| *** markvoelker has quit IRC | 00:03 | |
| *** ljfisher has quit IRC | 00:04 | |
| *** markvoelker has joined #openstack-security | 00:08 | |
| *** dave-mccowan has quit IRC | 00:33 | |
| *** dave-mccowan has joined #openstack-security | 00:50 | |
| *** bdpayne has quit IRC | 00:51 | |
| *** bpokorny has quit IRC | 01:07 | |
| *** dave-mccowan has quit IRC | 01:33 | |
| *** tkelsey has joined #openstack-security | 02:46 | |
| *** tkelsey has quit IRC | 02:50 | |
| *** bdpayne has joined #openstack-security | 03:05 | |
| *** bdpayne has quit IRC | 03:06 | |
| *** tmcpeak has quit IRC | 03:09 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/164081 | 06:06 |
|---|---|---|
| *** markvoelker has quit IRC | 06:11 | |
| *** markvoelker has joined #openstack-security | 06:12 | |
| *** markvoelker has quit IRC | 06:16 | |
| *** markvoelker has joined #openstack-security | 06:42 | |
| *** markvoelker has quit IRC | 06:47 | |
| *** browne has quit IRC | 06:57 | |
| *** tkelsey has joined #openstack-security | 07:17 | |
| *** jamielennox has quit IRC | 07:31 | |
| *** jamielennox has joined #openstack-security | 07:34 | |
| *** jamielennox has quit IRC | 07:39 | |
| *** markvoelker has joined #openstack-security | 07:43 | |
| *** markvoelker has quit IRC | 07:48 | |
| *** jamielennox|away has joined #openstack-security | 07:55 | |
| *** jamielennox|away is now known as jamielennox | 07:55 | |
| openstackgerrit | Merged openstack/security-doc: Imported Translations from Transifex https://review.openstack.org/164081 | 08:04 |
| *** openstackgerrit has quit IRC | 08:21 | |
| *** openstackgerrit has joined #openstack-security | 08:21 | |
| *** markvoelker has joined #openstack-security | 08:44 | |
| *** markvoelker has quit IRC | 08:48 | |
| *** tkelsey has quit IRC | 09:04 | |
| *** tkelsey has joined #openstack-security | 09:11 | |
| *** markvoelker has joined #openstack-security | 09:45 | |
| *** markvoelker has quit IRC | 09:49 | |
| *** tmcpeak has joined #openstack-security | 10:42 | |
| *** markvoelker has joined #openstack-security | 10:46 | |
| *** markvoelker has quit IRC | 10:50 | |
| *** jamielennox has quit IRC | 10:55 | |
| *** jamielennox|away has joined #openstack-security | 11:02 | |
| *** jamielennox|away is now known as jamielennox | 11:02 | |
| *** jamielennox has quit IRC | 11:14 | |
| *** jamielennox|away has joined #openstack-security | 11:24 | |
| *** jamielennox|away is now known as jamielennox | 11:24 | |
| *** dave-mccowan has joined #openstack-security | 11:32 | |
| *** markvoelker has joined #openstack-security | 11:46 | |
| *** markvoelker has quit IRC | 11:51 | |
| *** ljfisher has joined #openstack-security | 11:58 | |
| *** markvoelker has joined #openstack-security | 12:07 | |
| openstackgerrit | Merged stackforge/bandit: Update the config file, and use yaml.safe_load() https://review.openstack.org/163981 | 12:20 |
| *** bknudson has joined #openstack-security | 12:21 | |
| openstackgerrit | Merged stackforge/bandit: Wildcard injection requires a shell https://review.openstack.org/163991 | 12:25 |
| *** markvoelker has quit IRC | 13:16 | |
| *** markvoelker has joined #openstack-security | 13:17 | |
| *** ljfisher has quit IRC | 13:39 | |
| *** dave-mccowan has quit IRC | 13:42 | |
| openstackgerrit | Merged stackforge/bandit: Correct supported Python versions in setup.cfg https://review.openstack.org/164000 | 13:50 |
| *** ljfisher has joined #openstack-security | 13:51 | |
| *** singlethink has joined #openstack-security | 13:53 | |
| *** dave-mccowan has joined #openstack-security | 13:56 | |
| *** sicarie has joined #openstack-security | 14:08 | |
| *** voodookid has joined #openstack-security | 15:00 | |
| *** dwyde has joined #openstack-security | 15:05 | |
| *** bknudson has quit IRC | 15:13 | |
| *** browne has joined #openstack-security | 15:18 | |
| *** bpokorny has joined #openstack-security | 15:39 | |
| *** bknudson has joined #openstack-security | 15:45 | |
| *** browne has quit IRC | 16:11 | |
| elmiko | hey all, are there any guidelines for launchpad about when we should categorize security related bugs as private or public? | 16:13 |
| *** dwyde has quit IRC | 16:19 | |
| gmurphy | hmm.. not sure actually.. if it is security related as in it *could* be a vulnerability then click the private security tag to engage the vmt. then we figure out if something is a vulnerability or just security hardening etc. | 16:20 |
| gmurphy | but afaik that isn't written down anywhere.. | 16:21 |
| elmiko | gmurphy: so, if it's hardening would that be less weight towards making it private? | 16:23 |
| gmurphy | i think the general point of view is that we want to fix as much things as possible in the open. however if you are unsure if something could be a vulnerability feel free to engage the vmt first we don't bite. | 16:25 |
| elmiko | hehe, ok | 16:27 |
| gmurphy | elmiko: also it depends on the security support status of the project etc | 16:27 |
| elmiko | i marked it as public when i submitted, but i don't think it's major. | 16:27 |
| elmiko | this is for sahara | 16:27 |
| gmurphy | once public = always public | 16:27 |
| elmiko | k | 16:27 |
| gmurphy | if it is a vuln we can still issue an advisory | 16:28 |
| elmiko | like i said, this is minor (imo) but i was curious in general | 16:28 |
| gmurphy | yeah | 16:28 |
| gmurphy | it is probably something we need to have a clearer message about | 16:28 |
| elmiko | agreed | 16:28 |
| elmiko | thanks for the advice, gotta run | 16:28 |
| *** browne has joined #openstack-security | 17:07 | |
| *** dwyde has joined #openstack-security | 17:12 | |
| *** auraka has joined #openstack-security | 17:19 | |
| *** auraka has quit IRC | 17:25 | |
| *** bdpayne has joined #openstack-security | 17:31 | |
| openstackgerrit | David Wyde proposed stackforge/bandit: Remove Python 2.6 from setup.cfg https://review.openstack.org/164276 | 17:37 |
| *** tkelsey has quit IRC | 17:41 | |
| *** ljfisher has quit IRC | 19:13 | |
| openstackgerrit | Travis McPeak proposed stackforge/bandit: Tweaking severity for a couple of plugins https://review.openstack.org/164317 | 19:35 |
| openstackgerrit | Merged stackforge/bandit: Remove Python 2.6 from setup.cfg https://review.openstack.org/164276 | 19:36 |
| tmcpeak | dwyde: you around? | 19:40 |
| dwyde | tmcpeak: yep | 19:40 |
| tmcpeak | so for the shell injection plugin, we have an info now for subprocess call without a subshell | 19:41 |
| tmcpeak | what are we looking for there? | 19:41 |
| dwyde | hmm | 19:42 |
| dwyde | it often doesn’t matter, but i can cook up a stretch example or two | 19:43 |
| tmcpeak | the problem is there isn't any way to configure it, so shell injection will bundle that warning | 19:43 |
| tmcpeak | err info | 19:43 |
| dwyde | ah | 19:43 |
| tmcpeak | I'm going to chop it unless you object :) | 19:43 |
| dwyde | i don’t feel particularly strongly | 19:44 |
| tmcpeak | ok cool | 19:44 |
| tmcpeak | we can put it back later… Keystone is showing some results for that so until we can configure it properly we'll have to leave it out for now | 19:45 |
| dwyde | makes sense :-) | 19:45 |
| openstackgerrit | Travis McPeak proposed stackforge/bandit: Tweaking severity for a couple of plugins https://review.openstack.org/164317 | 19:45 |
| tmcpeak | cool, thank you | 19:45 |
| dwyde | for consistency, should it be removed from the injection_shell.py plugin? | 19:47 |
| dwyde | which I think is the only other place that config setting is used | 19:47 |
| tmcpeak | dwyde: what do you mean? | 19:51 |
| tmcpeak | that's where I removed it from, injection_shell :) | 19:51 |
| openstackgerrit | Travis McPeak proposed stackforge/bandit: Tweaking severity for a couple of plugins https://review.openstack.org/164317 | 19:51 |
| dwyde | tmcpeak: start_process_with_no_shell in that file | 19:51 |
| tmcpeak | dwyde: you mean just get rid of the whole no_shell thing? | 19:52 |
| tmcpeak | in bandit.yaml too? | 19:52 |
| tmcpeak | that one I don't have as much problem with because it is configurable | 19:52 |
| dwyde | ah, you mean they can disable it in a profile | 19:53 |
| tmcpeak | dwyde: yeah, as long as it is configurable, it's ok. Let people who want to run with everything cranked up do so, but can also be used for a sanity check in a gate | 19:54 |
| dwyde | gotcha | 19:55 |
| *** ljfisher has joined #openstack-security | 19:57 | |
| dwyde | tmcpeak: this may be overly picky, but then maybe it makes sense to make a separate function/plugin for subprocess with `shell != True`, for consistency | 19:58 |
| dwyde | not exactly a blocker though :-) | 19:58 |
| tmcpeak | dwyde: how come? | 19:59 |
| tmcpeak | oh, because they aren't related to shell injection? | 19:59 |
| dwyde | a separate @checks(‘Call’) function in that file | 20:00 |
| dwyde | so people can enable/disable as they please | 20:00 |
| dwyde | but if Bandit catches spawn* and exec*, maybe it should also catch subprocess non-shell calls | 20:00 |
| tmcpeak | couldn't we just add that to the "shell" section then? | 20:02 |
| tmcpeak | like add subprocess.Popen in there? | 20:02 |
| dwyde | then it gets flagged with ERROR, right? | 20:02 |
| dwyde | regardless of whether shell=True | 20:03 |
| tmcpeak | dwyde: yeah, you're right | 20:05 |
| tmcpeak | dwyde: isn't subprocess with shell != True fine though? | 20:05 |
| tmcpeak | I mean, sometimes you just gotta call subprocess, do it safely and such :) | 20:05 |
| dwyde | probably? maybe you’re calling a script that has a shell injection or some other vulnerability, though | 20:07 |
| dwyde | in my personal opinion, the three main ways to get hurt in Python are subprocesses, pickle, and eval/input | 20:07 |
| tmcpeak | dwyde: yeah, that's true.. how can we make it configurable though | 20:07 |
| dwyde | profile with exclude? | 20:07 |
| tmcpeak | but profiles only operate on a plugin level | 20:08 |
| tmcpeak | oh, you're saying move it out to a separate plugin? | 20:08 |
| tmcpeak | I'm ambivalent :) I'll approve it if you do the work :P | 20:09 |
| dwyde | tmcpeak: haha, okay | 20:09 |
| tmcpeak | ljfisher chair6: I need validation | 20:10 |
| tmcpeak | https://review.openstack.org/164317 | 20:10 |
| dwyde | i mean, the real work is in setting up a config profile for that project that doesn’t want to flag non-shell process calls | 20:10 |
| tmcpeak | tell me I'm doing a good job and everything will be ok, por favor | 20:11 |
| tmcpeak | dwyde: yeah, that's pretty easy and can be done once | 20:11 |
| tmcpeak | for Keystone I'm just creating an explicit "include" set, so that even if new things are added we don't change it up on them | 20:11 |
| dwyde | tmcpeak: oh, cool | 20:13 |
| ljfisher | tmcpeak: you can write a better commit message than that :) At least tell me why you are tweaking this so months from know we know what you were thinking. | 20:26 |
| tmcpeak | ljfisher: ok, fair enough | 20:26 |
| ljfisher | otherwise I think it is fine. you ran through all the tests I take it | 20:27 |
| openstackgerrit | David Wyde proposed stackforge/bandit: Make subprocess without `shell=True` into a plugin https://review.openstack.org/164339 | 20:28 |
| openstackgerrit | Travis McPeak proposed stackforge/bandit: Tweaking severity for a few plugins https://review.openstack.org/164317 | 20:28 |
| tmcpeak | ljfisher: done | 20:28 |
| tmcpeak | ljfisher: yeah | 20:28 |
| tmcpeak | dwyde: hang on, you'll have to rebase | 20:31 |
| tmcpeak | ljfisher: approves? | 20:31 |
| tmcpeak | chair6: approves? | 20:31 |
| ljfisher | so that tells me what but not why. The what can be conveyed by the code but the why is important and isn’t captured in the code. Like I can guess because I know what we have been doing. | 20:32 |
| ljfisher | does that make sense? | 20:32 |
| ljfisher | the why is in your head and we all know it is crazy in there :) | 20:32 |
| tmcpeak | ljfisher: fair enough | 20:32 |
| tmcpeak | one sec | 20:32 |
| ljfisher | so a sentence: Changing severity to reduce usless messages or remove noise or because it is inaccurate | 20:33 |
| ljfisher | you might scan https://wiki.openstack.org/wiki/GitCommitMessages sometime, because it helps everyone else know what is going on. | 20:34 |
| openstackgerrit | Travis McPeak proposed stackforge/bandit: Tweaking severity for a few plugins https://review.openstack.org/164317 | 20:34 |
| tmcpeak | ljfisher: you and your good practices, bring back tkelsey :) | 20:35 |
| tmcpeak | ljfisher: one more look please | 20:35 |
| ljfisher | ok, I’ll take that. | 20:35 |
| tmcpeak | ljfisher: say it with a +2 ;) | 20:37 |
| ljfisher | so pushy :) | 20:38 |
| ljfisher | I don’t know why you want tkelsey. I went through several revisions with him on stuff like this. | 20:38 |
| ljfisher | :) | 20:38 |
| tmcpeak | haha | 20:38 |
| tmcpeak | depends if he's feeling cheery | 20:38 |
| chair6 | i'm seeing 3 faililng tox tests.. | 20:40 |
| tmcpeak | wut? | 20:40 |
| ljfisher | so no more trusting tmcpeak | 20:40 |
| *** ljfisher has quit IRC | 20:40 | |
| tmcpeak | chair6: dammit, you're right | 20:40 |
| tmcpeak | forgot to install again | 20:40 |
| *** ljfisher has joined #openstack-security | 20:41 | |
| tmcpeak | this doesn't make sense, I haven't even touched wildcard injection | 20:41 |
| dwyde | the wildcard injection example includes shell injection | 20:42 |
| dwyde | my changes will fix your failures, I believe | 20:42 |
| *** ljfisher has quit IRC | 20:43 | |
| tmcpeak | allright, almost got it sorted | 20:44 |
| tmcpeak | right as ljfisher gave up | 20:44 |
| openstackgerrit | Travis McPeak proposed stackforge/bandit: Tweaking severity for a few plugins https://review.openstack.org/164317 | 20:45 |
| tmcpeak | chair6: allright | 20:45 |
| tmcpeak | fixed | 20:45 |
| tmcpeak | now dwyde will have to fix them back :\ | 20:46 |
| tmcpeak | this "python setup.py develop" thing tkelsey showed us was great until I learned it couldn't be trusted | 20:46 |
| tmcpeak | now I have to get back in the habit of doing a reinstall… every… single… time | 20:46 |
| tmcpeak | I should just set up a cronjob to 'python setup.py install' every 15 seconds from my current working directory and pipe output and stderr to /dev/null | 20:47 |
| dwyde | i thought about doing “python setup.py develop” and specifying a plugin directory in my config | 20:47 |
| dwyde | but the config keeps changing! | 20:47 |
| tmcpeak | dwyde: I got bit with a really really strange issue that took me 1+ hour and ukbelch chimed in and made me 'python setup.py install' and it all of a sudden worked | 20:48 |
| dwyde | tmcpeak: i know the feeling | 20:51 |
| tmcpeak | ok, now we need ljfisher back | 20:52 |
| tmcpeak | I guess I could just approve it myself, since nothing changed since he approved it other than it now passes tests | 20:52 |
| tmcpeak | is that janky? | 20:52 |
| dwyde | judge, jury, and executioner :-) | 20:54 |
| tmcpeak | haha, yeah | 20:55 |
| tmcpeak | allright, I'm just going to do it | 21:00 |
| tmcpeak | ljfisher meant to approve :) | 21:01 |
| tmcpeak | then we can get dwyde going | 21:01 |
| tmcpeak | allright dwyde: push away | 21:02 |
| *** dave-mccowan has quit IRC | 21:02 | |
| tmcpeak | I'll be back on later for approves and all that | 21:04 |
| tmcpeak | congratulations dwyde: it appears you might get the last patch for this version of Bandit | 21:04 |
| dwyde | tmcpeak: i feel so special :-) | 21:05 |
| tmcpeak | lol | 21:05 |
| tmcpeak | glad you've been making all these contributions, you're doing great work. Keep it up! | 21:06 |
| dwyde | thanks! i’ve been enjoying it | 21:07 |
| *** tkelsey has joined #openstack-security | 21:18 | |
| *** tkelsey has quit IRC | 21:22 | |
| *** singlethink has quit IRC | 21:27 | |
| *** singlethink has joined #openstack-security | 21:30 | |
| *** singlethink has quit IRC | 21:33 | |
| *** singlethink has joined #openstack-security | 21:33 | |
| *** bknudson has quit IRC | 21:35 | |
| *** bknudson has joined #openstack-security | 21:41 | |
| *** dave-mccowan has joined #openstack-security | 21:48 | |
| openstackgerrit | Doug Chivers proposed stackforge/anchor: Added a check for the use of the default user/secret. https://review.openstack.org/164353 | 21:56 |
| openstackgerrit | Doug Chivers proposed stackforge/anchor: Added a check for the use of the default user/secret https://review.openstack.org/164353 | 22:12 |
| openstackgerrit | Doug Chivers proposed stackforge/anchor: Added a check for the use of the default user/secret https://review.openstack.org/164353 | 22:22 |
| openstackgerrit | Merged stackforge/bandit: Tweaking severity for a few plugins https://review.openstack.org/164317 | 22:24 |
| openstackgerrit | David Wyde proposed stackforge/bandit: Make subprocess without `shell=True` into a plugin https://review.openstack.org/164339 | 22:24 |
| openstackgerrit | David Wyde proposed stackforge/bandit: Make subprocess without `shell=True` into a plugin https://review.openstack.org/164339 | 22:35 |
| *** dwyde has quit IRC | 22:41 | |
| *** singlethink has quit IRC | 22:45 | |
| openstackgerrit | Doug Chivers proposed stackforge/anchor: Removes CA Certificte and CRL signing from the default config. https://review.openstack.org/164366 | 22:46 |
| *** voodookid has quit IRC | 22:48 | |
| *** markvoelker has quit IRC | 22:56 | |
| *** browne has quit IRC | 23:03 | |
| *** sicarie has left #openstack-security | 23:07 | |
| *** tkelsey has joined #openstack-security | 23:19 | |
| *** tkelsey has quit IRC | 23:23 | |
| *** bdpayne has quit IRC | 23:41 | |
| *** bdpayne has joined #openstack-security | 23:41 | |
| *** dave-mccowan has quit IRC | 23:54 | |
| *** markvoelker has joined #openstack-security | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!