• Software
• Assessment
• 20111227-S-A-MiniTOP

• To Software Software - To Software-Assessment - Software/Assessment - To previous meeting - To next meeting

Minutes of the MiniTOP on the 2011-12-27

Setting

The MiniTOP will be held via telco 22:00 CET

Attendees: dirk, michael, uli, magu (late)

Topics

(skip to agenda)

Action items from last meeting Meeting Action Items

Agenda

1. bug#794 Display certs in admin console

• bug#794 display certs in admin console

  • bug #827 mailing results in around 36 new "delete account cases" moved into disputes queue

    • Time and action needed per case		total
      0,5 hour	to move from disputes into arbitration queue (iCM)	18 hours
      2 hours	pickup and handling by an arbitrator	72 hours
      20 min	handling by an SE	12 hours
      Total:		102 (12) hours

  • The problem:
    • Arbitration is slow (don't wonder why)
    • Delete Account cases can be handled by Support-Engineers, once Arbitrator has an option to rule a precedent case, that SE can check that 0 certs are used by the user, w/o hijacking an account

    • so this will free the disputes queue of about > 90% of all "delete account" cases

    • summary: 12 hours work by an SE with a software fix, + (10% of 90 hours = ) 9 hours by arbitration = 21 hours in total instead of 102 hours without a software fix

  • from within last meeting: bug#794 Display certs in admin console

    • assigned to michael, checked in to cacert-devel
    • 1. review by michael
    • 2 tests done
    • 2nd review dirk and go
    • working session: michael / dirk - git for beginners and runaways

  • 2nd Review by dirk (week 3)

  • from last meeting 2011-12-20
    • request from SE: iCM's to transfer disputes from disputes queue to arbitration queue
    • if 2 weeks open 2nd review on bug #794 will be transfered to critical, all delete account cases (approx 40) can be moved to SE queue for review and working under precedent

2. bug #985 - Move Translingo to Translations (incl. patches)

1. Translingo bug #985

   • https://translations.cacert.org (http://translations.cacert.org/) (replacement for translingo)

   • the translingo.cacert.org had been in operation far longer, so I think it is possible that some users migrated to translingo.cacert.org, without telling us.
   • I would suggest to mass-mail the email addresses of the translation-project leaders in the translingo database, to inform them, and to ask them to speak up if they still need it
   • last foreign uploads 2008 on about 13 + cacert projects
   • whohas translingo server console access?
     • mario
   • req for console access for michael to contact project leaders, Updates?
   • Transfer In, Transfer Out problems
   • Update from new deployment ?
   • opened for: create an account can now be started
   • Michael current state:
     • import and export routine works
     • script to incorporate updates needs fixed
   • next: complete language handling needs to be updated
   • accept lang handler needs fix
     • FF de, de_de
     • IE 6 de, 8,9 de_de
   • working session within last meeting: michael, marcus
     • infos from meeting 2011-10-18
       • pdf code needs rewrite (uni code library, move to external server (outsourcing))
       • message cert notification - uses perl code, text source not avail (get bind-text-domain)
   • current state?
   • Marcus sent mailing to translators, no response so far, no tests so far (week 3)
     • Morten NO
     • Emanuel IT
   • current state:
     • create test system accounts dutch@test, espania@test and so on, let users do their tests
     • Magu, Marcus will give it a try
     • a couple of testers has started testing and reporting within the last 7 days
     • results: de, fr, en, pl, es, pl

   • last meeting: working session bug#985 translingo transfer

     • Michael: needs 2nd review
   • Translations
     • problems that relates to blocks translations
     • changes into translations database
     • contact NEO to transfer manualy to testserver

     • bug #985 needs 2nd review, so update script can run also on critical system

   • needs 2nd review by dirk or ted or markus

3. Patches queue

1. bug #827 - New Points calculation / Thawte patch

   • bug #827

   • bug#827 + bug#882 to merge
     • close bug#882
     • wot.inc.php + notary.inc.php to merge
     • continue with bug#827
     • pojam bug to fix

2. bug#540 No key usage attribute in cacert org certs anymore?

   • also: bug#905

   • Policy group discussion - Extended key usage -> p20111113, motion CARRIED

   • deployment

     1. prepare fixes -> Michael to prepare diffs, against svn

     2. sending to testserver
     3. transfer to critical system
   • (2011-12-13) approx 2 weeks to write the fix, approx 2 months to go
   • Michael will work on this in last week this year

3. Marcus: working session bug#789 OA field extension

   • magu to test

4. Marcus: working session bug#859 Activity on Account

   • Michael: needs 1st review + transfer to testserver

5. bug #920 Join - single name only (eg Indonesian)

   • details under bug number
   • presented to Policy Group
   • first results from policy group?
     • dirk has made some changes in 6.php last year
     • there are 4 possible choices:
       1. givenname
       2. lastname (as current fix)
       3. givenname or lastname
       4. brians proposal, mononym + checkbox
     • dirks proposal:
       • make name handling more AP conform (1 line names, multiple names)
     • 2 possible paths:
       1. allow multiple names (dirks proposal) is massive change (long term change)
       2. "simple" solution (short term change)

4. Michaels workqueue

1. OCSP server - timeout 10 min too short, 3 days to long, recommendation is 24-48 hours max, verisign: 7 days, startssl: 2d
   • who has been informed, contacted?
   • Michael will inform Wytze
   • not yet written

     • thread relates to https://lists.cacert.org/wws/arc/cacert-board/2011-11/msg00021.html

2. Build + Document Emergency Patches Path

   • Build + Document Emergency Patches Path

     Andreas, Uli, Wytze

     {0}

   • Software/Assessment/Documentation/EmergencyPatches

   • Documentation written, reviewed by Wytze, Marcus

   • Michael: reminder for review Software/Assessment/Documentation/EmergencyPatches

   • other reviews done ?
3. New function to TMS - edit notary table record

   • bug #980

   • infos from last meeting
   • testers needs editing individual notary records: fields "method", "awarded", "points"
   • easier to create notary records with testserver (add F2F), and edit existing record, doesn't need to check for assurer-from, assuree-to and so on
   • Update?
   • Michael (2011-11-15): after some other bug reviews

5. Dirks workqueue - The List of open / running / unhandled bugs

1. review bug #794

   • bug#794 display certs in admin console

2. review bug #985

   • bug #985 Move Translingo to Translations (incl. patches)

3. VBscript for Vista/Win7 (select keysize >= 1024) (BlackJack) - reminder to dirk

   • x1 Dirk, new bug#964 DEV: bug#918 (Part II) (a20110312.1) Weak keys: /pages/account/.. 4.php, 17.php to combine ? (/includes/keygen.php) DEV

     current state: test /account/4.php added to testserver Marcus will do detailed tests on Wed some references added to bug#964

     {0}

   • as part of

   • x¹ Arbitration case a20110312.1 Weak keys bug #918 / bug #954 / bug#964

   • Current state:

     • {g}	pre mailing sent
       {g}	keys revocation script to bulk revoke weak keys, new bug #954, finished
       {-}	dirk: DEV: a20110312.1 bug#918 Weak keys: /pages/account/.. 4.php, 17.php to combine ? (/includes/keygen.php) DEV vbscript needs to be improved with select box key size and lower limit to 2048 (based on https://wiki.mozilla.org/CA:MD5and1024) Api CertEnroll (MS crypto provider) new bug#964 current state: test /account/4.php added to testserver Marcus will do detailed tests on Wed some references added to bug#964 - codename "BlackJack"
       {g}	Weak keys blog post, published
       {g}	Weak keys article published by Hanno(July 28), link is in CAcert's blog post (July 30)
       {b}	weak keys: problems with cryptostick (to test at Froscon with Juergen ?)

   • cert enroll infos under bug#964

   • vista and win7 works with other engine !CryptoAPI (?) => Cryptography API: Next Generation

     • http://msdn.microsoft.com/en-us/library/aa833130%28v=VS.85%29.aspx

     • Marcus: added notes for Win7 https://bugs.cacert.org/view.php?id=964#c2249

   • dirk: has not started the virtual machine
   • Question from Marcus: did someone contacted illuminat?
     • No, Marcus: to contact illuminat
     • illuminat will give it a try, first needs download of testserver image
   • Update?
     • marcus: illuminat not yet seen last time

     • baseline requirement - keyssize >= 2048 to fix till end of 2011

     • how to proceed?
     • dirk: 1st step, to bring win test server localy online
     • marcus: to contact illuminat
     • Do we have other developers who may pick up this project?

   • Marcus -> dirk: announcement of vbscript bug to developers mailing list

     • change keysize
     • merge 2 scripts to one
     • fix on script 1 needs fix in 2nd script too, solutions: include, one file, or comment fix script 2 too

   • interrupt: bug#964 -> codename "BlackJack"

     • relates to IE8 problem, that certs cannot be created

     • is there a security issue with available fix? also bug#918

     • related 927, 901, 847
     • a patch is online on testserver, but cannot found
     • related patch files, /pages/account/ 3,4,16,17; /include/account.php
     • there are other vbscript pages: ../account/ 6 + 19

   • Brian bug#964

     • Michael: Marcus to test with IE
     • IE select provider only
   • code from Brian needs some corrections, corrections to do, 4 + 17 inclusions, checkin
     • notification to Brian, done

6. General Bugs List Overview

1. Bugs to Review #1, transfer to testserver - Currently 4

   • uli	bug #977 admin console text fix	admin console Sysadmin - find domain - lists 2 tables - one for user accounts, one for org accounts, naming issue	{0}
     uli	bug #967 OA isassurer check	Give an OA the oppertuntiy to check if a desiginated Organisation Admininistrator is a CAcert assurer	{0}
     uli	bug #859 admin console interface	feature request: show activity on an account in the admin interface, new update	{0}
     inopiae	bug #981 OA overview (dupe of bug #943)	New layout of view for Organisation Administraors in account/id35	{0}
     Brian	new bug#964 DEV: bug#918 (Part II) (a20110312.1) Weak keys: /pages/account/.. 4.php, 17.php to combine ? (/includes/keygen.php) DEV	some references added to bug#964 current state: first review, add to testserver	{0}

2. Bugs under testing: - Currently 3

   • 	uli	bug #855 admin console interface "unknown" + "empty" assurance method fields, needed for correct testing on testserver	admin console lists "empty" and "Unknown" assurance types on listing given Assurances	{0}
     	Michael	bug #978 bug 978 (weak keys) (bug 918)	invalid key format, no regular error message, something wrong, error code # identified debugging infos from user + infos from critical team with error code # was spkac routine	{0}

3. Needs 2nd review + transfer to Critical team, to bundle, to deploy - Currently 3

   • define priority eg. 10,2, and so on, proposed order: from 1 to 10

     1	uli, michael	bug#794 display certs in admin console	last update 2011-12-06 tested by 2 2nd review + transfer	{0}	1
     7	uli, ted	bug #789 OA edit domain fix	Editing domain for organisations does not work new update 2011-09-26 more fixes, more testing * testcase scenario * open org, edit 1st domain in new window, edit 2nd domain in new window * results in: change made in window 2, written to record in window 2 * needs cross checking	{0}	? / u7 / m7
     2	neo	bug #985 move translingo to translations	check language settings under testserver	{0}	2

4. Needs development, deployment, discussion, reminder

   1. bug #835 Migrate CATS onto testserver

      • bug #835 Assurer challenge (on testserver)

        asssigned to Ted, CATS to install on ca-mgr1, awaiting deployment

        {0}

7. Long term projects

1. strategy plans ... next: strategy for "New Roots & Escrow"

   1. idea: using indirect crl's ?
      • 2 crl's needed, one valid, one invalid crl server
      • more infos available ? who ?
        1. build testserver with special certs
        2. Magu, Michael to send instructions for test deployment

           • indirect CRL: RFC 5280 http://tools.ietf.org/html/rfc5280 (chapter 5)

      • meetings ago we've defined Testing requirements and a potential testszenario
      • to remind every meeting
      • Michael: testserver environment deployment
      • Michael will review after Certs extension policy group vote
   2. policy group: define requirements
      • multimember escrow method ?
        • needs risk analyze
        • potential candidates ?
          • Marcus to contacted Benedikt, will contact Thomas K
          • Next step(s)
2. CI (Update)

   1. description to eclipse testpage, Webinar

      • deployment scenario:
        1. create testusers
        2. testing
        3. delete testusers
      • regression test for standard tests: eg 0,1,49,50,51,99,100,101 pts w/ and w/o CATS passed
      • reminder
   2. Jubula Test-Tool (by Michael) - update?

      • http://www.eclipse.org/jubula/download.php

      • instructions see under Minutes meeting 2011-08-30

      • test deployment needs to be continued by software testers

      • Jubula documentation started: Software/Jubula

   3. new proposal by Sven: Webdriver with Maven and Jenkins-CI
      1. Jubula vs. Webdriver
      2. testserver variants
         1. testserver for manual tests
         2. testserver of OS and application upgrades
         3. testserver for CI
      3. test methods
         1. unit test
            • test single modules, exceptions
         2. integration tests
            • test interaction of modules
         3. system tests
            • complete system test, with database interactions, module interactions and much more
      4. sven did some work regarding frontendtest (Webdriver with Maven and Jenkins-CI)
         • Michael did some review: probably needs some seperation
3. Infrastructure seperation
   1. CAcert Inc statement - received
   2. Hosting/Housing Provider
      • 2011-12-01: Vienna response
      • questions answered
   3. contacting secure-u, oophaga started?
      • Frank, Mario, Ted, Uli, Sebastian ?
      • started 2011-12-19, awaiting response
   4. Hardware
      • alternate solutions
4. Helping CAcert
   • How does recruitment work?
   • Newsletters, recuring notifications

   • Fosdem -> focus on Nucleus events

   • Recruitment on events?

   • Recruitment page eg events/Recruitment, HelpingCAcert, Jobs

   • Flyers?
   • re-design main page:
     • dirk: 3 news, upcoming events
     • michael: *
     • rss-feed script modification is simple
     • main page cms page, login to secure area (portal project)
       • public: www.cacert.org
         • secure1: www.cacert.org
         • secure2: secure.cacert.org

5. Discovery II a20110118.1 discussion

   • who should receive infos? list of appropiate recipients listed in discovery II table
   • possible software solutions:
     1. triggered info mailing eg board-private mailing list + support
     2. view page with current results (like hidden stats page?)
   • create bug# ?
6. Affilates program - topic for SA ?
   • planned income projects by CAcert Inc
   • new portal (Benedikt, Karsten working on it)
     • critical / non-critical systems
       • non-critical portal - with login link to critical secure.cacert.org
       • cms system: own user base?
       • critical system userid includes @, cms userid does not include @
       • cms login adding userid from critical system may result in security leak that account data can be collected (MITM)
   • affiliate link to each event (template)
     1. addtl. link under main ads

8. next meeting

• Tuesday, January 3, 2012 22:00

Minutes

1. bug#794 display certs in admin console

   • not yet

2. Translingo bug #985

   • try assigning to Ted

3. bug#540 No key usage attribute in cacert org certs anymore?

   1. policy change
   2. signer code update
      • changes against svn
   3. uli, to add to tester portal

4. bug #920 Join - single name only (eg Indonesian)

   • details under bug number
   • presented to Policy Group
   • first results from policy group?
     • dirk has made some changes in 6.php last year
     • there are 4 possible choices:
       1. givenname
       2. lastname (as current fix)
       3. givenname or lastname
       4. brians proposal, mononym + checkbox
     • dirks proposal:
       • make name handling more AP conform (1 line names, multiple names)
     • 2 possible paths:
       1. allow multiple names (dirks proposal) is massive change (long term change)
       2. "simple" solution (short term change)
     • global re-design
       • ie users view
       • 43.php, multiple views
5. OCSP server - timeout 10 min too short, 3 days to long, recommendation is 24-48 hours max, verisign: 7 days, startssl: 2d
   • who has been informed, contacted?
     • Michael will inform Wytze
     • not yet written

       • thread relates to https://lists.cacert.org/wws/arc/cacert-board/2011-11/msg00021.html

     • general solved
     • scalability might be a problem in the future ?!?
     • preconfigured there is no solution
   • whats with EBJCA
     • java based
     • distribution solution (database replication), master server distributes to other criticial slaves, no caching function
     • post request includes timestamp, simple http cache probably doesn't work
     • engineX ?
   • ocsp protocol: version, requestor-name, extension, request-list
   • open issue, needs time for implementation
   • studienarbeit? bachelor arbeit?
6. Infrastructure seperation
   1. CAcert Inc statement - received
   2. Hosting/Housing Provider
      • 2011-12-01: Vienna response
      • questions answered
   3. contacting secure-u, oophaga started?
      • Frank, Mario, Ted, Uli, Sebastian ?
      • started 2011-12-19, awaiting response
   4. Hardware
      • alternate solutions
        • offer Frank a) 80 w, too high, b) unknown yet
        • uli: luxemburg connection, will try 1st week in january
      • 2 way path: search sponsors for money, search hardware sponsors
7. next events:
   • Fosdem
   • Cebit
   • Chemnitzer Linuxtag
     • CAP forms have no bank account infos
       • CAP form redesign
8. TMS - certs expire handling
   • for testserver eg 3 days (short), 31 days (long)
9. signer rewrite
   • cabforum, blacklist implementation

10. Discovery II a20110118.1 discussion

    • still running
    • possible software solutions:
      1. triggered info mailing eg board-private mailing list + support
      2. view page with current results (like hidden stats page?)
    • create bug# ?

      • bug #1003

11. Affilates program - topic for SA ?
    • currently not
12. next meeting - Tuesday, January 3, 2012 22:00
    • NEO is away

Fixed Action Items since last or within meeting

• Ted, uli

  bug #957 Resize the comment field on https://secure.cacert.org/account.php?id=27 so more information is visible

  last update 2011-08-19 tested 3 times ready to deploy?

  {g}

Action Items New

• uli	bug #540 add to testers portal for testing	{0}
  uli	bug #1002 add to testers portal for testing	{0}

Action items: Meeting Action Items

• CategorySoftwareAssessment