14:25:50 <c0mrad3> #startmeeting Security Team Meeting - Agenda: https://fedoraproject.org/wiki/Security_Team_meetings
14:25:50 <zodbot> Meeting started Thu Apr  7 14:25:50 2016 UTC.  The chair is c0mrad3. Information about MeetBot at http://wiki.debian.org/MeetBot.
14:25:50 <zodbot> Useful Commands: #action #agreed #halp #info #idea #link #topic.
14:25:50 <zodbot> The meeting name has been set to 'security_team_meeting_-_agenda:_https://fedoraproject.org/wiki/security_team_meetings'
14:26:25 <c0mrad3> #chair Astradeus
14:26:25 <zodbot> Current chairs: Astradeus c0mrad3
14:27:14 <Astradeus> i think we can skip roll call ;)
14:27:36 <Astradeus> #topic Follow up on last week's tasks
14:28:38 <c0mrad3> #meetingname Fedora Security Team
14:28:38 <zodbot> The meeting name has been set to 'fedora_security_team'
14:29:22 <Astradeus> neither of d-caf, Sparks, pjp or zoglesby are in the channel, so we do not have any updates from any tasks
14:30:18 <c0mrad3> yes I am not sure where to get the Outstanding BZ Tickets Astradeus
14:30:37 <Astradeus> ah, mhayden sent them out via email
14:30:57 <Astradeus> there is a script somewhere querying the bugzilla and compiling a report
14:32:03 <Astradeus> #link https://git.fedorahosted.org/cgit/fedora-security-team.git/tree/report_generator.py
14:32:03 <c0mrad3> Astradeus: let's hit the open floor and discuss something else
14:32:42 <Astradeus> lets do the numbers first
14:32:50 <c0mrad3> Astradeus: I will try running the script and post it here
14:32:57 <c0mrad3> ack
14:33:08 <Astradeus> #topic Outstanding BZ Tickets
14:33:22 <Astradeus> +Tickets by Severity-+-------+---------+
14:33:23 <Astradeus> | Severity | Tickets | Owned | Unowned |
14:33:23 <Astradeus> +----------+---------+-------+---------+
14:33:23 <Astradeus> | medium   | 495     | 40    | 455     |
14:33:23 <Astradeus> | low      | 167     | 13    | 154     |
14:33:25 <Astradeus> | high     | 73      | 29    | 44      |
14:33:27 <Astradeus> +----------+---------+-------+---------+
14:34:17 <c0mrad3> Astradeus: cool!
14:35:04 <c0mrad3> tickets are increasing since the last week
14:35:12 <Astradeus> c0mrad3: are you already on the mailinglist? you should have received the mail from mhayden.
14:35:52 <Astradeus> yes, medium and high have increased, and low tickets have decreased
14:35:53 <c0mrad3> Astradeus: just now looked at them it's like 43 min ago
14:38:17 <Astradeus> Critical 0 (0), Important 73 (+6), Moderate 495 (+10), Low 167 (-4), Total 735 (+12)
14:39:45 <Astradeus> i do have one ticket i probably can close this week without additional support, but I still hope the mentoring thing works out sometime this week :)
14:39:49 <Astradeus> next topic?
14:40:21 <c0mrad3> #topic Open floor discussion/questions/comments
14:40:53 <c0mrad3> Astradeus: did you contact your mentor on fixing your first bug ?
14:41:50 <Astradeus> no, we did not write this week - it also has been quite busy from my dayjob, so i did not have too much time myself.
14:43:09 <Astradeus> how about you?
14:43:29 <c0mrad3> me too did not email him I was attending a hackthon, I will email him after this meeting
14:43:58 <Astradeus> so busy too :)
14:44:57 <c0mrad3> Also need to read a lot of wiki and get used to the work cycle, and I have many doubts in my mind to clear
14:45:24 <Astradeus> any questions which might be quick to answer?
14:46:25 <c0mrad3> like what should we do if the vuln is fixed upstream in a newer version, should be package the newer one and send it as security update ?
14:47:17 <Astradeus> first contact the maintainer, usually the maintainer then builds a new update
14:47:36 <c0mrad3> what if they won't patch for the current version of the software ?
14:47:49 <Astradeus> it is sent as a regular update currently, because there ist no special treatment for security patches currently
14:48:16 <Astradeus> we give them some timeframe we wait for a response
14:48:55 <c0mrad3> so all we do is look for security bugs and make sure that the maintainer updates the new package without the vuln ?
14:49:04 <Astradeus> if there is no answer and the vulnerability is serious, people from the proven-packagers-group can also package software and push it to the mirrors
14:49:12 <Astradeus> primarily, yes
14:49:35 <c0mrad3> okay! any other things that we do ?
14:51:03 <Astradeus> currently thinking about ways how to push security patches faster through the mirrors
14:51:28 <c0mrad3> ack, let end the meeting
14:51:46 <Astradeus> as the fedora security team is still building up - how to establish trust
14:52:24 <Astradeus> because e.g. the redhat security people or the debian security people do get information way earlier (embargoed vulns)
14:52:48 <c0mrad3> yes I get it the vulns shouldn't be shown to every one
14:53:20 <Astradeus> so fedora could be faster to push patches if we have a group which is trusted to see embargoed vulns
14:53:55 <Astradeus> (at least for some time - i'm definitely on the side that vulns should be public after some reasonable timeframe)
14:54:18 <Astradeus> i think those two things are currently the main issues
14:54:31 <c0mrad3> only after they are fixed / updates are available
14:54:43 <c0mrad3> they should be made public
14:55:08 <Astradeus> ah, and maybe to try to be advisors for security questsions other fedora-groups might have
14:55:39 <Astradeus> *questions
14:56:07 <Astradeus> or questions regular fedora-users might have
14:56:09 <c0mrad3> #endmeeting