Thursday, 2018-04-26

*** liverpooler has quit IRC00:49
*** salv-orlando has joined #openstack-security01:26
*** salv-orl_ has quit IRC01:29
*** chyka has joined #openstack-security01:53
*** chyka has quit IRC01:58
*** jamespage_ has joined #openstack-security02:08
*** jamespage has quit IRC02:12
*** d0ugal has quit IRC02:12
*** jamespage_ is now known as jamespage02:13
*** d0ugal has joined #openstack-security02:13
*** Unterd0g has quit IRC02:15
*** Unterd0g has joined #openstack-security02:17
*** edmondsw has joined #openstack-security02:20
*** daidv has joined #openstack-security02:46
*** daidv has quit IRC02:49
*** nicolasbock has quit IRC03:33
*** chyka has joined #openstack-security03:44
*** chyka has quit IRC03:49
*** edmondsw has quit IRC03:50
*** chyka has joined #openstack-security03:56
*** chyka has quit IRC03:57
*** chyka has joined #openstack-security03:58
*** edmondsw has joined #openstack-security04:18
*** edmondsw has quit IRC04:21
*** edmondsw has joined #openstack-security04:21
*** edmondsw has quit IRC04:21
*** edmondsw has joined #openstack-security04:22
*** edmondsw has quit IRC04:26
*** chyka has quit IRC05:09
*** d0ugal has quit IRC05:46
*** vds has joined #openstack-security05:58
*** macermak has joined #openstack-security06:04
*** d0ugal has joined #openstack-security06:13
*** browne has quit IRC06:31
*** murphy_zhao has quit IRC06:47
*** tesseract has joined #openstack-security06:58
*** tesseract has quit IRC07:00
*** murphy_zhao has joined #openstack-security07:01
*** tesseract has joined #openstack-security07:02
*** vds has quit IRC07:07
*** sxc731 has joined #openstack-security07:16
*** pcaruana has joined #openstack-security07:31
*** rcernin has quit IRC07:32
*** AlexeyAbashkin has joined #openstack-security07:45
*** sxc731 has quit IRC07:45
*** austin987 has quit IRC07:47
*** threestrands_ has quit IRC07:52
*** austin987 has joined #openstack-security07:57
*** murphy_zhao has quit IRC08:12
*** sxc731 has joined #openstack-security08:16
*** jaosorior has joined #openstack-security08:24
*** murphy_zhao has joined #openstack-security08:24
*** sxc731 has quit IRC08:42
*** sxc731 has joined #openstack-security08:47
*** sxc731 has quit IRC08:53
*** Alexey_Abashkin has joined #openstack-security08:57
*** AlexeyAbashkin has quit IRC09:01
*** Alexey_Abashkin is now known as AlexeyAbashkin09:01
*** jaosorior has quit IRC09:49
*** murphy_zhao has quit IRC10:04
*** macermak has quit IRC10:06
*** openstackgerrit has joined #openstack-security10:29
openstackgerritLuke Hinds proposed openstack/bandit master: Project Migration to PyCQA
*** nicolasbock has joined #openstack-security10:33
*** Unterd0g has quit IRC10:50
*** Unterd0g has joined #openstack-security10:53
*** threestrands_ has joined #openstack-security11:01
*** chyka has joined #openstack-security11:42
*** chyka has quit IRC11:47
*** edmondsw has joined #openstack-security11:57
*** edmondsw_ has joined #openstack-security11:58
*** edmondsw has quit IRC12:02
*** atoth has joined #openstack-security12:06
*** edmondsw_ is now known as edmondsw12:08
*** liverpooler has joined #openstack-security12:15
*** dave-mccowan has joined #openstack-security12:31
*** dave-mcc_ has joined #openstack-security12:41
*** dave-mccowan has quit IRC12:43
*** threestrands_ has quit IRC12:58
*** edmondsw has quit IRC13:12
*** edmondsw has joined #openstack-security13:12
*** edmondsw has quit IRC13:16
*** jaosorior has joined #openstack-security13:35
*** ediardo has quit IRC13:44
*** chyka has joined #openstack-security14:09
*** jaosorior has quit IRC14:12
*** jaosorior has joined #openstack-security14:13
*** chyka has quit IRC14:14
*** edmondsw has joined #openstack-security14:19
*** browne has joined #openstack-security14:24
*** pcaruana has quit IRC14:42
*** edmondsw has quit IRC14:54
*** edmondsw has joined #openstack-security14:54
*** jaosorior has quit IRC14:55
*** nickthetait has joined #openstack-security15:33
gagehugobrowne fungi we want to keep projects using bandit though right for their checks?15:33
fungiyes, that shouldn't pose any problems15:34
fungiremoving bandit from job configuration in project-config doesn't remove use of bandit from individual projects (which is generally implemented through their requirements.txt and tox.ini files)15:35
fungiit just stops running jobs on new changes proposed to the bandit repo, which is a prerequisite for removing its content before we switch it to read-only in gerrit15:36
fungistep #2 in
browneyeah, we have to turn off or make non-voting the zull checks that are failing for patch
fungiand step 415:36
browneha, did anyone do step 1>15:37
gagehugowe might have update projects's gates too if they are pulling from the old repo15:37
fungithey wouldn't install bandit from git15:37
fungithey install it from pypi15:37
gagehugoI mean do we need to change anything there?15:38
gagehugoI want to avoid breaking everyone's pep8 gate heh15:38
fungii.e., they test using released versions of bandit15:38
gagehugoah ok15:38
fungiso nothing needs to change there15:38
fungias long as bandit continues to publish new releases to pypi (which it does) then this is business as usual for projects relying on it15:39
browneok, i'll do a patch to remove bandit from openstack/requirements projects.txt15:39
*** gyee has joined #openstack-security15:40
nickthetaitHeres a link for browne about moving issues from launchpad to github
brownenickthetait:  thanks!15:50
*** AlexeyAbashkin has quit IRC15:56
fungisince we ran a bit over and i didn't get to highlight these, here are a couple new potential ossns which became public over the past week:
openstackLaunchpad bug 1739646 in OpenStack Compute (nova) queens "Instance type with disk set to 0 can cause DoS" [High,In progress] - Assigned to Matt Riedemann (mriedem)16:03
openstackLaunchpad bug 1765734 in oslo.rootwrap "one can bypass filters and execute arbitrary commands on namespaces" [Undecided,New] - Assigned to Daniel Alvarez (dalvarezs)16:03
*** d0ugal has quit IRC16:03
*** d0ugal has joined #openstack-security16:04
gagehugofungi idk if you're the correct person to ask, but do we only have the channel for 30 mins?  I thought that was the issue before we moved times, not sure if that's still the case16:24
gagehugofor the weekly meeting*16:24
fungigagehugo: i expect hyakuhei determined we regularly lacked sufficient content to go longer than that16:27
fungibut i'll check the git history for the schedule to find out16:27
gagehugofungi thank you!16:27
gagehugoyeah typically we don't run over16:27
gagehugobut sometimes we do, and I felt bad cutting it off if it was not necessary16:27
fungimight have even been a convention bdpayne started when he was chairing16:29
fungigagehugo: i don't see anything at or in explicitly limiting it to half an hour16:31
fungiand in fact says "DURATION:PT1H"16:31
*** edmondsw has quit IRC16:31
fungiso i thnik it's at least scheduled just like any of our standard weekly irc meetings which are an hour in length16:32
fungiin the past, some participants may have had a hard conflict starting at 15:30 utc or something16:32
fungior rather, at half-past whatever time the meeting was previously scheduled to start before we moved it to thursdays16:33
*** ediardo has joined #openstack-security16:55
*** lbragstad has quit IRC17:07
gagehugofungi ok, thanks for looking18:14
*** lbragstad has joined #openstack-security18:22
*** tesseract has quit IRC18:24
fungiso, yeah, i expect you could just say it's an hour-long meeting that you reserve the option to end early if there's insufficient agenda to last that long19:01
fungiand if people have a hard stop at 30 minutes for something else they can just let the meeting chair know to cover their topics in the first part of the meeting19:02
gagehugoyeah, I don't see any cons to having the room for an hour19:03
*** nickthetait has quit IRC19:06
*** browne has quit IRC19:08
*** browne has joined #openstack-security19:12
*** browne has quit IRC19:17
*** browne has joined #openstack-security19:19
*** browne has quit IRC19:21
*** ediardo has quit IRC19:23
*** browne has joined #openstack-security19:30
*** browne has quit IRC19:31
*** browne has joined #openstack-security20:09
*** salv-orl_ has joined #openstack-security20:11
*** salv-orlando has quit IRC20:11
*** browne has quit IRC20:11
*** browne has joined #openstack-security20:24
*** atoth has quit IRC20:29
*** atoth has joined #openstack-security20:29
*** liverpooler has quit IRC21:58
*** browne has quit IRC22:00
*** browne has joined #openstack-security22:00
*** dave-mcc_ has quit IRC22:02
*** alex8653 has joined #openstack-security22:07
*** rcernin has joined #openstack-security22:23
*** salv-orl_ has quit IRC22:45
*** salv-orlando has joined #openstack-security22:45
*** salv-orlando has quit IRC22:50
*** browne has quit IRC23:07
*** browne has joined #openstack-security23:41
*** salv-orlando has joined #openstack-security23:46
*** salv-orlando has quit IRC23:51
*** gyee has quit IRC23:54

Generated by 2.15.3 by Marius Gedminas - find it at!