Fedora Security Team Meeting minutes for 2016-03-24

[Eric Christensen]

======================================================================================================
#fedora-meeting: Security Team Meeting - Agenda:
https://fedoraproject.org/wiki/Security_Team_meetings
======================================================================================================


Meeting started by Sparks at 14:05:20 UTC. The full logs are available
at
https://meetbot.fedoraproject.org/fedora-meeting/2016-03-24/fedora_securi...
.



Meeting summary
---------------
* Roll Call  (Sparks, 14:05:26)
  * Participants are reminded to make liberal use of #info #link #help
    in order to make the minutes "more better"  (Sparks, 14:10:54)

* Follow up on last week's tasks  (Sparks, 14:11:09)
  * ACTION: pjp to give a status update on security policy in the wiki
    (carried over)  (Sparks, 14:11:40)
  * ACTION: Sparks to figure out how FST members can get access to
    Fedora security bugs (carried over)  (Sparks, 14:11:49)
  * ACTION: pjp and d-caf to work on the feature requests for Koji and
    Bodhi for private builds for embargoed vulnerabilities.  (Sparks,
    14:12:08)
  * ACTION: zoglesby to take the Apprenticeship discussion to the list
    for further development  (Sparks, 14:13:31)

* Apprenticeship  (Sparks, 14:13:38)
  * LINK: https://fedoraproject.org/wiki/Security_Team_Apprenticeship
    (Sparks, 14:14:13)

* Handling embargoed vulnerabilities  (Sparks, 14:16:45)
  * The management in Red Hat Product Security is investigating our
    ability to work closer with them.  (Sparks, 14:18:02)

* Outstanding BZ Tickets  (Sparks, 14:23:24)
  * Thursday's numbers: Critical 0 (0), Important 67 (+13), Moderate 485
    (+11), Low 169 (-18), Total 721  (Sparks, 14:23:32)
  * ACTION: Sparks to contact gd to see if he is working on a patch for
    Fedora.  (Sparks, 14:29:21)

* Open floor discussion/questions/comments  (Sparks, 14:30:33)

Meeting ended at 14:33:47 UTC.




Action Items
------------
* pjp to give a status update on security policy in the wiki (carried
  over)
* Sparks to figure out how FST members can get access to Fedora security
  bugs (carried over)
* pjp and d-caf to work on the feature requests for Koji and Bodhi for
  private builds for embargoed vulnerabilities.
* zoglesby to take the Apprenticeship discussion to the list for further
  development
* Sparks to contact gd to see if he is working on a patch for Fedora.




Action Items, by person
-----------------------
* Sparks
  * Sparks to figure out how FST members can get access to Fedora
    security bugs (carried over)
  * Sparks to contact gd to see if he is working on a patch for Fedora.
* zoglesby
  * zoglesby to take the Apprenticeship discussion to the list for
    further development
* **UNASSIGNED**
  * pjp to give a status update on security policy in the wiki (carried
    over)
  * pjp and d-caf to work on the feature requests for Koji and Bodhi for
    private builds for embargoed vulnerabilities.




People Present (lines said)
---------------------------
* Sparks (63)
* zoglesby (18)
* linuxmodder (16)
* zodbot (7)
* Southern_Gentlem (1)


14:05:20 <Sparks> #startmeeting Security Team Meeting - Agenda:
https://fedoraproject.org/wiki/Security_Team_meetings
14:05:20 <zodbot> Meeting started Thu Mar 24 14:05:20 2016 UTC.  The
chair is Sparks. Information about MeetBot at
http://wiki.debian.org/MeetBot.
14:05:20 <zodbot> Useful Commands: #action #agreed #halp #info #idea
#link #topic.
14:05:20 <zodbot> The meeting name has been set to
'security_team_meeting_-_agenda:_https://fedoraproject.org/wiki/security_team_meetings'
14:05:21 <zoglesby> tick tock
14:05:23 <Sparks> #meetingname Fedora Security Team
14:05:23 <zodbot> The meeting name has been set to 'fedora_security_team'
14:05:26 <Sparks> #topic Roll Call
14:05:37 * Sparks
14:05:46 * zoglesby
14:06:39 * Sparks puts the final touches on the agenda for today
14:10:07 <Sparks> Okay, this promises to be a short meeting...
14:10:08 * linuxmodder
14:10:15 <zoglesby> not anymore
14:10:25 <linuxmodder> huh
14:10:43 <Sparks> Okay, lets get going
14:10:50 <linuxmodder> why not zoglesby
14:10:54 <Sparks> #info Participants are reminded to make liberal use of
#info #link #help in order to make the minutes "more better"
14:11:01 <Sparks> linuxmodder: Cause you're here
14:11:09 <Sparks> #topic Follow up on last week's tasks
14:11:12 <linuxmodder> what did dI do
14:11:23 * Sparks notes pjp is not here today and will just continue his
actions
14:11:40 <Sparks> #action pjp to give a status update on security policy
in the wiki (carried over)
14:11:49 <Sparks> #action Sparks to figure out how FST members can get
access to Fedora security bugs (carried over)
14:12:08 <Sparks> #action pjp and d-caf to work on the feature requests
for Koji and Bodhi for private builds for embargoed vulnerabilities.
14:12:24 <Sparks> zoglesby: Did you ever bring up the Apprenticeship on
the list?
14:13:09 <zoglesby> nope, forgot until your ping, please move that to
this week as well
14:13:31 <Sparks> #action zoglesby to take the Apprenticeship discussion
to the list for further development
14:13:38 <Sparks> #topic Apprenticeship
14:14:00 <Sparks> There are a few more links that need to be populated
on the Apprenticeship page
14:14:13 <Sparks> #link
https://fedoraproject.org/wiki/Security_Team_Apprenticeship
14:15:13 <Sparks> Anyone have any thing to discuss for this topic?
14:16:26 <zoglesby> nope, only that it needs done
14:16:32 <Sparks> Okay, moving on
14:16:45 <Sparks> #topic Handling embargoed vulnerabilities
14:18:02 <Sparks> #info The management in Red Hat Product Security is
investigating our ability to work closer with them.
14:18:16 <Sparks> I don't really have anything more than that.
14:18:29 * Sparks is waiting for pjp and d-caf to start their parts
14:18:43 <zoglesby> As in pre us doing what we need to or after we do
FAD items?
14:18:43 <Sparks> Anyone have anything else?
14:19:59 <Sparks> No, overall
14:21:17 <Sparks> It's annoying as everyone seems to have a different
idea of what we should have.
14:21:51 <zoglesby> well, if they have ideas they need to share them with us
14:21:51 <linuxmodder> what is the general concensus then
14:22:01 <Sparks> linuxmodder: There is none
14:22:14 <Sparks> zoglesby: I'm trying to figure out what ideas they
might have...
14:22:19 <zoglesby> tell them
fedora-security-team(a)lists.fedoraproject.org, not sparks(a)redhat.com
14:22:34 <Sparks> zoglesby: +1
14:23:01 <linuxmodder> noted
14:23:08 <Sparks> Okay, moving along...
14:23:24 <Sparks> #topic Outstanding BZ Tickets
14:23:24 <linuxmodder> but they  may think its gonna get  sparked off
with the late r:)
14:23:32 <Sparks> #info Thursday's numbers: Critical 0 (0), Important 67
(+13), Moderate 485 (+11), Low 169 (-18), Total 721
14:23:38 <Sparks> +Tickets by Severity-+-------+---------+
14:23:38 <Sparks> | Severity | Tickets | Owned | Unowned |
14:23:38 <Sparks> +----------+---------+-------+---------+
14:23:38 <Sparks> | medium   | 485     | 40    | 445     |
14:23:38 <Sparks> | low      | 169     | 13    | 156     |
14:23:40 <Sparks> | high     | 67      | 30    | 37      |
14:23:43 <Sparks> +----------+---------+-------+---------+
14:23:51 <Sparks> We appear to be letting these highs get away from us,
again...
14:24:07 <linuxmodder> where is that  new embargoed one  expected to
drop into?
14:24:39 <Sparks> linuxmodder: The samba one?
14:25:04 <linuxmodder> think so the one  we  were talkign loosely  about
yesterday  / early this am
14:25:11 <zoglesby> by the website it is a crit
14:25:16 <linuxmodder> with the  suspenseful teasers
14:25:23 <Sparks> Ummm.. I don't have it up at the moment.  Sometime in
April.
14:25:41 <zoglesby> april 12th
14:25:44 <Sparks> The 12th I think (patch Tuesday)
14:25:44 <linuxmodder> ick we were doing so  well on  no crits
14:26:12 <Sparks> linuxmodder: This may be already getting fixed for
Fedora; I'll need to check.
14:26:14 <linuxmodder> anywhere I might be  able to school up in in its
 current  embargoed state?  or  shadow  someone
14:26:29 <linuxmodder> get the feet wet  persay
14:26:30 <Sparks> But we'll have another race to the finish line when it
comes out.
14:26:59 <zoglesby> (I read it wrong, the website says it is a "crucial
security bug")
14:27:33 <Sparks> What's the CVE?
14:27:42 <Sparks> nevermind
14:27:49 <zoglesby> I don't remember
14:28:09 <zoglesby> CVE-2016-2118
14:28:14 <Sparks> It's rated as Important
14:28:21 <zoglesby> but I don't think its important for this meeting
14:28:41 <Sparks> .whoowns samba
14:28:41 <zodbot> Sparks: gd
14:28:50 <Sparks> .fasinfo gd
14:28:52 <zodbot> Sparks: User: gd, Name: Guenther Deschner, email:
gdeschner(a)redhat.com, Creation: 2007-05-03, IRC Nick: gd, Timezone:
Europe/Berlin, Locale: en, GPG key ID: 8EE11688, Status: active
14:28:55 <zodbot> Sparks: Approved Groups: fedorabugs cla_fedora
cla_done packager cla_redhat gitding-libs @gitgss-proxy
14:29:21 <Sparks> #action Sparks to contact gd to see if he is working
on a patch for Fedora.
14:29:45 <Sparks> Anything else?
14:30:02 <linuxmodder> nfm
14:30:24 <zoglesby> no
14:30:33 <Sparks> #topic Open floor discussion/questions/comments
14:30:44 <Sparks> Okay, anything from anyone about anything?
14:30:47 <zoglesby> I have nothing more for today
14:31:57 <Sparks> linuxmodder: ???
14:32:02 <Southern_Gentlem> Sparks study for your Extra at SELF
14:32:17 <Sparks> Southern_Gentlem: de WG3K
14:32:28 <linuxmodder> nothing from me
14:32:46 <zoglesby> Sparks: are you going to SELF?
14:32:48 * linuxmodder needs to study  for that period :)
14:32:59 <Sparks> I hadn't really considered going...  I could
14:33:05 <zoglesby> err, this is not meeting topic
14:33:32 <Sparks> Okay, let's move this discussion to #fedora-security-team
14:33:39 <Sparks> Southern_Gentlem: Please join us there!
14:33:43 <Sparks> Thanks all
14:33:47 <Sparks> #endmeeting