15:00:18 <fungi> #startmeeting security
15:00:18 <opendevmeet> Meeting started Thu May  5 15:00:18 2022 UTC and is due to finish in 60 minutes.  The chair is fungi. Information about MeetBot at http://wiki.debian.org/MeetBot.
15:00:18 <opendevmeet> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote.
15:00:18 <opendevmeet> The meeting name has been set to 'security'
15:01:12 <fungi> not sure who else is around, but i put an agenda together in the usual spot
15:01:22 <fungi> #link https://etherpad.opendev.org/p/security-agenda
15:02:26 <fungi> we skipped the april meeting in favor of (virtually) getting together at the ptg, so this is our first regular meeting since the ptg
15:03:28 <fungi> #topic PTG recap
15:05:17 <fungi> #link https://etherpad.opendev.org/p/security-sig-ptg-zed
15:05:24 <fungi> that's where we took some notes
15:06:25 <fungi> we covered a few topics, some of which are broken out into activities in today's meeting agenda
15:07:13 <fungi> we talked about finding more volunteers to expand the vmt
15:07:36 <fungi> big thanks to d34dh0r53 and dmendiza[m] for expressing interest in getting involved there!
15:08:03 <d34dh0r53> o/
15:08:10 <d34dh0r53> you're welcome
15:08:31 <fungi> thankfully, things have been fairly quiet on the vmt front for the past month, so i haven't had much opportunity for engagement with our new recruits on anything yet
15:08:47 <dmendiza[m]> 🙋‍♂️                                                                                                                             ad
15:09:17 <fungi> it looks like i had one action item from the vmt coverage expansion discussion which i've neglected to work on yet
15:09:36 <fungi> #action fungi adjust the repos-overseen doc to also mention the vmt is available to assist projects even if their repos are not explicitly opted into oversight
15:10:20 <fungi> i'll get into other stuff from the ptg later in today's agenda
15:10:44 <fungi> anyone have anything ptg-related to add which isn't on the meeting agenda already?
15:12:02 <fungi> #topic Interim SIG chair
15:12:53 <fungi> many thanks to gagehugo for chairing the sig (for i can't even remember how many years it's been now)!
15:13:03 <fungi> #link http://lists.openstack.org/pipermail/openstack-discuss/2022-April/028251.html
15:14:13 <fungi> as he mentions in that ml post, he's unable to continue chairing the sig, so we need one or more new (co)chairs
15:15:24 <fungi> given the lack of responses, there's a wip change which i'll amend to set myself as interim chair, though i'm happy to entertain other co-chairing or replacement chairs from anyone with interest
15:15:43 <fungi> #link https://review.opendev.org/839632
15:16:15 <fungi> we'll also need a similar change to the openstack/governance-sigs repository officially setting the chair(s) for the sig
15:16:44 <fungi> #action fungi push/amend sig chair update changes
15:17:29 <fungi> if anyone's up for it, speak up now or feel free to reach out to me any time after the meeting
15:19:36 <fungi> #topic Activities: retiring security-analysis repository
15:19:55 <fungi> this was something we spent some time discussing at the ptg
15:20:47 <fungi> the references to the security-analysis repo were already removed from the ossa repo and thus from the security site when i was working on importing the vulnerability:managed governance tag documentation
15:21:25 <fungi> the repository itself has yet to be retired, so i'll take care of the next steps, which i believe will be as follows:
15:21:58 <fungi> #action fungi send an announcement to the openstack-discuss list about moving documentation out of security-analysis to individual project repos
15:22:24 <fungi> #action fungi follow retirement process from project teams guide/infra manual to retire security-analysis
15:22:53 <fungi> if anyone is interested in doing either or both of those things, i'm happy to help provide guidance
15:24:32 <fungi> #topic Activities: horizon xstatic javascript library wrappers plan
15:25:10 <fungi> we covered this some in the security sig ptg session, and i also had a lengthy discussion with horizon contributors in their session about it
15:28:57 <fungi> i still owe the openstack-discuss ml a discussion starter about what can be done
15:29:09 <fungi> and the current pitfalls with what we have
15:29:44 <fungi> #action fungi initiate openstack-discuss thread on the topic of xstatic packages and js dependency handling
15:31:19 <fungi> #topic Activities: removing references to defunct security blog
15:31:52 <fungi> this has come up in the past, and i just noticed when looking back over the main page of the security.openstack.org site that we still refer to it
15:32:00 <gagehugo> o/
15:32:10 <gagehugo> apologies for being late
15:32:22 <fungi> no worries! i've been taking things slowly
15:33:21 <fungi> the "openstack security blog" was being managed by some of the more active openstack security group folks in years past, but it was abandoned around 5 years ago
15:34:41 <fungi> it would probably be good if someone who's a member of the openstack-security org on github could wind it down more cleanly there, but i don't know who had or still has access to do that (it's not me, at the very least)
15:35:28 <fungi> hyakuhei seems to have probably set it up originally, and i see indication that lhinds might have been the last one approving pull requests in it
15:36:12 <fungi> at any rate, what i *can* do is remove references to it from the security.openstack.org site, so i'll push up a change to do that and further simplify the page in the process
15:36:53 <fungi> #action fungi propose change to remove security blog references from ossa repo
15:38:08 <fungi> #topic Recently public security bug reports
15:38:41 <fungi> we've only had one of note since the ptg, and it was marked invalid by the vmt:
15:38:52 <fungi> #link https://launchpad.net/bugs/1970932
15:39:35 <fungi> i'm looking forward to progress on the rbac work, particularly the idea of dropping the ambiguous "admin" role, which will hopefully solve a lot of this sort of confusion
15:39:54 <gagehugo> more documentation would be nice
15:40:20 <fungi> yeah, if anyone has time and interest in making that particular pitfall more easily spotted by users/operators, that would be awesome
15:42:02 <fungi> #topic Recent vulnerabilities in or related to OpenStack
15:42:24 <fungi> i noticed these advisories for dpdk this morning:
15:42:36 <fungi> #link https://www.openwall.com/lists/oss-security/2022/05/05/1
15:42:47 <fungi> #link https://www.openwall.com/lists/oss-security/2022/05/05/2
15:43:32 <fungi> unfortunately there's not a ton of detail in the ml posts, and their bugzilla requires a login to see whatever's at the urls they linked for more information
15:44:17 <fungi> the first one might be arbitrary code execution, but i'm not sure how the vulnerable function call is reached, so i can't be positive
15:44:53 <fungi> the second is called out as a potential denial of service due to resource exhaustion
15:45:31 <fungi> i'm bringing them up because i know some openstack deployments rely on dpdk features, so this might be of interest to a subset of our operators
15:46:04 <fungi> if anyone's got a burning desire to do a bit more research and write up an ossn (openstack security note) about these, i'm sure that would be welcome
15:46:57 <fungi> #topic Anything else?
15:47:29 <fungi> i'll give everyone a few minutes in case someone has something to bring up before i end the meeting
15:50:25 <fungi> i'll take that as a "no." thanks for coming! see you on thursday, june 2, when we'll have a (hopefully short) meeting to talk about anything of interested related to the summit happening in berlin the following week
15:50:45 <gagehugo> thanks fungi!
15:50:51 <fungi> er, anything of interest, i mean
15:50:59 <fungi> #endmeeting