| fungi | reminder, we're meeting in ~10 minutes | 14:50 |
|---|---|---|
| * fungi puts the kettle on | 14:50 | |
| fungi | #startmeeting security | 15:00 |
| opendevmeet | Meeting started Thu May 5 15:00:18 2022 UTC and is due to finish in 60 minutes. The chair is fungi. Information about MeetBot at http://wiki.debian.org/MeetBot. | 15:00 |
| opendevmeet | Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. | 15:00 |
| opendevmeet | The meeting name has been set to 'security' | 15:00 |
| fungi | not sure who else is around, but i put an agenda together in the usual spot | 15:01 |
| fungi | #link https://etherpad.opendev.org/p/security-agenda | 15:01 |
| fungi | we skipped the april meeting in favor of (virtually) getting together at the ptg, so this is our first regular meeting since the ptg | 15:02 |
| fungi | #topic PTG recap | 15:03 |
| fungi | #link https://etherpad.opendev.org/p/security-sig-ptg-zed | 15:05 |
| fungi | that's where we took some notes | 15:05 |
| fungi | we covered a few topics, some of which are broken out into activities in today's meeting agenda | 15:06 |
| fungi | we talked about finding more volunteers to expand the vmt | 15:07 |
| fungi | big thanks to d34dh0r53 and dmendiza[m] for expressing interest in getting involved there! | 15:07 |
| d34dh0r53 | o/ | 15:08 |
| d34dh0r53 | you're welcome | 15:08 |
| fungi | thankfully, things have been fairly quiet on the vmt front for the past month, so i haven't had much opportunity for engagement with our new recruits on anything yet | 15:08 |
| dmendiza[m] | 🙋♂️ ad | 15:08 |
| fungi | it looks like i had one action item from the vmt coverage expansion discussion which i've neglected to work on yet | 15:09 |
| fungi | #action fungi adjust the repos-overseen doc to also mention the vmt is available to assist projects even if their repos are not explicitly opted into oversight | 15:09 |
| fungi | i'll get into other stuff from the ptg later in today's agenda | 15:10 |
| fungi | anyone have anything ptg-related to add which isn't on the meeting agenda already? | 15:10 |
| fungi | #topic Interim SIG chair | 15:12 |
| fungi | many thanks to gagehugo for chairing the sig (for i can't even remember how many years it's been now)! | 15:12 |
| fungi | #link http://lists.openstack.org/pipermail/openstack-discuss/2022-April/028251.html | 15:13 |
| fungi | as he mentions in that ml post, he's unable to continue chairing the sig, so we need one or more new (co)chairs | 15:14 |
| fungi | given the lack of responses, there's a wip change which i'll amend to set myself as interim chair, though i'm happy to entertain other co-chairing or replacement chairs from anyone with interest | 15:15 |
| fungi | #link https://review.opendev.org/839632 | 15:15 |
| fungi | we'll also need a similar change to the openstack/governance-sigs repository officially setting the chair(s) for the sig | 15:16 |
| fungi | #action fungi push/amend sig chair update changes | 15:16 |
| fungi | if anyone's up for it, speak up now or feel free to reach out to me any time after the meeting | 15:17 |
| fungi | #topic Activities: retiring security-analysis repository | 15:19 |
| fungi | this was something we spent some time discussing at the ptg | 15:19 |
| fungi | the references to the security-analysis repo were already removed from the ossa repo and thus from the security site when i was working on importing the vulnerability:managed governance tag documentation | 15:20 |
| fungi | the repository itself has yet to be retired, so i'll take care of the next steps, which i believe will be as follows: | 15:21 |
| fungi | #action fungi send an announcement to the openstack-discuss list about moving documentation out of security-analysis to individual project repos | 15:21 |
| fungi | #action fungi follow retirement process from project teams guide/infra manual to retire security-analysis | 15:22 |
| fungi | if anyone is interested in doing either or both of those things, i'm happy to help provide guidance | 15:22 |
| fungi | #topic Activities: horizon xstatic javascript library wrappers plan | 15:24 |
| fungi | we covered this some in the security sig ptg session, and i also had a lengthy discussion with horizon contributors in their session about it | 15:25 |
| fungi | i still owe the openstack-discuss ml a discussion starter about what can be done | 15:28 |
| fungi | and the current pitfalls with what we have | 15:29 |
| fungi | #action fungi initiate openstack-discuss thread on the topic of xstatic packages and js dependency handling | 15:29 |
| fungi | #topic Activities: removing references to defunct security blog | 15:31 |
| fungi | this has come up in the past, and i just noticed when looking back over the main page of the security.openstack.org site that we still refer to it | 15:31 |
| gagehugo | o/ | 15:32 |
| gagehugo | apologies for being late | 15:32 |
| fungi | no worries! i've been taking things slowly | 15:32 |
| fungi | the "openstack security blog" was being managed by some of the more active openstack security group folks in years past, but it was abandoned around 5 years ago | 15:33 |
| fungi | it would probably be good if someone who's a member of the openstack-security org on github could wind it down more cleanly there, but i don't know who had or still has access to do that (it's not me, at the very least) | 15:34 |
| fungi | hyakuhei seems to have probably set it up originally, and i see indication that lhinds might have been the last one approving pull requests in it | 15:35 |
| fungi | at any rate, what i *can* do is remove references to it from the security.openstack.org site, so i'll push up a change to do that and further simplify the page in the process | 15:36 |
| fungi | #action fungi propose change to remove security blog references from ossa repo | 15:36 |
| fungi | #topic Recently public security bug reports | 15:38 |
| fungi | we've only had one of note since the ptg, and it was marked invalid by the vmt: | 15:38 |
| fungi | #link https://launchpad.net/bugs/1970932 | 15:38 |
| fungi | i'm looking forward to progress on the rbac work, particularly the idea of dropping the ambiguous "admin" role, which will hopefully solve a lot of this sort of confusion | 15:39 |
| gagehugo | more documentation would be nice | 15:39 |
| fungi | yeah, if anyone has time and interest in making that particular pitfall more easily spotted by users/operators, that would be awesome | 15:40 |
| fungi | #topic Recent vulnerabilities in or related to OpenStack | 15:42 |
| fungi | i noticed these advisories for dpdk this morning: | 15:42 |
| fungi | #link https://www.openwall.com/lists/oss-security/2022/05/05/1 | 15:42 |
| fungi | #link https://www.openwall.com/lists/oss-security/2022/05/05/2 | 15:42 |
| fungi | unfortunately there's not a ton of detail in the ml posts, and their bugzilla requires a login to see whatever's at the urls they linked for more information | 15:43 |
| fungi | the first one might be arbitrary code execution, but i'm not sure how the vulnerable function call is reached, so i can't be positive | 15:44 |
| fungi | the second is called out as a potential denial of service due to resource exhaustion | 15:44 |
| fungi | i'm bringing them up because i know some openstack deployments rely on dpdk features, so this might be of interest to a subset of our operators | 15:45 |
| fungi | if anyone's got a burning desire to do a bit more research and write up an ossn (openstack security note) about these, i'm sure that would be welcome | 15:46 |
| fungi | #topic Anything else? | 15:46 |
| fungi | i'll give everyone a few minutes in case someone has something to bring up before i end the meeting | 15:47 |
| fungi | i'll take that as a "no." thanks for coming! see you on thursday, june 2, when we'll have a (hopefully short) meeting to talk about anything of interested related to the summit happening in berlin the following week | 15:50 |
| gagehugo | thanks fungi! | 15:50 |
| fungi | er, anything of interest, i mean | 15:50 |
| fungi | #endmeeting | 15:50 |
| opendevmeet | Meeting ended Thu May 5 15:50:59 2022 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4) | 15:50 |
| opendevmeet | Minutes: https://meetings.opendev.org/meetings/security/2022/security.2022-05-05-15.00.html | 15:50 |
| opendevmeet | Minutes (text): https://meetings.opendev.org/meetings/security/2022/security.2022-05-05-15.00.txt | 15:50 |
| opendevmeet | Log: https://meetings.opendev.org/meetings/security/2022/security.2022-05-05-15.00.log.html | 15:50 |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!