14:02:24 <lhinds> #startmeeting Security Group 17/08/16
14:02:24 <collabot> Meeting started Wed Aug 17 14:02:24 2016 UTC.  The chair is lhinds. Information about MeetBot at http://wiki.debian.org/MeetBot.
14:02:24 <collabot> Useful Commands: #action #agreed #help #info #idea #link #topic.
14:02:24 <collabot> The meeting name has been set to 'security_group_17_08_16'
14:02:33 <lhinds> let me just get a pad
14:03:32 <lhinds> ok, here we go:
14:03:34 <lhinds> https://etherpad.opnfv.org/p/opnfv-sec-meetings
14:03:39 <lhinds> #topic agenda
14:04:15 <lhinds> anyone wish to make any additions?
14:04:37 <aripie> OK by me
14:04:48 <sona> ok
14:05:20 <lhinds> #topic Security Scanning
14:05:55 <lhinds> that would be me, only thing new is we resolved an issue in Apex, which was making functests use of security scanning hang.
14:06:34 <lhinds> the second thing is we have moved functest over to using security scannings own repo now;
14:06:39 <lhinds> #link https://gerrit.opnfv.org/gerrit/#/c/18727/
14:06:40 <sona> good so functest run successfuly
14:06:49 <lhinds> sona: I think so / hope so
14:06:50 <lhinds> should be
14:06:52 <lhinds> :)
14:07:17 <sona> How can I check the result?
14:08:16 <lhinds> https://build.opnfv.org/ci/job/functest-apex-apex-daily-master-daily-master/
14:08:32 <lhinds> normally its under nosdn-nofeature
14:08:43 <lhinds> but functest fails a lot! so it often does not run
14:08:55 <lhinds> I think I will chat to apex again and maybe run it outside as well
14:09:43 <lhinds> ok badge program
14:09:49 <lhinds> #info badge
14:09:56 <lhinds> #undo
14:09:56 <collabot> Removing item from minutes: <MeetBot.ircmeeting.items.Info object at 0x2b57290>
14:10:05 <lhinds> #topic badge program
14:12:05 <sona> good  news about badge we have  achieved 100%
14:12:28 <sona> https://bestpractices.coreinfrastructure.org/projects?q=opnfv
14:13:28 <lhinds> yeay!
14:13:55 <lhinds> that will make heather happy
14:14:16 <sona> we need to do some work, spread this message to developers
14:14:35 <sona> make them aware of security best practices
14:15:14 <sona> Luke,  I didn't really follow all conversation in the meeting :)
14:15:19 <sona> what was decided?
14:15:47 <sona> we need to have some sort of check/kontroll so all projects follwo these best practices
14:15:49 <lhinds> looks like we are going to start auditing projects, and ashlee will help out and do the policing
14:15:53 <sona> how can we reach this?
14:16:09 <sona> ok good
14:16:51 <lhinds> I don't think we can make sure they follow, but we can start by pointing out what they are doing wrong, to pressure them into looking into security more.
14:17:11 <sona> agree
14:17:33 <sona> bu we need once in a while check criteria again and see they are true
14:18:11 <sona> how can we do this so we don't forget?
14:18:17 <lhinds> I guess we need to then go through the list and see what can be automated.
14:18:29 <lhinds> maybe add that to the etherpad discussion
14:18:30 <sona> good idea
14:19:26 <sona> I will create jira ticket
14:19:45 <sona> I will close all resolved jira issues related to the badge prigram
14:20:21 <lhinds> that would be good sona, give it a good clean up in there, as a lot is shown as open
14:21:23 <sona> yes I will do that
14:22:25 <lhinds> ok cool
14:22:45 <sona> What do you think that I should focus more now that we are almost done with badge program?
14:23:14 <lhinds> I think the audit work we have coming up will be interesting for you
14:23:15 <sona> whould we start with sec-guide or shall I get involved in Openscap/functest?
14:23:22 <sona> ok
14:23:34 <sona> I hope I can help
14:23:54 <lhinds> in fact...
14:24:01 <lhinds> #topic OPNFV Audit
14:24:06 <lhinds> #link https://etherpad.opnfv.org/p/sec-audit
14:24:44 <lhinds> so we will capture thoughts in the above, and put something to the TSC
14:25:11 <lhinds> I think you can help with testing a lot here Sona, as you will be able to run this easily on your laptop or a VM
14:25:35 <sona> ok, I can do that
14:25:37 <lhinds> doing security scan testing is a lot more inaccessable as you need an openstack cloud deployed by apex
14:25:55 <sona> I see
14:26:20 <lhinds> It might need a PTL as well, but we should see if Ash is interested as welll
14:27:37 <lhinds> that's it there for now. I will start playing with some code this week
14:27:54 <serverascode> what's the difference between sec-audit and the other projects?
14:28:10 <serverascode> the idea is that sec-audit is a separate project?
14:28:34 <lhinds> sec-audit looks at all of the opnfv projects and checks to make they are not using insecure artifacts
14:28:41 <lhinds> so yes, seperate project
14:29:20 <lhinds> we might also get it to a code / lint type scan, but package auditing is most import
14:29:49 <lhinds> so like using an OpenSSL version from six years ago that is full of heartbleed and like
14:30:19 <serverascode> ok, cool
14:31:42 <lhinds> which you're welcome to get involved in as well should you like
14:32:00 <lhinds> ok, i think that wraps it up?
14:32:09 <sona> yes
14:32:25 <lhinds> oh btw I am core on the openstack security group now as well, so I am doing a bit more there as well.
14:32:43 <sona> very good Luke
14:32:50 <lhinds> k..thanks all
14:32:52 <aripie> awesome
14:32:55 <sona> you can give us some update maybe
14:33:19 <sona> is there any info it would be good to share?
14:33:26 <lhinds> sure, I will keep you update
14:33:29 <lhinds> ..d
14:33:49 <lhinds> mainly geting out some backlogged security notes, so released this one last week https://wiki.openstack.org/wiki/OSSN/OSSN-0068
14:33:55 <sona> btw there is openstac summit in Stockholm, any one planning to attend?
14:34:08 <lhinds> is that next year?
14:34:25 <sona> next month
14:34:30 <sona> let me check
14:34:32 <lhinds> oh, like a local summit?
14:34:39 <lhinds> usergroup
14:34:55 <lhinds> I plan to be at Barcelona
14:35:15 <sona> http://openstacknordic.org/
14:35:24 <sona> yes, local summit
14:35:34 <serverascode> wish I could go, that'd be nice :)
14:35:36 <sona> I was hoping to see you here :)
14:35:38 <lhinds> ah ok, I won't be there myself
14:35:44 <serverascode> the openstack ops meetup is next week in nyc as well
14:35:59 <sona> ok
14:36:16 <lhinds> are you going serverascode ?
14:36:34 <serverascode> yeah I will be in NYC, and at the opnfv hackfest in TO next week
14:37:11 <serverascode> there will be some NFV sessions as the ops meetup but I'm not too sure how many ppl will be there
14:37:20 <serverascode> for the NFV sessions that is
14:37:25 <lhinds> oh cool, maybe you can do a little slot with some updates next week or after?
14:37:38 <serverascode> yeah for sure
14:38:00 <lhinds> sounds good, need to hash some actions
14:38:12 <lhinds> #sona close jira issues on badge program
14:38:16 <lhinds> derp!
14:38:23 <lhinds> #action sona close jira issues on badge program
14:38:43 <lhinds> #action serverascode to report back on openstack ops day, and hackfest
14:38:55 <lhinds> ok, i think we are done
14:38:57 <lhinds> thanks all!
14:39:05 <sona> thanks
14:39:09 <lhinds> unless any other business?
14:39:09 <serverascode> thanks
14:39:09 <aripie> thanks
14:39:30 <sona> bye all
14:39:33 <lhinds> #endmeeting