03:09 | |
| *** dikonoor has joined #openstack-security | 03:33 | |
| *** sdake_ has quit IRC | 03:42 | |
| *** yuanying has joined #openstack-security | 03:49 | |
| *** lamt has quit IRC | 04:01 | |
| *** markvoelker has quit IRC | 04:03 | |
| *** markvoelker has joined #openstack-security | 04:10 | |
| *** vinaypotluri has joined #openstack-security | 04:10 | |
| *** woodster_ has quit IRC | 05:10 | |
| openstackgerrit | avnish proposed openstack/anchor: Added sphinix config to setup.cfg https://review.openstack.org/373651 | 05:18 |
| *** austin987 has joined #openstack-security | 05:29 | |
| *** lamt has joined #openstack-security | 05:39 | |
| *** markvoelker has quit IRC | 06:01 | |
| openstackgerrit | zhangyanxian proposed openstack/bandit: Fix typos in config.py & utils.py https://review.openstack.org/373683 | 06:02 |
| *** markvoelker has joined #openstack-security | 06:03 | |
| openstackgerrit | zhangyanxian proposed openstack/bandit: Fix typos in config.py & utils.py https://review.openstack.org/373683 | 06:03 |
| *** rcernin has joined #openstack-security | 06:07 | |
| *** markvoelker has quit IRC | 06:11 | |
| openstackgerrit | avnish proposed openstack/security-analysis: py33 is no longer supported by Infra's CI https://review.openstack.org/373728 | 06:23 |
| *** vinaypotluri has quit IRC | 06:42 | |
| *** austin987 has quit IRC | 07:01 | |
| *** markvoelker has joined #openstack-security | 07:11 | |
| *** pcaruana has joined #openstack-security | 07:13 | |
| *** markvoelker has quit IRC | 07:16 | |
| *** Alexey_Abashkin_ has quit IRC | 07:20 | |
| *** AlexeyAbashkin has joined #openstack-security | 07:23 | |
| *** salv-orlando has joined #openstack-security | 07:42 | |
| *** salv-orl_ has quit IRC | 07:45 | |
| *** shohel has joined #openstack-security | 07:48 | |
| *** austin987 has joined #openstack-security | 08:09 | |
| *** austin987 has quit IRC | 08:30 | |
| *** liverpooler has joined #openstack-security | 08:31 | |
| *** shohel has quit IRC | 09:35 | |
| *** liverpooler has quit IRC | 11:30 | |
| *** woodster_ has joined #openstack-security | 11:40 | |
| *** edmondsw has joined #openstack-security | 11:49 | |
| *** lamt has quit IRC | 11:58 | |
| *** dave-mccowan has joined #openstack-security | 12:00 | |
| hyakuhei | Ok, so I missed the PTL deadline, I think mainly because I had some personal issues due to some lifeboat issues that a few of you here know about - anyway, now they want to remove us from the Big Tent! | 12:18 |
| hyakuhei | Please take a look at the email thread on -dev titled : [openstack-dev] [security] [salt] Removal of Security and OpenStackSalt project teams from the Big Tent | 12:18 |
| hyakuhei | and respond with your thoughts. | 12:18 |
| openstackgerrit | Merged openstack/bandit: Fix typos in config.py & utils.py https://review.openstack.org/373683 | 12:27 |
| *** lamt has joined #openstack-security | 12:29 | |
| *** lamt has quit IRC | 12:31 | |
| *** lamt has joined #openstack-security | 12:32 | |
| *** markvoelker has joined #openstack-security | 12:33 | |
| *** zhihui has quit IRC | 12:38 | |
| *** _elmiko is now known as elmiko | 13:01 | |
| *** liverpooler has joined #openstack-security | 13:13 | |
| *** salv-orl_ has joined #openstack-security | 13:42 | |
| *** salv-orlando has quit IRC | 13:45 | |
| *** lamt has quit IRC | 13:47 | |
| *** sdake has joined #openstack-security | 13:59 | |
| *** sdake has quit IRC | 13:59 | |
| *** sdake has joined #openstack-security | 14:00 | |
| *** hongbin has joined #openstack-security | 14:01 | |
| *** dikonoor has quit IRC | 14:18 | |
| *** mvaldes has joined #openstack-security | 14:19 | |
| *** aimeeu__ has quit IRC | 14:26 | |
| *** edtubill has joined #openstack-security | 14:30 | |
| *** edtubill has quit IRC | 14:30 | |
| *** edtubill has joined #openstack-security | 14:31 | |
| *** cleong has joined #openstack-security | 14:45 | |
| *** ccneill has joined #openstack-security | 14:54 | |
| *** openstack has joined #openstack-security | 15:00 | |
| *** diazjf has joined #openstack-security | 15:05 | |
| *** mihero has quit IRC | 15:07 | |
| *** diazjf has quit IRC | 15:11 | |
| *** gszafranski has joined #openstack-security | 15:13 | |
| *** lamt has joined #openstack-security | 15:15 | |
| *** diazjf has joined #openstack-security | 15:20 | |
| openstackgerrit | Merged openstack/syntribos: Updated from global requirements https://review.openstack.org/373720 | 15:21 |
| *** ccneill-phone has joined #openstack-security | 15:24 | |
| *** edtubill has quit IRC | 15:37 | |
| *** tmcpeak has joined #openstack-security | 15:37 | |
| *** edtubill has joined #openstack-security | 15:37 | |
| *** austin987 has joined #openstack-security | 15:41 | |
| *** knangia has joined #openstack-security | 15:46 | |
| *** d0ugal has quit IRC | 15:48 | |
| *** d0ugal has joined #openstack-security | 15:50 | |
| *** diazjf has quit IRC | 15:57 | |
| *** vinaypotluri has joined #openstack-security | 15:57 | |
| mhayden | hyakuhei: i added my $0.02 | 16:01 |
| *** murphy_zhao has quit IRC | 16:03 | |
| *** rcernin has quit IRC | 16:03 | |
| *** murphy_zhao has joined #openstack-security | 16:04 | |
| *** austin987 has quit IRC | 16:08 | |
| *** mdong has joined #openstack-security | 16:09 | |
| *** mvaldes has quit IRC | 16:09 | |
| *** austin987 has joined #openstack-security | 16:10 | |
| *** diazjf has joined #openstack-security | 16:12 | |
| *** pcaruana has quit IRC | 16:15 | |
| *** pcaruana has joined #openstack-security | 16:17 | |
| *** edtubill has quit IRC | 16:22 | |
| *** edtubill has joined #openstack-security | 16:23 | |
| openstackgerrit | Michael Dong proposed openstack/syntribos: Added nova templates (hypervisors to external events) https://review.openstack.org/372772 | 16:29 |
| *** codfection has joined #openstack-security | 16:30 | |
| openstackgerrit | Rahul U Nair proposed openstack/syntribos: Adding Template files for the compute service https://review.openstack.org/373443 | 16:33 |
| tmcpeak | mhayden: thank you | 16:37 |
| tmcpeak | I did as well | 16:38 |
| tmcpeak | :\ | 16:38 |
| tmcpeak | lhinds: thanks for weighing in too | 16:38 |
| codfection | hi | 16:38 |
| tmcpeak | hi codfection | 16:38 |
| codfection | how are you tmcpeak | 16:39 |
| *** diazjf has quit IRC | 16:39 | |
| tmcpeak | heh, I've been better :P | 16:39 |
| codfection | good | 16:40 |
| codfection | :) | 16:40 |
| *** codfection has quit IRC | 16:43 | |
| *** lamt has quit IRC | 16:43 | |
| *** codfection has joined #openstack-security | 16:43 | |
| *** mvaldes has joined #openstack-security | 16:45 | |
| lhinds | tmcpeak: np, mp | 16:49 |
| *** codfection has quit IRC | 16:49 | |
| *** edtubill has quit IRC | 16:51 | |
| *** lamt has joined #openstack-security | 16:57 | |
| *** codfection has joined #openstack-security | 16:58 | |
| *** diazjf has joined #openstack-security | 17:03 | |
| *** diazjf has quit IRC | 17:06 | |
| ccneill | about to chime in myself.. | 17:06 |
| tmcpeak | ccneill: thank you | 17:06 |
| *** diazjf has joined #openstack-security | 17:07 | |
| ccneill | did my message come through? | 17:13 |
| * tmcpeak checks | 17:13 | |
| ccneill | I can't see it on osdir | 17:13 |
| ccneill | hope I wasn't too crusty, but that pissed me off lol | 17:16 |
| *** singlethink has joined #openstack-security | 17:17 | |
| tmcpeak | ccneill: this is great | 17:18 |
| ccneill | did it come through? I can't see it :S | 17:18 |
| tmcpeak | http://lists.openstack.org/pipermail/openstack-dev/2016-September/104231.html | 17:18 |
| ccneill | boom | 17:19 |
| ccneill | thank you sir | 17:19 |
| tmcpeak | also I'm a pleb… I put the entire rest of the email in my response, lol | 17:19 |
| *** gfhellma has joined #openstack-security | 17:21 | |
| ccneill | lol <3 mailing lists.. | 17:21 |
| *** diazjf has quit IRC | 17:24 | |
| mvaldes | bam | 17:28 |
| mvaldes | good job guys | 17:28 |
| *** singleth_ has joined #openstack-security | 17:33 | |
| *** singlethink has quit IRC | 17:36 | |
| hyakuhei | ccneill thank you sir. | 17:37 |
| *** gfhellma has quit IRC | 17:38 | |
| ccneill | np :) | 17:38 |
| ccneill | I hope they don't fire me O:-) | 17:44 |
| ccneill | oh, wait.. | 17:44 |
| unrahul | ccneill: awesome reply :D | 17:44 |
| tmcpeak | lol | 18:00 |
| *** mvaldes has quit IRC | 18:01 | |
| *** mvaldes has joined #openstack-security | 18:07 | |
| *** edtubill has joined #openstack-security | 18:18 | |
| *** rcernin has joined #openstack-security | 18:30 | |
| *** diazjf has joined #openstack-security | 18:37 | |
| *** sdake has quit IRC | 18:39 | |
| *** ig0r_ has joined #openstack-security | 18:50 | |
| *** sdake has joined #openstack-security | 18:56 | |
| *** codfection has quit IRC | 18:58 | |
| *** codfection has joined #openstack-security | 19:02 | |
| sigmavirus | hyakuhei: on a more constructive note than what some people here are writing on the mailing list, would you want someone to split the PTL duties with? | 19:11 |
| sigmavirus | It seems like you're thoroughly swamped and this is at least the second time we as a project team have missed the PTL nomination window | 19:11 |
| *** catintheroof has joined #openstack-security | 19:12 | |
| *** codfection has quit IRC | 19:16 | |
| *** mvaldes has quit IRC | 19:26 | |
| *** mvaldes has joined #openstack-security | 19:28 | |
| *** codfection has joined #openstack-security | 19:30 | |
| tmcpeak | sigmavirus: we always welcome help | 19:33 |
| sigmavirus | tmcpeak: So the thing is, I was aware of the PTL nomination period. I don't follow all of the nominations though. I also regularly fail to think of us as a project team | 19:33 |
| sigmavirus | Our deliverables are all over the place | 19:33 |
| sigmavirus | So, I didn't think to ping anyone | 19:34 |
| tmcpeak | in what respects are we not a project team though? | 19:34 |
| ccneill | I guess we could use some work as far as meshing with the greater OpenStack organism, but the "we're just gonna throw them out and act like they can't hear us" approach was a little insulting | 19:34 |
| *** dhellmann has joined #openstack-security | 19:35 | |
| tmcpeak | hi dhellmann | 19:35 |
| *** diazjf has quit IRC | 19:35 | |
| dhellmann | hi, tmcpeak | 19:35 |
| tmcpeak | we blew it on missing the PTL election for sure | 19:35 |
| dhellmann | we'll figure out what to do | 19:36 |
| dhellmann | I'm still trying to figure out if the team actually needs a PTL or not. | 19:36 |
| dhellmann | or if being designated an official working group is sufficient | 19:36 |
| tmcpeak | dhellmann: we have a couple of concerns with working group | 19:36 |
| dhellmann | I'm interested in hearing what those are. | 19:37 |
| tmcpeak | my biggest concern is losing legitimacy. We've got a few projects we're trying to integrate security reviews with. VMT themselves have asked us to take the security review responsibility because they don't have the bandwidth | 19:38 |
| tmcpeak | similarly many of our contributors are receiving cycles to work on a blessed project | 19:38 |
| tmcpeak | without that status we're going to lose contributors | 19:39 |
| tmcpeak | how many is an open question | 19:39 |
| tmcpeak | I can say for 100% certainty my company is going to give me less time and resources to do whatever working groups do | 19:39 |
| dhellmann | ok. | 19:39 |
| dhellmann | why would that be? why is an *official* working group less than a big tent team? | 19:39 |
| tmcpeak | in a perfect world it might not be | 19:40 |
| dhellmann | we have other working groups with similar cross-project natures (architecture is just getting started, but there's a performance group, too) | 19:40 |
| tmcpeak | organizations are always trying to distinguish themselves with metrics and for better or worse big-tent acceptance is such a metric | 19:40 |
| dhellmann | yeah, that's a constant issue | 19:41 |
| ccneill | I must confess my ignorance of the expected duties of a PTL, but reading this http://docs.openstack.org/project-team-guide/open-development.html#project-team-lead | 19:41 |
| tmcpeak | so, what are we not doing that we need to do better to be taken seriously? | 19:41 |
| ccneill | it seems that a project and PTL should exist if the community organized around that project agrees that it should | 19:41 |
| dhellmann | ccneill : all official teams are required to have a PTL as a way of ensuring that the team is interfacing with the rest of the community as a whole | 19:42 |
| *** salv-orlando has joined #openstack-security | 19:42 | |
| dhellmann | tmcpeak : from what I understand this is the second time the election was missed. I'm not sure if other folks have other concerns, but that's my main concern. | 19:42 |
| tmcpeak | dhellmann: not following PTL nomination has been an issue for us before because we're all happy with Rob, but we can definitely make sure to hold elections in the future | 19:43 |
| dhellmann | tmcpeak : you don't have to hold an election if there's only one candidate, but the candidate does need to be renewed by going through the nomination process | 19:43 |
| tmcpeak | dhellmann: we will ensure that happens going forward if we're allowed to keep our status | 19:43 |
| dhellmann | so it's not that there was only one candidate, or that the same person is doing the work, it's that the process wasn't followed in a way that makes it seem like the team is not engaged with the community at that level | 19:44 |
| tmcpeak | dhellmann: gotcha | 19:44 |
| tmcpeak | dhellmann: we'll certainly address that and any other concerns if we can go forward as a project | 19:45 |
| tmcpeak | we have weekly meetings and I'll put it at the top of our agenda tomorrow to figure out what exactly we need to be doing going forward and how to prevent these mistakes | 19:46 |
| *** salv-orl_ has quit IRC | 19:46 | |
| tmcpeak | dhellmann: we'd welcome any other points that we're failing to address from TC aside from the PTL election process as well | 19:46 |
| dhellmann | like I said, I don't have a broader list myself. you'll want to get some of the other tc members to respond to that question. | 19:47 |
| dhellmann | the mailing list is good for that, though it may take some time -- I know folks are pretty busy wrapping up the release right now | 19:48 |
| tmcpeak | ok, it seems like we have some interest from Adam Lawson and sigmavirus (potentially) to help us with our TC requirements | 19:49 |
| dhellmann | ccneill : this may be a better list of the duties of a PTL: http://docs.openstack.org/project-team-guide/open-community.html#technical-committee-and-ptl-elections | 19:49 |
| dhellmann | ok, that's good | 19:49 |
| tmcpeak | so we could definitely use a cross-project liaison | 19:50 |
| tmcpeak | we used to have bknudson but I don't think he's been able to fill that role | 19:50 |
| dhellmann | you should make sure that ttx is aware of that, since we'll want to make sure the discussion appears on the tc agenda again soon | 19:50 |
| tmcpeak | ok, I'll add all this to our agenda for discussion tomorrow | 19:51 |
| dhellmann | good | 19:51 |
| tmcpeak | hopefully those who expressed interest in PTL are similarly interested to help us with roles such as cross project liaison | 19:51 |
| dhellmann | that would be good, yes | 19:52 |
| ccneill | dhellmann: thanks, that helps | 19:52 |
| dhellmann | sure thing | 19:52 |
| tmcpeak | thanks dhellmann | 19:52 |
| dhellmann | I want to make sure we come up with a good outcome, short and long term. | 19:52 |
| tmcpeak | dhellmann: I did put an item there to discuss if we do want to remain a big tent project | 19:53 |
| dhellmann | good, you should definitely have that discussion. I can understand why both approaches might be appealing, or unappealing. | 19:53 |
| tmcpeak | my perspective is that we're already challenged in active participation and this is really going to hurt us, but realistically unless somebody steps up to attend cross project meetings, tag releases, and all the other stuff we need to do in that list we might not be able to keep it going | 19:54 |
| ccneill | dhellmann: is there a document describing the differences between those two designations by chance? | 19:54 |
| ccneill | the one I'm aware of is automatic ATC status | 19:54 |
| ccneill | which is certainly something that we'd like to maintain | 19:54 |
| ccneill | speaking as someone who's currently working full-time on an OSSP project | 19:55 |
| dhellmann | ccneill : unfortunately, I don't think so. the working groups are a bit less clearly defined but generally have a purpose under which they are organized that at least makes the goal clear. | 19:55 |
| *** ccneill-phone has quit IRC | 19:55 | |
| dhellmann | right, I think that would be the big difference | 19:55 |
| ccneill | I think one of the challenges is, it would be a struggle for each of the OSSP projects (syntribos, anchor, bandit, etc.) | 19:55 |
| ccneill | to maintain independent PTLS | 19:56 |
| dhellmann | atc status would need to come from contributions elsewhere, which might be easy if you're helping fix security issues (either directly for as an extra-atc) | 19:56 |
| ccneill | aggregating them under one umbrella of OSSP makes it easier in some ways to manage | 19:56 |
| tmcpeak | ccneill: +1 | 19:56 |
| dhellmann | well, sure, I don't think it would make sense to have each of them be their own project either | 19:56 |
| sigmavirus | ccneill: sure, but they're not benefitting from all having the same PTL either right now | 19:56 |
| sigmavirus | Each has project leads that do 90% of the directing work who effectively act as a sub-ptl | 19:57 |
| sigmavirus | or a sub-team PTL | 19:57 |
| sigmavirus | They're doing the work a PTL would do for a project like that | 19:57 |
| ccneill | I can only speak from the experience and information I have, but I can speak to trying to add security to other "groups" | 19:57 |
| sigmavirus | the OSSP is a looser collection of projects that are really only tied together by the word "security" | 19:57 |
| dhellmann | that sounds a little bit like how we organized oslo, though maybe with less cross-over | 19:57 |
| ccneill | I proposed changes to tempest at the beginning of the year to include security testing, and was told that I should make that a separate project | 19:57 |
| sigmavirus | dhellmann: I feel like oslo projects even have more in common than our projects do | 19:58 |
| tmcpeak | sigmavirus: what do you suggest? | 19:58 |
| dhellmann | sigmavirus : that might be; you're closer to the code so I'll trust your assessment | 19:58 |
| ccneill | syntribos currently serves that purpose, because projects (Barbican, designate) did not want the code to live in their repo, and then tempest did not want it either | 19:58 |
| sigmavirus | ccneill: no one is saying syntribos should cease to exist | 19:58 |
| sigmavirus | tmcpeak: I don't know what the right way forward is | 19:58 |
| sigmavirus | I recognize that some companies have really bad and wrong priorities including my own | 19:58 |
| ccneill | sigmavirus: I'm trying (perhaps badly) to explain why code contributions to other projects as a proxy is maybe a poor indicator of what we're doing | 19:59 |
| sigmavirus | And I acknowledge that having an official working group would probably hurt contribution stats | 19:59 |
| dhellmann | ccneill : yeah, I may be conflating the overall security team and the vmt team | 19:59 |
| sigmavirus | dhellmann: yeah that's also a problem | 19:59 |
| dhellmann | there was also some discussion of splitting those up to make the distinction clearer, though I don't know whether the vmt folks want to do that or not | 19:59 |
| sigmavirus | I think the only VMT members who show up to security meetings are hyakuhei and tmcpeak | 19:59 |
| sigmavirus | Which isn't to say I want to burden those folks with OSSP meetings, but that team doesn't necessarily widely overlap with the rest of the OSSP | 20:00 |
| tmcpeak | I'm not VMT | 20:00 |
| dhellmann | yeah, no more than they really did with the release team before they moved | 20:00 |
| sigmavirus | dhellmann: right. I'm also unclear as to whether the VMT needs a PTL-esque person or if having a PTL for their team makes sense | 20:00 |
| sigmavirus | tmcpeak: ah, sorry | 20:00 |
| tmcpeak | neither is hyakuhei actually | 20:00 |
| tmcpeak | gmurphy is and he shows up regularly | 20:00 |
| sigmavirus | really? | 20:00 |
| sigmavirus | huh | 20:00 |
| * sigmavirus has a terrible memory of who's on the VMT then | 20:00 | |
| dhellmann | sigmavirus : yeah, that's up to how they want that group structured. a WG may be appropriate there, too. | 20:01 |
| tmcpeak | Morgan, Grant, Jeremy, Tristan | 20:01 |
| dhellmann | yeah, that list looks right | 20:01 |
| sigmavirus | Right, I don't think fungi or Tristan show up and I don't recall seeing Morgan recently either | 20:01 |
| tmcpeak | yeah, they generally don't | 20:01 |
| tmcpeak | they operate autonomously from OSSP | 20:01 |
| sigmavirus | This isn't to throw mud at their face, I'm just sincerely struggling to see the benefit of a PTL for the security project | 20:01 |
| dhellmann | so it sounds like the split makes some sense, regardless of what else happens | 20:01 |
| sigmavirus | tmcpeak: so do bandit, syntribos, anchor, and the rest of the projects | 20:02 |
| tmcpeak | we merged them a year or so ago, I don't remember why, I think it had something to do with confusion about separate roles and responsibilities | 20:02 |
| tmcpeak | from an outsider perspective | 20:02 |
| dhellmann | yeah, it might have been a bit more artificial than expected | 20:02 |
| * sigmavirus nods | 20:02 | |
| sigmavirus | Here's the thing though, very few of us read the mailing list frequently enough. I noticed the PTL nomination period but at no point thought "I wonder if the OSSP is going to have a PTL" because I rarely think of it having a PTL | 20:03 |
| dhellmann | ttx has always pointed out that teams should be organized by groups working together on a common goal. if that's not the case, then splitting up makes sense. we wouldn't want to take that farther than necessary, though. | 20:03 |
| sigmavirus | I mean our common goal, roughly speaking, is to improve the security posture of OpenStack | 20:04 |
| tmcpeak | I'd argue the OSSP is working really well. We've accomplished a lot. Having a dedicated core group of security members to jump around on initiatives helps. Having sponsored midcycle meetings helps. If we lose our project status it's only going to detract from our ability to accomplish what we're working on with no discernible benefit | 20:04 |
| sigmavirus | We're significantly different from any other openstack team I've worked on though | 20:04 |
| tmcpeak | what is the upside to removing our project status? | 20:04 |
| dhellmann | like I'm not sure it makes sense to have each deliverable of the current team become its own team. maybe it does? but that seems excessive, and I would rather look for ways to encourage collaboration. | 20:04 |
| sigmavirus | dhellmann: I agree, like I said, I don't know what the right answer is here. I just feel like we're not benefitting from having a PTL | 20:05 |
| dhellmann | tmcpeak : it's not really a matter of "upside". it's more that if the team doesn't appear to be acting like a team, we shouldn't call it a team. | 20:05 |
| * dhellmann nods | 20:05 | |
| tmcpeak | I'm pretty sure we've been acting like a team in every sense of the word with the exception of timely elections | 20:05 |
| dhellmann | good, then it's just a matter of appearances, to some degree | 20:05 |
| ccneill | sigmavirus: I take your point about us operating somewhat autonomously, but we couldn't have that arrangement any other way - we don't have people on each of those teams who could function as PTLs either, so in a way it's kind of a "hack". I don't know if that's WHY we've done things as we have, but it seems to be working from my perspective | 20:07 |
| sigmavirus | "we don't have people on each of those teams who could function as PTLs either" we do have people that do exactly that. They show up to the security meeting every week and represent their project | 20:07 |
| tmcpeak | so all of those people are going to attend the cross project meeting? | 20:08 |
| *** catintheroof has quit IRC | 20:08 | |
| ccneill | we're not going to have "syntribos midcycles" | 20:08 |
| ccneill | I don't think, anyway | 20:08 |
| ccneill | if there was no overlap, why did some of us work on OSSNs and the barbican threat analysis? | 20:08 |
| tmcpeak | separate Syntribos weekly meetings... | 20:08 |
| mdong | speaking strictly for Syntribos - we don’t have a “sub-PTL” | 20:09 |
| dhellmann | ccneill : we don't really have the weekly cross-project meeting any more (that doc is a bit out of date in that respect) | 20:09 |
| tmcpeak | dhellmann: from our perspective something we could use is a concrete list of deliverables for PTL | 20:09 |
| ccneill | my point is more that Rob has just executed a midcycle for us where many of us attended, discussed priorities, worked together, and had good outputs | 20:09 |
| tmcpeak | so we can decide whether we have the bandwidth to meet them | 20:09 |
| dhellmann | tmcpeak : yes, I agree, we need to write that down somewhere | 20:10 |
| dhellmann | the list in http://docs.openstack.org/project-team-guide/open-community.html#technical-committee-and-ptl-elections is mostly right | 20:10 |
| dhellmann | there's no weekly meeting, that has changed to as-needed | 20:10 |
| dhellmann | your deliverables don't follow the release cycle, so that aspect is less important | 20:11 |
| sigmavirus | "if there was no overlap, why did some of us work on OSSNs and the barbican threat analysis?" I didn't say there was "no overlap" Charles. There is overlap, but it's not the same as with other projects. We're an incredibly unique project in many regards (not in the least that our members are unwilling to skim a mailing list) | 20:11 |
| dhellmann | although I would welcome you using the automation we've put in place anyway | 20:11 |
| tmcpeak | ok so we're really left with organizing the project team track in design summits, which hyakuhei has done as long as I've been involved | 20:12 |
| dhellmann | tmcpeak : in general, understanding the cycle schedule and being aware of current events are going to be the more important things for this team, imho | 20:12 |
| ccneill | sigmavirus: +1 not same as other projects, +1 unique project, -1 unwilling to skim mailing list | 20:12 |
| ccneill | I'm now subscribed | 20:13 |
| ccneill | we used to have our own mailing list, I was under the impression that we might still be using that | 20:13 |
| ccneill | so I follow that | 20:13 |
| tmcpeak | dhellmann: we definitely need to do a better job with cycle events, although we've been extremely organized around our midcycle and summit events | 20:13 |
| dhellmann | tmcpeak : what effect will the change to the PTG structure have on midcycles? | 20:14 |
| unrahul | so I am a newcomer to the OpenStack security team and I am part of OSIC, I see many ppl in different OpenStack teams and how big/small interactions they had with the OpenStack project team they are working on. Personally the security team under Rob has been excellent in welcoming new people to the team and giving us opportunity to work on different projects. | 20:14 |
| unrahul | I have worked on Syntribos, OpenStack security docs, OSSNs, Bandit and Anchor. I am not sure if this would be possible if we were not a team and if I never got any support from the Security team as a whole. | 20:14 |
| tmcpeak | dhellmann: less (if at all) funding for starters | 20:14 |
| tmcpeak | given corporate incentives mentioned above | 20:14 |
| unrahul | And I feel this is a bit overreaction, just for a delay in submitting the PTL nominations. | 20:14 |
| tmcpeak | I'm going to have a really hard time getting approval to attend a get-together with my security friends | 20:15 |
| dhellmann | yeah, the hope is you'll be able to get together at the ptg and summits and not need separate events | 20:15 |
| sigmavirus | unrahul: perhaps you missed it, but this is far from the first time there was a "delay" | 20:15 |
| dhellmann | unrahul : I understand that perspective. I think it would be different if this was the first time. | 20:15 |
| sigmavirus | We've missed the boat several times | 20:15 |
| tmcpeak | I think we're circling here. What's next steps? | 20:16 |
| dhellmann | tmcpeak : ensuring you have space at the PTG may help with some of the travel, since I assume your contributors are also involved with other projects? | 20:16 |
| unrahul | dhellmann: sigmavirus yes and as tmcpeak says we need to change some things and may be improve they way mailing lists are done.. I dont know, you guys know better. | 20:16 |
| tmcpeak | the mail made it sound like TC has already voted | 20:16 |
| sigmavirus | unrahul: further, I understand OSIC does things ... in an interesting way, but I've been working in the OpenStack sphere for 2.25 years at this point and have worked on a variety of projects (Glance, Searchlight, Bandit, etc.) you don't need a single team for that | 20:16 |
| ccneill | so from a governance perspective, everything I've heard so far leads me to believe that if I set up a cron job to email the mailing list with "please nominate Rob" every 6 months, our team would be good to go | 20:16 |
| sigmavirus | tmcpeak: no it didn't. It was suggesting this as an outcome | 20:16 |
| ccneill | everything else seems good to go, or no? | 20:16 |
| sigmavirus | ccneill: that's not how nominations work sadly | 20:17 |
| dhellmann | tmcpeak : we discussed it this week, and there was a rough consensus that we'd probably vote to remove the project, but that hasn't actually happened | 20:17 |
| tmcpeak | "The majority of TC members present at the meeting yesterday suggested that those project teams should be removed from the Big Tent, with their design summit space allocation slightly reduced to match that (and make room for other not-yet-official teams)." | 20:17 |
| ccneill | okay, another easy hack: | 20:18 |
| ccneill | http://governance.openstack.org/resolutions/20141128-elections-process-for-leaderless-programs.html | 20:18 |
| dhellmann | ccneill: if that's how it's handled, then you can probably put me on the vote-to-remove list. I want the team to be engaged with the community, not just going through the motions. | 20:18 |
| ccneill | this says if that we're leaderless, someone can be appointed. why not re-appoint our previous leader | 20:18 |
| dhellmann | ccneill : that's what we did last time. Missing twice in a row is a bigger signal. | 20:18 |
| sigmavirus | dhellmann: I thought this was the third time | 20:19 |
| sigmavirus | hm | 20:19 |
| dhellmann | sigmavirus : maybe it was? I believe at least 2, and I haven't looked beyond that. | 20:20 |
| tmcpeak | ok so what's our next steps? | 20:21 |
| tmcpeak | I'd like to avoid a protracted mailing list argument | 20:21 |
| tmcpeak | what's a better way? | 20:21 |
| tmcpeak | a few of us can attend the TC meeting? | 20:22 |
| ccneill | dhellmann: sorry, bad joke. I do take it more seriously than that, but my point was that from what I've heard here, it seems that the major violation that we've committed is not following up on the mailing list in a timely fashion | 20:22 |
| tmcpeak | open invitation to anybody that doesn't want OSSP as a project to attend our meeting? | 20:22 |
| sigmavirus | I think we need to have our meeting tomorrow and decide if we get any benefits from having a PTL besides "They plan midcycles and PTG/summit events" and if we actually want to accept the responsibilities of integrating with the larger community | 20:22 |
| sigmavirus | Because it sounds to me like members of our lot do not want the latter responsibility and people here can't come up with more convincing reasons for having a PTL at the moment other than corporate commitment and event planning | 20:23 |
| ccneill | what does "responsibilities of integrating with the larger community" mean? | 20:23 |
| dhellmann | tmcpeak : you should summarize on the mailing list, and maybe contact ttx directly about the team plans (who will be PTL, etc.) and make sure it is on the TC agenda. Having someone attend to participate in the discussion is a good idea, too. | 20:23 |
| tmcpeak | dhellmann: ok, will do | 20:24 |
| ccneill | sigmavirus: what are we not delivering to the OpenStack community that is expected of us? From my perspective, our entire role is to serve the larger organism, and in every way but following proper nomination protocol, I think we have done so | 20:25 |
| tmcpeak | sigmavirus: also are you volunteering to help? | 20:25 |
| sigmavirus | tmcpeak: I am. I have the meeting on my calendar for tomorrow as something I can't miss as well as next week's TC meeting | 20:26 |
| sigmavirus | ccneill: you're framing this entirely incorrectly | 20:26 |
| tmcpeak | great, we'll all discuss further tomorrow and see what needs to be done and who is willing to do them | 20:27 |
| sigmavirus | it's not about delivering things to the larger community. That's not our sole responsibility. We need to be part of the community, not just jogging along side of it handing them cups of security | 20:27 |
| sigmavirus | "Shipping code" is not the sole responsibility of being an OpenStack community member | 20:27 |
| tmcpeak | sigmavirus: I think we're doing a lot with diminished participation | 20:27 |
| sigmavirus | tmcpeak: absolutely, although we've never had consistent participation from more than a small number of the same people who already do security related work at their job and integrate with other security teams at their work | 20:28 |
| sigmavirus | i.e., why all my OSSP work has been part of my free time | 20:28 |
| mvaldes | a big steaming cup o' security sounds pretty good right now | 20:30 |
| ccneill | sigmavirus: I guess this is just my ignorance, but I still do not fundamentally understand what you mean by "being part of the community" | 20:30 |
| sigmavirus | ccneill: it's not what you've been told in the meetings that we've both been in. It's not "shipping features and becoming core developers [sic]" | 20:30 |
| tmcpeak | well what IS it? | 20:31 |
| ccneill | short of filing bugs in projects' launchpads and working with them to mitigate, collaborating with barbican on a midcycle, writing OSSN/OSSA | 20:31 |
| sigmavirus | It's supporting the users, interacting positively on the mailing list and with other teams, working to help improve the OpenStack project | 20:31 |
| sigmavirus | (I want to say product but that word might start a different yak shave) | 20:31 |
| ccneill | the tools we're writing are our way of supporting users | 20:32 |
| ccneill | I suck @ mailing list. will try harder | 20:32 |
| sigmavirus | ccneill: none of the people deploying OpenStack are using syntribos or bandit | 20:32 |
| sigmavirus | People outside of openstack are using bandit | 20:32 |
| ccneill | right.. but they use the projects that we test with them | 20:32 |
| ccneill | ¯\_(ツ)_/¯ | 20:32 |
| sigmavirus | Being part of the community means taking an interest in all of the security bugs that come across our lap, not just barbican | 20:32 |
| ccneill | I guess if your point is "to be a project you must ship a product to operators", we fail | 20:32 |
| tmcpeak | sigmavirus: well hyakuhei and I both participated on a whitepaper describing security for the foundatino | 20:33 |
| tmcpeak | *foundation | 20:33 |
| tmcpeak | that is supporting our users | 20:33 |
| sigmavirus | tmcpeak: just the once though, right? | 20:33 |
| mvaldes | guys, these are all rabbit holes | 20:33 |
| sigmavirus | constant cross project participation is expected of every other openstack project (nova, glance, sahara, etc.) | 20:33 |
| sigmavirus | we do one off cross project collaborations and then we go back to our rabbit holes | 20:34 |
| mvaldes | it looks like there are some simple metrics by which openstack projects are measured | 20:34 |
| mvaldes | those need special attention. | 20:34 |
| mvaldes | in addition to all the good work being done | 20:34 |
| sigmavirus | mvaldes: is right, we do a lot of good stuff | 20:35 |
| tmcpeak | sigmavirus: what is the source of all of these ideals you're talking about? I didn't see them on any of those links above | 20:35 |
| sigmavirus | we just don't do it the way every other project commits to doing it when they become a big tent project | 20:35 |
| tmcpeak | "constant cross project participation", constant? | 20:35 |
| sigmavirus | tmcpeak: not daily but at least weekly | 20:35 |
| mvaldes | i wouldnt worry about these ideals | 20:36 |
| tmcpeak | says who, and where? | 20:36 |
| mvaldes | OSSP is not being called out for that | 20:36 |
| tmcpeak | did you just make this up? | 20:36 |
| mdong | plus, if the problem is “the security project doesn’t interact with other teams enough”, then making this into a workgroup is only going to make it worse with decreased participation | 20:36 |
| sigmavirus | tmcpeak: a lot of this is in the governance repository and often discussed on the mailing list | 20:36 |
| * ccneill needs a cigarette | 20:36 | |
| sigmavirus | mdong: based on what? | 20:36 |
| mvaldes | i think sigmavirus is just illustrating some differences. it's not really the point here | 20:36 |
| sigmavirus | yeah, and I'm now well past time for me to have left for something completely different | 20:37 |
| *** ccneill-phone has joined #openstack-security | 20:37 | |
| mdong | based on the impacts to participation that I think everyone in this project shares, for a start | 20:37 |
| mvaldes | no one is denying that | 20:37 |
| mdong | at the very minimum, making us a workgroup is certainly not a solution to any problem | 20:38 |
| mvaldes | but that possibility has certainly called attention to some deficiencies | 20:39 |
| mvaldes | like it or not | 20:39 |
| mvaldes | simply put, the [community] has made a proposal | 20:39 |
| mvaldes | tmcpeak seems to have a pretty good handle on the next steps | 20:39 |
| ccneill-phone | I guess it comes down to this: since there is only one definable difference in status of project vs. WG, and it is removing our ATC status, then the whole exercise seems to have the purpose of removing that benefit. Plus or minus a few emails to the mailing list | 20:40 |
| tmcpeak | yeah, we can discuss more in the meeting | 20:40 |
| ccneill-phone | +1 for discussing further in our meeting so we can get hyakuhei 's input as well | 20:41 |
| ccneill-phone | Should we invite extend an invite on the mailing list? | 20:42 |
| mvaldes | +1 [big drag] | 20:42 |
| tmcpeak | yes, absolutely | 20:42 |
| tmcpeak | ccneill: you'll do the honors or should I? | 20:44 |
| ccneill | I'm on it :) | 20:44 |
| tmcpeak | thanks man | 20:44 |
| ccneill | any idea what zulu time is for our meeting..? | 20:46 |
| tmcpeak | UTC is 1700 | 20:46 |
| *** mihero has joined #openstack-security | 20:48 | |
| ccneill | sent | 20:56 |
| *** mwturvey has joined #openstack-security | 20:59 | |
| *** mwturvey has quit IRC | 20:59 | |
| ccneill | so.. who's watching the Mr. Robot finale tonight? | 21:00 |
| unrahul | really?? finale..?! | 21:01 |
| ccneill | for season 2 at least | 21:03 |
| *** cleong has quit IRC | 21:04 | |
| tmcpeak | ccneill: I've got to catch up a few episodes, but this season has been gooood | 21:05 |
| ccneill | yeeah buddy | 21:05 |
| ccneill | very trippy | 21:06 |
| *** mvaldes has quit IRC | 21:07 | |
| *** gmurphy has joined #openstack-security | 21:07 | |
| *** alexgooz has joined #openstack-security | 21:12 | |
| *** alexgooz has left #openstack-security | 21:12 | |
| *** mvaldes has joined #openstack-security | 21:23 | |
| *** rcernin has quit IRC | 21:24 | |
| *** salv-orlando has quit IRC | 21:26 | |
| *** jass93 has quit IRC | 21:27 | |
| *** salv-orlando has joined #openstack-security | 21:27 | |
| *** edmondsw has quit IRC | 21:40 | |
| *** ig0r_ has quit IRC | 21:45 | |
| *** edtubill has quit IRC | 21:59 | |
| *** mvaldes1 has joined #openstack-security | 22:16 | |
| *** mvaldes has quit IRC | 22:19 | |
| *** jass93 has joined #openstack-security | 22:19 | |
| *** lamt has quit IRC | 22:20 | |
| *** mvaldes1 has quit IRC | 22:31 | |
| *** eljuanjo has joined #openstack-security | 22:41 | |
| eljuanjo | HALLO | 22:42 |
| *** eljuanjo has left #openstack-security | 22:42 | |
| *** markvoelker has quit IRC | 22:43 | |
| *** singleth_ has quit IRC | 22:45 | |
| *** elmiko is now known as _elmiko | 23:01 | |
| *** jamielennox is now known as jamielennox|away | 23:04 | |
| *** hongbin has quit IRC | 23:05 | |
| openstackgerrit | Michael Dong proposed openstack/syntribos: Added nova extension client https://review.openstack.org/373547 | 23:14 |
| openstackgerrit | Michael Dong proposed openstack/syntribos: Added nova extension client https://review.openstack.org/373547 | 23:20 |
| *** mdong has quit IRC | 23:21 | |
| *** ccneill-phone has quit IRC | 23:25 | |
| *** jass93 has quit IRC | 23:27 | |
| *** jamielennox|away is now known as jamielennox | 23:43 | |
| *** lamt has joined #openstack-security | 23:43 | |
| *** markvoelker has joined #openstack-security | 23:44 | |
| *** lamt has quit IRC | 23:47 | |
| *** markvoelker has quit IRC | 23:49 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!