| tmcpeak1 | nkinder chair6: you guys around? | 00:30 |
|---|---|---|
| nkinder | tmcpeak1: yep, but about to go pick up my kids | 00:30 |
| nkinder | tmcpeak1: what's up? | 00:30 |
| tmcpeak1 | wondering about the apache license | 00:30 |
| tmcpeak1 | any downside? | 00:30 |
| nkinder | tmcpeak1: nah, it's the same license as the rest of OpenStack | 00:30 |
| tmcpeak1 | nkinder: ok cool, thank you | 00:31 |
| nkinder | tmcpeak1: that should make approval easier, given you're allowed to contribute to OpenStack itself. | 00:31 |
| nkinder | tmcpeak1: anything else quick before I run? | 00:31 |
| nkinder | tmcpeak1: congrats on your first code patch to glance by the way! | 00:31 |
| tmcpeak1 | nkinder: nope, go for it | 00:32 |
| tmcpeak1 | nkinder: thank you | 00:32 |
| tmcpeak1 | nkinder: thanks! | 00:32 |
| openstackgerrit | A change was merged to openstack/security-doc: Add link to management security domain to security guide https://review.openstack.org/108851 | 00:35 |
| openstackgerrit | A change was merged to openstack/security-doc: Cleaning up grammer and wording, avoiding 2nd person https://review.openstack.org/108855 | 00:35 |
| openstackgerrit | A change was merged to openstack/security-doc: Smoothing awkward sentence structure around incident response https://review.openstack.org/108883 | 00:35 |
| *** bdpayne has quit IRC | 00:45 | |
| *** jhoan has joined #openstack-security | 01:35 | |
| *** jhoan has left #openstack-security | 01:49 | |
| *** tmcpeak1 has quit IRC | 01:53 | |
| *** tmcpeak has joined #openstack-security | 01:54 | |
| *** tmcpeak has quit IRC | 01:58 | |
| *** tmcpeak has joined #openstack-security | 02:44 | |
| *** tmcpeak1 has joined #openstack-security | 02:56 | |
| *** tmcpeak has quit IRC | 03:00 | |
| *** tmcpeak1 has quit IRC | 03:01 | |
| *** tmcpeak has joined #openstack-security | 03:19 | |
| *** bdpayne has joined #openstack-security | 03:41 | |
| *** tmcpeak has quit IRC | 04:24 | |
| *** tmcpeak has joined #openstack-security | 04:25 | |
| *** tmcpeak has quit IRC | 04:29 | |
| *** bdpayne has quit IRC | 04:37 | |
| *** bdpayne has joined #openstack-security | 04:54 | |
| *** voodookid has joined #openstack-security | 05:47 | |
| *** bdpayne has quit IRC | 05:54 | |
| openstackgerrit | OpenStack Proposal Bot proposed a change to openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/109191 | 06:04 |
| *** voodookid has quit IRC | 06:17 | |
| *** bdpayne has joined #openstack-security | 06:25 | |
| *** bdpayne has quit IRC | 08:26 | |
| *** marzif has joined #openstack-security | 11:34 | |
| *** nkinder has quit IRC | 13:13 | |
| *** bknudson has joined #openstack-security | 13:53 | |
| *** nkinder has joined #openstack-security | 13:58 | |
| *** tmcpeak has joined #openstack-security | 14:06 | |
| *** paulmo has joined #openstack-security | 14:25 | |
| *** voodookid has joined #openstack-security | 14:27 | |
| *** voodookid has quit IRC | 14:41 | |
| *** bdpayne has joined #openstack-security | 14:42 | |
| *** bdpayne has quit IRC | 14:44 | |
| *** paulmo1 has joined #openstack-security | 15:01 | |
| *** voodookid has joined #openstack-security | 15:02 | |
| *** paulmo has quit IRC | 15:03 | |
| *** bdpayne has joined #openstack-security | 15:59 | |
| *** bdpayne has quit IRC | 16:03 | |
| *** paulmo1 has quit IRC | 16:05 | |
| *** paulmo has joined #openstack-security | 16:06 | |
| *** bdpayne has joined #openstack-security | 16:21 | |
| *** mxin_ has joined #openstack-security | 16:21 | |
| *** bdpayne has quit IRC | 16:33 | |
| *** sicarie has joined #openstack-security | 16:38 | |
| *** tmcpeak has quit IRC | 16:43 | |
| *** tmcpeak has joined #openstack-security | 16:45 | |
| tmcpeak | I may be a bit of a noop today at the meeting, have a demo running simultaneously that I actually have to present for at some point | 16:57 |
| nkinder | tmcpeak: blasphemy! ;) | 16:58 |
| tmcpeak | nkinder: lol | 16:58 |
| *** bdpayne has joined #openstack-security | 17:00 | |
| *** marzif has quit IRC | 17:12 | |
| openstackgerrit | A change was merged to openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/109191 | 17:13 |
| *** Priti has joined #openstack-security | 17:15 | |
| *** tmcpeak has quit IRC | 17:49 | |
| *** tmcpeak has joined #openstack-security | 17:50 | |
| *** tmcpeak has quit IRC | 18:00 | |
| *** sicarie has quit IRC | 18:00 | |
| *** sicarie has joined #openstack-security | 18:07 | |
| *** Priti has quit IRC | 19:18 | |
| *** tmcpeak has joined #openstack-security | 19:19 | |
| tmcpeak | any of you fine folks going to OpenStack birthday in SF and/or security meetup the day after? | 19:24 |
| *** tmcpeak1 has joined #openstack-security | 19:41 | |
| *** tmcpeak has quit IRC | 19:41 | |
| *** AndChat|673521 has joined #openstack-security | 20:10 | |
| nkinder | tmcpeak1: what day is it on? | 20:24 |
| bdpayne | nkinder do you know if the oslo bug in the vuln spreadsheet was found via bandit? | 20:32 |
| nkinder | bdpayne: I think it was the hacking/pep8 checks, not bandit | 20:33 |
| tmcpeak1 | nkinder: the birthday is Wednesday | 20:33 |
| bdpayne | ahh | 20:33 |
| bdpayne | is that code available for me to run? | 20:33 |
| tmcpeak1 | nkinder: http://www.meetup.com/openstack/events/190061812/?rv=mr1 | 20:33 |
| nkinder | bdpayne: hyakuhei's cleantox repo in github has it | 20:34 |
| tmcpeak1 | bdpayne: the spreadsheet vulns were found with pep8 checks | 20:34 |
| bdpayne | ok | 20:34 |
| tmcpeak1 | bdpayne: cleantox is the source of truth for those checks | 20:34 |
| nkinder | tmcpeak1: I'm going to be on vacation on wednesday (coming back thursday) | 20:35 |
| bdpayne | also, it says openstack common, but doesn't reference the project name | 20:35 |
| bdpayne | there are serveral oslo repos | 20:35 |
| tmcpeak1 | nkinder: damn, ok, well hopefully you can be at the security meetup? | 20:35 |
| tmcpeak1 | oh | 20:35 |
| nkinder | bdpayne: oslo.common I'm guessing? Not sure | 20:35 |
| bdpayne | no such thing | 20:35 |
| tmcpeak1 | bdpayne: I believe it may be incubator | 20:36 |
| nkinder | bdpayne: yeah, I guess I'm thinking of the common stuff that's sync'd from various oslo repos (incubator most likely) | 20:36 |
| nkinder | bdpayne: I was off working on bandit when those scans were done | 20:36 |
| tmcpeak1 | bdpayne: I did the oslo one | 20:36 |
| tmcpeak1 | bdpayne: guess I forgot to mention the repo | 20:36 |
| bdpayne | heh | 20:36 |
| bdpayne | no worries, you're telling me now :-) | 20:37 |
| tmcpeak1 | :D | 20:37 |
| bdpayne | tmcpeak1 so what's the nicest way to run this | 20:40 |
| tmcpeak1 | tox -epep8 | 20:40 |
| tmcpeak1 | actually I think you can just do tox | 20:40 |
| tmcpeak1 | bdpayne: ^ | 20:40 |
| bdpayne | I assume I need to configure it to point at the oslo code? | 20:40 |
| tmcpeak1 | bdpayne: we took the rest of the stuff out of the tox.ini, so 'tox' should do it for you | 20:40 |
| tmcpeak1 | bdpayne: yes, so there is some script in there, that will grab code from github repos | 20:41 |
| tmcpeak1 | 'get_source.sh' | 20:41 |
| tmcpeak1 | but you can just run your own git clone | 20:41 |
| bdpayne | gotcha | 20:41 |
| bdpayne | that script doesn't get osla | 20:41 |
| tmcpeak1 | key is that the code is a subdir of the cleantox dir | 20:41 |
| bdpayne | oslo | 20:41 |
| tmcpeak1 | right, you'll have to modify it or just do your own git clone | 20:42 |
| bdpayne | ok, just making sure I wasn't missing something | 20:42 |
| bdpayne | just trying to repo your steps | 20:42 |
| tmcpeak1 | bdpayne: nope, we started with those and then added more projects later | 20:42 |
| sicarie | tmcpeak1 Does it really have a problem with python-pbr v0.7? | 20:42 |
| tmcpeak1 | in fact, to take out the noise don't run that script if you're only looking at oslo | 20:43 |
| tmcpeak1 | sicarie: I'm not sure, what's the context? | 20:43 |
| tmcpeak1 | sicarie: is it giving you a PEP error for it? | 20:43 |
| sicarie | yes | 20:43 |
| bdpayne | (1000's of lines of error messages) | 20:43 |
| tmcpeak1 | bdpayne: lol | 20:43 |
| tmcpeak1 | bdpayne: rm all the dirs that aren't oslo and run it | 20:44 |
| tmcpeak1 | shouldn't be all that bad | 20:44 |
| sicarie | Downloading/unpacking pbr>=0.6,!=0.7,<1.0 (from -r /home/ndillon/bin/git/cleantox/requirements.txt (line 1)) | 20:44 |
| tmcpeak1 | we have suppressed most of the style checks | 20:44 |
| bdpayne | ah, so that helped ;-) | 20:44 |
| bdpayne | I forgot I had a virtualenv in there | 20:44 |
| bdpayne | heh | 20:44 |
| tmcpeak1 | sicarie: hmmm, not sure | 20:44 |
| tmcpeak1 | sicarie: that was probably just copied over from whichever project we stole this tox environment from | 20:45 |
| sicarie | Could not find any downloads that satisfy the requirement pbr>=0.6,!=0.7,<1.0 (from -r /home/ndillon/bin/git/cleantox/requirements.txt (line 1)) | 20:45 |
| sicarie | Yeah, that's why I was wondering ifi I could just edit requirements.txt to remove !=0.7 | 20:45 |
| sicarie | Or if that was in there for a reason and would break something | 20:45 |
| tmcpeak1 | sicarie: you could try it :) | 20:45 |
| tmcpeak1 | sicarie: my venv is using .8 and it seems to be working fine | 20:46 |
| sicarie | Hmmm, .8 wasn't in my repo, looks like I get to find new repos | 20:46 |
| sicarie | tmcpeak1 thanks! | 20:46 |
| tmcpeak1 | sicarie: sure, let me know how it goes | 20:46 |
| *** AndChat|673521 has quit IRC | 20:59 | |
| openstackgerrit | KATO Tomoyuki proposed a change to openstack/security-doc: Use the right name and add the glossterm. https://review.openstack.org/108645 | 21:49 |
| *** voodookid has quit IRC | 22:03 | |
| *** nkinder has quit IRC | 22:13 | |
| *** nkinder has joined #openstack-security | 22:26 | |
| *** paulmo has quit IRC | 22:35 | |
| *** mxin_ has quit IRC | 22:51 | |
| openstackgerrit | Mike Lange proposed a change to openstack/security-doc: Added sections 1.2 and 1.3 https://review.openstack.org/108570 | 22:52 |
| tmcpeak1 | how do you guys read this ugly S.O.B? | 22:54 |
| tmcpeak1 | user_and_pass = ({ | 22:54 |
| tmcpeak1 | ' --password=%(password)s -u %(user)s ' | 22:54 |
| tmcpeak1 | '2>/tmp/mysqldump.log' % | 22:54 |
| tmcpeak1 | 'user': ADMIN_USER_NAME}) | 22:54 |
| tmcpeak1 | 22:54 | |
| tmcpeak1 | my thought is that it's setting a string where two parameters should be getting passed | 22:54 |
| tmcpeak1 | password and user | 22:54 |
| tmcpeak1 | or is it setting a dictionary because of the curly brace | 22:55 |
| tmcpeak1 | but the first ':' I see is in the last line | 22:55 |
| tmcpeak1 | so the last part is pretty self-explanatory | 22:56 |
| tmcpeak1 | 'user': ADMIN_USER_NAME}) | 22:57 |
| tmcpeak1 | sets a dictionary item 'user' to ADMIN_USER_NAME | 22:57 |
| chair6 | it's using %-based string formatting with named parameters | 22:57 |
| tmcpeak1 | shouldn't there be 2 though? | 22:57 |
| tmcpeak1 | where's password | 22:57 |
| chair6 | i don't know :) | 22:58 |
| tmcpeak1 | or is password just implicit somehow | 22:58 |
| chair6 | yeah, looks weird | 22:58 |
| tmcpeak1 | ugly ugly | 22:58 |
| *** bdpayne_ has joined #openstack-security | 22:58 | |
| chair6 | i don't think that should execute | 22:59 |
| tmcpeak1 | chair6: ok cool, as long as I'm not the only one | 23:00 |
| tmcpeak1 | yeah, it doesn't look right | 23:00 |
| chair6 | seventh:~ finnigaj$ python | 23:00 |
| chair6 | Python 2.7.8 (default, Jul 13 2014, 17:11:32) | 23:00 |
| chair6 | [GCC 4.2.1 Compatible Apple LLVM 5.1 (clang-503.0.40)] on darwin | 23:00 |
| chair6 | Type "help", "copyright", "credits" or "license" for more information. | 23:00 |
| chair6 | >>> user_and_pass = ({' --password=%(password)s -u %(user)s 2>/tmp/mysqldump.log' % 'user': ADMIN_USER_NAME}) | 23:00 |
| chair6 | Traceback (most recent call last): File "<stdin>", line 1, in <module> | 23:00 |
| chair6 | NameError: name 'ADMIN_USER_NAME' is not defined | 23:01 |
| chair6 | >>> ADMIN_USER_NAME='adminuser' | 23:01 |
| chair6 | >>> user_and_pass = ({' --password=%(password)s -u %(user)s 2>/tmp/mysqldump.log' % 'user': ADMIN_USER_NAME}) | 23:01 |
| chair6 | Traceback (most recent call last): File "<stdin>", line 1, in <module> | 23:01 |
| chair6 | TypeError: format requires a mapping | 23:01 |
| chair6 | looks broken to me.. | 23:01 |
| tmcpeak1 | yeah! | 23:01 |
| tmcpeak1 | chair6: awesome | 23:01 |
| *** nkinder has quit IRC | 23:01 | |
| tmcpeak1 | ok, so this might just be a flat out bug in addition to security flaw | 23:01 |
| *** bdpayne has quit IRC | 23:02 | |
| chair6 | tweaked it a little... | 23:02 |
| chair6 | >>> user_and_pass = (' --password=%(password)s -u %(user)s 2>/tmp/mysqldump.log' % {'user': ADMIN_USER_NAME, 'password':'secret'}) | 23:02 |
| chair6 | >>> user_and_pass | 23:02 |
| chair6 | ' --password=secret -u adminuser 2>/tmp/mysqldump.log' | 23:02 |
| chair6 | ^ that's more like what i'd expect to see.. | 23:02 |
| tmcpeak1 | chair6: yeah, that I would understand | 23:03 |
| tmcpeak1 | chair6: was just wondering if there was some nifty (disgusting) Python trick where you could recreationally leave off the format string params | 23:03 |
| tmcpeak1 | chair6: maybe I better double check the source to see if that's actually in there | 23:04 |
| tmcpeak1 | chair6: maybe I fell asleep on the keyboard somehow | 23:04 |
| tmcpeak1 | chair6: yeah keyboard robbers strike again | 23:07 |
| tmcpeak1 | here is the actual code | 23:07 |
| tmcpeak1 | user_and_pass = ( | 23:07 |
| tmcpeak1 | ' --password=%(password)s -u %(user)s ' | 23:07 |
| tmcpeak1 | '2>/tmp/mysqldump.log' % | 23:07 |
| tmcpeak1 | {'password': get_auth_password(), | 23:07 |
| tmcpeak1 | 'user': ADMIN_USER_NAME}) | 23:07 |
| tmcpeak1 | which is fine :) | 23:07 |
| tmcpeak1 | false alarm | 23:08 |
| tmcpeak1 | I'm starting to accumulate unnecessary stress by leaving the code open in IDE while I'm apparently screwing around with other stuff | 23:08 |
| chair6 | haha, that looks better :) | 23:10 |
| tmcpeak1 | ok, two possible venues for shell injection on this trove/backup strategy | 23:29 |
| tmcpeak1 | double the possibility for good times! | 23:30 |
| *** sicarie has quit IRC | 23:40 | |
| *** jhoan has joined #openstack-security | 23:44 | |
| *** jhoan has left #openstack-security | 23:44 | |
| tmcpeak1 | anybody know where all the config files are for devstack? | 23:46 |
| tmcpeak1 | I guess maybe it's per project | 23:49 |
| tmcpeak1 | in /etc it seems | 23:50 |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!