17:00:01 #startmeeting security 17:00:01 Meeting started Thu Oct 13 17:00:01 2016 UTC and is due to finish in 60 minutes. The chair is tmcpeak. Information about MeetBot at http://wiki.debian.org/MeetBot. 17:00:02 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 17:00:04 The meeting name has been set to 'security' 17:00:05 #chair hyakuhei 17:00:06 Warning: Nick not in channel: hyakuhei 17:00:06 o/ 17:00:07 Current chairs: hyakuhei tmcpeak 17:00:16 #chair hyakuhei- 17:00:19 Current chairs: hyakuhei hyakuhei- tmcpeak 17:00:20 o/ 17:00:25 o/ 17:00:27 #link https://etherpad.openstack.org/p/security-agenda 17:00:37 o/ 17:00:42 Hey! Sorry about that 17:00:55 My BNC doesn't auth with Nickserv properly 17:01:01 o/ 17:01:21 o/ 17:01:28 o/ 17:01:36 Interesting, who put privacy badger on there. I'm guessing they browse reddit :) 17:01:39 oh hai redrobot ! 17:01:47 hi guys! 17:01:51 hyakuhei: that would be fungi 17:01:56 excellent 17:02:13 allright, let's get started 17:02:19 #topic Privacy Badger + Security Blog 17:02:34 fungi: mentioned that Privacy Badger despises our security blog 17:02:37 fungi: you around? 17:02:57 Interesting 17:03:18 It's green[0] for me... 17:03:22 does anybody use security badger? I assume this is a drawback of using the github.io? 17:03:34 green[0] sounds good 17:03:35 I use the badger 17:03:38 what's the url? 17:03:45 #link https://openstack-security.github.io/ 17:03:46 http://openstack-security.github.io/ 17:04:24 lol, welcome capnoday 17:04:26 o/ 17:04:31 hey guys, sup? 17:04:35 it complains about logging into google user content or something... 17:04:40 <3 that nick 17:04:47 gmurphy_: yeah, that's what fungi said too 17:04:51 Interesting, that must be a non-default setting. 17:05:03 http://imgur.com/a/bi1wz 17:05:04 is that because of hyakuhei email address? 17:05:18 Hmm. Interesting. 17:05:30 https://www.eff.org/privacybadger == plugin 17:05:35 hi , sorry I am late 17:05:41 looks ok with noscript + uBlockOrigin 17:05:43 Yeah, I don't have that come up when I hit it 17:05:44 heh, hyakuhei must have always allowed google user content in the past 17:05:49 but I can see hyakuhei's email in plaintext O:-) 17:05:54 o/ 17:06:00 hi lhinds and sigmavirus 17:06:02 tmcpeak narp, it's been installed all of 10 minutes 17:06:02 yeah, the badger is real upset about the Google User Content 17:06:07 The google content is images anyway 17:06:41 oh, it's linked to google drive 17:06:41 To my mind that's a false positive but we could move the images into github and link directly 17:06:41 I see 17:06:54 Though that makes tmcpeak grumpy because he doesn't like binary in Git 17:07:08 well we already have tons of them, might as well add a few 17:07:11 hyakuhei: github has lfs right? 17:07:19 I think binaries that are unlikely to change are OK 17:07:31 I'll open it as a GH issue, if someone _wants_ to move it all out of Google I won't stop them :) 17:07:36 tmcpeak +1 17:07:44 find a free CDN tier somewhere maybe? 17:07:48 sweet 17:08:32 allright, next topic? 17:08:36 if only there was some kind of cloud thing we could host that on 17:08:40 ccneill I think just git will work, one less thing to worry about keeping track of 17:08:46 +1 17:08:47 capnoday there is no cloud... 17:08:50 capnoday: then the cloud will track you ;) 17:08:59 its just someone elses server? 17:09:04 hyakuhei: +1 17:09:18 honestly I don't understand what's the implication here? google knows that I went to the OS security blog? 17:09:27 yep 17:09:45 top 20% on my list of things I don't give s' about :P 17:09:58 that being said, I've given up on privacy long ago 17:10:09 well, google _might_ know 17:10:23 It's more the concern that the blog is using something like single pixel images to track you etc 17:10:27 Google probably knows anyway if you're using Chrome :P 17:10:30 either way it's a false positive 17:10:46 but still would be nice to not have our visitors that are using privacy badger get nasty alerts 17:11:10 hyakuhei: +1 17:11:17 #topic OpenCIT 17:11:25 so I met with some of the Intel folks last week 17:11:33 has anybody heard of Intel CIT? 17:11:47 #link https://01.org/opencit 17:12:00 Only a little. I know we spoke about it before tmcpeak but it wasn't what I thought it was. 17:12:23 basically the idea is to use TPMs to perform host attestation to verify each progressive stage of boot up through the kernel 17:12:46 this can help detect certain attacks 17:12:52 I wonder if they are going to re-write the nova filter 17:12:52 do i care any more than about regular attestation? 17:12:53 Nice, yeah the boot chaining stuff is great 17:12:57 it badly needs it 17:13:13 lhinds: yeah, that's what this proposal is. They want to bring that back up and figure out how to get it 17:13:29 OpenCIT can be used to do things like geofencing too, which is interesting given European data laws and such 17:13:33 good move 17:13:35 Interesting, does it have any of the people working on it who were involved with TrustedCompute? 17:13:39 so we'd like to use a security session to discuss how to move it forward 17:13:44 hyakuhei: I'm sure it does 17:14:23 Interesting. So I'd love to hear more about what they're doing. TC ended up bouncing out of Nova because it wasn't really used IIRC 17:14:38 tmcpeak: I am interested in jumping in and hearing whats possible 17:14:41 This is more the 'under-cloud' though right? 17:14:50 Or a fully trusted stack? 17:14:53 lhinds: awesome 17:15:05 hyakuhei: undercloud focus for now, but there are some other cool uses later 17:15:32 for example, you could use a trusted and immutable module in a kernel to validate the contents of containers and only deliver secrets to those that pass a check 17:15:34 that kind of stuff 17:15:46 I beleive a big problem with the former TC filter, is it marked a host as trusted based on last boot, but if it had been compromised after then, it would still say 'go ahead' to any VM's asking for a trusted compute host 17:16:23 false sense of security I guess would be the words to use 17:16:25 lhinds yup, that was the problem with TCP and OAT all over TBH 17:16:42 Knowing a host came up with good firmware 3 months ago is of little value 17:16:49 hyakuhei: +1 17:16:49 lhinds: yeah, there are some challenges along those lines. Because of some work I've done in my day job I can help describe the current state of a lot of this too 17:16:54 However the ability to re-attest is interesting 17:16:59 In a live system etc. 17:17:01 Intel has some things to address that problem in their commercial product they may open source at some point 17:17:09 tmcpeak: definately intrested 17:17:23 lhinds, hyakuhei: awesome! 17:17:32 so I'm just going to add a session proposal to 17:17:33 #link https://etherpad.openstack.org/p/barcelona-security-sessions 17:17:46 seems like we have only 3 so far 17:17:47 Please do. I need to finalize those over the next few days. 17:17:50 how many rooms do we have hyakuhei? 17:17:59 we may need to give some back if we don't have additional topics 17:19:04 I'll mention it but my understanding is we are not pushed for space at this summit, in fact there were a few slots going spare. 17:19:12 hyakuhei: gotcha 17:19:21 I saw on the ML at least one project give some back 17:19:31 anyway, let's move to regular agenda 17:19:38 #topic Syntribos 17:19:48 ccneill, unrahul 17:19:59 I see a lot of Syntribos patches landing recently :) 17:20:07 mmm not as many as a few weeks ago haha 17:20:12 :D 17:20:31 we'd like to get browne's CR here merged: https://review.openstack.org/#/c/379844/2 17:20:38 if there's anyone here who can give it a nudge :) 17:20:45 oops, no /2 at end 17:20:53 I always do that >_< 17:21:07 so we've started planning for Ocata 17:21:10 https://etherpad.openstack.org/p/syntribos-planning-ocata 17:21:25 sorry, i need to revisit the patch. been busy with my day job 17:21:50 browne: no worries, Andreas asked for a few minor edits so I just jumped in and made them real quick. hope you don't mind me jumping in 17:22:39 no problem at all 17:22:47 we have a few short-term objectives: get a working PyPI release cut, publish docs somewhere, and link it in a retrospective post on the OSSP blog 17:23:13 turns out we have the python job all set up for pypi releases, just gotta tag a release. anyone with experience numbering those, hit me up 17:23:15 As your planning these things can you start to think about OpenStack release phases ? 17:23:35 sure, our goal is to have a pypi release cut by the summit if possible 17:23:45 have a bit of work to do around the pypi installation process, but I think we might make it 17:24:13 ccneill: i can help with that 17:24:25 ccneill: there's little reason for you to start tagging things yourself 17:24:34 We need to do similar things (Release management, OpenStack Style) for Anchor, Bandit etc 17:24:35 ok, well that's just my ignorance talking 17:24:44 not sure what the common best practices are 17:24:44 ccneill: nah, it's probably out of date docs too 17:24:57 openstack/releases is the repo to use 17:25:08 hyakuhei, sigmavirus maybe we can use a session for that at the summit? 17:25:16 knock all of them out at once 17:25:18 so, we've been talking about how to package up templates and payloads for a base pypi install 17:25:18 sigmavirus: you coming? 17:25:23 I'm not 17:25:33 our thought right now is to basically have separate repos for them 17:25:41 tmcpeak that's a good idea. An idiots guide so to speak. There might be others who can drop in and help. 17:25:42 ccneill: data_files is what I'd use 17:25:47 but a separate repo could work too 17:25:47 Sorry to hijack ccneill 17:25:48 so on your first run, you go download the payloads, and can cache them or not 17:26:12 hyakuhei: +1 17:26:20 hyakuhei: no worries. so a session about uniting OSSP project releases? 17:26:25 sounds good to me 17:26:59 sigmavirus: so I've fumbled around looking at pbr a bit, and I'm not sure how to work with data_files in the way we need to 17:27:17 we want to ship them to ~/.syntribos/payloads in most cases 17:27:22 hyakuhei: do we have time to discuss that here or should ccneill and I move to -security? 17:27:30 ccneill: ah, neither pbr nor setuptools/wheel will make that easy for you 17:27:36 yeah :( 17:27:49 thought about package -> /usr/share/syntribos -> our folder maybe 17:27:52 sigmavirus we've got time, it's important for all our code-y projects. 17:28:11 but that intermediate step isn't always easy, since it might be /usr/share or /usr/local/share or /dev/null based on system.. 17:28:24 (not really /dev/null, but it does vary) 17:28:43 anyway, if we were to do repos, I was curious if that would be something that we would host under openstack? or outside it 17:29:04 so we were thinking like "syntribos-payloads", "syntribos-keystone-templates", "syntribos-neutron-templates", etc 17:29:17 that way we don't ship you 5000 files on install, and you pick the pieces you want 17:29:23 ccneill: that'd be inside openstack 17:29:33 ccneill: right, having another package makes sense 17:29:56 ccneill: maybe even separate packages for separate services? 17:30:05 Also the repo way has the advantage of updating the payloads whenever its necessary and giving a sub command to update the user local version as well. 17:30:32 sigmavirus: that's the idea, splitting it all up so that we don't ship stuff that general end-users aren't interested in 17:30:40 ccneill: why not build into syntribos teh ability to download these from a git repo? 17:30:41 or website 17:30:43 or whatever? 17:30:58 sigmavirus: yep, that's where we're headed at the moment 17:30:59 i.e., syntribos download-templates http://github.com/openstack/syntribos-nova-templates 17:31:02 I believe unrahul is working on it 17:31:14 ccneill: +1 yup just started. 17:31:23 that way you don't need to package the templates 17:31:25 just wanted to air the idea and see if anyone had other ideas, but I'm hearing that this sounds reasonable 17:31:34 ccneill: absolutely 17:31:38 cool cool 17:31:51 that said, for releasing syntribos, using openstack/releases is the best idea 17:32:04 ok, will definitely look into that 17:32:05 thanks 17:32:06 we already have bandit imported there for now 17:32:10 sweet 17:32:21 (so for our next bandit release we can use that) 17:32:33 so one other thing that we're probably going to be revamping soon is our request template language 17:32:41 how we doing on time? want me to carry this to -security? or keep going? 17:32:53 tmcpeak? hyakuhei ? 17:32:55 ccneill: I'd revamp that before you release if it's going to break anything 17:32:56 yeah, let's move to security 17:33:08 got a few more agenda items to cover 17:33:11 ok, sounds good. figured we were getting in the weeds a bit. but tl;dr: fun stuff on the way 17:33:16 good stuff 17:33:18 #topic OSSN 17:33:19 and if anyone wants to get involved, please reach out! :) 17:33:24 lhinds: you're up 17:33:59 ok, been out of action a little bit, but I have one to go out after this call (embargoed glance note) 17:34:15 and we have four more then, hyakuhei is also very close to having a final draft. 17:34:33 after that we have another three to get out (one new one came in iirc) 17:34:48 capnoday: you've been dying to write embargoed notes 17:34:50 I think I'm still waiting for an OK on one of the embargoed ones 17:35:01 tmcpeak i live for that! 17:35:05 boom 17:35:24 haha +1 17:36:04 hyakuhei: couple of notes from gmurphy_ and o-tony 17:36:08 its close though! 17:36:24 ok, so what do we need to do to get them all over teh line. 17:36:25 or maybe even ready if the nits are missing the point 17:36:34 Ah on mine, yeah 17:36:51 should have said comments rather then notes...yep 17:37:18 posting versions of the note on Launchpad kind of sucks 17:37:24 tmcpeak and dg___ have some to work on too :) 17:37:30 wonder if we want to get to subscribing people to our google doc 17:37:50 Yeah, so generally I get the note up to scratch and then post the final-ish draft 17:38:09 ^ what hyakuhei said 17:38:11 I had to go back and forth 5 or 6 times on one of them on Launchpad 17:38:25 but I am not against extending it into the cores / vmt's 17:38:25 welcome to openstack tmcpeak 17:38:52 well, I'm happy to forget about it for now 17:39:04 lol 17:39:13 shall we try google-docs on the next one, maybe the one just assigned to you tmcpeak 17:39:13 lhinds: anything else for notes? 17:39:19 A better process for these embagoed OSSN would be nice 17:39:19 lhinds: yep 17:39:25 the main thing is making sure we accept from valid emails 17:39:31 hyakuhei: yeah, especially given how many of them there are these days 17:39:33 but so would a better gerrit process for all bad vulns 17:39:50 It's a constant issue for the VMT 17:39:59 yep 17:40:10 allright, we've got to move on 17:40:16 i am done 17:40:19 sweet 17:40:21 #topic Blog 17:40:30 lhinds: you post your masterpiece yet? 17:40:33 tmcpeak: mypost can go out 17:40:44 Cool! lhinds you should be able to publish it yourself? 17:40:45 hyakuhei: can you add lhinds to the repo so he can merge his own stuff? 17:40:48 I just needed to check real life names are ok 17:40:56 hyakuhei: cool, will take a look 17:41:11 #topic Security Review 17:41:17 capnoday ? 17:41:20 I actually don't think we have anything new hee 17:41:21 *here 17:41:29 we met with Kolla last week but already discussed that last meeting 17:41:30 I think the babrican one wrapped? 17:41:37 yeah, think so 17:41:46 capnoday: you are now Security Review point person :) 17:41:47 yeah the big news is the barbican one got merged 17:41:50 weekly wrap up 17:41:56 Do we need to create issues from the barbican one ? 17:42:07 hyakuhei: yeah, I think we had at least one that I remember 17:42:16 that is probably a note/OSSA 17:42:19 is there a repo where these reviews are being collected? 17:42:26 there is.. 17:42:28 yup, capnoday got a linky ? 17:42:32 sigmavirus yes its the security-analysis repo 17:42:36 one sec and I'll dig out a link 17:42:42 openstack or on github? 17:42:45 openstack 17:42:48 capnoday: want to announce to ML about our completed Barbican review? 17:42:50 (sorry, I missed this in the past) 17:42:57 np sigmavirus 17:43:05 we should actually probably do a retro blog post on it too 17:43:25 tmcpeak yeah good idea, althugh shall we go through the list of findings first and see if we need to open tickets 17:43:32 yeah let's do that first 17:43:44 thanks capnoday 17:43:49 manila is interested in pursuing managed-vulnerability tag. I take it we should look at barbican review as example? 17:43:50 we also need to figure out where we are going to publish completed reviews 17:43:54 * tbarron may be confused 17:43:55 this might be one for sicarie 17:44:11 check with redrobot first but I think that's a great idea (publish on the ML) 17:44:37 tbarron yes barbican is a good example, we are currently writing a chapter for the security guide that describes it, once its published (or in review at least) I'll reach out 17:44:40 hyakuhei ML sounds good to me 17:45:12 capnoday: excellent, we'd like to make good progress on this front in ocata 17:45:18 Sounds like we could do a blog post around it too, what the experience was like, where we need to improve etc? 17:45:19 excellent 17:45:41 hyakuhei maybe work with redrobot on that? 17:45:55 yupyup 17:46:08 tbarron: we're happy to work with you to complete a security review 17:46:17 We have to scale up to get these done faster :) 17:46:24 hyakuhei: yeah 17:46:27 bust out the markov chains! 17:46:28 Learning slow is fine so long as we can apply it quickly 17:46:29 tmcpeak: great 17:46:33 :P 17:46:43 hyakuhei: +1 17:47:00 tbarron: probaly won't have time before the summit 17:47:04 want to get with us at the summit? 17:47:05 tmcpeak hyakuhei any thoguhts on publishing reviews? 17:47:11 we can get started 17:47:20 tmcpeak: me either? but yes, at the summit would be perfect. 17:47:28 capnoday: I'm pretty sure we should publish them 17:47:33 it would be nice if there was a way to view it in pretty markup like the security guide, rather than having to browse RST in the repo 17:47:35 seems like a lot of work to sit in a closet 17:47:37 s/?/:) 17:47:53 but without them being part of the security guide repo, or do we want to move them into there when they are completed? 17:47:53 tbarron: great, see you there 17:48:07 capnoday: emm, I have no idea 17:48:14 hahah ok 17:48:17 well have a think 17:48:21 yeah, would be awesome to have a nice pretty version 17:48:21 We can build RST ourselves with the relevant jobs or roll into the security docs stuff, whatever makes the most sense... 17:48:24 I'll talk to sicarie and see what he thinks 17:48:31 capnoday: +1 17:48:35 cool 17:48:47 speaking of sicarie, don't think we're going to have a sec guide update today 17:48:51 no sicarie, no elmiko 17:48:53 yeh hes afk 17:48:57 so… 17:49:00 i just spoke to him, RL 17:49:15 ok 17:49:17 #topic AOB 17:49:26 are we having a meeting next week? 17:49:37 we obviously aren't in Barcelona 17:49:44 I'm also gone the following week 17:49:57 I am around next week 17:50:11 is there something going on next week? 17:50:21 Traditionally we don't pre summit 17:50:22 no, just don't know if people are heading out early 17:50:24 I'm around too 17:50:30 hyakuhei: yea, that :) 17:50:32 ah ok. 17:50:35 I should be around I think 17:50:56 #vote Should we have a meeting next week? 17:51:12 Oh maybe I can't because I changed nick after I got chair 17:51:27 #vote Should we have a meeting next week? 17:51:34 nope, i cant 17:51:37 TBH I think we can skip it. Give people some breathing room before the summit 17:52:00 yeah, let's skip it 17:52:00 +1 17:52:10 ok cool. 17:52:19 allright, anything else? 17:52:19 I am ok with that 17:52:51 #endmeeting