• To Software Software - To Software-Assessment - Software/Assessment - To previous meeting - To next meeting

---

Minutes of the MiniTOP on the 2011-12-06

Setting

The MiniTOP will be held via telco 22:00 CET

Attendees: magu, marcus, uli, michael, dirk

Topics

(skip to agenda)

Action items from last meeting Meeting Action Items

Agenda

1. "Software-Assessment works slow"

• Why it takes so long to pass patches ?
  • Does a patch doesn't work as advertised?
  • Or is it: this patch raises security issues?

    The point of the dual control over software is to stop any person 
    introducing security breaches.  That doesn't extend to introducing 
    patches that don't work ... as long as they don't breach the security, a 
    known incomplete patch can still be introduced.

• SP 7. SOFTWARE ASSESSMENT ... defines:

  •  7.2. Tasks
    
    The primary tasks for Software Assessors are:
    
       1. Keep the code secure in its operation,
       2. Fix security bugs, including incidents,
       3. Audit, Verify and sign-off proposed patches,
       4. Provide guidance for architecture, 
    
    Software assessment is not primarily tasked to write the code. In principle, anyone can submit code changes for approval

     7.4. Review
    
    At the minimum, patches are signed off by the team leader or his designated reviewer. Each software change should be reviewed by a person other than the author. Author and signers-off must be logged. The riskier the source is, the more reviews have to be done. 

• Discussion

2. bug#794 Display certs in admin console

• bug#794

• bug #827 mailing results in around 36 new "delete account cases" moved into disputes queue

  • Time and action needed per case		total
    0,5 hour	to move from disputes into arbitration queue (iCM)	18 hours
    2 hours	pickup and handling by an arbitrator	72 hours
    20 min	handling by an SE	12 hours
    Total:		102 (12) hours

• The problem:
  • Arbitration is slow (don't wonder why)
  • Delete Account cases can be handled by Support-Engineers, once Arbitrator has an option to rule a precedent case, that SE can check that 0 certs are used by the user, w/o hijacking an account

  • so this will free the disputes queue of about > 90% of all "delete account" cases

  • summary: 12 hours work by an SE with a software fix, + (10% of 90 hours = ) 9 hours by arbitration = 21 hours in total instead of 102 hours without a software fix

• from within last meeting: bug#794 Display certs in admin console

  • assigned to michael

3. bug #827 - New Points calculation / Thawte patch

• bug #827

• PR work
  • mailing script running/sent
  • End results ?
• "Special case" - handling of 0:0 cases under arbitration

  • Arbitration case a20111001.1 still running

  • review of Support/Handbook/NewPointsCalculation instructions for SE's

    • 3 potential scenarios possible:
      1. orig email is identical to email addr on CAP form
      2. orig email is secondary email in account, assuree can set email addr from assurance to primary email
      3. orig email from assurance is no longer valid, assurer has to contact support
         • addtl. documentation required
         • new email addr to write onto assurers cap form, with ticket id, old assurance id, new assurance id
         • addtl. documentation old id + ticket id to add in locations field
    • mailing script / sql query
• bug#827 + bug#882 to merge
  • close bug#882
  • wot.inc.php + notary.inc.php to merge
  • continue with bug#827
  • pojam bug to fix

4. Patches queue

1. Translingo bug #985

   • https://translations.cacert.org (http://translations.cacert.org/) (replacement for translingo)

   • the translingo.cacert.org had been in operation far longer, so I think it is possible that some users migrated to translingo.cacert.org, without telling us.
   • I would suggest to mass-mail the email addresses of the translation-project leaders in the translingo database, to inform them, and to ask them to speak up if they still need it
   • last foreign uploads 2008 on about 13 + cacert projects
   • whohas translingo server console access?
     • mario
   • req for console access for michael to contact project leaders, Updates?
   • Transfer In, Transfer Out problems
   • Update from new deployment ?
   • opened for: create an account can now be started
   • Michael current state:
     • import and export routine works
     • script to incorporate updates needs fixed
   • next: complete language handling needs to be updated
   • accept lang handler needs fix
     • FF de, de_de
     • IE 6 de, 8,9 de_de
   • working session within last meeting: michael, marcus
     • infos from meeting 2011-10-18
       • pdf code needs rewrite (uni code library, move to external server (outsourcing))
       • message cert notification - uses perl code, text source not avail (get bind-text-domain)
   • current state?
   • Marcus sent mailing to translators, no response so far, no tests so far (week 3)
     • Morten NO
     • Emanuel IT
   • current state:
     • create test system accounts dutch@test, espania@test and so on, let users do their tests
     • Magu, Marcus will give it a try
     • a couple of testers has started testing and reporting within the last 7 days
     • results: de, fr, en, pl, es, pl

   • last meeting: working session bug#985 translingo transfer

     • Michael: needs 2nd review

2. bug#894 "Haeckchen bug" - review done, changes needs reviewed again

   • 3

     Dirk

     bug#894 assure someone patches (checkbox)

     (incl wot.php changes) tested by 2, needs 2nd review, deploy new test round

     {0}

     ? / u1 / m1

   • review by dirk in session, review ok
   • current state:
     • needs testing
     • Magu, Marcus will pickup the task
     • one and last test and report done 2011-11-19 (week 4)

   • running arbitration a20111001.1 prob

     • checkbox on AP, "Haeckchen bug" helps to pass the "old" assurance
     • alternates: adding comment field if checkbox is not set
   • current patch: check on AP to disable
     • patch transfered to cacert-devel
   • first test: first two checkboxes set, ok
     • pojam case potential problem

       • < 18 years -> 10 pts, < 14 years -> 0 pts

       • 2011-11-01 -> 10.php: 0 pts, 15.php -> 10 pts

       • 14 years limit started with pojam, limit given by pojam reached, issue upto 10 pts
   • test report from 2011-11-29

     • 0 checkbox	error missing checks
       only 1st checkbox	error missing checks
       only 2nd checkbox	error missing checks
       1+2 set	ok
       1+2+3 set	ok

   • ready to deploy?

3. bug#540 No key usage attribute in cacert org certs anymore?

   • also: bug#905

   • Policy group discussion - Extended key usage -> p20111113, motion CARRIED

   • deployment

     1. prepare fixes -> Michael to prepare diffs, against svn

     2. sending to testserver
     3. transfer to critical system

4. Marcus: working session bug#789 OA field extension

   • magu to test

5. Marcus: working session bug#859 Activity on Account

   • Michael: needs 1st review + transfer to testserver

6. bug #976 - database restructure preperation

   • current state summary:
     • transfered to critical system, patch has been applied
     • database upgrade, scheduled for Wed Nov 23rd, successfully finished
   • downtime was about 5 min
   • cacert user has all permissions
     • Michael: proposal to limit permissions, eg remove, drop, index, references
     • magu: problem, can we expect that all works as before?
       • uli: if there are permission problems, this will be logged and logs the source
     • Update: Michael + Wytze worked on this, problem solved?

5. Michaels workqueue

1. OCSP server - timeout 10 min too short, 3 days to long, recommendation is 24-48 hours max, verisign: 7 days, startssl: 2d
   • who has been informed, contacted?
   • Michael will inform Wytze
   • not yet written

     • thread relates to https://lists.cacert.org/wws/arc/cacert-board/2011-11/msg00021.html

2. Build + Document Emergency Patches Path

   • Build + Document Emergency Patches Path

     Andreas, Uli, Wytze

     {0}

   • Software/Assessment/Documentation/EmergencyPatches

   • Documentation written, reviewed by Wytze, Marcus

   • Michael: reminder for review Software/Assessment/Documentation/EmergencyPatches

   • other reviews done ?
3. New function to TMS - edit notary table record

   • bug #980

   • infos from last meeting
   • testers needs editing individual notary records: fields "method", "awarded", "points"
   • easier to create notary records with testserver (add F2F), and edit existing record, doesn't need to check for assurer-from, assuree-to and so on
   • Update?
   • Michael (2011-11-15): after some other bug reviews

6. Dirks workqueue - The List of open / running / unhandled bugs

1. VBscript for Vista/Win7 (select keysize >= 1024) - reminder to dirk

   • x1 Dirk, new bug#964 DEV: bug#918 (Part II) (a20110312.1) Weak keys: /pages/account/.. 4.php, 17.php to combine ? (/includes/keygen.php) DEV

     current state: test /account/4.php added to testserver Marcus will do detailed tests on Wed some references added to bug#964

     {-}

   • as part of

   • x¹ Arbitration case a20110312.1 Weak keys bug #918 / bug #954 / bug#964

   • Current state:

     • {g}	pre mailing sent
       {g}	keys revocation script to bulk revoke weak keys, new bug #954, finished
       {-}	dirk: DEV: a20110312.1 bug#918 Weak keys: /pages/account/.. 4.php, 17.php to combine ? (/includes/keygen.php) DEV vbscript needs to be improved with select box key size and lower limit to 2048 (based on https://wiki.mozilla.org/CA:MD5and1024) Api CertEnroll (MS crypto provider) new bug#964 current state: test /account/4.php added to testserver Marcus will do detailed tests on Wed some references added to bug#964 - codename "BlackJack"
       {g}	Weak keys blog post, published
       {g}	Weak keys article published by Hanno(July 28), link is in CAcert's blog post (July 30)
       {b}	weak keys: problems with cryptostick (to test at Froscon with Juergen ?)

   • cert enroll infos under bug#964

   • vista and win7 works with other engine !CryptoAPI (?) => Cryptography API: Next Generation

     • http://msdn.microsoft.com/en-us/library/aa833130%28v=VS.85%29.aspx

     • Marcus: added notes for Win7 https://bugs.cacert.org/view.php?id=964#c2249

   • dirk: has not started the virtual machine
   • Question from Marcus: did someone contacted illuminat?
     • No, Marcus: to contact illuminat
     • illuminat will give it a try, first needs download of testserver image
   • Update?
     • marcus: illuminat not yet seen last time

     • baseline requirement - keyssize >= 2048 to fix till end of 2011

     • how to proceed?
     • dirk: 1st step, to bring win test server localy online
     • marcus: to contact illuminat
     • Do we have other developers who may pick up this project?

7. General Bugs List Overview

1. Bugs to Review #1, transfer to testserver - Currently 4

   • uli	bug #977 admin console text fix	admin console Sysadmin - find domain - lists 2 tables - one for user accounts, one for org accounts, naming issue	{0}
     uli	bug #967 OA isassurer check	Give an OA the oppertuntiy to check if a desiginated Organisation Admininistrator is a CAcert assurer	{0}
     uli	bug #859 admin console interface	feature request: show activity on an account in the admin interface, new update	{0}
     inopiae	bug #981 OA overview (dupe of bug #943)	New layout of view for Organisation Administraors in account/id35	{0}

2. Bugs under testing: - Currently 5

   • 	neo	bug #985 move translingo to translations	check language settings under testserver	{0}
     	inopiae	bug #920 Join - single name only (eg Indonesian)	details under bug number present to Policy Group ?	{0}
     	uli	bug #855 admin console interface "unknown" + "empty" assurance method fields, needed for correct testing on testserver	admin console lists "empty" and "Unknown" assurance types on listing given Assurances	{0}
     3	Dirk	bug#894 assure someone patches (checkbox)	(incl wot.php changes) tested by 2, needs 2nd review, deploy new test round	{0}	? / u1 / m1
     7	uli, ted	bug #789 OA edit domain fix	Editing domain for organisations does not work new update 2011-09-26 more fixes, more testing * testcase scenario * open org, edit 1st domain in new window, edit 2nd domain in new window * results in: change made in window 2, written to record in window 2 * needs cross checking	{0}	? / u7 / m7

3. Needs 2nd review + transfer to Critical team, to bundle, to deploy - Currently 1

   • define priority eg. 10,2, and so on, proposed order: from 1 to 10

     8

     Ted, uli

     bug #957 Resize the comment field on https://secure.cacert.org/account.php?id=27 so more information is visible

     last update 2011-08-19 tested 3 times ready to deploy?

     {0}

     ? / u8 / m8

4. Needs development, deployment, discussion, reminder

   1. bug #835 Migrate CATS onto testserver

      • bug #835 Assurer challenge (on testserver)

        asssigned to Ted, CATS to install on ca-mgr1, awaiting deployment

        {0}

8. Long term projects

1. strategy plans ... next: strategy for "New Roots & Escrow"

   1. idea: using indirect crl's ?
      • 2 crl's needed, one valid, one invalid crl server
      • more infos available ? who ?
        1. build testserver with special certs
        2. Magu, Michael to send instructions for test deployment

           • indirect CRL: RFC 5280 http://tools.ietf.org/html/rfc5280 (chapter 5)

      • meetings ago we've defined Testing requirements and a potential testszenario
      • to remind every meeting
      • Michael: testserver environment deployment
      • Michael will review after Certs extension policy group vote
   2. policy group: define requirements
      • multimember escrow method ?
        • needs risk analyze
        • potential candidates ?
          • Marcus to contacted Benedikt, will contact Thomas K
          • Next step(s)
2. CI (Update)

   1. description to eclipse testpage, Webinar

      • deployment scenario:
        1. create testusers
        2. testing
        3. delete testusers
      • regression test for standard tests: eg 0,1,49,50,51,99,100,101 pts w/ and w/o CATS passed
      • reminder
   2. Jubula Test-Tool (by Michael) - update?

      • http://www.eclipse.org/jubula/download.php

      • instructions see under Minutes meeting 2011-08-30

      • test deployment needs to be continued by software testers

      • Jubula documentation started: Software/Jubula

   3. new proposal by Sven: Webdriver with Maven and Jenkins-CI
      1. Jubula vs. Webdriver
      2. testserver variants
         1. testserver for manual tests
         2. testserver of OS and application upgrades
         3. testserver for CI
      3. test methods
         1. unit test
            • test single modules, exceptions
         2. integration tests
            • test interaction of modules
         3. system tests
            • complete system test, with database interactions, module interactions and much more
      4. sven did some work regarding frontendtest (Webdriver with Maven and Jenkins-CI)
         • Michael did some review: probably needs some seperation
3. Infrastructure seperation
   • contacting secure-u, oophaga started?
     • Frank, Mario, Ted, Uli, Sebastian ?
   • 2011-12-01: Vienna response

9. next meeting: Tuesday, December 13, 2011 22:00

• dirk at 13th away

Minutes

1. bug #827 mailing results
   • mailing started: 2011-11-27 10:00
   • mailing finished: 2011-12-01 00:00
   • 210.000 mails sent
   • approx 24747 returns (~10%)
2. "Software-Assessment works slow"
   • Why it takes so long to pass patches ?
     • Does a patch doesn't work as advertised?
     • Or is it: this patch raises security issues?
   • Michael: most problems code quality
     • doesn't qualify on quality
     • not well documented
   • security leaks?
     • not much, not many
     • problems can be
       1. confidentialy
       2. integrity
       3. availability
   • SP: defines review on Security breaches
   • eg points removal, patch written, no security breach, should this patch be passed?
   • Who defines code good to go? Commiter job, quality check
   • 2 tier developers team
     • developers reviews patches
     • software-assessors makes last review
   • Task: transfer patches to production
     • we have to deal with current resources
     • we have to deal with spaghetti code, a mess to review
     • wish list: quality code
     • It does not make sense to pass unfinished code, if the patch pops up 3 months later again
   • sub discussion: google code of summer
   • announcements to the dev mailing list to encourage developers to become active
   • responses to software-assessment project team meeting invitations can be forwarded to developers list
   • developers list: 130 subscribers

   • Marcus -> dirk: announcement of vbscript bug to developers mailing list

     • change keysize
     • merge 2 scripts to one
       • fix on script 1 needs fix in 2nd script too, solutions: include, one file, or comment fix script 2 too
   • Process restructure?
     1. quality level definitions?
     2. fast processing?
        • quality standards?
        • first reviewer has to check quality?
        • 2nd reviewer only checks security breach topics?
        • split commiter review from SA review?
     3. proposal?
        1. first round: committer review, testing, committer review
        2. second round: review by 2 SAs

3. interrupt: bug#964 -> codename "BlackJack"

   • relates to IE8 problem, that certs cannot be created

   • is there a security issue with available fix? also bug#918

   • related 927, 901, 847
   • a patch is online on testserver, but cannot found
   • related patch files, /pages/account/ 3,4,16,17; /include/account.php
   • there are other vbscript pages: ../account/ 6 + 19

4. bug#794 display certs in admin console

   • 1. review by michael
   • 2 tests done
   • 2nd review dirk and go
   • working session: michael / dirk - git for beginners and runaways
5. Helping CAcert
   • How does recruitment work?
   • Newsletters, recuring notifications

   • Fosdem -> focus on Nucleus events

   • Recruitment on events?

   • Recruitment page eg events/Recruitment, HelpingCAcert, Jobs

   • Flyers?
   • re-design main page:
     • dirk: 3 news, upcoming events
     • michael: *
     • rss-feed script modification is simple
     • main page cms page, login to secure area
       • public: www.cacert.org
         • secure1: www.cacert.org
         • secure2: secure.cacert.org

Fixed Action Items since last or within meeting

• Magu, Marcus

  bug#894 assure someone patches (checkbox) (incl wot.php changes) invite testers for testing

  {g}

---

Action Items New

• dirk

  announcement of vbscript bug (bug#964, bug#918 (Part II)) to developers mailing list

  {0}

Action items: Meeting Action Items

---

• CategorySoftwareAssessment