9:47 a.m.
======================================================================================================
#fedora-meeting: Security Team Meeting - Agenda:
https://fedoraproject.org/wiki/Security_Team_meetings
======================================================================================================
Meeting started by Sparks at 14:00:43 UTC. The full logs are available
at
http://meetbot.fedoraproject.org/fedora-meeting/2015-04-02/fedora_securit...
.
Meeting summary
---------------
* Roll Call (Sparks, 14:00:49)
* Participants are reminded to make liberal use of #info #link #help
in order to make the minutes "more better" (Sparks, 14:09:21)
* Outstanding BZ Tickets (Sparks, 14:09:29)
* Thursday's numbers: Critical 1, Important 48 (+2), Moderate 379
(+3), Low 170 (+7), Total 598, Trend +12 (Sparks, 14:09:39)
* Current tickets owned: 169 (~28%) (Sparks, 14:09:45)
* Tickets closed: 249 (+2) (Sparks, 14:09:49)
* LINK: http://ronin-ruby.github.io/blog/2013/01/28/new-rails-poc.html
(bvincent, 14:13:36)
* ACTION: jsmith to patch rubygem-activesupport as provenpackager (BZ
905374) (Sparks, 14:17:32)
* ACTION: pjp to start non-responsive maintainer against
rubygem-activesupport in EPEL6 (Sparks, 14:20:20)
* ACTION: Team Goal: All important CVEs from 2014 and before should be
fixed by the end of June. (Sparks, 14:25:01)
* ACTION: Sparks to talk about the team goal to the list. (Sparks,
14:25:15)
* ACTION: Sparks to complete the tickets of packages removed from EPEL
earlier this year. (Sparks, 14:25:36)
* Open floor discussion/questions/comments (Sparks, 14:27:58)
Meeting ended at 14:39:39 UTC.
Action Items
------------
* jsmith to patch rubygem-activesupport as provenpackager (BZ 905374)
* pjp to start non-responsive maintainer against rubygem-activesupport
in EPEL6
* Team Goal: All important CVEs from 2014 and before should be fixed by
the end of June.
* Sparks to talk about the team goal to the list.
* Sparks to complete the tickets of packages removed from EPEL earlier
this year.
Action Items, by person
-----------------------
* jsmith
* jsmith to patch rubygem-activesupport as provenpackager (BZ 905374)
* pjp
* pjp to start non-responsive maintainer against rubygem-activesupport
in EPEL6
* Sparks
* Sparks to talk about the team goal to the list.
* Sparks to complete the tickets of packages removed from EPEL earlier
this year.
* **UNASSIGNED**
* Team Goal: All important CVEs from 2014 and before should be fixed
by the end of June.
People Present (lines said)
---------------------------
* Sparks (42)
* pjp (17)
* bvincent (6)
* zodbot (5)
* striker (5)
* jsmith (4)
12:05 p.m.
New subject: Making Fedora more secure, a 90-day goal.
On Thursday, April 02, 2015 10:47:59 AM Eric Christensen wrote:
* Team Goal: All important CVEs from 2014 and before should be
fixed
by the end of June.
During today's meeting we talked about the number of open CVEs, as normal.
But, really, it's annoying to see the number of critical and important bugs
just sitting there not getting any traction.
Right now there is one critical CVE and 46 important CVEs open against either
a package in Fedora or EPEL. These are CVEs that should have been addressed
long ago and I'm, quite frankly, tired of looking at them.
With your help, I won't have to look at them ever again. During today's
meeting we set a goal of closing out all important CVEs (Jared is already
working on the critical CVE) that are circa 2014 and earlier by the end of
June. That means we have three months to figure out 38 CVEs[0].
It won't be easy but it's completely doable.
To help encourage FST members to participate, the top three FST members who
help close these bugs will get a prize of some sort. Heck, we might be able
to do something for everyone involved if we get all the critical and important
CVEs disposed of by the end of June.
Now lets go get serious about this! Game on!
[0] http://red.ht/1ELtwA5
--Eric
2:22 p.m.
New subject: Making Fedora more secure, a 90-day goal.
On Thursday, April 02, 2015 01:05:32 PM Eric Christensen wrote:
Right now there is one critical CVE and 46 important CVEs open
against
either a package in Fedora or EPEL. These are CVEs that should have been
addressed long ago and I'm, quite frankly, tired of looking at them.
Just looked at the numbers after the weekend hoping I'd see some movement.
Here's what I found:
Of the 38 important CVEs opened in 2014 or prior that I identified last
Thursday as still being open one was closed, five are On_QA, and the rest don't
really look like they've been touched in a while, with a few exceptions.
All the cases are "owned" but it looks like most haven't been followed up on
in a while. If you want to participate in this "contest" but don't see a
way
in here's what I suggest: if a case hasn't been followed up on in the past
month TAKE IT! This includes the ones I touched today but don't "own".
Let's
crush these bugs and make Fedora better!
-- Eric
--------------------------------------------------
Eric "Sparks" Christensen
Red Hat, Inc - Product Security
sparks(a)redhat.com - sparks(a)fedoraproject.org
097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1
--------------------------------------------------
2:27 p.m.
New subject: Making Fedora more secure, a 90-day goal.
On 04/06/2015 03:22 PM, Eric Christensen wrote:
On Thursday, April 02, 2015 01:05:32 PM Eric Christensen wrote:
> Right now there is one critical CVE and 46 important CVEs open against
> either a package in Fedora or EPEL. These are CVEs that should have been
> addressed long ago and I'm, quite frankly, tired of looking at them.
Just looked at the numbers after the weekend hoping I'd see some movement.
Here's what I found:
Of the 38 important CVEs opened in 2014 or prior that I identified last
Thursday as still being open one was closed, five are On_QA, and the rest don't
really look like they've been touched in a while, with a few exceptions.
All the cases are "owned" but it looks like most haven't been followed up
on
in a while. If you want to participate in this "contest" but don't see a
way
in here's what I suggest: if a case hasn't been followed up on in the past
month TAKE IT! This includes the ones I touched today but don't "own".
Let's
crush these bugs and make Fedora better!
-- Eric
Hi Eric,
I noticed you commented on a couple of my tickets, I just wanted to let
you know there was some followup outside of the ticket system as well.
This often occurred when i found I got no response from the ticket
updates (and started sending emails directly).
That doesn't mean that went anywhere either, but just want to make sure
it's clear that more activity may be happening off ticket as well.
Another questions. What is the ultimate goal of this ticket push? Are
we trying to get patches and updates no matter what or are we going to
settle for somethings going to the orphaned queue?
Would prefer to have everything get a patch and update then go to orphan
queue myself, but that's more work.
Thanks,
David
2:45 p.m.
New subject: Making Fedora more secure, a 90-day goal.
On Monday, April 06, 2015 03:27:03 PM David Cafaro wrote:
Another questions. What is the ultimate goal of this ticket push?
Are
we trying to get patches and updates no matter what or are we going to
settle for somethings going to the orphaned queue?
Well, this might be a good way to see how many packages in Fedora are actually
supported. It would be great if this was just a reminder to those package
maintainers that something is pending for one of their packages. I suspect
we'll end up with more non-responsive packagers before it's all over with.
This will either mean the package gets pulled or someone else will step up to
maintain the package.
Would prefer to have everything get a patch and update then go to
orphan
queue myself, but that's more work.
Yeah, that's a lot more work. Probably a better outcome but... I don't know.
-- Eric
--------------------------------------------------
Eric "Sparks" Christensen
Red Hat, Inc - Product Security
sparks(a)redhat.com - sparks(a)fedoraproject.org
097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1
--------------------------------------------------
2:46 p.m.
New subject: Making Fedora more secure, a 90-day goal.
On Monday, April 06, 2015 03:27:03 PM David Cafaro wrote:
I noticed you commented on a couple of my tickets, I just wanted to
let
you know there was some followup outside of the ticket system as well.
This often occurred when i found I got no response from the ticket
updates (and started sending emails directly).
Okay, and this is fine. However, when you have these conversations outside of
the ticketing system it's likely a good idea to summarize any outcome from
that conversation in BZ as a matter of record. That way everyone stays
informed.
-- Eric
--------------------------------------------------
Eric "Sparks" Christensen
Red Hat, Inc - Product Security
sparks(a)redhat.com - sparks(a)fedoraproject.org
097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1
--------------------------------------------------
3:05 p.m.
New subject: Making Fedora more secure, a 90-day goal.
On 04/06/2015 03:46 PM, Eric Christensen wrote:
On Monday, April 06, 2015 03:27:03 PM David Cafaro wrote:
> I noticed you commented on a couple of my tickets, I just wanted to let
> you know there was some followup outside of the ticket system as well.
> This often occurred when i found I got no response from the ticket
> updates (and started sending emails directly).
Okay, and this is fine. However, when you have these conversations
outside of
the ticketing system it's likely a good idea to summarize any
outcome
from
that conversation in BZ as a matter of record. That way everyone
stays
informed.
-- Eric
I'm fine with that, though sometimes it may just be as simple as
"Reached out to maintainer via email" and "unable to assist".
The actual responses are sometimes a little more, uhm, less helpful,
like, "I'm to busy right now, can you do it". I'm not sure it's
appropriate to add that to the ticket. That goes down the path of
public shaming, which I have mixed feelings about.
-David
3307
days inactive
3311
days old
security-team@lists.fedoraproject.org
6 comments
3 participants
participants (3)
-
David Cafaro -
Eric Christensen -
Eric Christensen