| *** shakamunyi has quit IRC | 01:02 | |
| *** bpokorny has quit IRC | 01:36 | |
| *** salv-orlando has quit IRC | 02:03 | |
| *** browne1 has quit IRC | 02:07 | |
| *** shakamunyi has joined #openstack-security | 02:09 | |
| *** tmcpeak has quit IRC | 02:34 | |
| *** markvoelker has quit IRC | 03:04 | |
| *** sdake_ has joined #openstack-security | 03:09 | |
| *** sdake has quit IRC | 03:13 | |
| *** sdake has joined #openstack-security | 03:36 | |
| *** browne has joined #openstack-security | 03:36 | |
| *** sdake_ has quit IRC | 03:39 | |
| *** markvoelker has joined #openstack-security | 04:04 | |
| *** markvoelker has quit IRC | 04:09 | |
| *** dave-mccowan has quit IRC | 04:24 | |
| *** onrul has joined #openstack-security | 04:57 | |
| *** markvoelker has joined #openstack-security | 05:05 | |
| *** markvoelker has quit IRC | 05:10 | |
| *** sdake has quit IRC | 05:20 | |
| *** sdake has joined #openstack-security | 05:24 | |
| *** sdake_ has joined #openstack-security | 05:26 | |
| *** sdake has quit IRC | 05:29 | |
| *** onrul has quit IRC | 05:40 | |
| *** salv-orlando has joined #openstack-security | 05:50 | |
| *** markvoelker has joined #openstack-security | 05:51 | |
| *** markvoelker has quit IRC | 05:56 | |
| *** sdake_ is now known as sdake | 06:10 | |
| *** markvoelker has joined #openstack-security | 06:52 | |
| *** markvoelker has quit IRC | 06:56 | |
| *** markvoelker has joined #openstack-security | 08:53 | |
| *** markvoelker has quit IRC | 08:58 | |
| *** markvoelker has joined #openstack-security | 09:54 | |
| *** markvoelker has quit IRC | 09:58 | |
| *** tmcpeak has joined #openstack-security | 10:21 | |
| *** markvoelker has joined #openstack-security | 10:55 | |
| *** markvoelker has quit IRC | 11:00 | |
| *** openstackgerrit has quit IRC | 11:52 | |
| *** openstackgerrit has joined #openstack-security | 11:52 | |
| *** markvoelker has joined #openstack-security | 11:56 | |
| *** markvoelker has quit IRC | 12:00 | |
| *** markvoelker has joined #openstack-security | 12:15 | |
| *** dave-mccowan has joined #openstack-security | 12:24 | |
| *** tmcpeak has quit IRC | 12:38 | |
| *** tmcpeak has joined #openstack-security | 13:03 | |
| *** nkinder has quit IRC | 13:14 | |
| *** singlethink has joined #openstack-security | 13:33 | |
| *** jamielennox is now known as jamielennox|away | 13:51 | |
| *** nkinder has joined #openstack-security | 14:08 | |
| *** tmcpeak has quit IRC | 14:17 | |
| *** tmcpeak has joined #openstack-security | 14:18 | |
| *** voodookid has joined #openstack-security | 14:28 | |
| *** dwyde has joined #openstack-security | 15:05 | |
| *** salv-orlando has quit IRC | 15:08 | |
| *** bpokorny has joined #openstack-security | 15:16 | |
| *** tmcpeak has quit IRC | 15:25 | |
| *** browne has quit IRC | 15:31 | |
| *** singlethink has quit IRC | 15:42 | |
| *** sdake has quit IRC | 15:44 | |
| *** sdake has joined #openstack-security | 15:44 | |
| *** tmcpeak has joined #openstack-security | 15:51 | |
| *** sicarie has joined #openstack-security | 15:58 | |
| openstackgerrit | Merged stackforge/bandit: Update the README file https://review.openstack.org/180641 | 16:05 |
|---|---|---|
| *** salv-orlando has joined #openstack-security | 16:09 | |
| *** salv-orlando has quit IRC | 16:12 | |
| *** browne has joined #openstack-security | 16:13 | |
| *** singlethink has joined #openstack-security | 16:15 | |
| *** dwyde has quit IRC | 16:28 | |
| *** shakamunyi has quit IRC | 16:29 | |
| tmcpeak | browne: I've managed to undo your move of README.md -> README.rst : | 16:42 |
| tmcpeak | :\ | 16:42 |
| browne | ha, ok, np | 16:42 |
| *** dwyde has joined #openstack-security | 16:49 | |
| *** bpokorny_ has joined #openstack-security | 16:51 | |
| *** sdake_ has joined #openstack-security | 16:52 | |
| *** bpokorny has quit IRC | 16:55 | |
| *** sdake has quit IRC | 16:56 | |
| *** fletcher has joined #openstack-security | 17:02 | |
| *** tkelsey has joined #openstack-security | 17:12 | |
| *** sdake has joined #openstack-security | 17:13 | |
| *** sdake_ has quit IRC | 17:17 | |
| *** fletcher has quit IRC | 17:22 | |
| *** anteaya has quit IRC | 17:45 | |
| *** Codeman655 has joined #openstack-security | 17:45 | |
| *** Codeman655 has quit IRC | 17:54 | |
| *** bpokorny has joined #openstack-security | 18:02 | |
| tmcpeak | nkinder: ping | 18:05 |
| nkinder | tmcpeak: hey hey | 18:05 |
| tmcpeak | hey there | 18:05 |
| tmcpeak | you get anywhere with that OSSN->RST? | 18:05 |
| *** bpokorny_ has quit IRC | 18:06 | |
| nkinder | tmcpeak: no. I need to push it up to github. Been swamped with regular work stuff + summit prep | 18:06 |
| nkinder | I will get it up there before the summit | 18:06 |
| tmcpeak | ahh ok cool | 18:06 |
| tmcpeak | gmurphy: ^ | 18:07 |
| *** sdake has quit IRC | 18:08 | |
| *** sdake has joined #openstack-security | 18:09 | |
| *** salv-orlando has joined #openstack-security | 18:23 | |
| *** salv-orlando has quit IRC | 18:27 | |
| *** tkelsey has quit IRC | 18:43 | |
| *** sdake_ has joined #openstack-security | 18:43 | |
| *** sdake has quit IRC | 18:47 | |
| tmcpeak | dstufft: around? | 18:57 |
| dstufft | tmcpeak: sup | 19:01 |
| tmcpeak | dstufft: curious about the state of PyPI security.. been reading a bit on signed packages and similar things | 19:02 |
| tmcpeak | some of this looks fairly old though | 19:02 |
| tmcpeak | dstufft: currently picking my way through this thread on TUF… https://mail.python.org/pipermail/distutils-sig/2013-September/022761.html and went through most of the PEP you contributed to for integration with TUF | 19:03 |
| dstufft | tmcpeak: the state is we rely entirely on HTTPS right now, though the state of pip is that if you're using a new enough pip you'll _only_ get stuff from PyPI not random hosts from around the world | 19:03 |
| tmcpeak | dstufft: ok, I also noticed that not many packages on PyPI are signed by the authors | 19:03 |
| dstufft | it's not really useful to gpg sign packages | 19:04 |
| dstufft | I mean, theortically some distros verify those signatures | 19:04 |
| dstufft | but pip doesn't nor does anything else that I'm aware of | 19:04 |
| dstufft | long term TUF is, I'm pretty sure, the answer | 19:04 |
| tmcpeak | dstufft: but if the packages are signed, we can do a gpg verification manually before we install them with PIP, right? | 19:04 |
| dstufft | but I haven't gotten around to doing that, I'm focusing more on replacing the horrible codebase that powers PyPI first | 19:05 |
| dstufft | tmcpeak: sure, if you can figure out what keys to trust anyways :) | 19:05 |
| dstufft | I don't really consider that a very useful thing though, because if it's not done automatically and it's not something we can require then it's not super useful | 19:06 |
| dstufft | 100 singed packages and 1 unsigned package and you're still hit | 19:06 |
| tmcpeak | dstufft: ah, ok… the reason I'm bringing this up is because I was picking at an idea of getting OpenStack components and dependencies signed, then having a list of the keys that should have signed them, then at least providing code to check those signatures | 19:06 |
| *** dwyde has quit IRC | 19:06 | |
| tmcpeak | dstufft: it just makes me exceedingly nervous that security of all of OpenStack is depending on the integrity of 250 bits of code, most of which aren't signed | 19:07 |
| *** dwyde has joined #openstack-security | 19:07 | |
| dstufft | tmcpeak: I mean, you can sign them. Some distros might use them but not much else will. Probably not many people will bother | 19:08 |
| tmcpeak | dstufft: yeah, at least having the option of checking signatures seems like it would be a benefit | 19:08 |
| tmcpeak | at least from where I stand | 19:09 |
| tmcpeak | giving people the option | 19:09 |
| tmcpeak | to validate if they want… I know most people will just "pip install -r all_the_things" and be done with it | 19:09 |
| tmcpeak | dstufft: you're right though, all it takes is one unsigned, and what does signed even mean if nobody is checking the quality of this stuff | 19:09 |
| dstufft | tmcpeak: Yea, well I mean fundamentally PyPI is never going to be more than "make sure you get the bits that the author uploaded", whether those bits are "safe" or "ok" is an exercise left to the reader | 19:11 |
| tmcpeak | dstufft: what's the deal with warehouse? | 19:11 |
| dstufft | tmcpeak: PyPI 2.0 | 19:12 |
| tmcpeak | dstufft: anything good to read there? is it solving any security problems? | 19:12 |
| *** sicarie has quit IRC | 19:13 | |
| dstufft | tmcpeak: PyPI legacy (aka what's running PyPI right now) was written in like... 2003, before the rise of things like web frameworks or unit testing, and it's mostly two 3000+ line files with spaghetti code and stuff wound all around. It was never designed to be a permanent thing. It was a proof of concept that never got replaced and has had various people of various skill levels indescminately adding things over time | 19:13 |
| dstufft | so Warehouse is "let's rewrite from scratch with modern components and practices" | 19:14 |
| tmcpeak | dstufft: I feel like I've heard this story before | 19:14 |
| dstufft | Right now warehouse isn't trying to do much of anything that PyPI itself doesn't do (other than have a sensible implementation) | 19:14 |
| tmcpeak | ahh ok cool | 19:15 |
| dstufft | the goal is to get warehouse to feature parity, then drop it in as a repalcement, deal with the fallout, then move forward on making improvements | 19:15 |
| tmcpeak | cool — did you guys get anywhere with PEP-0458? | 19:15 |
| dstufft | it's stalled, largely because it's a large block of work that needs someone familar with both cryptography/security and PyPI/pip to review it and implement it | 19:16 |
| dstufft | and I think the set of people who fit that is.. well me. | 19:17 |
| tmcpeak | dstufft: makes sense | 19:17 |
| tmcpeak | dstufft: any last words of advice regarding jumping headfirst into a quest to push OpenStack requirements to all be signed by their authors? | 19:17 |
| dstufft | tmcpeak: nothing that comes to mind! Happy to review anything you write or do for it though | 19:18 |
| tmcpeak | dstufft: awesome, thanks for your time! | 19:20 |
| gmurphy | https://review.openstack.org/#/c/181123/ | 19:21 |
| gmurphy | = security guidance -> ossa -> security.o.o | 19:21 |
| tmcpeak | gmurphy: sweet! | 19:21 |
| *** singlethink has quit IRC | 19:22 | |
| gmurphy | i think we should nit all the docs on this review and get things up to an ok standard in one go | 19:22 |
| *** bpokorny has quit IRC | 19:22 | |
| tmcpeak | cool, I'll take a pass | 19:22 |
| *** bpokorny has joined #openstack-security | 19:23 | |
| *** singlethink has joined #openstack-security | 19:34 | |
| *** tkelsey has joined #openstack-security | 19:38 | |
| tmcpeak | browne chair6 elmiko gmurphy nkinder tkelsey — you've been chosen (victimized) completely randomly (probably not) for your valuable input on this: https://review.openstack.org/#/c/181123/ | 19:40 |
| tmcpeak | please take a stab at reviewing… our goal is to make these developer friendly guidelines written in simple language. I know you're all busy, but please take the time to review a few | 19:41 |
| elmiko | tmcpeak: ack, i'll take a gander | 19:41 |
| tmcpeak | dave-mccowan, dstanek, dwyde, erw, jraim, redrobot, sdake, singethink, sweston, voodookid | 19:41 |
| tmcpeak | ^ | 19:41 |
| tmcpeak | more random victims ;) | 19:41 |
| elmiko | hehe | 19:41 |
| dstanek | tmcpeak: np | 19:42 |
| *** tkelsey has quit IRC | 19:42 | |
| voodookid | let me take a look | 19:42 |
| tmcpeak | elmiko, dstanek, voodookid: thanks! | 19:43 |
| tmcpeak | this one is the quintessential good example: https://review.openstack.org/#/c/181123/1/doc/source/guidelines/dg_avoid-shell-true.rst | 19:46 |
| tmcpeak | we'd like them in that voice, casual, etc | 19:46 |
| voodookid | how would you like the comments to be made? Within gerrit? | 19:52 |
| *** singleth_ has joined #openstack-security | 20:00 | |
| *** salv-orlando has joined #openstack-security | 20:01 | |
| *** bpokorny_ has joined #openstack-security | 20:02 | |
| *** singlethink has quit IRC | 20:03 | |
| *** bpokorny_ has quit IRC | 20:03 | |
| *** bpokorny_ has joined #openstack-security | 20:04 | |
| *** bpokorny has quit IRC | 20:06 | |
| *** bknudson has joined #openstack-security | 20:09 | |
| *** salv-orlando has quit IRC | 20:16 | |
| *** sdake_ has quit IRC | 20:29 | |
| gmurphy | so i think initially we should just do this via review comments for the current patchset. | 20:46 |
| elmiko | gmurphy: +1 | 20:47 |
| gmurphy | then we can figure out how to split it up or i can just address all the suggestions. | 20:47 |
| elmiko | it is a large patch to review. lots of reading, i wonder if it would be more efficient to review them as individual docs? | 20:48 |
| gmurphy | hmm could be. | 20:49 |
| elmiko | i dunno, just my first reaction as i'm starting to read these. | 20:49 |
| gmurphy | maybe i should abandon change. | 20:49 |
| elmiko | some of them seem like they would be accepted with little compaint | 20:50 |
| elmiko | *complaint | 20:50 |
| gmurphy | hmmm. | 20:52 |
| elmiko | tmcpeak: any thoughts on this ^^ | 20:53 |
| elmiko | gmurphy: don't rush to abandon just yet. let's see what others think. i may be alone in this. | 20:53 |
| gmurphy | no i agree it would probably make things easier. | 20:54 |
| gmurphy | i guess i could drop all the ones that got comments from the next patch set and push them up separately for individual review | 20:55 |
| gmurphy | bah | 20:55 |
| gmurphy | i dunno! | 20:56 |
| gmurphy | tmcpeak: thoughts? | 20:56 |
| elmiko | yea, given the call to review and the number of comments it might be best to just charge ahead at this point | 20:57 |
| elmiko | call it a learned lesson for next time ;) | 20:57 |
| *** browne has quit IRC | 20:58 | |
| tmcpeak | back | 21:00 |
| tmcpeak | gmurphy, elmiko: yeah, let's charge ahead | 21:00 |
| tmcpeak | probably easier to get one review through than a bunch | 21:01 |
| elmiko | fair | 21:01 |
| tmcpeak | gmurphy, elmiko: so where did we get to? we'll just push ahead? | 21:01 |
| elmiko | tmcpeak: i think so | 21:02 |
| tmcpeak | cool | 21:02 |
| elmiko | especially given all the comments that are rolling in | 21:02 |
| tmcpeak | yep, ok sounds good | 21:02 |
| *** bpokorny has joined #openstack-security | 21:02 | |
| *** bpokorny_ has quit IRC | 21:05 | |
| *** sdake has joined #openstack-security | 21:08 | |
| gmurphy | also fwiw you can also check the html output -> http://docs-draft.openstack.org/23/181123/1/check/gate-ossa-docs/64ee953/doc/build/html/ | 21:10 |
| *** sdake_ has joined #openstack-security | 21:11 | |
| *** sdake has quit IRC | 21:15 | |
| elmiko | gmurphy: nice, thanks | 21:28 |
| *** sdake_ is now known as sdake | 21:30 | |
| *** sdake_ has joined #openstack-security | 21:54 | |
| *** sdake has quit IRC | 21:58 | |
| *** browne has joined #openstack-security | 22:16 | |
| *** nkinder has quit IRC | 22:18 | |
| *** sdake has joined #openstack-security | 22:22 | |
| *** salv-orlando has joined #openstack-security | 22:25 | |
| *** sdake_ has quit IRC | 22:25 | |
| *** dwyde has quit IRC | 22:30 | |
| *** salv-orlando has quit IRC | 22:31 | |
| *** sdake has quit IRC | 22:51 | |
| *** sdake has joined #openstack-security | 22:53 | |
| *** singleth_ has quit IRC | 22:56 | |
| *** voodookid has quit IRC | 23:07 | |
| *** markvoelker has quit IRC | 23:26 | |
| *** nkinder has joined #openstack-security | 23:34 | |
| *** onrul has joined #openstack-security | 23:38 | |
| *** tkelsey has joined #openstack-security | 23:39 | |
| *** tkelsey has quit IRC | 23:43 | |
| *** markvoelker has joined #openstack-security | 23:56 | |
| *** markvoelker has quit IRC | 23:57 | |
| *** markvoelker has joined #openstack-security | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!