14:01:10 <Sparks> #startmeeting Security Team Meeting - Agenda: https://fedoraproject.org/wiki/Security_Team_meetings
14:01:10 <zodbot> Meeting started Thu Apr 14 14:01:10 2016 UTC.  The chair is Sparks. Information about MeetBot at http://wiki.debian.org/MeetBot.
14:01:10 <zodbot> Useful Commands: #action #agreed #halp #info #idea #link #topic.
14:01:10 <zodbot> The meeting name has been set to 'security_team_meeting_-_agenda:_https://fedoraproject.org/wiki/security_team_meetings'
14:01:13 <Sparks> #meetingname Fedora Security Team
14:01:13 <zodbot> The meeting name has been set to 'fedora_security_team'
14:01:16 <Sparks> #topic Roll Call\
14:01:35 <linuxmodder> .hellomynameis corey84
14:01:36 <zodbot> linuxmodder: corey84 'Corey Sheldon' <sheldon.corey@gmail.com>
14:01:58 <linuxmodder> mattdm,  you here with us  today?
14:03:17 <Southern_Gentlem> .hello jbwillia
14:03:17 <zodbot> Southern_Gentlem: jbwillia 'Ben Williams' <vaioof@yahoo.com>
14:03:30 * zoglesby 
14:03:52 <linuxmodder> c0mrad3,   said he'd be  absent
14:05:39 <Sparks> Okay, lets get started
14:05:46 <Sparks> #info Participants are reminded to make liberal use of #info #link #help in order to make the minutes "more better"
14:06:04 <Sparks> #chair zoglesby Southern_Gentlem linuxmodder
14:06:04 <zodbot> Current chairs: Southern_Gentlem Sparks linuxmodder zoglesby
14:06:29 <Sparks> #topic Follow up on last week's tasks
14:06:47 <Sparks> #action  pjp to give a status update on security policy in the wiki (carried over)
14:06:59 <Sparks> #action Sparks to figure out how FST members can get access to Fedora security bugs (carried over)
14:07:10 <Sparks> #action pjp and d-caf to work on the feature requests for Koji and Bodhi for private builds for embargoed vulnerabilities. (carried over)
14:07:35 <Sparks> zoglesby: I have down here that you were supposed to take the Apprenticeship discussion to the list.
14:07:51 <Sparks> zoglesby: I believe you did this...  Was there an outcome?
14:10:06 <zoglesby> no
14:10:16 <zoglesby> it was taken to the list, I would like to think people are reading docs
14:10:42 <Sparks> ha!
14:11:02 <mhayden> i read through it after i saw it on the list -- i think we had talked about taking the big list and breaking it into maturity levels
14:11:08 <Sparks> #topic Apprenticeship
14:11:17 <Sparks> #link https://lists.fedoraproject.org/archives/list/security-team@lists.fedoraproject.org/thread/NCCG4ZFQ4IWA62OV4FVAIOMJQPE6Y7NR/
14:11:19 <mhayden> so that people would know which content they ought to review based on their maturity level in information security
14:11:38 <zoglesby> that is the plan
14:11:44 <zoglesby> just need to execute on it
14:11:46 <Sparks> I see no responses to the email...
14:12:39 <Sparks> zoglesby: What are next steps?
14:12:48 <linuxmodder> I have had little time this  week to  do anything on it
14:12:50 <linuxmodder> :(
14:12:58 <Sparks> ditto
14:13:26 <zoglesby> Read and respond to what you think is good for first level
14:13:48 <linuxmodder> on that note for open floor  I'd  request a  review of a  blog post  for  WP / likely the  commblog as well on badlock
14:13:54 <mhayden> i wonder if we could do our next meeting via videoconference and just work through it there
14:14:03 <mhayden> we could tag each one and then sort them when the call is over
14:14:27 <Sparks> mhayden: I'm not against that
14:14:43 <mhayden> perhaps a google hangout?
14:14:55 <zoglesby> I *should* be able to do that as well
14:15:09 <linuxmodder> I'd be  cool with that
14:15:11 <Sparks> mhayden: I'll let you take the lead on that.
14:15:18 <mhayden> we could get the discussion done real-time and one person could share their screen
14:15:36 <mhayden> Sparks: sure -- i'll send a meeting invitation to the list
14:15:44 <Sparks> #agreed Next week's meeting will be held via video-teleconference to work through the Apprentice training
14:16:13 <mhayden> any objections if i just send a google calendar invitation directly to the list?
14:16:52 <linuxmodder> nfm
14:17:08 <Sparks> mhayden: Might want to follow up to the invite with exactly what we're trying to do if it isn't clear from the invite.
14:17:35 <mhayden> agreed
14:17:57 <mhayden> #action mhayden to send an invitation for a VC meeting next week with detailed agenda for reviewing security docs in the wiki
14:18:18 <mhayden> zoglesby++
14:18:18 <zodbot> mhayden: Karma for zoglesby changed to 3 (for the f23 release cycle):  https://badges.fedoraproject.org/tags/cookie/any
14:18:26 <linuxmodder> #help -- review of  post  for  personal /  commblog  http://fpaste.org/355375/
14:18:27 <mhayden> thanks for keeping this thing going
14:18:46 <Sparks> #topic Handling embargoed vulnerabilities
14:18:58 <Sparks> Neither pjp or d-caf are here to talk about this.
14:19:06 <zoglesby> :
14:19:09 <zoglesby> :(
14:19:15 <Sparks> #action Sparks to follow up with pjp and d-caf on this project.
14:19:25 <linuxmodder> on that  with this weeks  unembargoed ^^ badlock  planned  post on that  link
14:19:26 <Sparks> #info pjp and d-caf were supposed to be working with Koji and Bodhi folks to figure out private builds (carried over)
14:19:39 <Sparks> #topic Outstanding BZ Tickets
14:19:45 <Sparks> #info Thursday's numbers: Critical 0 (0), Important 72 (-1), Moderate 510 (+15), Low 169 (+2), Total 751 (+16)
14:19:58 <Sparks> +Tickets by Severity-+-------+---------+
14:19:58 <Sparks> | Severity | Tickets | Owned | Unowned |
14:19:58 <Sparks> +----------+---------+-------+---------+
14:19:58 <Sparks> | medium   | 510     | 40    | 470     |
14:19:58 <Sparks> | low      | 169     | 13    | 156     |
14:20:00 <Sparks> | high     | 72      | 29    | 43      |
14:20:03 <Sparks> +----------+---------+-------+---------+
14:20:18 <Sparks> Anyone have anything to discuss ticket-wise?
14:20:48 <linuxmodder> I should have  cycles to tackle  a few this week but not  on any active tickets
14:21:40 <Sparks> #topic Open floor discussion/questions/comments
14:21:45 <Sparks> Anyone have anything?
14:22:11 <linuxmodder> had some  interest  at  bitcamp for  security  member  joins  working on follow ups
14:22:37 <linuxmodder> #link http://fpaste.org/355375/  <  proposed badlock  post  for planet
14:22:42 <linuxmodder> nffm
14:22:43 <Sparks> linuxmodder: I'm sure that would have made better sense had there not been a shortage of punctuation.
14:23:16 <linuxmodder> Sparks,  following up with some  attendees at  bitcamp that  showed interest
14:23:37 <Sparks> linuxmodder: I'm sure that even if you were in a SCIF you likely heard about Badlock
14:23:51 <linuxmodder> lol
14:23:54 <zoglesby> also it is now in the main repo
14:23:55 <zoglesby> https://bodhi.fedoraproject.org/updates/FEDORA-2016-be53260726
14:24:11 <Sparks> gd++
14:24:11 <zodbot> Sparks: Karma for gd changed to 1 (for the f23 release cycle):  https://badges.fedoraproject.org/tags/cookie/any
14:24:23 <linuxmodder> noted
14:24:35 <Sparks> #info gd got the patches out for Fedora fairly quickly for Samba
14:24:41 <linuxmodder> that was from yesterday    before that   dropped will update
14:25:14 <linuxmodder> any other issues  /comments  are welcome
14:25:14 <Sparks> It's important to note that Badlock was not a critical bug.
14:25:46 <linuxmodder> it was only Important  correct
14:25:50 <Sparks> ...in spite of all the hype
14:25:52 <Sparks> correct
14:26:12 <linuxmodder> critical has the  criterion of  active  0day no?
14:26:49 <Sparks> linuxmodder: Not necessarily.  It has to be remotely exploitable, I think.
14:27:19 <Sparks> #link https://access.redhat.com/security/updates/classification/
14:27:21 <linuxmodder> remote with  no user interact  seems logical
14:27:35 <Sparks> #info Critical Impact - This rating is given to flaws that could be easily exploited by a remote unauthenticated attacker and lead to system compromise (arbitrary code execution) without requiring user interaction. These are the types of vulnerabilities that can be exploited by worms. Flaws that require an authenticated remote user, a local user, or an unlikely configuration are not classed as Critical impact.
14:28:37 <linuxmodder> the fact  badlock required  auth users  saved it from that
14:29:07 <linuxmodder> any other mods  from the post  before I publish it ?
14:29:07 <Sparks> I don't think the dust has settled completely on this vuln.
14:29:15 <linuxmodder> nor do I
14:29:27 <linuxmodder> residuals would not  surprise me
14:29:30 <mhayden> invitation sent for next week -- let me know if i am missing detail
14:29:35 <Sparks> I didn't really read through it for accuracy as I've been overexposed to it now.
14:29:41 <linuxmodder> as  this  partly  allowed drown
14:29:47 <Sparks> mhayden++
14:29:55 <mhayden> oh no -- i scheduled it for *today*
14:29:58 <linuxmodder> the links were to the access.rh  links
14:29:59 <mhayden> rather than next thurs :P
14:30:01 * mhayden goes to fix
14:30:02 <Sparks> mhayden--
14:30:08 <zoglesby> lol
14:30:25 <linuxmodder> and  wiki pages or  official docs  for the  'terms'
14:30:55 <Sparks> Okay, anything else?
14:31:12 <linuxmodder> if anyone else  can give it an accuracy  check that would be great
14:31:39 <linuxmodder> << EOF
14:32:12 <Sparks> #info mhayden wins the weekly prize of having sent the most mail to the list over the last 30 days.
14:32:31 <Sparks> And that's all I have.
14:32:44 <mhayden> :|
14:32:47 <mhayden> oopsies
14:32:50 <Sparks> Join us again, next week, when we do this all over again!
14:32:54 <mhayden> #makemailinglistsgreatagain?
14:33:02 <Sparks> mhayden++
14:33:04 <mhayden> haha
14:33:11 * mhayden orders a red hat
14:33:22 <mhayden> more like a red cap
14:33:30 <Sparks> Okay, see you all in the Intertubez!
14:33:33 <Sparks> #endmeeting