Minutes of the MiniTOP on the 2011-09-13

Setting

The MiniTOP will be held via telco 22:00 CEST

Attendees: dirk, marcus, uli, michael, magu

Topics

(skip to agenda)

Action items from last meeting Meeting Action Items

Software/Assessment/ActionItems

Development, Deployment, Discussion

  • OAO, Ted

    bug #943 change OA admin/assurer text

    needs 2nd test -> Fabian, Marc, Alex? {g} / needs 2nd review -> Ted, rejected

    {-}

    uli, Ted

    bug #824 Org User cert fix Case study

    Organisation User Certificates: Need UI improvement for proper production usage

    {0}

    uli, ted

    bug #823 email address removal fix

    No warning when removing e-mail address from account that certificates will be revoked
    checked by 4, needs 2nd review, deploy
    rejected

    {-}

    inopiae

    bug #920 Join - single name only (eg Indonesian)

    details under bug number

    {0}

    uli

    bug #859 admin console interface

    feature request: show activity on an account in the admin interface
    rejected, certs login doesn't modify "modified" field

    {r}

    Michael

    bug #540

    p20111113 CPS #7.1.2 "Certificate Extensions" adjustments - testing
    uli, marcus: needs full cert create tests
    duplicate report to bug#978
    tested by 3, 2nd review done, transfered
    Ken reported: still has problems, bug kept open

    {0}

    gagern, NEO

    bug #440 Problem with subjectAltName (CSR, renew certs)

    There seems to be a problem with the subjectAltName. Dupes, missing entries, and more, rejected, needs further development

    {r}

    neo

    bug #1025 Domain Dispute issue

    disputes rc and rc2 var prob
    needs work

    {r}

    dirk

    bug #1054 0001054: Review the code regarding the new point calculation

    Thawte patch part II
    needs further work

    {r}

Software Assessors: Review 1 / add to cacert-devel, add to testserver

  • Software-Assessors task

Testing

  • Testers task

    neo

    bug #1004 Stats page improvement

    tested by 2, needs 2nd review

    {0}

    neo

    Bugs #1159 it might be possible to execute commands on the signing server

    {0}

    inopiae

    bug #1065 Wrong wording when sending mails during the assurance process

    {0}

    inopiae

    bug #1162 calcutate (the passwords) hash in php instead of in mysql

    create test scenarios for the software testers /!\
    Full testing /!\

    {0}

    inopiae

    bug #0028 Wrong language for you've been assured & [CAcert.org] Client Certificate emails

    {0}

    inopiae

    bug #988 TTP cap form deployment

    {0}

Software Assessors: 2nd Review, Bundle Package to Critical Team

  • Software-Assessors task

    Ted

    bug #500 Get contact mail adress after resolving test

    tested by 3, requires review

    {0}

    Ted

    bug #1140 Show if a test is passed in learnprogress

    tested by 3, requires review

    {0}

    magu

    bug #1131 Rename _all_ Policies from .php to .html and fix all links

    global policy directory maintenance and update

    {0}

    inopiae

    bug #1010 Reorder the view on organisation certificates

    tested by 3

    {0}

Software Assessors: Bundle Package to Critical Team

  • Software-Assessors task

    inopiae

    bug #1139 Add new fields to the database

    tests through #500 and #1140, 2nd review done, requires transfer

    {0}

Awaiting Response from Critical Team

  • inopiae

    bug #411 Wrong text is made into link

    {g}


Agenda

  1. Software-Assessors blockage - The List of open / running / unhandled bugs - Part I

    1. bug #827

      • Dirk, Michael

        bug #827 and bug #959 Thawte patch/Points-Count-Order-Change project

        related bug 959: needs 1 more test, needs 2nd review / 2nd review: also check -x / tests done, needs 2nd review
        959 {g} reviewed, deployed
        827 {g} reviewed, deployment in 2 steps
        deployed, report from Wytze

        {g}
        {0}

      • request by Joost for variable fields
      • next steps:
        1. preparing PR, support (see below)
          1. Thawte Patch - PR strategy
            • alex to prepare blog post
            • if the patch goes active, this needs support
            • wiki faq (existing page? thawte topic?)
            • blog (-> alex)

            • mailing list
            • press release? probably not at this state
            • Support: could be better, but is ok
              • Triage: where to forward Thawte patch requests?
              • add to Support team meeting agenda
        2. reviewed last meeting. needs transfer to critical team
          • transfer to critical team, done.
          • mailing to people: Ted, Florian F, PG, Wytze, Carsten L, Jeff F, Frank K (ask Marcus) 120 pts, Sebastian K, done.
          • report by Wytze: problem with Unknown, Trusted Third Parties, Assurances before 2006 (0,0)
    2. Michael, Ted - action items last week
      1. bug 846
        • and others in the queue
  2. PR work
    1. thawte patch - blog post
    2. newsletter mailings
      1. thawte patch details
        1. infos about thawte points removal
        2. infos about points counting
          • Update ? Text proposal ?
      2. Security campaign, Newsletters (1 month later, 6-8 weeks later)
        1. weak passwords (bug 637)
        2. password reset w/ Assurance replaces pwd reset thru paypal
        3. cert login security fix (bug 841)
        4. weak keys disabled (bug 918)
        5. class3 re-sign with sha256
        6. check your CAcert account
          1. create a client cert for client cert login (also needed for CATS)
          2. check your secret questions
          3. check your password
          4. check your notification settings
          5. check your location settings
  3. Mozilla Communication: Immediate action requested
  4. Wytze: system upgrade on production and cacert1.it-sls.de (cont. from last meeting)
    • proposed next upgrade step lenny to squeeze
    • Action item: who informs Wytze?
  5. Translingo
    • the translingo.cacert.org had been in operation far longer, so I think it is possible that some users migrated to translingo.cacert.org, without telling us.
    • I would suggest to mass-mail the email addresses of the translation-project leaders in the translingo database, to inform them, and to ask them to speak up if they still need it
    • last foreign uploads 2008 on about 13 + cacert projects
    • whohas translingo server console access?
      • mario
    • req for console access for michael to contact project leaders, Updates?
    • Transfer In, Transfer Out problems
  6. Question from Lambert (by email): Is CAcert's ocsp server a blacklist or a whitelist ocsp ? (cont. from last meeting)
    • CAcert is probably a blacklist ocsp, cause the server delivers infos derived from current crl's interactively
    • Is this for Software-Assessment project group ? Next action step?
  7. Dirks workqueue - The List of open / running / unhandled bugs
    1. VBscript for Vista/Win7 (select keysize >= 1024) - reminder to dirk

    2. Advertising
      1. Prepare Advertising fix for testserver - reminder to dirk

        • Dirk

          Advertising (from last board meeting), bug #958

          add changes as discussed in last meeting to testserver

          {0}

        • CAcertInc/LogosForSale/Rules wiki link exist

        • "buy me" logo / "Logo For Sale" logo / "Monthly Auction on Logos" logo
        • Logos and Links exist, needs deployment to testserver
        • Update (3rd week) ?
      2. google ads, nobody knows about
        • http://google.de/adsense/ - needs google account

          • ad client id: pab.*9860, email adress is needed
          • board member to write email request to Robert, Philipp, Philpp, Teus, ernie
          • contact google?
          • account recovery?
          • dirk: google ads account - to write mail to treasurer (address from invoice)
        • Update (3rd week) ?
  8. Software-Assessors blockage - Bugs to Review #1, transfer to testserver - Currently 12 (!!!)

    • uli

      bug #977 admin console text fix

      admin console Sysadmin - find domain - lists 2 tables - one for user accounts, one for org accounts, naming issue

      {0}

      uli

      bug #975 admin console interface (2)

      report potential database inconsistency in SE console (debug infos), new update /!\

      {0}

      uli

      bug #968 error logging cleanup (splitted bug #909)

      split 0000909: too many error messages logged - part II - general.php

      {0}

      uli

      bug #967 OA isassurer check

      Give an OA the oppertuntiy to check if a desiginated Organisation Admininistrator is a CAcert assurer

      {0}

      uli, Ted

      bug #965 0000965: Outsource / fix Webdb text pages id=12, 13

      addtl. id=37, id=38, new update /!\

      {0}

      uli, ted

      bug #882

      display Assurance when field in list of assurances received, assurances given by a user in admin console interface, new update /!\

      {0}

      uli

      bug #859 admin console interface

      feature request: show activity on an account in the admin interface, new update /!\

      {0}

      uli

      bug #855 admin console interface "unknown" + "empty" assurance method fields, needed for correct testing on testserver

      admin console lists "empty" and "Unknown" Assurance types on listing given Assurances

      {0}

      uli

      bug #823 email address removal fix

      No warning when removing e-mail adres from acount that certificates wil be revoked

      {0}

      uli, ted

      bug #794

      visibility over certificates for sysadm in account administration, new update /!\

      {0}

      uli

      bug #789 OA edit domain fix

      Editing domain for organisations does not work

      {0}

      moh

      bug #596 certs list advanced

      display ser# in certs overview lists

      {0}

    • 12 open fixes available (week 3), needs 1st review by 1st Software-Assessor
  9. Bugs under testing: - Currently 4
    • uli, Michael

      bug #966 cancel doesn't cancel but processes instead

      potential workaround to fix all "Cancel" requests available
      addtl. individual fixes
      new update 2011-08-30
      at least one more test

      {0}

      uli, Ted

      bug #957 Resize the comment field on https://secure.cacert.org/account.php?id=27 so more information is visible

      new fix avail 2011-08-19
      at least one more test

      {0}

      Dirk

      bug #894 problems with check-boxes on website forms (Assure someone) -> a20091118.3
      1st review still needed
      two testers to test

      {0}

      uli

      bug #824 Org User cert fix

      Organisation User Certificates: Need UI improvement for proper production usage
      needs some more fixes

      {0}

  10. Software-Assessors blockage - Needs 2nd review + transfer to Critical team, to bundle, to deploy - Currently 4 (!!!)

    • uli, ted

      bug #955 change sort order Orga list

      Possibilty to change the sorting order for the organisation overview

      {0}

      uli, ted

      bug #940 help* to wiki

      Outsource Webdb text pages help.php?id=0..9 to wiki
      needs review, deploy

      {0}

      uli, ted

      bug #910 Outsource board member list

      from Webdb to wiki (id=8) (Part II)

      {0}

      Ted, uli

      bug #846 Join Form restructure, help link

      Better guidance of bonafide members in Join Form about Suffixes they doesn't have in their ID doxs (a20100207.2)

      {0}

  11. Needs development, deployment, discussion
    1. bug #835 Migrate CATS onto testserver

      • bug #835 Assurer challenge (on testserver)

        asssigned to Ted, CATS to install on ca-mgr1, awaiting deployment

        {0}

    2. bug #943 change OA admin/assurer text

      • bug #943 change OA admin/assurer text

        -> Ted, rejected, needs comment from OAO

        {-}

      • webdb names OrgAdmins as OrgAssurers and names OrgAssurers as OrgAdmins.

      • patch takes account about this issue
      • problem with menu link Org Admin .. is Org Assurers menu
        • but this menu includes one addtl. link "View" that is available for Org Admins
          • and Org Admins with master flag to add new admins
        • master flag is not described in OAP (!)

        • addtl master flag to revoke ?
        • rename to "Org Administration"
        • don't show menu to OrgAdmins

  12. strategy plans ... next: strategy for "New Roots & Escrow"

    1. idea: using indirect crl's ?
      • 2 crl's needed, one valid, one invalid crl server
      • more infos available ? who ?
        1. build testserver with special certs
        2. Magu, Michael to send instructions for test deployment
      • meetings ago we've defined Testing requirements and a potential testszenario
      • to remind every meeting
      • Michael: testserver environment deployment
    2. policy group: define requirements
      • multimember escrow method ?
        • needs risk analyze
        • potential candidates ?
          • Marcus to contacted Benedikt, will contact Thomas K
          • Next step(s)
    3. how does debian work ?
      • defered to Froscon (end of Aug), CCCcamp (around Aug 10th)
  13. CI (Update)
    1. description to eclipse testpage, Webinar

      • deployment scenario:
        1. create testusers
        2. testing
        3. delete testusers
      • regression test for standard tests: eg 0,1,49,50,51,99,100,101 pts w/ and w/o CATS passed
      • reminder
    2. Jubula Test-Tool (by Michael) - update?
  14. next meeting: Tuesday, September 20, 2011 22:00

Minutes

  1. Marcus: 43.php to add notary.id to bug#882
    • dirk tries to upload new 43.php
  2. dirk: bug#827 update
  3. translingo: michael tries to deploy pootle
  4. michael: bug#846 reviewed, made some corrections, needs 2nd review
  5. PR: Alex not available, will prepare blog post, mailing
  6. Mozilla Communication: Immediate action requested
  7. Wytze: system upgrade on production and cacert1.it-sls.de (cont. from last meeting)
    • proposed next upgrade step lenny to squeeze
    • Action item: who informs Wytze?
    • -> Michael

  8. Testserver hosting: request to Funkfeuer directly ?
  9. Question from Lambert (by email): Is CAcert's ocsp server a blacklist or a whitelist ocsp ? (cont. from last meeting)
    • CAcert is probably a blacklist ocsp, cause the server delivers infos derived from current crl's interactively
    • Is this for Software-Assessment project group ? Next action step?
    • is topic for critical admin
  10. Jubula Test-Tool (by Michael) - update?
  11. bug#855 problem prevents testing of TTP entries
    • needs to be activated at least on testserver
  12. next meeting: Tuesday, September 20, 2011 22:00

Fixed Action Items since last or within meeting


Action Items New

Action items: Meeting Action Items


Software/Assessment/20110913-S-A-MiniTOP (last edited 2011-09-22 23:55:45 by UlrichSchroeter)