| frickler | one venus cleanup patch is still open, I didn't want to just self-approve, maybe someone can give it a second look? https://review.opendev.org/c/openstack/venus/+/981947 | 07:29 |
|---|---|---|
| opendevreview | Jeremy Stanley proposed openstack/openstack-manuals master: Correct links to OpenStack Security site https://review.opendev.org/c/openstack/openstack-manuals/+/991641 | 13:43 |
| frickler | wow, the keystone ossa from a week ago is already rotated out of the list of "latest 5" on that site ... :-/ | 14:40 |
| fungi | just wait until the advisory volume *really* picks up | 14:41 |
| fungi | but yeah, we can easily expand the window on the main page to latest 10 or something | 14:41 |
| clarkb | maybe you need a "5 of X" tracker with a clear link to a full list? | 14:45 |
| clarkb | (maybe that already exists) | 14:45 |
| fungi | the link to the full list is already there just below the recent summary | 14:46 |
| frickler | yes, I think this is fine, I just stumbled about it when checking the above docs patch and then thought "wow what a busy week" | 14:49 |
| fungi | it's been a busy many weeks. keep in mind some of those advisories are roll-ups of multiple bugs/fixes too (take a look at the mistral one for example) | 14:51 |
| sean-k-mooney | the keyston one is like 5 or 6 in one | 15:30 |
| sean-k-mooney | although that may have been one of the ones that rotated | 15:31 |
| fungi | this year so far (and the year's not even half over!) the vmt has published more than 10x as many advisories as we did in all of last year, just to put it in perspective | 15:49 |
| fungi | this is the first time in a decade we've published double-digit advisories in a year (next highest was 8 in 2020), and we're well on track to exceed the busiest year we ever had for advisories in the history of openstack, which was 41 published in 2014 back in the heyday | 15:52 |
| dansmith | hoo boy. | 17:36 |
| Mike-- | such is the age of AI | 17:37 |
| sean-k-mooney | for better or worse im happy that we are activly improvign openstack for our users even if we all would have prefed to not have the security issue in the first place | 18:42 |
| sean-k-mooney | but yes its been a major effort for the vmt so far | 18:43 |
| JayF | I've been modeling it as a tsunami. I don't think the high rate of incoming security issues will continue, but it'll peter out after a while. | 18:54 |
| fungi | i'm not so optimistic about that, i don't see bugs as being limited in supply, and am just hoping the interest in searching for them trails off before we burn everyone out with it | 18:55 |
| clarkb | in theory if the machines make it easier to write tons of code we're just filling up the queue on the backend as we drain it on the frontend | 18:58 |
| clarkb | I've already had to fix one production software crash that I can directly attribute to claude | 18:58 |
| fungi | also the machines have proven to be really efficient at creating new bugs | 19:01 |
| clarkb | right thats what I mean. We're fixing existing/old bugs but everyone is racing to add new ones at hte same time | 19:02 |
| fungi | er, yeah i was continuing my thought about the supply of bugs not being limited, but you did indeed mention the same problem | 19:03 |
| dansmith | fungi: I'm with you.. I think it's "new normal" | 19:09 |
| fungi | pessimist club | 19:09 |
| dansmith | I saw that as we've got CVEs on previous CVE fixes | 19:09 |
| fungi | and that's not even a new phenomenon we can blame on the llm craze, but it has scaled up along with everything else | 19:10 |
| gouthamr | with one of the reporters it's their investigation pattern.. which, i thought was pretty cool | 19:10 |
| fungi | but also the availability of the tools means anyone with some spare token credits who has read an article on searching for security holes in open source software is now doing it, even if they have no real understanding of vulnerability handling practices or open source developer workflows | 19:11 |
| fungi | which, i'll try to put this politely... adds to our education burden | 19:12 |
| dansmith | yeah, I can see the pressure leading to writing better stuff in the first place, so the tide may recede because of that, but not because I think the pressure will go away like a fad | 19:13 |
| gouthamr | on the burden, yeah.. no matter what they've found and how they've found it, we triage and process everything responsibly.. and it's a long and painful process for good reason.. and i'm seeing more of us doing it this year because of this influx... education all around :) | 19:16 |
| JayF | "pessimist club" <-- exactly why I left this conversation, bluntly. Discussions of potential relief fights burnout; just chatting in IRC about how terrible everything is creates more burnout imo :( | 19:17 |
| gouthamr | JayF: You can check out any time you like But you can never leave | 19:19 |
| fungi | i took your keys | 19:22 |
| dansmith | JayF: I'm not at burnout level (on the security things) yet so I guess I don't see it as "everything is getting worse." any time we're fixing a security bug I feel pretty good, usually better than features | 19:35 |
| dansmith | like sean-k-mooney said above, I'm happy these are getting found and fixed | 19:36 |
| dansmith | but I can totally see why people could be sick of it already (and/or that we could all get that way at some point) | 19:36 |
| JayF | I'm happy too, in general. But also tired. | 19:36 |
| fungi | my main concern is that it's sapping our collective bandwidth to get other things done, and most of the people dealing with this new increase in workload are the same ones who are/were taking care of central commons maintenance in our projects | 19:39 |
| fungi | searching for security vulnerabilities has become interesting to people, but fixing them or pitching in on other boring maintenance tasks have not suddenly become interesting enough to balance that out | 19:40 |
| dansmith | yeah, but as the former becomes easier to do, the glory may wear off a bit. but, you're not wrong | 19:41 |
| fungi | just wondering if we'll all look back on hibiscus as the (first?) cycle where "all" we got done was plug security holes | 19:42 |
| sean-k-mooney | for what its wroth there are a lot of small bug that were valid that we never used to get to before that i feel like we are now actully starting to burn donw | 19:43 |
| sean-k-mooney | indepently of the high profile secuirty ones | 19:43 |
| fungi | that's reassuring to hear! | 19:43 |
| sean-k-mooney | at least in project with extensive testing like nova its a lot esier no to take a bug report and create a repoducer quickly to demonstate it and then work on a fix then it was in the past | 19:44 |
| sean-k-mooney | in cyborg the last of test ifnra is a bit painful but its another motivation to actully build it | 19:44 |
| opendevreview | Jay Faulkner proposed openstack/security-doc master: [OSSN-0099] Service DoS in Ironic https://review.opendev.org/c/openstack/security-doc/+/991729 | 19:46 |
| opendevreview | Jay Faulkner proposed openstack/security-doc master: [OSSN-0099] Service DoS in Ironic https://review.opendev.org/c/openstack/security-doc/+/991729 | 19:47 |
| opendevreview | Jay Faulkner proposed openstack/security-doc master: [OSSN-0099] Service DoS in Ironic https://review.opendev.org/c/openstack/security-doc/+/991729 | 19:50 |
| JayF | Another! Another Security vulnerability! A-ha-ha-ha | 19:52 |
| fungi | JayF is now known as TheCount | 19:52 |
| * fungi wants to start singing round of "99 security notes on the wall" | 19:53 | |
| JayF | https://www.youtube.com/watch?v=2AoxCkySv34#t=45s VMT members counting OSS*s | 19:54 |
| JayF | https://www.youtube.com/watch?v=vC0uvUuXVh8#t=45s is actually what I wanted to link! How dare I post an inferior sesame street clip lol | 19:54 |
| opendevreview | Jay Faulkner proposed openstack/security-doc master: [OSSN-0099] Service DoS in Ironic https://review.opendev.org/c/openstack/security-doc/+/991729 | 19:56 |
| opendevreview | Jay Faulkner proposed openstack/security-doc master: [OSSN-0099] Service DoS in Ironic https://review.opendev.org/c/openstack/security-doc/+/991729 | 20:02 |
| *** elodilles is now known as elodilles_OoO | 20:17 | |
| opendevreview | Jay Faulkner proposed openstack/security-doc master: [OSSN-0099] Service DoS in Ironic https://review.opendev.org/c/openstack/security-doc/+/991729 | 20:41 |
| opendevreview | Jay Faulkner proposed openstack/security-doc master: [OSSN-0099] Service DoS in Ironic https://review.opendev.org/c/openstack/security-doc/+/991729 | 21:05 |
Generated by irclog2html.py 4.1.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!