• Software
• Assessment
• 20110823-S-A-MiniTOP

• To Software Software - To Software-Assessment - Software/Assessment - To previous meeting - To next meeting

Minutes of the MiniTOP on the 2011-08-23

Setting

The MiniTOP will be held via telco 22:00 CEST

Attendees: dirk, uli, ted, Michael, Marcus, Marc, Magu, Alex

Topics

(skip to agenda)

Action items from last meeting Meeting Action Items

Agenda

1. Workshop - The List of open / running / unhandled bugs - Part I
   1. Working Session - Action Items to start

      1. x⁴ bug #841 Problems on cert login

         • needs 2nd review - Ted, done
           needs bundling, done

         • NEO: did restructuring (sql query to subroutine), (Update 2011-07-26), re-tested, reviewed
         • needs 2nd review, bundling

           • => Ted on Wed, not done

         x4 NEO: bug #841 Problems on cert login

         needs 2nd review - Ted, done needs bundled NEO will check to get sql query extracted needs pushing pushed to testserver Needs Review & testing

         {0}

2. Froscon is over, whats with the 2 open action items?

   • dirk, Michael	3. next: strategy for "New Roots & Escrow" - how does debian work? to contact, defered to Froscon (end of Aug), CCCcamp (around Aug 10th)	{-}
     Michael	weak keys: problems with cryptostick to test at Froscon with Juergen ?	{-}

3. Workshop - The List of open / running / unhandled bugs - Part II

   1. VBscript for Vista/Win7 (select keysize >= 1024)

      • x1 Dirk, new bug#964 DEV: bug#918 (Part II) (a20110312.1) Weak keys: /pages/account/.. 4.php, 17.php to combine ? (/includes/keygen.php) DEV

        current state: test /account/4.php added to testserver Marcus will do detailed tests on Wed some references added to bug#964

        {-}

      • as part of

      • x¹ Arbitration case a20110312.1 Weak keys bug #918 / bug #954 / bug#964

      • Current state:

        • {g}	pre mailing sent
          {g}	keys revocation script to bulk revoke weak keys, new bug #954, finished
          {-}	dirk: DEV: a20110312.1 bug#918 Weak keys: /pages/account/.. 4.php, 17.php to combine ? (/includes/keygen.php) DEV vbscript needs to be improved with select box key size and lower limit to 2048 (based on https://wiki.mozilla.org/CA:MD5and1024) Api CertEnroll (MS crypto provider) new bug#964 current state: test /account/4.php added to testserver Marcus will do detailed tests on Wed some references added to bug#964
          {g}	Weak keys blog post, published
          {g}	Weak keys article published by Hanno(July 28), link is in CAcert's blog post (July 30)
          {b}	weak keys: problems with cryptostick (to test at Froscon with Juergen ?)

      • cert enroll infos under bug#964

      • vista and win7 works with other engine !CryptoAPI (?) => Cryptography API: Next Generation

        • http://msdn.microsoft.com/en-us/library/aa833130%28v=VS.85%29.aspx

        • Marcus: added notes for Win7 https://bugs.cacert.org/view.php?id=964#c2249

   2. Advertising

      1. • bug #958

           Advertising, ADS Challenge

           {0}

         • CAcertInc/LogosForSale/Rules wiki link exist

         • "buy me" logo / "Logo For Sale" logo / "Monthly Auction on Logos" logo
         • Logos and Links exist, needs deployment to testserver
      2. google ads, nobody knows about

         • http://google.de/adsense/ - needs google account

           • ad client id: pab.*9860, email adress is needed
           • board member to write email request to Robert, Philipp, Philpp, Teus, ernie
           • contact google?
           • account recovery?
   3. Thawte Patch - PR strategy

      1. x² Bug# 827 and bug #959 "Thawte" patch - Points-Count-Order-Change project - 2nd Review + deploy

         x2 bug #827 "Thawte" patch (still running) related bug #959

         needs 1 more test, needs 2nd review 2nd review: also check -x tests done, 2nd review outstanding

         {0} {g}

         • bug #959 deployed

         • bug #827 awaiting response from critical team

         • next steps:
           1. preparing PR, support
           2. report from Wytze, Hans: review, rebundle
         • if the patch goes active, this needs support
           • wiki faq (existing page? thawte topic?)

           • blog (-> alex)

             • mailing list
             • press release? probably not at this state
           • Support: could be better, but is ok
             • Triage: where to forward Thawte patch requests?
             • add to Support team meeting agenda
           • patch review
             • 10.php / 15.php ranking differs
             • 15.php experience points links to assurer account
             • patch applied to testserver, patch to transfer to critical system
           • alex to prepare blog post

   4. Dirk reminder (from last meeting) assure someone patches (checkboxes)

      • Dirk

        DEV: bug #894 problems with check-boxes on website forms (Assure someone) -> a20091118.3

        {0}

   5. Bugs to Review #1, transfer to testserver

      • Dirk	Advertising (from last board meeting), bug #958	add changes as discussed in last meeting to testserver	{0}
        uli	bug #968 error logging cleanup (splitted bug #909)	split 0000909: too many error messages logged - part II - general.php	{0}
        uli	bug #967	Give an OA the oppertuntiy to check if a desiginated Organisation Admininistrator is a CAcert assurer	{0}
        uli	bug #882	display Assurance when field in list of assurances received, assurances given by a user in admin console interface	{0}
        uli	bug #846 Join Form restructure, help link	Better guidance of bonafide members in Join Form about Suffixes they doesn't have in their ID doxs (a20100207.2)	{0}
        uli	bug #794	visibility over certificates for sysadm in account administration	{0}
        Ted, uli	bug #957 Resize the comment field on https://secure.cacert.org/account.php?id=27 so more information is visible	new fix avail 2011-08-19	{0}

   6. Bugs under testing:

      • Dirk, Michael, Ted

        bug #965 0000965: Outsource / fix Webdb text pages id=12, 13

        one more testing

        {0}

   7. Review bugs under testing (finished testing?) (Review 2?)

      • bug #910 Outsource board member list	from Webdb to wiki (id=8) (Part II)	{0}
        bug #955 change sort order Orga list	Possibilty to change the sorting order for the organisation overview	{0}

      • bug #966

        • tests ok, but the question is, is OrgAdmin allowed to remove other admins ? yes or no?

        • current scenario doesn't allow removal of other admin
        • NEO: reset testserver state to fix state before bugfix
        • NEO: re-add bug 966 to testserver
        • bug needs more work, selection currently clashes with language setting (Delete != Löschen)
        • general problem in /pages/account.php with process variable, transfer of "cancel" pushes any action
        • potential workaround to fix all "Cancel" requests available

          • read https://bugs.cacert.org/view.php?id=966#c2287

   8. Needs review, transfer to Critical team, to bundle, to deploy

      • bug #940 help* to wiki

        Outsource Webdb text pages help.php?id=0..9 to wiki needs review, deploy

        {0}

   9. Needs development, deployment, discussion

      1. bug #835 Assurer challenge (on testserver)

         bug #835 Assurer challenge (on testserver)

         asssigned to Ted, set to needs work, CATS to install on ca-mgr1

         {0}

      2. bug #943 change OA admin/assurer text

         • bug #943 change OA admin/assurer text

           -> Ted, rejected, needs comment from OAO

           {-}

         • webdb names OrgAdmins as OrgAssurers and names OrgAssurers as OrgAdmins.

         • patch takes account about this issue
         • problem with menu link Org Admin .. is Org Assurers menu
           • but this menu includes one addtl. link "View" that is available for Org Admins
             • and Org Admins with master flag to add new admins

           • master flag is not described in OAP

           • addtl master flag to revoke ?
           • rename to "Org Administration"

           • don't show menu to OrgAdmins

   10. Still awaiting response from Critical team

4. strategy plans ... next: strategy for "New Roots & Escrow"

   1. idea: using indirect crl's ?
      • 2 crl's needed, one valid, one invalid crl server
      • more infos available ? who ?
        1. build testserver with special certs
        2. Magu, Michael to send instructions for test deployment

           • indirect CRL: RFC 5280 http://tools.ietf.org/html/rfc5280 (chapter 5)

      • meetings ago we've defined Testing requirements and a potential testszenario
      • to remind every meeting
   2. policy group: define requirements
      • multimember escrow method ?
        • needs risk analyze
        • potential candidates ?
          • Marcus to contacted Benedikt, will contact Thomas K
          • Next step(s)
   3. how does debian work ?
      • defered to Froscon (end of Aug), CCCcamp (around Aug 10th)
   4. The Bjoern report

      • New signatures for CAcert-Class 3-Subroot-certificate - Comments

5. CI (Update)

   • description to eclipse testpage, Webinar

   • deployment scenario:
     1. create testusers
     2. testing
     3. delete testusers
   • regression test for standard tests: eg 0,1,49,50,51,99,100,101 pts w/ and w/o CATS passed
   • reminder
6. next meeting: Tuesday, August 30, 2011 22:00

Minutes

1. x² Bug# 827 and bug #959 "Thawte" patch - Points-Count-Order-Change project - 2nd Review + deploy

   • x2 bug #827 "Thawte" patch (still running) related bug #959

     needs 1 more test, needs 2nd review 2nd review: also check -x tests done, 2nd review outstanding

     {0} {g}

     • bug #959 deployed

     • bug #827 awaiting response from critical team

     • next steps:
       1. preparing PR, support
       2. report from Wytze, Hans: review, rebundle
     • if the patch goes active, this needs support
       • wiki faq (existing page? thawte topic?)

       • blog (-> alex)

         • mailing list
         • press release? probably not at this state
       • Support: could be better, but is ok
         • Triage: where to forward Thawte patch requests?
         • add to Support team meeting agenda
       • patch review
         • 10.php / 15.php ranking differs
         • 15.php experience points links to assurer account
         • patch applied to testserver, patch to transfer to critical system
       • alex to prepare blog post
     • 15.php to push, 10.php ? to set active ? or not?
     • mailing to people: Ted, Florian F, PG, Wytze, Carsten L, Jeff F, Frank K (ask Marcus) 120 pts, Sebastian K

2. bug #835 Assurer challenge (on testserver)

   • bug #835 Assurer challenge (on testserver)

     asssigned to Ted, set to needs work, CATS to install on ca-mgr1

     {0}

   • Ted needs access informations, configuration of IP
3. Dirk - development

   • Dirk, Michael

     bug #827 and bug #959 Thawte patch/Points-Count-Order-Change project

     related bug 959: needs 1 more test, needs 2nd review / 2nd review: also check -x / tests done, needs 2nd review 959 {g} reviewed, deployed 827 {g} reviewed, deployment in 2 steps new fixes, reviewed, needs testing

     {g} {0} {g}

4. Dirk - 2nd review

   • x4 NEO: bug #841 Problems on cert login

     needs 2nd review - Ted, done needs bundled NEO will check to get sql query extracted needs pushing pushed to testserver Needs Review & testing

     {0}

   • not started? not finished
5. Michael - 2nd review

   • on bug #827

6. Ted - reviewed

   • uli, ted	bug #882	display Assurance when field in list of assurances received, assurances given by a user in admin console interface	{0}
     uli, ted	bug #794	visibility over certificates for sysadm in account administration	{0}
     Ted, uli	bug #957 Resize the comment field on https://secure.cacert.org/account.php?id=27 so more information is visible	new fix avail 2011-08-19	{0}

7. bug #835 Assurer challenge (on testserver)

   • bug #835 Assurer challenge (on testserver)

     asssigned to Ted, set to needs work, CATS to install on ca-mgr1

     {0}

   • Ted needs an IP address
   • Uli to request dns entry for cats1.it-sls.de by Andreas
8. Froscon is over, whats with the 2 open action items?

   • dirk, Michael

     3. next: strategy for "New Roots & Escrow" - how does debian work? to contact, defered to Froscon (end of Aug), CCCcamp (around Aug 10th)

     • no success, people not avail at Froscon

     Michael

     weak keys: problems with cryptostick to test at Froscon with Juergen ?

     {g}

     • Magu has a stick, to meet with Michael

Fixed Action Items since last or within meeting

• Dirk, Michael, Ted	annoying bug #911 (gpg expires 1970)	Tested needs 2nd review, deploy	{g}
  Uli	PRO: Uli to write nomination to board mailing list cc alex	{g}
  Michael	weak keys: problems with cryptostick to test at Froscon with Juergen ?	{g}

Action Items New

• Uli

  to request dns entry for cats1.it-sls.de by Andreas (for bug #835)

  {0}

Action items: Meeting Action Items

• CategorySoftwareAssessment