17:01:04 #startmeeting Security 17:01:04 Meeting started Thu Jan 28 17:01:04 2016 UTC and is due to finish in 60 minutes. The chair is hyakuhei. Information about MeetBot at http://wiki.debian.org/MeetBot. 17:01:05 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 17:01:08 The meeting name has been set to 'security' 17:01:10 #chair tmcpeak 17:01:12 o/ 17:01:14 Current chairs: hyakuhei tmcpeak 17:01:16 o/ 17:01:19 o/ 17:01:30 o/ 17:01:35 tmcpeak: I have to finish a call, you’ll have my full attention in 2 minutes or so 17:01:44 hi 17:01:45 hyakuhei: cool man 17:01:49 elmiko: what up 17:01:57 hey 17:02:04 tmcpeak: nada, you? 17:02:04 hello 17:02:11 yo yo 17:02:19 pretty good 17:02:27 let's start building up an agenda 17:02:28 o/ 17:02:31 one sec, I'll do an etherpad 17:02:51 https://etherpad.openstack.org/p/security-20160128-agenda 17:02:59 hi 17:03:07 please add all the things to the etherpad 17:03:37 elmiko: did you get the stickers? 17:04:03 michaelxin: i did, thank you! 17:04:13 i even put one on my laptop already XD 17:04:14 great. np 17:04:25 back :) 17:04:30 Man those stickers are awesome 17:04:45 there is stickers? 17:04:53 s/is/are 17:05:04 dg_: I have some for you 17:05:05 I ran into Rachel who designed the logos and gave her a couple too. 17:05:16 Excellent, Rachel is awesome! 17:05:19 hyakuhei sweet 17:05:21 +1 17:05:46 ok then, lets crank it :) 17:05:49 #topic Bandit 17:05:58 cool, so we did a new release this week 17:06:02 ahem, three of them 17:06:06 lol 17:06:10 thanks to a bunch of silliness 17:06:10 haha 17:06:24 basically that was just to implement the .bandit feature some of the teams I'm working with really needed 17:06:35 that buys us some time to do 1.0 with good quality and the way we want 17:06:45 good job 17:06:50 if we need anything else meantime we can push to "stable" which is basically the 0.17.x line 17:07:00 next real release will be 1.0 it seems 17:07:10 tkelsey: you want to do an update on that? 17:07:14 on the 1.0 front, I have a bunch of changes for new/old config compatibility 17:07:48 1.0 will have backwards compatibility to help early adopters move over 17:07:51 I'll do thorough reviews later this morning 17:08:33 we are actually quite close to 1.0 feature wise, but we need to do a push on bringing docs up to date 17:08:33 sweet 17:08:41 and TONS of testing 17:08:49 and close of a bunch of bugs etc 17:09:12 tmcpeak: +1 17:09:20 nice, and it's awesome to see all the activity recently from new folks getting into bandit 17:09:28 elmiko: for sure :D 17:09:38 elmiko: +1 17:09:43 we seem to have had a surge of interest following the midcycle :) 17:09:47 very nice to see 17:09:51 seems like it's really picking up steam 17:10:14 yea, totally awesome and job well done to the bandit team =) 17:10:22 +1 17:10:23 +! 17:10:27 elmiko: thanks! 17:10:32 well job well done OSSP :) 17:10:33 +1 it’s a great flagship for the Security Project 17:10:40 hyakuhei: +1 17:10:59 Anymore on Bandit? 17:11:02 anyway, I have no more specific on bandit, we can move on unless there is more 17:11:03 that's good for Bandit 17:11:09 heh 17:11:10 :) 17:11:12 coolio 17:11:18 #topic Blog 17:11:29 #link https://openstack-security.github.io 17:11:45 There’s a few completed posts up there. It’d be nice to have more :) 17:12:13 we should start trying to get it out there too 17:12:19 Ideas on that? 17:12:37 hyakuhei: do you have any thoughts on what the general tone and topic should be there? 17:12:38 well let's add it to our deck 17:12:40 for starters 17:12:42 is there any easy way to know they are complete? 17:12:51 and which need contribution 17:12:56 for example, should it be general openstack security, or can we talk about specific projects? 17:13:01 If they’re listed there, they’re complete 17:13:03 share on the twitters? 17:13:21 Drafts should be in branchs/pull requests: https://github.com/openstack-security/openstack-security.github.io 17:13:28 everyone is welcome to contribute 17:13:39 and as long as it’s related you can blog it 17:13:55 thank you 17:14:02 ack, so anything openstack + security related? 17:14:08 Want to blog about how RH uses sVirt for KVM, etc that’s fine 17:14:19 Yeah, no sales pitches, but you can take credit where it’s due 17:14:27 or how we use DogTag for perfect CA ? 17:14:28 ie the threat analysis post for example 17:14:32 dang.. 17:14:33 elmiko: exactly 17:14:34 elmiko: LOOL 17:14:41 elmiko lol 17:14:53 * elmiko wishes nkinder was here 17:15:14 +1 17:15:17 :D 17:15:41 Might be worth doing something clever to cross post to medium or something like that 17:15:59 also, did you register the blog with planet openstack? 17:16:09 i thought we had a nice rss agregator somewhere 17:16:17 I will add it to our security pitch deck 17:16:26 Excellent plan elmiko 17:16:35 hyakuhei: http://planet.openstack.org/ 17:16:42 #action hyakuhei to register with planet.openstack.org 17:16:45 Thanks elmiko 17:16:53 yeah, good idea 17:17:07 what's planet website for? 17:17:19 Aggregator 17:17:24 it's a blog aggregator 17:17:29 Click on it 17:17:34 We’re on the front page atm :D 17:17:54 http://superuser.openstack.org/articles/takeaways-from-the-openstack-mitaka-mid-cycle-security-meetup 17:17:59 whoop! 17:18:12 who wrote this? Good job! 17:18:25 cool 17:18:44 michaelxin: Nicole from the foundation wrote it, but Rob and I answered her questions for it 17:18:56 There’s a lot of copy/paste in there :) 17:19:01 excellent 17:19:05 and a lot of love for you guys 17:19:10 tmcpeak: Thanks. 17:19:31 yeah, I'm already missing breakfast tacos 17:19:38 lol 17:19:42 any more on that ? 17:19:54 lol 17:19:58 should be good 17:20:22 Ok, decent sized agenda today so let’s roll on. 17:20:26 #topic OSSN 17:20:38 Only three in the queue https://bugs.launchpad.net/ossn it would be nice to clear them out 17:20:48 0060 finally out the door :P 17:20:49 any takers? 17:21:08 Dave Mc was working on the Nova/Cinder one 17:21:42 i thought there was some question about the blacklist one, no? 17:21:54 like, should it even be an ossn 17:22:06 Let me take another look 17:22:10 elmiko: which one? 17:22:15 #link https://bugs.launchpad.net/ossn/+bug/1497031 17:22:16 Launchpad bug 1497031 in OpenStack Security Notes "Authenticated Denial of Service in Blacklists" [Undecided,New] 17:22:23 the possible dos from designate 17:22:30 yeah I was the one who found that bug, it’s already been mitigated in Designate 17:22:41 we had a big discussion about whether this was a vuln or just bad config or something 17:22:54 I remember this 17:23:02 Would it DoS all of Designate or just one users instance/invocation 17:23:37 when it was reported, all of Designate 17:24:06 My feeling is it probably is OSSN worthy 17:24:27 cool 17:24:31 I don't know what we'd propose as a mitigation? 17:24:31 oh wait, ok I just the that blacklist creation is admin-only 17:24:43 Don’t create a dumb blacklist? 17:25:03 As Security notes are just signposts for users about bad/insecure things I’d be ok with an OSSN 17:25:03 haha 17:25:26 ok, i can take a stab at it since i kicked the dustball 17:25:26 I'd agree that the 3rd option is probably the most practical. 17:25:41 hyakuhei: hmm ok, if we're really telling admin's "be conscious about your blacklist" doesn't seem like that really needs a note, does it? 17:26:05 lol, this is like a re-do of the conversation we had last time 17:26:11 it seems far down on the list of bad things admin could do 17:26:54 WontFix. 17:26:56 Next. 17:27:04 :D 17:27:18 sicarie: you around to talk Security guide? 17:27:37 we've had a few slow weeks for the sec-guide 17:27:46 Any updates? 17:27:49 elmiko is probably better suited for this update 17:27:51 #topic Security Guide 17:27:53 I've been underwater on other things 17:27:56 mainly just small bug fixes coming in 17:28:18 i think we still have a long term plan to get a new leaf version out, but i don't think there has been movement on it 17:29:05 that's about it, we need to get back on track with our plans for revamping some of the networking sections though 17:29:14 "some" 17:29:16 What’s required to help drive that forward? 17:29:34 sicarie: ;) 17:29:49 i think we mainly need more bodies who are willing to do doc work and now the networking service well 17:29:58 the leaf version requires a pdf, so we need to get the sphinx jobs back up and running and producing it 17:30:00 s/now/know/ 17:30:15 networking requires either a neutron resource or someone to spend quite a bit of time int he code 17:30:26 Is it worth sending a mail to -dev asking for contributors from Neutron ? 17:30:29 i've been pushing to get the neutron docs lead, but haven't been able to tie him down 17:30:44 hyakuhei: that seems reasonable 17:30:45 could be, though I think i attempted that at one point last year 17:30:57 Breifly explain what the SecGuide is, how there’s a noticable gap for Neutron and ask for help bridging that? 17:31:37 yeah, seems reasonable 17:31:55 should probably keep it rolling, looks like we're about 1/3 through agenda and 1/2 through time 17:31:58 Anyone want that as an action? 17:32:17 if nobody else will, i will, but it won't be completed until mid to late next week 17:32:36 #action sicarie to find someone to write or author himself a mail for -dev re: contributing to the sec guide 17:32:46 #topic Outreach 17:32:53 tmcpeak: ? 17:33:11 nothing new on my side, anybody get anywhere with setting up new meetups? 17:33:22 As you might know that Rackspace are teaming with Intel 17:33:29 in the next month or two, i am going to be connecting with the MichSec group 17:33:32 #link http://michsec.org/ 17:33:40 gonna try to setup a talk with them 17:33:47 elmiko: awesome! 17:34:00 We are working on a proposal to get someone from Intel to work on OSSP 17:34:07 I'm also going to follow up with some professors at SJSU and SCU and see if any students are interested in hearing about this 17:34:09 michaelxin: ooh, nice 17:34:14 michaelxin: that would be awesome 17:34:16 tmcpeak: +1 17:34:33 Will keep you guys updated with the progress 17:34:36 elmiko: +1 17:34:44 excellent! 17:35:00 that's probably good on outreach this week 17:35:07 agree 17:35:40 #topic Summit Talks 17:35:58 when is voting open? 17:36:12 o/ sorry I'm late, stupid monitor was being stupid 17:36:13 I guess after deadline, Jan 31? 17:36:22 hehe, i hope so ;) 17:36:26 Deadline over the weekend, FYI I’m putting in three talks, one an update on the awesomeness of the security group, second one on threat analysis and third a laterall exploitation talk 17:36:30 tmcpeak: TBD 17:36:45 I've got one with gmurphy on Security CI 17:36:47 gee, talk monster 17:37:02 Lol, I only list them for full disclosure :) 17:37:06 hyakuhei: laterall exploitation? 17:37:07 Three’s the max this time around 17:37:23 Yeah, so what can you do to a production cloud if $x suffers a compromise 17:37:33 Say, Nova, Libvert, Swift Backend server etc 17:37:35 oh, awesome 17:37:37 shut down it 17:37:43 michaelxin: LOL 17:37:50 oh hai, I might propose an OpenStack CVE Process to answer the I think I found a security bug, what 17:37:51 Well we always just assume it’s all FUBAR and it probably is 17:37:53 happens now? 17:37:57 but I’m going to have graphics! 17:38:01 tristanC: +1 17:38:14 tristanC: Great plan! 17:38:43 As OpenStack grows we get lots of derivative talks. A few years back I did one reviewing all the major OSSA and CVE 17:38:52 Next summit had 5 proposals doing the same thing 17:39:01 hyakuhei: i've been working on something that is similar about exploiting clouds from the inside, not up for a talk yet, but i'm curious how accepting the summit commitee is for talks that show exploits? 17:39:25 TALKS LIKE THAT ARE AWESOME 17:39:30 I mean, not so much if they’re 0days 17:39:41 way more if they're 0 days 17:39:50 :D 17:39:56 lol summit != blackhat 17:39:56 So long as responsible disclosure has been followed for whatever the issue is, go nuts 17:40:01 Anyone knows exactly about talk reviewing/acceptance process? 17:40:16 michaelxin: Sure, ping me an email if you like 17:40:20 hyakuhei: ack, excitement noted ;) 17:40:22 you make a bribe to Rob, and you're off to the races 17:40:30 haha 17:40:33 tmcpeak: +1 17:40:35 Or we can followup after this but I’ve got limited availability 17:40:44 tmcpeak its more complicated than that, you have to bribe elmiko too 17:40:55 hyakuhei: sure, will send you an email. 17:41:07 ;) 17:41:19 dg_: sadly, i'm not on the conference commitee 17:41:20 michaelxin: My paypal is the same address 17:41:38 just wired you 10,000$ :-) 17:41:45 Sweet 17:41:52 What are you going to say in your 10 talks ? 17:41:56 because you bought the track 17:41:57 lol 17:42:12 haha 17:42:18 Right, limited time so we’ll breeze through this next bit 17:42:24 #topic Design Summit Proposals 17:42:39 me me me me 17:42:45 how many sessions will we get this time? 17:42:53 Not for a while yet, we will be trying to get many more slots this time as well as sessions on the X-project 17:43:00 michaelxin: we won’t know that for quite some time 17:43:14 x project? 17:43:14 im keen to do a design session on threat analysis, and maybe one on PKI 17:43:24 dg_: +1 17:43:25 +1 17:43:37 dg_ that would be awesome 17:43:48 dg_: i'd be up for that 17:43:52 #topic Threat Analysis - Next Steps 17:43:52 TA that is 17:43:55 and i had a crazy idea to get a group of interested people together and try and run through a threat analysis on the last day of the summit, the one where there is no talks 17:44:09 dg_: Yup that’ll be a good thing to try 17:44:10 Tim's breakdown of bandit plugin in mid-cycle is a great one 17:44:19 I’m hoping to get anchor through one first 17:44:35 +1 meetup in bristol/wales 17:44:35 ty michaelxin :) 17:45:15 It will teach new members to get start quickly. 17:45:25 Yeah! 17:45:45 ok, speeding on! 17:45:48 #topic SWAG 17:45:48 We also like a session about fuzzing testing API, include syntribos 17:45:56 michaelxin: +1 17:46:03 Do we want swag for the conference. 17:46:09 hyakuhei: yes, yes we do. 17:46:14 Do we have budget? 17:46:16 who doesn't want swag... 17:46:17 yes. preferably not black 17:46:18 hoodies with the logo? 17:46:20 michaelxin: Do you think we could get Rachel’s help again? 17:46:22 from foundation? 17:46:32 hyakuhei: Yes. 17:46:33 tmcpeak +1 17:46:38 She is happy to help. 17:46:42 I’m finding out about budget this week 17:46:43 since it's in austin, i think 10 gallon hats or oversized belt buckles 17:46:49 +1000 17:46:49 +1 17:46:52 lol 17:46:53 haha 17:47:05 +1 17:47:42 I’m trying to put together funding. Add your name and a +1 to the etherpad if you want swag please 17:48:00 which etherpad? 17:48:01 which etherpad? 17:48:03 we have a swag etherpad? 17:48:05 lol 17:48:16 swaggerpad 17:48:16 the agenda one 17:48:19 https://etherpad.openstack.org/p/security-20160128-agenda 17:48:20 haha 17:48:31 ok, need to move on, we’ll skip the writeup 17:48:36 #topic Syntribos 17:48:46 michaelxin: you’ve got a whole 5 minutes for Syntribos! 17:49:20 Is mdong here? 17:49:33 So MDong has been working on it. 17:49:49 The team met and discussed about the plans and futures. 17:49:51 ccneill: lol 17:49:53 :D 17:50:08 sorry I’m here 17:50:16 We created some blueprints for features that we want to implement 17:50:22 The team started working on it. 17:50:28 I demand links! 17:50:34 https://blueprints.launchpad.net/syntribos 17:51:15 Nice. I might even be able to help with some of those 17:51:24 hyakuhei: +1 17:51:36 #link https://blueprints.launchpad.net/syntribos 17:51:37 hyakuhei michaelxin +1 17:51:39 so we definitely want to build some serious momentum here, a few people on our team have started work, and we’d love it if more can join 17:52:12 i would really love to get involved with syntribos, i've just been over-stretched recently :/ 17:52:24 We might be able to push some effort torwards it 17:52:36 hyakuhei: +1 17:52:44 tmcpeak: tmcpeak: thoughts on applicability to HDP (edge testing)? 17:53:03 hyakuhei: yeah, definitely seems like something we should at least play with 17:53:07 +1 17:53:21 Excellent, we can throw some small amount of effort at it for a while then :) 17:53:22 seems like some nice low hanging fruit on the BP page 17:53:26 formatters for example 17:53:27 I'll carve out a few hours to play with it 17:53:28 +1 17:54:08 awesome! glad to hear it 17:54:08 Next up I had Anchor 1.0 discussion but I have zero bandwidth for that this week anyway so that can roll on 17:54:24 #topic Any Other Business 17:54:42 Consider throwing your twitter handles on the etherpad https://etherpad.openstack.org/p/security-20160128-agenda 17:54:53 So we can promote links/blog posts etc a little more easily 17:55:15 Anything else to discuss in the next 5 minutes? 17:55:22 TA, very quickly? 17:55:47 elmiko I've gone through your comments and made a whole bunch of changes, will be pushing to gerrit again soon, so please have a look when its up 17:55:48 Sure 17:56:01 dg_: ack, will do, and thanks =) 17:56:02 still obviously WIP, but iterating in the correct direction, I hope 17:56:05 yea 17:56:28 We need to have a separate meeting about TA next week, to discuss next steps, where docs are going to live, the tools we’re going to use, how to step through the process etc 17:56:29 i realize those docs will need to be hammered on for a bit, hence why i was trying to avoid -1'ing just yet 17:56:41 hyakuhei +1 17:56:46 yea, +1 17:57:02 maybe a google hangout or something? 17:57:07 yeah sounds good 17:57:21 +1 17:57:27 Please include me too. 17:57:38 Yeah. Throw your email address on the agenda 17:57:48 I put a section at the bottom 17:57:52 hyakuhei add times you can do to an etherpad for TA meetup 17:58:04 Sure, though I was going to email around re: times. 17:58:10 whatevs 17:58:35 ok we’re running up on time. Any last minute stuff? 17:59:24 Righto, lets call it :) 17:59:27 #endmeeting