17:00:50 #startmeeting security 17:00:50 Meeting started Thu Jul 16 17:00:50 2015 UTC and is due to finish in 60 minutes. The chair is tmcpeak. Information about MeetBot at http://wiki.debian.org/MeetBot. 17:00:51 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 17:00:54 The meeting name has been set to 'security' 17:00:55 o/ 17:00:55 o/ 17:00:59 sup 17:01:00 o/ 17:01:03 \o 17:01:08 o/ 17:01:09 heyo/ 17:01:13 \o 17:01:26 o/ 17:01:44 cool 17:01:45 good crowd 17:02:00 ok 17:02:03 o/ 17:02:09 hey 17:02:22 cool 17:02:26 let's roll right into agenda 17:02:36 (btw we have an agenda): https://wiki.openstack.org/wiki/Meetings/OpenStackSecurity 17:02:38 #link https://wiki.openstack.org/wiki/Meetings/OpenStackSecurity 17:02:43 :shockedface: 17:02:44 =P 17:02:51 (I'm supposed to use hashtags heavily) 17:02:55 #topic Anchor Update 17:03:02 dg_ tkelsey: take it away 17:03:09 #yolo 17:03:37 no update from me this week, tkelsey? 17:04:22 The migration to openstack namespace seemed to be uneventful 17:04:33 tkelsey is has crashed from whatever energy substance has enabled him to write all these Bandit patches 17:04:34 Daviey: no fireworks happened for you? 17:05:00 sigmavirus24: after a git pull rebease, it was ok :) 17:05:01 weve had a couple of users be confused because they cant clone from the old link, but I've gone through and update the wiki pages, so hopefully we shouldnt have too many more 17:06:02 cool 17:06:08 oh, quick reminder 17:06:08 http://meetbot.debian.net/Manual.html#user-reference 17:06:10 yeah, everything for the most part just seems to have worked 17:06:23 mvaldes: cool, thank you 17:06:33 tmcpeak: we owe our infra team something then 17:06:43 yep, beer usually works 17:06:58 cool 17:07:01 #topic Bandit Update 17:07:09 so we've had a ton of good work going in 17:07:14 I think 3-5 patches this week 17:07:19 tkelsey is going nuts 17:07:22 and some questionable work 17:07:33 Daviey: what do you mean? 17:07:43 tmcpeak: self deprecating. 17:07:44 hey sorry im late :O 17:07:47 haha 17:07:48 ;) 17:07:52 your patch was great 17:08:14 we finally have a wordlist again :) 17:08:24 yay 17:08:24 wordlists working? that's so 90s 17:08:28 I did want to bring up one thing though.. 17:08:45 the project seems to have grown to the point where it can be difficult to synchronize on big changes 17:08:57 tmcpeak: +1 agreed 17:09:00 for simple fixes, enhancements, etc what we're doing seems to be working 17:09:12 but for big changes I'd like it if we start using blueprints, specs, or whatever 17:09:31 we had a big change and backtrack with the statement stuff 17:09:34 agree. probably just blueprints is fine for now. not sure we need specs yet 17:09:36 +1 17:09:39 tmcpeak: +1 I think we need some organisation around larger stuff 17:09:43 if we had a clear goal in mind we could avoid backtracking 17:09:46 cool 17:09:50 well, we have an area for specs now... 17:09:51 * Daviey started writing a spec for using stevedore for the plugins. 17:10:00 sounds like we have agtreement 17:10:08 do we already have a bandit-specs repo? 17:10:15 Daviey: the hipster of spec usage ;) 17:10:17 the question is, shoudl we align to the release schedule for the rest of OpenStack? 17:10:28 nkinder: good question 17:10:32 i.e. - approve specs for a release by a cut-off date 17:10:32 nkinder: I'd rather not, 6 months is pretty slow for Bandit I think 17:10:36 nkinder: doesn't seem to make sense for bandit 17:10:45 #link https://git.openstack.org/cgit/openstack/security-specs/tree/specs/liberty 17:10:51 agree, don't think it makes sense for bandit 17:10:55 Daviey: thank you, saved me the googles 17:11:06 Daviey: oh cool 17:11:16 although that does make the spec repo layout more complicated 17:11:18 nkinder: humm, I dont want to loose velocity on stuff by going too far in that direction, but some organisation is needed i think 17:11:30 we had agreed on release/project/ 17:11:31 yeah, not recommending it. Just raisign it for discussion 17:11:38 nkinder: +1 17:11:41 nkinder: its good input 17:11:45 ok, so let's do this 17:11:48 we have to be careful that we don't make drastic changes that break the gate for other projects that use us 17:11:53 ...especially late in a cycle 17:11:53 if we change to allow some projects to have different release schedules we might want a different layout 17:11:57 if you want to write a feature that you know is small - bring it up on IRC 17:12:05 if you aren't sure whether it should have a spec, ask on ML 17:12:07 nkinder: agreed 17:12:11 if you know it should have a spec write it :) 17:12:12 maybe we just should have a later cut-off that most 17:12:27 nkinder: +1 17:12:34 tmcpeak: IMO, spec for stevedore conversation is overkill.. but seemed like a good excuse to dry run the process. 17:12:36 nkinder: +1 17:12:42 nkinder: I'd like to automate that "making sure" 17:12:49 nkinder: +1, very reasonable 17:12:50 Daviey: stevedore in which project? bandit? 17:12:53 chair6 merged something that can audit what projects have Bandit gates 17:12:55 sigmavirus24: yah 17:12:56 Daviey: that makes a good test bed 17:13:04 Daviey: we should sync up 17:13:08 lol 17:13:15 sigmavirus24 has merged that already ;) 17:13:18 * sigmavirus24 added stevedore already =P 17:13:27 sigmavirus24: Happy for you to sit in the driving seat if you prefer. 17:13:45 Daviey: not necessarily drive anything, but I'm interested in what you want to add with stevedore is all 17:13:51 hehe, a good example of needing more organisation :) 17:13:58 tkelsey: +1 17:13:58 tkelsey: +1 17:14:35 chair6's audit script was really rather nice. i imagined something that inspected ~/git/openstack/*/tox.ini or something, which seemed really nasty.. but it is quite graceful how it queries zuul config. 17:15:49 ok cool 17:15:58 seems like we're in agreement as to the need to have blueprints for big changes 17:16:13 +1 17:16:16 so we can start doing that and avoid reversing course and wasting time like we did with statements, but live and learn 17:16:16 yep 17:16:31 we still have great momentum and a great community around Bandit, so if this is our biggest problem we're doing ok 17:16:47 anything else for Bandit? 17:17:08 so should bandit be in feature freeze now? 17:17:34 browne: we can.. we can keep doing development and not pin another version until we unfreeze 17:17:49 Probably silly, but would I be a terrible person to request some documentation around bandit's release management? (E.g., feature freezes, release schedule, etc.)? 17:17:50 Do we have a release cadence for bandit? 17:17:54 when's the freeze for other projects 17:18:02 sigmavirus24: just what i was thinking! 17:18:04 Daviey: no, we could probably use one 17:18:04 Daviey: we're were thinking the same thing:D 17:18:12 sigmavirus24: ^ 17:18:16 tmcpeak: it's a per-project thing 17:18:26 Glance, for example, really doesn't freeze until milestone 3 17:18:31 Others tend to freeze earlier 17:18:37 how about anybody interested can collaborate on this with… a spec :) 17:18:38 But that's because Glance specs are borken 17:18:47 tmcpeak has a new toy 17:18:50 haha 17:18:52 tmcpeak: so a monthly release schedule is okay? =P 17:18:54 I'll definitely participate 17:18:55 that's what my spec will say =P 17:19:04 LGTM 17:19:17 can we have a ML discussion on this please 17:19:30 so other projects know we take it seriously and what our plans are 17:19:31 tkelsey: good point 17:19:41 #action tkelsey to start Bandit ML discussion on Bandit release cadence 17:19:43 Who is taking the action? 17:19:48 :) 17:19:51 tkelsey is: ^ ;) 17:20:05 looks like i got volunteered :P 17:20:09 cool, allright 17:20:12 next up 17:20:18 #topic Security Guide 17:20:25 sicarie, elmiko, Daviey 17:20:27 wassup 17:20:35 tkelsey: voluntold ;) 17:20:36 plugging away on the RST migration 17:20:55 awesome 17:20:56 Hopefully a bp will landin the spec repo this week or early next 17:20:57 sicarie: Formalizing the meeting schedule ? 17:21:08 Daviey: yep 17:21:21 we've filled in the info on the Specialty Team wiki 17:21:27 I have a change in to get us listed in the meetings 17:21:33 \o/ 17:21:41 sweet! 17:21:41 It's going to stand in #openstack-security at 10am PST Mondays 17:22:01 good stuff 17:22:03 And we were wanting to bring meetbot into the security room 17:22:06 for logging etc 17:22:06 The bot works there, just pending approval from infra to get the meeting schedule merged 17:22:11 any opinion for/against? 17:22:15 about time you guys get a formal schedule and meeting going. That will probably help attract volunteers too 17:22:21 +1 17:22:26 tmcpeak: +1 17:22:26 meetbot is fine 17:22:35 we already have logging in there 17:22:39 I'm surprised if #openstack-security isn't already logged 17:22:40 ah 17:22:44 We do :D 17:22:48 yeah, it is 17:22:50 :D 17:22:58 Excellent 17:23:16 good stuff 17:23:24 I don't think anything major has happened with the doc this week? 17:23:28 you guys have enough volunteers to plug through your backlog? 17:23:33 I'm still trying to find a good way to make a security guide sprint easy to do for people not familiar with a given project 17:23:37 i think those were the major things ;) 17:23:38 I think day 1 might be research 17:23:44 My cinder wipe one is still too single-vendor centric.. need to work out how to deal with that 17:23:49 it could be time to get out there and start shaking the can again 17:23:56 tmcpeak: we always have more bugs, but I think they're generally triaged 17:24:04 Daviey: i've talked with eharney about the fedora/centos/rhel side, he commented on the review 17:24:22 not for triaging, I mean for actually doing work - do you guys have sufficient participation or should we plan another socializing our efforts tour? 17:24:24 elmiko: Yeah 17:24:42 I think I'm almost ready to finish the case studies, I am going to volun-script people next sec guide meeting to review the ones I don't think need to be changed 17:24:49 er, Alice's case studies 17:24:52 Bob's still needs work 17:25:00 And then the Compute chapter needs a few more touches 17:25:04 but overall it's coming along 17:25:13 Personally, i kinda think security-doc should be doing more shepherding of content from subject matter experts.. rather than feeling personally responsible for writing new content whilst learning project detail 17:25:13 sicarie: +1 17:25:20 nkinder: would you be interested in doing another "intro to OpenStack Security" thing like I initially found you guys at? 17:25:27 elmiko, sicarie, etc 17:25:40 could be good to get a couple of meetups going, one in Seattle and one in the Bay or something 17:25:47 bring in some new blood 17:25:52 tmcpeak: yeah 17:25:52 Daviey: that's a very interesting discussion 17:26:04 but one for another venue :) 17:26:09 +1 tmcpeak 17:26:11 indeed 17:26:15 cool, ok impromptu agenda item 17:26:19 agreed about Daviey's comment 17:26:23 #topic Socializing OS-Security 17:26:50 so I discovered OpenStack Security about 15 months ago from a tour nkinder and bdpayne were doing 17:26:57 I think it could be cool to set up something else like that 17:27:13 tmcpeak: interesting idea 17:27:41 maybe we could actually do 3: UK, Seattle, Bay 17:27:47 anybody interested in working on something like that? 17:28:04 our community really benefits from participation, and you never know who we might discover 17:28:14 sounds cool, i'm kinda far from those locales though :/ 17:28:26 i could provide moral support =) 17:28:27 elmiko: that means you can give one local to you... :) 17:28:32 elmiko: :) 17:28:46 nkinder: yea, i'd be curious to talk more about it 17:28:50 OpenStack London meetup 21st July, anyone going? 17:29:02 Basically, we shoudl develop a presentation that any of us can re-use to recruit and evangelize 17:29:06 maybe see if local PyCon's or what not would have a guest talk on OS sec 17:29:10 nkinder: +1 17:29:15 nkinder: +1 17:29:25 nkinder: +1 17:29:29 I think hyakuhei has some deck we could do a little surgery on and present 17:29:32 theres an OS london meetup? 17:29:38 Tkelsey? fancy a day out? 17:29:43 #link http://www.meetup.com/Openstack-London/ 17:29:57 dg_: I might even let you buy me a beer. 17:30:08 dg_: why not :) 17:30:34 yeah, I can take my old deck and modernize it too 17:30:44 nkinder: awesome 17:30:50 nkinder: in git? 17:30:54 nkinder: do you have bandwidth and interest to lead this? 17:31:15 we have a local appsec conference in austin in october that might be a good venue for this 17:31:31 mvaldes: awesome! yeah, Austin seems like it would be a prime location too 17:31:48 With bluebox/ibm local we have a rather active group up here too - I'd be interested in helping develop content, though I'm not a huge fan of speaking in front of people 17:31:50 #link http://lascon.org/ 17:31:52 so I guess general plan is get a basic deck/preso worked out, then get one or two people from each location to find a venue and present 17:31:53 tmcpeak: I'll resurrect my slide deck and we can collaborate to build on it 17:32:00 nkinder: great! 17:32:07 probably a good item to get in shape at the midcycle 17:32:14 nkinder: for sure, great idea 17:32:36 we can carve off a day for it, might really pay off 17:32:50 ok, next :) 17:32:56 #topic Notes 17:33:00 nkinder: take it away :) 17:33:52 There's not too much activity lately. Daviey has a note out as a WIP. 17:34:06 nkinder: I could do with your input on how to declare Affects: Keystone + anything that uses it. 17:34:10 I'm in the middle of reviewing it, so comments are coming your way Daviey :) 17:34:16 Oh super, thanks 17:34:23 link? 17:34:29 https://review.openstack.org/#/c/200303/ 17:34:33 ty :) 17:34:34 #link https://review.openstack.org/#/c/200303/ 17:34:54 There's still a healthy backlog of notes to choose from... 17:35:10 nkinder: backlog link? 17:35:10 lol @ cowsay 17:35:22 nkinder: I will try to pick one up 17:35:26 backlog - https://bugs.launchpad.net/ossn/ 17:35:34 tkelsey: great, thanks! 17:35:39 but i didnt manage it last time I said that 17:36:32 that's really it on OSSNs right now. I'm hoping to hack on the parsing tool I mentioned last week pretty soon 17:36:35 I I have OSSN-0051 rough draft, but i wanted to land 50 first 17:36:39 nkinder: i'll look into picking another up too 17:37:20 awesome, great work as usual Mr. Kinder 17:37:31 elmiko: thanks! 17:37:33 #topic Midcycle 17:37:54 ok so I think we all know about the midcycle, we had some maybes I'd really like to get there 17:38:00 elmiko, sigmavirus24, nkinder 17:38:11 Whilst it is most unlikely I'll be at the mid-cycle, I was tempted by the specific AirBNB (option 4) on the wiki.. worth looking at! 17:38:14 #link https://wiki.openstack.org/wiki/Sprints/SecurityLibertySprint#Hotels 17:38:15 #link https://etherpad.openstack.org/p/security-liberty-midcycle 17:38:21 tmcpeak: i'm trying, its just a budgetary issue at this point 17:38:29 * sigmavirus24 can't go. 17:38:42 We have a quarterly team sync up at HQ that I have to go to that week 17:38:50 Daviey: we did an AirBnb place in San Francisco with the HP folks and it was lots of fun 17:38:58 sigmavirus24: ahh bummer 17:39:04 tell me about it 17:39:16 elmiko: cool, keep working it - drop in management terms, explain the ROI, etc etc etc 17:39:19 :P 17:39:26 haha, for sure =) 17:39:28 tmcpeak: you should look at that one, i suspect it'll be less fun 17:39:29 * sigmavirus24 may be able to participate remotely though 17:39:46 Daviey: lmao 17:40:12 I'm guessing this is Rob's doing, since it's written in pounds 17:40:26 considering there is an active part of the security team that likely will not be there, i wonder if we could think of /some/ sprinty things to complement the week? 17:40:35 although the whole UK side of the pond is full of snark, so it could really be any of you 17:40:35 (another time, but just an idea) 17:40:51 Daviey: that's a great idea 17:41:12 Infra also has some teleconferencing software set up that we can use 17:41:54 Whilst remote conf' is useful for the remote attendees, it often changes the dynamics of the local attendees - such that much of the value of local collab is lost 17:41:56 I'm definitely willing to give it a shot, I mean I work entirely from home at the moment, so I know it's possible to effectively conference :) 17:41:57 (IMO) 17:42:20 Daviey: yeah, I think we should shoot for a different time that isn't the midcycle 17:43:03 Daviey: you want to put together some ideas so we don't drop this? 17:43:14 uh, ok 17:43:17 sigmavirus24: etc 17:43:43 tmcpeak: was that a wilco reference? (Jesus, etc.) 17:43:58 no, I don't know what that is 17:44:07 I'll show you later 17:44:10 okies 17:44:23 does anybody want an action for this, or shall we pick it up another time? 17:44:49 another time it is ;) 17:44:53 tmcpeak: lets thrash some of it out another time in the main channel? 17:44:58 Daviey: cool 17:45:01 sounds like a plan 17:45:13 #topic API Testing 17:45:15 mvaldes: shoot 17:45:30 cool. we have a PoC up and running 17:45:38 awesome? 17:45:41 I mean awesome! 17:45:42 linky? 17:45:43 link? 17:45:47 lol 17:45:51 yes :) 17:46:01 if this is a rickroll, i'll be unimpressed. 17:46:11 no link yet. hoping to open source it in the next week-ish 17:46:20 lol 17:46:32 mvaldes: cool, looking forward to seeing it :) 17:46:33 but it is doing things 17:46:54 mvaldes: awesome 17:47:07 do you want to say anything about it or wait until it's posted and we can go over it together? 17:47:21 so far i equate it to automating much of what we use burp intruder for 17:47:48 that sounds like a useful start 17:48:12 that's about all i have for now i think 17:48:15 cool, so… 17:48:24 #topic Open Bugs, Crypto Oversight, AOB 17:48:45 I'm squashing these because I expect we won't have any updates on the crypto thing since hyakuhei was leading it 17:48:51 and he's gonzo 17:49:12 open floor, anybody have anything to discuss? 17:49:38 nothing from me, just to let folks know I'll be pushing on Bandit bugs this comming week still 17:49:49 * sigmavirus24 gives tkelsey a round of applause 17:49:56 +1 17:50:02 heh thanks sigmavirus24 :) 17:50:20 I might work out a spec to give bandit the ability to do analysis using multiprocessing 17:50:32 There's a bp registered for it, but might as well toy with our specs 17:50:40 We'll see how much time I have 17:50:42 sigmavirus24: awesome, sounds like a good usage for them 17:50:43 sigmavirus24: interesting :) 17:51:08 Hopefully it'll take analyzing glance from ~20s to like 5 17:51:22 that would be impressive :) 17:51:31 Flake8 has seen similarly drastic performance benefits 17:51:47 sigmavirus24: exciting stuff 17:52:14 sounds exciting, and a perfect use for specs :D 17:52:32 allright, anything else before I call it? 17:52:42 lets go home? 17:53:58 lol sounds like a plan 17:54:00 #endmeeting