17:00:15 #startmeeting Security 17:00:16 Meeting started Thu Feb 9 17:00:15 2017 UTC and is due to finish in 60 minutes. The chair is hyakuhei. Information about MeetBot at http://wiki.debian.org/MeetBot. 17:00:17 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 17:00:19 The meeting name has been set to 'security' 17:00:20 o/ 17:00:25 o/ 17:00:36 o/ 17:00:44 o/ 17:00:51 0/ 17:01:09 o/ 17:01:46 o/ 17:01:55 Hey guys :D 17:02:08 I've been back to back all day, I'll just update the agenda now 17:02:18 oh wait 17:02:23 Someone else did it. 17:02:26 OMG. 17:02:31 The agenda fairy 17:02:38 :D 17:02:44 I'm assuming that's sigmavirus ? 17:02:53 #link https://etherpad.openstack.org/p/security-agenda 17:03:03 Yes that was 17:03:12 ty 17:03:16 ty sir! 17:03:23 great 17:03:34 ok, so lhinds passed his apologies for not being able to make it today 17:03:37 Just one item 17:04:39 Added a couple but lets start with OSSN 17:04:42 #topic OSSN 17:05:02 A couple of embargoed OSSN will go out this week, I think they've already gone to the pre-notify people 17:05:17 There's a public OSSN that needs an owner: https://bugs.launchpad.net/ossn/+bug/1606495 17:05:17 Launchpad bug 1606495 in OpenStack Security Notes "copy_from in api v1 allows network port scan" [Undecided,New] - Assigned to Travis McPeak (travis-mcpeak) 17:05:52 tmcpeak say's he is fine with it 17:06:50 Ok, no one wants it. That's ok I'll un-assign it for now 17:07:11 sigmavirus did you add the other one? 17:08:19 I did 17:08:35 It was more of a "Should we have an OSSN about this given that it's in the public now?" 17:08:52 Oh I see 17:08:57 I tend towards not, because it's a problem that's disregarded across openstack (drivers disabling TLS verification) 17:09:33 sigmavirus: if not, is that in the driver documentation (or service documentation)? 17:09:35 Interesting. If that is the case then we should probably still have an OSSN but regarding TLS being disabled in many services. 17:09:45 +1 17:10:15 sicarie: it's not. And I only have that opinion because I tried to fight this battle in glance's glance-store project before 17:10:34 then I'm of the opinion we should have an OSSN 17:11:11 I'm inclined to agree 17:12:26 sigmavirus thoughts? 17:12:42 I'm always in favor of telling people their software is doing silly things 17:13:03 I think it would be valuable if we gave driver authors some common patterns to use though for dealing with this 17:13:23 i.e., drivers should be able to handle client certificates, certificate authority pem paths, and toggling verification 17:13:48 That's an ideal though, and I don't know how many of those drivers use requests, but those are all things they'd just need to pass into requests 17:14:06 For socket level stuff, I can also provide some documentation around doing it correctly there too 17:14:10 But that's a separate concern 17:14:13 It gets messy when there's so many different implementations 17:14:16 So IMO that should be sec-guide material, specific drivers disabling TLS in a service should be an OSSN 17:14:22 +1 17:14:35 agreed 17:14:41 I meant that should all be in addition to the OSSN 17:14:42 Though it would be nice if the OSSN could point to the relevant info in the sec guide. 17:14:50 Because too many driver authors don't know any of this 17:15:03 +1 hyakuhei I'll see what I can do 17:16:45 sigmavirus: Are you still working on Glance Project? 17:16:58 michaelxin: for certain quantities of "work" 17:17:10 Just like I still work on this project 17:17:17 And the 4 others I'm assigned to work on 17:17:51 sheesh 17:18:37 ok, so we're agreed 17:18:46 Next up, security docs 17:18:52 #topic Security Guide 17:18:59 We had a productive conversation last week 17:19:14 My key concern is still that we need other teams to be more involved. 17:19:43 I was considering sending out a plea to the mailing list, which I might still do, however, I wondered if we should try to coordinate this with something at the PTG too 17:21:00 Hmm, no thoughts on that, ok, well I'll wait for the PTG then. 17:21:03 We the OSIC ppl would be contributing to the sec guide from now on as we discussed last week, we have initiated talks with the docs PTL and she has given us some pointers on things were we can contribute , around 26 bugs for now .. 17:21:10 michaelxin: ^ 17:21:17 Oh excellent 17:21:27 I'd still like project teams to be more involved 17:21:40 hyakuhei: agreed .. 17:21:45 we finished our priority planning for next cycle. I put helping security guide into it. OSCI is ok with it. 17:21:54 Excellent! 17:22:11 michaelxin: +1 17:22:30 +1 17:22:33 ok cool, lets move swiftly on :) 17:22:45 #topic Barbican SimpleCryptoThingy 17:22:50 #link https://review.openstack.org/#/c/431228/2/specs/pike/enhance-simple-crypto.rst 17:22:58 Crypto monkies, Attack! 17:23:08 That is to say, please give this a thoughtful review. 17:23:14 I've put a cautious -1 on there at the moment 17:23:26 @dave-mccowan fyi ^^^ 17:23:56 hyakuhei thanks! please, all, provide input early in Pike, so we have time to implement. :-) 17:24:19 Cool, you all heard the man, have at it! 17:24:52 We're doing well time wise, lets move to AOB 17:24:56 #topic Any Other Business 17:25:20 I won't be available for a meeting next week because of the way my travel has fallen regarding the PTG 17:25:31 Are others happy to take it or should we postpone? 17:25:43 oh and a reminder to keep this up to date 17:25:45 #link https://etherpad.openstack.org/p/ptg-security-team 17:26:10 sicarie did you get auth to go ? 17:26:20 I got time, but not funding 17:26:24 so I will not be attending 17:26:56 :( 17:27:07 +1 17:27:20 booo, sorry to hear that sicarie 17:27:27 ok, anything else to discuss? 17:28:21 hyakuhei: We are working on glance testing from this week had a very productive meeting with the glance PTL.. nothing as of yet on bugs, will keep you all posted. 17:28:33 Also we have one more person who joined our team 17:28:35 aasthad: 17:29:01 welcome aasthad! 17:29:20 Hello everyone .. I am happy to be a part of osic security team.. 17:29:20 hyakuhei: calling back to your question, if people want to have the meeting, I'm happy to chair it 17:29:37 Thanks sigmavirus might as well see what happen then :) 17:29:47 ok that's time people! Thanks everyone, thanks sigmavirus for your help! 17:29:51 #endmeeting