• Software
• Assessment
• 20120710-S-A-MiniTOP

• To Software Software - To Software-Assessment Software/Assessment - To previous meeting - To next meeting

Minutes of the MiniTOP on the 2012-07-10

Setting

The MiniTOP will be held via telco 22:00 CEST

Attendees: Marcus, Benny, Uli, dirk (late), magu (late)

Topics

(skip to agenda)

Action items from last meeting Meeting Action Items

Agenda

1. Preface

1. Cebit brainstorming
   • dirk: request for events report
   • (2012-03-27) Marcus awaiting translation from Marc
   • (2012-06-19) Marcus: translation received, will send within the next upcoming days
   • (2012-06-26) Marcus: not yet finished

2. 2nd review of about 5 patches

• Software-Assessors task

  1. bug #789 OA edit domain fix, Editing domain for organisations does not work
     new update 2011-09-26
     2 tests, needs 2nd review, deploy
     more fixes, more testing

     • 2nd review of 1 patch
       • Michael cannot do, needs doing by dirk (or other Software-Assessor, who else?)

  2. bug #978 bug 978 (weak keys) (bug 918)

     • invalid key format, no regular error message, something wrong, error code # identified
     • debugging infos from user + infos from critical team with error code #, was spkac routine
     • one test done 2011-12-17 by JensK

     • uli, marcus: more tests: certs routine, weak keys (small keys test), relates to bug#540 tests

     • (week 7)

  3. bug#540 No key usage attribute in cacert org certs anymore?

     • also: bug#905

     • Policy group discussion - Extended key usage -> p20111113, motion CARRIED

     • deployment

       1. prepare fixes -> Michael to prepare diffs, against svn

       2. sending to testserver
       3. transfer to critical system
     • (2011-12-13) approx 2 weeks to write the fix, approx 2 months to go
     • Michael did transfer the patch to testserver
       • signer code update
       • changes against svn
       • uli, to add to tester portal, done
       • uli to inform testers about new tests
       • test report from kenneth to transfer to report (email from 2011-12-25)
         • Michael: where to find the report from kenneth? link?
         • NEO has added the report (written to private dl)
       • who has adobe 8 for testing?
         • magu has, please test
       • next: needs testing (week 6)
         • uli, marcus: needs full cert create tests
         • uli (2012-01-25): sent notification to software testers
         • awaiting testing ... problem FULL test, including all possible variations with certs creation

         • also to report under bug #978 bug 978 (weak keys) (bug 918)

       • Testers: test all certs veriations, functions

  neo	bug #1024 Assurer flag is not set correctly on updatesort.php run	tested by 4, ok	2 {0}
  Michael	bug #540	p20111113 CPS #7.1.2 "Certificate Extensions" adjustments - testing uli, marcus: needs full cert create tests duplicate report to bug#978	3 {0}
  inopiae	bug #981 OA overview (dupe of bug #943)	New layout of view for Organisation Administrators in account/id35	4 {0}
  neo	bug #978 Invalid SPKAC requests are not properly validated	recheck full certs signing procedures duplicate report to bug#540	5 {0}
  uli, ted	bug #789 OA edit domain fix	Editing domain for organisations does not work new update 2011-09-26 2 tests, needs 2nd review, deploy more fixes, more testing	6 {0}

3. bug #1023 Testing (6.php)

1. Thawte points removal, final step
   • last patch transfered to production system 2012-05-30
2. what are the next steps for thawte points revoke?
   • points settings codes eg 50 pts open gpg/pgp, which certs avail by how many pts
   • 15.php needs rename to 10.php
   • cannot move forward without dirk

4. Marcus Bugs list

• see also Software/BugsOverview

• bug#1023 related

  • bug#583 "Assure Somebody" allows future assurance dates

  • bug#648 send message from Assurer to Member

  • bug#802 Name parts should be designated in assurance form

  • bug#870 My Details - My Points show bugus time stamp

  • bug#914 Information about Practice on Name while entering an Assurance

  • bug#930 types wrong points in "Assure Someone" form

  • bug#931 Date of assurance in future don't throw any exception

  • bug#998 When entering an assurance in the WoT one line of the form the suffix is given in another line the suffix is missing.

  • bug#1000 Entering an assurance into the system after searching for an assurer causes a pre-filled location field

• Others

  • bug#118 Secure TTP Form upload - outdated, conflicts with new procedure, closed

  • bug#428 Reminder language-drop-down-box doesn't keep "English" if you choose it again - cannot be reproduced, tested by 2, closed

  • bug#489 Pb on rewarding 2 points for an assurance

  • bug#567 case sensitive email: tested by 2, cannot be confirmed, closed

  • bug#767 Single-quotes escaped in Web-of-Trust contact form.

• info pages to wiki pages

  • starting bug #671. there still exist a bug# bug #740 (How to become an assurer is missleading)

• bug #491 "Please allow usage of "secondary" emails user ids." - proposes: Close with rejected

  •   * username/password half of the combination is known to potential attacker
      * login prevents login to several email addresses
      * acceptance to several email addresses is prevented
      * no notification if primary email address has been changed
      * note regarding Policy Group
      * dirk: proposal: response email address exists, but isn't primary email ?
       * create new account results in "email address exists"
       * what is a proper response?
       * requestor has to be an assurer for assure someone
      * neo: for registration process chaptcha required
      * no good solution
      * for assurance only primary, for all other services allow also secondary addresses
       * search needs enhancement: search not only primary, also secondary

• bug #571 "need for email addresses (or link) in admin console" - proposes: Closed with solved by other bug fix

  •   * primary and secondary email addresses are shown in admin console

• bug #591 "CPS has to be improved for audit." - proposes: Closed

  •   * CPS is a working revision also DRAFT revision included
      * relates to policy repository bug# final place finding

• addtl. groups:
  1. OA
  2. CCA rollout
  3. TTP

5. Benny reviews

1. bug #1025 "Domain Dispute strange behaviour / Domain Dispute issue", checked

   • wrong description, problem removing domains, bugfix solves this problem
   • async removal of certs by signer
   • needs review and testing
   • inopiae will try testing on upcoming weekend
   • to test: email- and domain dispute

2. bug #922 "CAcert application code problem causing missing 'certificate about to expire' messages", checked

   • patch seems to be ok
   • white spaces cleanup

   • includes/account.php var $id shall be fixed within recursion, new bug #1078

   • 2 tests initiated by inopiae and u60
   • principle ok, but very confusing
   • test reports Marcus:
     • discussions, Marcus got 71 or 72 notifications
     • Neo: default 5 notifications: 45d, 30d, 15d, 3d, 1d

3. bug #1019 "Contact form does not work when logged in"

   • Michael: rework contact form
     • usability: 1 form, option box with public/support delivery, default support
     • current form 1: public, form 2: private
     • spam prevention via java, on disabled java the mail is marked [possible spam]
   • mass mailing possible if adding multiple emails separated by commas
   • account.php - email address from sender, no address validation, several other places it passes address validation
   • neo: why not use primary email address?
     • works only if logged-in
   • index?id=11 has also been changed
   • url was hardcoded
   • account.php?id=14
   • sendmail() routine in includes/mysql.php

6. New SA candidates

1. ABC Benny - possible Itzehoe (2012-09-14), mrmcd (2012-09-08) or other events before 2012-08-10 - 2012-08-11 BarCamp kiel

   • ABC Benny

2. Whats with ABC over archaios?

7. English Translation Problems

• how to handle typing error in web phrase Software/TranslationMisspelling

  • "Can't continue with certificaterequest." in ../includes/account.php:341 ../includes/account.php:1482

8. Long Term Projects

1. NEO: "BlackJack"

2. Marek's sql class project:
   • is working on charset replacement
3. api project, Carsten continues with portal project if vendor-api will be delivered
   • potential candidates for development
     1. Marek's sql class proposal
        • needs probably db upgrades
        • needs addtl. indices
        • needs testing
     2. archaios
        • builds daemon as unpreviliged user
   • vendor-api delayed
     • no coders
     • other projects
     • related to sql class project

9. next meeting

• Tuesday, July 17, 2012 22:00 CEST

Minutes

1. Preface

1. bug #922 test report / review

   • one test account, 1 client cert, 1 server cert, received 105 (1) reminders (!!!)
     • 15 reminders checked, 1 for client cert, 14 for server cert
     • needs further inspection
2. Cebit brainstorming
   • 2nd draft finished
   • Sat report missing
3. Bennys c.o address
   • wip
4. offer for timeserver hardware
   • company is current under OA wip

5. Marcus: info from NEO: "BlackJack" moved forward

6. api project, Carsten continues with portal project not waiting for vendor-api to be delivered
   • potential candidates for development
     1. Marek
     2. archaios
   • vendor-api delayed
     • no coders
     • other projects
     • related to sql class project
   • portal project continues with a workaround, needs an assurer
   • arbitration case on locations database orders outsourcing of find-an-assurer asap
   • with portal function, update of data is possible, update of data on critical system is difficult
7. patches 2nd review, Benny to do pre-view

   • neo	bug #1024 Assurer flag is not set correctly on updatesort.php run	tested by 4, ok	2 {0}
     Michael	bug #540	p20111113 CPS #7.1.2 "Certificate Extensions" adjustments - testing uli, marcus: needs full cert create tests duplicate report to bug#978	3 {0}
     inopiae	bug #981 OA overview (dupe of bug #943)	New layout of view for Organisation Administrators in account/id35	4 {0}
     neo	bug #978 Invalid SPKAC requests are not properly validated	recheck full certs signing procedures duplicate report to bug#540	5 {0}
     uli, ted	bug #789 OA edit domain fix	Editing domain for organisations does not work new update 2011-09-26 2 tests, needs 2nd review, deploy more fixes, more testing	6 {0}

   • for #540 uli has sent a short summary to dirk
8. dirk 2nd review of patches

   • bug #540

     • diff line 23ff unclear, what does section ($root==2) mean?

     • also unclear: else section $CRLUrl="http://crl.cacert.org/root${root}.crl";

     • skipped

   • bug #1024

     • server.pl, too much changes to review in a working session, skipped

   • bug #789

     • what is /pages/account/29.php for? edit org domain
     • (pc vm crashed)
9. Discussion about Assurance, CAP, documents, retention of CAP forms and other events related stuff
10. next meeting: Tuesday, July 17, 2012 22:00 CEST

Fixed Action Items since last or within meeting

• uli

  bug #967 OA isassurer check

  Give an OA the opportunity to check if a designated Organisation Administrator is a CAcert assurer

  1 {0}

Action Items New

Action items: Meeting Action Items

• CategorySoftwareAssessment