• Software
• Assessment
• 20120403-S-A-MiniTOP

• To Software Software - To Software-Assessment Software/Assessment - To previous meeting - To next meeting

Minutes of the MiniTOP on the 2012-04-03

Setting

The MiniTOP will be held via telco 22:00 CEST

Attendees: magu, Marcus, uli, dirk, alex, Michael

Topics

(skip to agenda)

Action items from last meeting Meeting Action Items

Agenda

• there are 5 topics of high priority (2-6):

1. Preface

1. dirk topics
   1. Cebit brainstorming
      • dirk: request for events report
      • (2012-03-27) Marcus awaiting translation from Marc
2. u60: new Dev image
   • after removal of stamp server by Critical team

3. u60: a20110118.1 continued

   • Permissions Review Reports recipients review under bug #1003

   • new report recipients proposal a20110118.1 new proposal

4. u60: new bug under bug#855, bug #855 re-opened

   • board=1 users: assure someone leads in <empty> assurance method fields

   • identified under a20110118.1 discovery

   • Marcus cannot confirm board=1 assurance result error to be <empty>

   • more testers to try, to confirm or not

2. Software-Assessors candidates

• Problem:
  • 2nd review of 4 patches cannot be reviewed by NEO, dirk is busy, so only Ted avail, Markus inactive
• candidate to contact by ...

  • kotek? (-> neo)

  • aphexer? (-> ?)

  • bjoern? (-> magu)

  • willm (-> neo)

3. bug #1023 Testing (6.php)

1. Thawte points removal, final step
   • relates to 6.php
   • this also relates to TTP
   • dirk will work on this last weekend (2012-01-21)
   • current state: not yet finished
     • expected finishing? upcoming weekend (2012-01-23 to 2012-01-30)
     • not finished, upcoming weekend 2012-02-06?
     • not finished, last weekend 2012-03-12?

     • 2012-03-13: new bug#1023 bug#1023

     • transfered to git cacert
     • to test:
       • assure someone
       • w/ and w/o ttp
       • in all variations
     • Added to testserver Tue 13.3., Wed 14.3.

     dirk

     bug #1023 Consolidate changes into the Assure Someone page

     6.php global re-design project assurance, wot area (Thawte points removal effective)

     {0}

   • current state: patch removed from testserver, needs work (DEV)
   • (2012-03-27) back on testserver: bug #1023 (6.php), has a bug, needs work

4. testing of certs patches

• 2012-02-21 meeting test series by uli
• 2012-03-27 adobe8 test candidate, magu has a contact

  1. bug#540 No key usage attribute in cacert org certs anymore?

     • also: bug#905

     • Policy group discussion - Extended key usage -> p20111113, motion CARRIED

     • deployment

       1. prepare fixes -> Michael to prepare diffs, against svn

       2. sending to testserver
       3. transfer to critical system
     • (2011-12-13) approx 2 weeks to write the fix, approx 2 months to go
     • Michael did transfer the patch to testserver
       • signer code update
       • changes against svn
       • uli, to add to tester portal, done
       • uli to inform testers about new tests
       • test report from kenneth to transfer to report (email from 2011-12-25)
         • Michael: where to find the report from kenneth? link?
         • NEO has added the report (written to private dl)
       • who has adobe 8 for testing?
         • magu has, please test
       • next: needs testing (week 6)
         • uli, marcus: needs full cert create tests
         • uli (2012-01-25): sent notification to software testers
         • awaiting testing ... problem FULL test, including all possible variations with certs creation

         • also to report under bug #978 bug 978 (weak keys) (bug 918)

       • Testers: test all certs veriations, functions

  2. bug#440 Problem with subjectAltName (CSR, renew certs)

     • "There seems to be a problem with the subjectAltName. Dupes, missing entries, and more"
     • patch by gagern
     • Software-Assessors: needs 1st review + transfer to testserver (week 4)
     • (2012-01-23) michael picked up

  3. bug #978 bug 978 (weak keys) (bug 918)

     • invalid key format, no regular error message, something wrong, error code # identified
     • debugging infos from user + infos from critical team with error code #, was spkac routine
     • one test done 2011-12-17 by JensK

     • uli, marcus: more tests: certs routine, weak keys (small keys test), relates to bug#540 tests

     • (week 7)

  4. bug #812 CAcert certificate not working with Windows Encrypting Filesystem (EFS)

  5. bug #905 Unable to sign PDF file with Acrobat

5. 2nd review of 3 patches

• Software-Assessors task

  uli, ted	bug #789 OA edit domain fix	Editing domain for organisations does not work new update 2011-09-26 2 tests, needs 2nd review, deploy more fixes, more testing	6 {0}
  Michael	bug #1002	0001002: Contact Assurer form leaves a funny comment after sending	{0}
  Michael	bug #1011 problem fix	needs review by Software-Assessor - priority: high {-} untestable, needs 2nd review	{0}

  • 2nd review of 3 patches
    • Michael cannot do, needs doing by dirk (or other Software-Assessor, who else?)

6. continue BlackJack coding by Michael

1. bug#964, bug#918 (Part II) Codename "BlackJack" - VBscript for Vista/Win7 (select keysize >= 1024)

   • x1 Dirk, new bug#964 DEV: bug#918 (Part II) (a20110312.1) Weak keys: /pages/account/.. 4.php, 17.php to combine ? (/includes/keygen.php) DEV

     current state: test /account/4.php added to testserver Marcus will do detailed tests on Wed some references added to bug#964

     {0}

   • as part of

   • x¹ Arbitration case a20110312.1 Weak keys bug #918 / bug #954 / bug#964

   • Current state:

     • {g}	pre mailing sent
       {g}	keys revocation script to bulk revoke weak keys, new bug #954, finished
       {-}	dirk: DEV: a20110312.1 bug#918 Weak keys: /pages/account/.. 4.php, 17.php to combine ? (/includes/keygen.php) DEV vbscript needs to be improved with select box key size and lower limit to 2048 (based on https://wiki.mozilla.org/CA:MD5and1024) Api CertEnroll (MS crypto provider) new bug#964 current state: test /account/4.php added to testserver Marcus will do detailed tests on Wed some references added to bug#964 - codename "BlackJack"
       {g}	Weak keys blog post, published
       {g}	Weak keys article published by Hanno(July 28), link is in CAcert's blog post (July 30)
       {b}	weak keys: problems with cryptostick (to test at Froscon with Juergen ?)

   • cert enroll infos under bug#964

   • vista and win7 works with other engine !CryptoAPI (?) => Cryptography API: Next Generation

     • http://msdn.microsoft.com/en-us/library/aa833130%28v=VS.85%29.aspx

     • Marcus: added notes for Win7 https://bugs.cacert.org/view.php?id=964#c2249

   • dirk: has not started the virtual machine
   • Question from Marcus: did someone contacted illuminat?
     • No, Marcus: to contact illuminat
     • illuminat will give it a try, first needs download of testserver image
   • Update?
     • marcus: illuminat not yet seen last time

     • baseline requirement - keyssize >= 2048 to fix till end of 2011

     • how to proceed?
     • dirk: 1st step, to bring win test server localy online
     • marcus: to contact illuminat
     • Do we have other developers who may pick up this project?

   • Marcus -> dirk: announcement of vbscript bug to developers mailing list

     • change keysize
     • merge 2 scripts to one
     • fix on script 1 needs fix in 2nd script too, solutions: include, one file, or comment fix script 2 too

   • interrupt: bug#964 -> codename "BlackJack"

     • relates to IE8 problem, that certs cannot be created

     • is there a security issue with available fix? also bug#918

     • related 927, 901, 847
     • a patch is online on testserver, but cannot found
     • related patch files, /pages/account/ 3,4,16,17; /include/account.php
     • there are other vbscript pages: ../account/ 6 + 19

   • Brian bug#964

     • Michael: Marcus to test with IE
     • IE select provider only
   • code from Brian needs some corrections, corrections to do, 4 + 17 inclusions, checkin
     • notification to Brian, done
     • quickfix has problems too
     • next step(s)
       • check error codes / debug routines
       • open developer mode, create cert
         • resulting error: line 213, put length, wrong parameter

           Zeile: 213
           Fehler: CertEnroll::CX509PrivateKey::put_Length: Falscher Parameter. 0x80070057 (WIN32: 87)
           Zeile 213:  objPrivateKey.Length = &h08000000

   • current state: an undef error with current patch
     • we need someone who has experience with vbscript, to come into telco, reviews interface/api beforehand
       • illuminat: not before eastern
       • marcus: will ask users on assurance party Wed 18th Jan
   • 2012-01-23:
     • also cabforum requirement, keysize under IE limited to 1024
     • how to find programmers ?
       • windows webserver programmers: Outlook, Citrix portals
     • new API's can use java, new apis have web-enabled

     • splitting vbscript for os revisions < vista, java for os revisions >= vista ?

   • NEO started development, not yet finished

   • next: for XP: rewrite vbscript to JavaScript

7. next meeting

• Tuesday, April 10, 2012 22:00 CEST

Minutes

1. dirk topics
   • Cebit brainstorming
   • dirk: request for events report
   • (2012-03-27) Marcus awaiting translation from Marc
   • (2012-04-03) Marcus will do upcoming weekend
2. u60: new Dev image
   • after removal of stamp server by Critical team
   • (2012-04-03) u60: mail sent to Wytze, Critical team, Michael asking about removal of stamp.cacert.org

3. u60: a20110118.1 continued

   • Permissions Review Reports recipients review under bug #1003

   • new report recipients proposal a20110118.1 new proposal

   • discussion
     • Marcus: (prefers) Support to send to OTRS
       • magu: addtl. email address for OTRS SE queue
       • uli: (prefers) Support to send to admin=1 recipients
       • Michael: alias, email addr for OTRS
       • dirk: open CA, disclosure of lists?
       • Marcus: list includes names, emails, group membership, potential privacy problem, rcvd 3-4 complains regarding tverify (own group prob)
       • ruling: to reset tverify, board, problem settings: how to continue, AO+OAO notification, own group specials
     • Neo: Locadmin falls back to board, responsibility: board
     • Michael: AO, OAO recipients, alias: OAO avail, AO not yet

     • Michael, Marcus: AdAdmin: Advertisement, no team, was held by treasurer

     • Michael: Codesigning, counter() public, no implementation needed
4. bug #1023 Testing (6.php)
   • 2 new bugs within meeting 2012-03-27
5. Marcus: automated create user script (dotnet script)
   • Magu: testing
6. Software-Assessors candidates
   • Problem:
     • 2nd review of 4 patches cannot be reviewed by NEO, dirk is busy, so only Ted avail, Markus inactive
   • candidate to contact by ...

     • kotek? (-> neo) - neo is doing reviewing

     • aphexer? (-> ?)

     • bjoern? (-> magu) - no update

     • willm (-> neo) (xing contact, developer), will contact next

     • stephan (-> marcus)

7. continued Permissions review recipients discussion

8. new patch bug #1027 Add information for affiliate program from booking.com

   • on testserver, request to dirk for 2nd review
   • current: on donatation page, discussion about add on main page donations info
9. bug #1023 Testing (6.php)
   • bugs analyze, empty results analyse, new patch transfered to testserver
10. github
11. uli: make ca-mgr1 + git, backup
    • machines needs update, neo wip
12. next meeting, in 14 days (upcoming week: dirk, marcus, uli, michael not avail)
    • Tuesday, April 17, 2012 22:00 CEST

Fixed Action Items since last or within meeting

• Michael

  bug #1003 Provide a possibility to regularly review the permissions in the system

  needs to be started from console, not testable

  {g}

Action Items New

• neo	bug #1027 Add information for affiliate program from booking.com	Inform users about the affilate program on the donations page (index.php?id=13)	{0}
  uli	image backup ca-mgr1, git-cacert	for planned system maintenance	{0}
  neo	system maintenance ca-mgr1, git-cacert	scheduled 2012 KW 14	{0}
  critical team	system maintenance cacert1 (and others)	remove stamp.cacert.org	{0}

Action items: Meeting Action Items

• CategorySoftwareAssessment