18:01:12 <bdpayne> #startmeeting OpenStack Security Group
18:01:12 <clarkb> the first endmeeting was a few second early :)
18:01:13 <openstack> Meeting started Thu Oct 10 18:01:12 2013 UTC and is due to finish in 60 minutes.  The chair is bdpayne. Information about MeetBot at http://wiki.debian.org/MeetBot.
18:01:14 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
18:01:17 <openstack> The meeting name has been set to 'openstack_security_group'
18:01:26 <bdpayne> Hi security group!
18:01:35 <joel-coffman> hello
18:01:50 <malini1> Greetings!
18:02:07 <bdpayne> I'd like to continue talking about the summit today
18:02:14 <bdpayne> And get updates on any work in progress
18:02:19 <bdpayne> Anything else on people's minds?
18:02:27 <n41902> hi
18:02:36 <sdague> #endmeeting
18:02:53 <sdague> oh, someone else managed it :)
18:02:55 <joel-coffman> not from me
18:03:12 <bdpayne> ok, let's start with wip
18:03:22 <bdpayne> #topic Work In Progress
18:03:54 <bdpayne> On my end, the folks at White Hat Security have offered to do a free security assessment of Horizon
18:04:14 <bdpayne> they have tools that will perform a scan, and then they do some human analysis to weed out false positives and such
18:04:45 <joel-coffman> what kind of scan?
18:04:48 <bdpayne> Since the OpenStack folk are still working on standing up a reference implementation, I'll be working with White Hat to use a Nebula installation for the scanning
18:05:07 <bdpayne> basically the can scan web services for a variety of security issues
18:05:13 <bdpayne> I'm still flushing out the details
18:05:28 <joel-coffman> oh, that sounds good
18:05:45 <bdpayne> they can't do REST APIs, aparently
18:05:48 <bdpayne> so it will be just Horizon
18:05:54 <bdpayne> but that's still useful
18:05:58 <malini1> bdpayne: your scan checklist will be a juicy addition for the security guide
18:06:32 <bdpayne> checklist?
18:06:40 <thomasbiege2> do we have a list do test cases they use? (I didn't follow the thread to be honest)
18:06:56 <malini1> is not "flushing out the details" a checklist?
18:07:02 <bdpayne> oh I see
18:07:11 <bdpayne> yeah, I'll need to learn more about what they are doing
18:07:21 <bdpayne> I do not currently know all of their test cases
18:07:30 <thomasbiege2> ok
18:07:39 <bdpayne> I would think that the security guide may be improved if there's a deployment option that can mitigate problems better
18:07:41 <thomasbiege2> test coverage could also be interesting
18:07:54 <bdpayne> so we'll see how this goes
18:08:03 <bdpayne> but I just wanted to let people know that this was starting to take shape
18:08:12 <thomasbiege2> cool
18:08:26 <malini1> absolutely cool
18:08:28 <salv-orlando> [
18:08:29 <salv-orlando> .
18:08:34 <bdpayne> Any other ongoing projects people would llke to discuss?
18:08:36 <bdpayne> slides?
18:08:44 <bdpayne> dev work?
18:08:47 <bdpayne> new blueprints?
18:09:20 <joel-coffman> quiet from our end right now
18:09:27 <malini1> sorry: my WIP -- edits on guide and slides -- no further progress. looks this way till Dec
18:09:29 <salv-orlando> sorry guys. Those two messages were brought to you by my kitten.
18:09:47 <bdpayne> np on the kitten issue
18:09:49 <bdpayne> :-)
18:10:25 <bdpayne> #topic Summit Planning
18:10:41 <elo> hi. little late...
18:10:46 <bdpayne> So I shared this previously
18:10:47 <bdpayne> https://docs.google.com/spreadsheet/ccc?key=0AqnzHH5YYzZvdHM0R042U0t5LTNXWFp1MlB2VHpCZmc&usp=sharing#gid=0
18:10:49 <bdpayne> hi elo
18:11:20 <bdpayne> Still need to go through the dev sessions once those are flushed out
18:11:30 <bdpayne> I'd also like to have an OSSG gathering at the summit
18:11:41 <bdpayne> For those that are attending, any preferences on when that takes place?
18:12:19 <joel-coffman> not from me
18:12:28 <malini1> no preference from me
18:12:44 <elo> thursday/friday I'm not available for a few hour due to sessions that I'm helping out on
18:12:55 <bdpayne> ok, I'm leaning towards finding a long lunch one day
18:13:00 <malini1> i submitted a geo-tagging design session and blueprint
18:13:10 <bdpayne> I'll review the schedule and try to find a time with minimal potential conflicts
18:13:36 <bdpayne> malini1 interesting
18:13:45 <bdpayne> feel free to add any dev sessions of interest to the wiki
18:13:54 <bdpayne> s/wiki/google doc/
18:14:06 <bdpayne> even at this stage, without knowing what is accepted there
18:14:10 <joel-coffman> link to the blueprint?
18:14:13 <bdpayne> would be good to start tracking stuff
18:14:32 <malini1> will do, but it may be rejected
18:14:37 <bdpayne> of course
18:14:55 <bdpayne> So, a few more words on the summit...
18:15:17 <bdpayne> I view the summit as an opportunity to (1) reflect on how we've done over the past 6 months, and (2) plan for the next 6 months
18:15:47 <bdpayne> I'd like to discuss both of these items at the OSSG meeting at the summit
18:15:57 <malini1> i think for next summit we should aim for a workshop, 1-2 hours on securiing and openstack implementation
18:16:06 <bdpayne> But, some prep between now and then could make that discussion more fruitful
18:16:22 <bdpayne> malini1 perfect
18:16:33 <bdpayne> so, yeah, I was going to ask for ideas / goals / etc for the upcoming 6 months
18:16:46 <malini1> Absolutely, like your Nebula reference impl and what makes it secure
18:16:53 <bdpayne> basically, where would you like to see OSSG heading
18:17:31 <bdpayne> yeah, that would be interesting
18:17:48 <bdpayne> any other ideas?
18:18:01 <bdpayne> surely there's plenty of ways that OSSG can improve / have more influence / etc
18:18:35 <malini1> I thin OSSG is gaining momentum with the guide, the OSSNs and being a crosscutting entity across the OS projects, but have to be more vocal, kind of establish ourselves such that people come to us "please take a look" type thing
18:18:53 <bdpayne> yeah
18:19:05 <bdpayne> I think that will come with more specific involvement in each project
18:19:30 <bdpayne> we could really benefit from having people just dig in and get involved in the various projects
18:20:03 <bdpayne> ok, well the key take away here is to really think about this topic
18:20:04 <joel-coffman> agreed, it's difficult to review code for security issues when unfamiliar with the context
18:20:10 <bdpayne> I'd like to have a good discussion on it at the summit
18:20:22 <bdpayne> specifically:
18:20:30 <malini1> for one thing, coming from Intel and TXT land, at the very least I have to be savvy setting it up, its limitations (like its OK for VMMs, but not yet for bare metal, so we are not yet there for TXT for the openstack service nodes)
18:20:31 <bdpayne> * What are the problems / areas we can improve
18:20:33 <joel-coffman> or contribute security-related bug fixes
18:20:40 <bdpayne> * What are specific things we can do to improve
18:21:17 <bdpayne> #topic Other business
18:21:26 <bdpayne> So that's all that I have for today… anything else on people's minds?
18:22:15 <bdpayne> Hearing none, I guess we're all done here
18:22:20 <malini1> would be nice to research "known holes" and share with each other. For instance security wrt to SR-IOV
18:22:39 <bdpayne> ah…
18:22:42 <bdpayne> agreed
18:23:26 <bdpayne> malini1 on a similar topic, I'd be interested in more information on Intel SGX
18:23:48 <malini1> :-) Will learn more and get back to you on it.
18:24:21 <malini1> anything specific
18:24:31 <bdpayne> clearly it's new, not out yet, but I think it may have a role to play for securing nodes
18:24:31 <malini1> can even bug developers
18:25:07 <bdpayne> specifically, I'm curious if this could be used to protect a security agent on a host that then uses memory introspection techniques to monitor the host and, perhaps, the VMs / containers on that host
18:25:32 <bdpayne> and, if it can, then I'd like to play with engineering samples :-)
18:25:43 <malini1> on a separate note, I am relishing the many flavors of the word "TEAM", for it it means making things possible, achieving things, because we leverage each others strengths
18:25:55 <malini1> OK, that is an action item for me.
18:26:00 <bdpayne> cool, thanks
18:26:31 <bdpayne> for those not interested in SGX, check out the Intel presentations here https://sites.google.com/site/haspworkshop2013/workshop-program
18:26:40 <bdpayne> s/interested/ familiar/ :-)
18:27:13 <bdpayne> ok, then I think we're really done here
18:27:16 <bdpayne> thanks everyone
18:27:18 <bdpayne> cya next time
18:27:22 <thomasbiege2> bye
18:27:25 <joel-coffman> cheers
18:27:25 <randy_perryman> bye
18:27:40 <malini1> bye
18:27:45 <bdpayne> #endmeeting