Security Project Meeting 2010-09-01
===================================

Roll call
---------
  here:
    Alex Legler (a3li)
    Tony Vroon (chainsaw), padawan
    Stefan Behte (craig)
    Raphaël Marichez (falco), joined later on during the meeting
    Sune Kloppenborg Jeppesen (jaervosz)
    Tobias Heinlein (keytoaster)
    Pierre-Yves Rofes (py)
    Robert Buchholz (rbu)
    Robin H. Johnson (robbat2), infrastructure representative
    Tim Sammut (underling), padawan
    Matthias Geerdsen (vorlon)
  missing:
    Kurt Lieber (klieber)
    Ned Ludd (solar)


1. Project status
-----------------
The Gentoo Security team is functional, but running on low flame. There is a
huge backlog (a huge amount of open bugs and GLSAs that still need to be sent)
and due to a small amount of active members not all bugs are filed/handled in a
timely manner and bigger packages (Firefox, Java, etc.) are not easy to draft
GLSAs for for various reasons.

Some members feel that drafting GLSAs with the old GLSAMaker is a huge PITA.

Not all recruitment requests by both developers and non-developers have been
handled as well as we want them to, due to limited time and resources.


2. Lead election
----------------
It has been decided that the Gentoo security team's leads are there to do
administrative stuff (like distributing permissions e.g. on Bugzilla), to
ensure progress, to cast deciding votes, and to act as the point of contact for
encrypted mails.

Robert, Matthias, and Stefan have either opted out of being nominated or not
accepted their nomination due to time issues. Alex and Tobias have been
nominated.

The team has decided unanimously to continue having two leads, and that those be
Alex and Tobias.


3. Population of several mail aliases, bugzilla groups etc.
-----------------------------------------------------------
The following groups/aliases had to be cleaned and updated in order to ensure
that no outdated entries still exist.


3.1 CERT mails
It has been decided that all team members who attended the meeting will receive
the CERT mails. Matthias will put a list together and send it to the security
alias before informing CERT.


3.2 vendor-sec alias
Due to respect for the group, the team decided to have only a limited number of
people subscribed. As such, everyone has been removed from the alias and only
Alex, Tobias, and Stefan have been put on it. The team agreed to further
evaluate subscribing active members at the next meeting.


3.3 "securitymail" group on dev.gentoo.org
The team decided that only the new leads will be allowed to edit mail aliases.


3.3 "security" mail alias and "security" group on Bugzilla
The team agreed that every "full" team member should be on/in these. The leads
will have the power to edit them.


4. Handling of the current GLSA and bug queues and how to avoid such situations in the future
---------------------------------------------------------------------------------------------
The new GLSAMaker will ease the team's work in huge parts and its development is
currently of utmost importance. Alex and Tobias have given a summary on the new
GLSAMaker: It's in a near-usable state, the goal is to have our information
integrated better, it will replace the old CVE tracker, it's way easier to
draft minor issues, and permission groups allow for non-team members and new
recruits to help with drafting.

Alex and Tobias will see to getting a usable beta version of GLSAMaker2 deployed
until Oct 1, 2010, while the rest of the team will try to get some GLSAs out
with the old one.

The team agreed to send "mini-GLSAs" for minor issues, that is a usual GLSA
with shorter description and impact texts, like we did a few months ago.


5. Any other topic
------------------
In order to be more open to users, Matthias will draft an announcement
explaining our current situation.

Alex will arrange for a wiki to document todo lists and miscellaneous stuff.

The team will hold meetings more frequently, every 2 or 3 months has been
suggested. The next meeting will be around mid-October to vote on this and also
to check the progress of GLSAMaker2.

There is no further need for the position of the infrastructure liasion and it
has been removed. Robin suggested to bug either him or Ned.

Tobias will merge documentation files from devspaces into our project pages.