. '''To Software [[Software|Software]]''' - '''To Software-Assessment [[Software/Assessment|Software/Assessment]]''' - '''To [[Software/Assessment/20120807-S-A-MiniTOP|previous meeting]]''' - '''To [[Software/Assessment/20120821-S-A-MiniTOP|next meeting]]'''

----

= Minutes of the MiniTOP on the 2012-08-14 =

== Setting ==
The MiniTOP will be held via telco  22:00 CEST

Attendees: Marcus, magu, uli, benny, Michael, dirk


== Topics ==

(skip to [[#AGENDA|agenda]])

Action items from last meeting '''[[Software/Assessment/ActionItems|Meeting Action Items]]''' 
<<Include(Software/Assessment/ActionItems)>> 



<<Anchor(AGENDA)>>
== Agenda ==

## last full agenda https://wiki.cacert.org/Software/Assessment/20120228-S-A-MiniTOP


=== 1. Preface ===
 1. Cebit brainstorming
  * dirk: request for events report
  * (2012-03-27) Marcus awaiting translation from Marc
  * (2012-06-19) Marcus: translation received, will send within the next upcoming days
  * (2012-06-26) Marcus: not yet finished
  * 2nd draft finished
  * Sat report missing, Uli sent a report 2012-03-22 (with wiki link [[Assurance/Procedures/RLO]]
  * Marcus to compile final report

=== 2. Testing session on bug 1070 ===
 1. Testing working session of [[https://bugs.cacert.org/view.php?id=1070|bug #1070]]
  || all || [[https://bugs.cacert.org/view.php?id=1070|bug #1070]] Certain account passwords are logged in web server error log || patch applied on production and testserver<<BR>>arbitration still open [[Arbitrations/a20120614.1|a20120614.1]]<<BR>>2nd review done by dirk<<BR>>Testing working session for agenda of upcoming meeting || {0} ||


=== 3. DEV on bug 1023 ===
 * "Thawte points removal, final step" [[https://bugs.cacert.org/view.php?id=1023|bug #1023]]
  * bug #1023 Testing (6.php)
 * last patch transfered to production system 2012-05-30
 * what are the next steps for thawte points revoke?
  * points settings codes eg 50 pts open gpg/pgp, which certs avail by how many pts
  * 15.php needs rename to 10.php

=== 4. 2nd review of about 1 remaining patches ===

 ||<#ff8080> '''Software-Assessors task''' ||

 1. Benny pre-views done
  || neo || [[https://bugs.cacert.org/view.php?id=978|bug #978]] Invalid SPKAC requests are not properly validated || recheck full certs signing procedures<<BR>>duplicate report to bug#540 || 5 {0} ||

  * from meeting 2012-07-17:
   * 5 patches reviewed
   * 3 simple, bugs 540 (fixed), 789 (fixed), 981 (reviewed)
   * 2 with some difficultys, 978 (related to bug#540), complexest one: 1024 (reviewed)

 1. [[https://bugs.cacert.org/view.php?id=978|bug #978]] bug 978 (weak keys) (bug 918)
  * invalid key format, no regular error message, something wrong, error code # identified
  * debugging infos from user + infos from critical team with error code #, was spkac routine
  * one test done 2011-12-17 by JensK
  * uli, marcus: more tests: certs routine, weak keys (small keys test), relates to [[https://bugs.cacert.org/view.php?id=540|bug#540]] tests
  * (week 7)

 || neo || [[https://bugs.cacert.org/view.php?id=978|bug #978]] Invalid SPKAC requests are not properly validated || recheck full certs signing procedures<<BR>>duplicate report to bug#540 || 5 {0} ||

=== 5. Patches to transfer to production ===

 || neo || [[https://bugs.cacert.org/view.php?id=1024|bug #1024]] Assurer flag is not set correctly on updatesort.php run || tested by 4, ok<<BR>>2nd review by dirk, ok || 2 {0} ||
 || inopiae || [[https://bugs.cacert.org/view.php?id=981|bug #981]] OA overview (dupe of [[https://bugs.cacert.org/view.php?id=943|bug #943]]) || New layout of view for Organisation Administrators in account/id35<<BR>>2nd review by dirk, ok || 4 {0} ||


=== 6. Patches Overview - DEV and Testing ===
 1. Bugs under Testing
 1. English Translation Problems
  * how to handle typing error in web phrase [[Software/TranslationMisspelling]]
   * "Can't continue with certificaterequest." in ../includes/account.php:341 ../includes/account.php:1482
   * create shared bug
   * probably make part a. and b. a. that is clear, b. that is questionable
   * new [[https://bugs.cacert.org/view.php?id=1086|bug #1086]]

 1. Marcus Bugs list
  * see also [[Software/BugsOverview]]

  * [[https://bugs.cacert.org/view.php?id=1023|bug#1023]] related
   * [[https://bugs.cacert.org/view.php?id=583|bug#583]] "Assure Somebody" allows future assurance dates
   * [[https://bugs.cacert.org/view.php?id=648|bug#648]] send message from Assurer to Member
   * [[https://bugs.cacert.org/view.php?id=802|bug#802]] Name parts should be designated in assurance form
   * [[https://bugs.cacert.org/view.php?id=870|bug#870]] My Details - My Points show bugus time stamp
   * [[https://bugs.cacert.org/view.php?id=914|bug#914]] Information about Practice on Name while entering an Assurance
   * [[https://bugs.cacert.org/view.php?id=930|bug#930]] types wrong points in "Assure Someone" form
   * [[https://bugs.cacert.org/view.php?id=931|bug#931]] Date of assurance in future don't throw any exception
   * [[https://bugs.cacert.org/view.php?id=998|bug#998]] When entering an assurance in the WoT one line of the form the suffix is given in another line the suffix is missing.
   * [[https://bugs.cacert.org/view.php?id=1000|bug#1000]] Entering an assurance into the system after searching for an assurer causes a pre-filled location field
  * Others
   * [[https://bugs.cacert.org/view.php?id=118|bug#118]] Secure TTP Form upload - outdated, conflicts with new procedure, closed
   * [[https://bugs.cacert.org/view.php?id=428|bug#428]] Reminder language-drop-down-box doesn't keep "English" if you choose it again - cannot be reproduced, tested by 2, closed
   * [[https://bugs.cacert.org/view.php?id=489|bug#489]] Pb on rewarding 2 points for an assurance
   * [[https://bugs.cacert.org/view.php?id=567|bug#567]] case sensitive email: tested by 2, cannot be confirmed, closed
   * [[https://bugs.cacert.org/view.php?id=767|bug#767]] Single-quotes escaped in Web-of-Trust contact form.
  * info pages to wiki pages
   * starting [[https://bugs.cacert.org/view.php?id=671|bug #671]]. there still exist a bug# [[https://bugs.cacert.org/view.php?id=740|bug #740]] (How to become an assurer is missleading)

  * [[https://bugs.cacert.org/view.php?id=491|bug #491]] "Please allow usage of "secondary" emails user ids." - proposes: Close with rejected
   {{{
  * username/password half of the combination is known to potential attacker
  * login prevents login to several email addresses
  * acceptance to several email addresses is prevented
  * no notification if primary email address has been changed
  * note regarding Policy Group
  * dirk: proposal: response email address exists, but isn't primary email ?
   * create new account results in "email address exists"
   * what is a proper response?
   * requestor has to be an assurer for assure someone
  * neo: for registration process chaptcha required
  * no good solution
  * for assurance only primary, for all other services allow also secondary addresses
   * search needs enhancement: search not only primary, also secondary
}}}

  * [[https://bugs.cacert.org/view.php?id=571|bug #571]] "need for email addresses (or link) in admin console" - proposes: Closed with solved by other bug fix
  {{{
  * primary and secondary email addresses are shown in admin console
}}}

  * [[https://bugs.cacert.org/view.php?id=591|bug #591]] "CPS has to be improved for audit." - proposes: Closed
  {{{
  * CPS is a working revision also DRAFT revision included
  * relates to policy repository bug# final place finding
}}}

  * addtl. groups:
   a. OA
   a. CCA rollout
   a. TTP

 1. [[https://bugs.cacert.org/view.php?id=1025|bug #1025]] "Domain Dispute strange behaviour / Domain Dispute issue", checked
  * wrong description, problem removing domains, bugfix solves this problem
  * async removal of certs by signer
  * needs review and testing
  * inopiae will try testing on upcoming weekend
  * to test: email- and domain dispute

 1. [[https://bugs.cacert.org/view.php?id=922|bug #922]] "CAcert application code problem causing missing 'certificate about to expire' messages", checked
  * patch seems to be ok
  * white spaces cleanup
  * includes/account.php var $id shall be fixed within recursion, new [[https://bugs.cacert.org/view.php?id=1078|bug #1078]]
  * 2 tests initiated by inopiae and u60
  * principle ok, but very confusing
  * test reports Marcus:
   * discussions, Marcus got 71 or 72 notifications
   * Neo: default 5 notifications: 45d, 30d, 15d, 3d, 1d
  * [[https://bugs.cacert.org/view.php?id=922|bug #922]] test report / review
   * one test account, 1 client cert, 1 server cert, received 105 (1) reminders (!!!)
   * 15 reminders checked, 1 for client cert, 14 for server cert (!!!)
   * needs further inspection
  * Bug Testing / Reporting bug #922 difficult
   * Marcus writes a tool to collect Email infos from TMS 
  * benny will try to debug mass mailing problem with [[SystemAdministration/Systems/Development|local image]]

 1. [[https://bugs.cacert.org/view.php?id=1019|bug #1019]] "Contact form does not work when logged in"
  * Michael: rework contact form
   * usability: 1 form, option box with public/support delivery, default support
   * current form 1: public, form 2: private
   * spam prevention via java, on disabled java the mail is marked [possible spam]
  * mass mailing possible if adding multiple emails separated by commas
  * account.php - email address from sender, no address validation, several other places it passes address validation
  * neo: why not use primary email address?
   * works only if logged-in
  * index?id=11 has also been changed
  * url was hardcoded
  * account.php?id=14
  * sendmail() routine in includes/mysql.php

 1. Findings from David
  1. (char) 160 is problematic in various locales, as it appears as whitespace (160 is not a particularly good val either in ISO-8859-1) in certs
   * todo: doing whitelist of allowable chars
   * \xA0 is a problem too (at least in Win32/64)
   * todo: file a new bug#
  1. subjectAltName is occasionally not checked for problems
   * todo: file a new bug#

=== 7. Benny reviews ===
 1. bug #922 debugging
  || benny || [[https://bugs.cacert.org/view.php?id=922|bug #922]] will try to debug mass mailing problem with [[SystemAdministration/Systems/Development|local image]] || {0} ||


=== 8. New SA candidates and Coders ===

 1. ABC Benny - possible Itzehoe (2012-09-14), mrmcd (2012-09-08) or other events before 2012-08-10 - 2012-08-11 BarCamp kiel
  * [[Arbitrations/a20120703.1|ABC Benny]]
  * ABC Benny, no fixed date set yet
 1. ABC David
  * [[Arbitrations/a20120721.1|ABC David]]
  * at board meeting 2012-08-05 ATE-Melbourne report by Ian the interview was probably named as ABC interview
  * Philipp will pickup [[Arbitrations/a20120721.1|ABC David a20120721.1]]
  * Case closed: 2012-08-10
  * Ruling:
  {{{
Since this Arbitration has been aborted, no conclusions are reached. David is a person who could help CAcert a lot. Doing so in a security sensitive are is not recommended at this time.
}}}
 1. Heino, not yet prepared, needs first contact
 1. How to find coders? Experiences from the Gentoo project
  * [[http://redmonk.com/dberkholz/2012/07/10/how-to-recruit-open-source-contributors/]]
  * [[http://www.slideshare.net/dberkholz/lessons-on-recruiting-open-source-contributors-from-the-google-summer-of-code]]
  * use as blueprint for other recruits?
 1. report from last board meeting - topic Arbitration
  * is added to upcoming [[Brain/CAcertInc/Committee/MeetingAgendasAndMinutes/20120819|board meeting 2012-08-19]]

=== 9. Long Term Projects ===

 1. NEO: "BlackJack" [[https://bugs.cacert.org/view.php?id=964|bug #964]]
  * 2012-07-17 NEO: has finished IE patch, [[http://cacert.nhng.de/IEkeygen/keygen.html]]
  * meeting 2012-07-24: working session: testing "Black Jack"
   * marcus: tested chrome
   * marcus, uli: enable-login flag set after key has been signed with unset flag on request, fixed
  * 2012-07-24 working session
   1. NEO: (964) enable-login flag fixed, to transfer to testserver
   1. NEO: org-certs prob
   1. ben: "Bei den Fehlermeldungen der Statuscodes bitte Hex und Int angeben. Au?erdem beim Ablehnen der Best?tigungsmeldungen die Fehlermeldung etwas aussagekr?ftiger."
    * "Fehler: Nachricht (0x80000095 / -2147.....)"
    * error messages on ms website: [[ http://msdn.microsoft.com/en-us/library/ms953432.aspx#smartcardcspcook_topic3]]
   1. magu: tests bug #964
    * error messages:
     * available key sizes: 512-1024 Bit (in 64 Bit steps)
     * Schlumberger CSP, Keysize 1024 --> 2146435043
     * Infineon SICRYPT Base Smart Card CSP Keysize Nothing  Error_ (-7feff92 / -2146434962)
  * NEO: "BlackJack" [[https://bugs.cacert.org/view.php?id=964|bug #964]] testing from last week -> error codes
   * started implementing

 1. Marek's sql class project:
  * is working on charset replacement

 1. api project, Carsten continues with portal project not waiting for vendor-api to be delivered
  * potential candidates for development
   1. Marek's sql class proposal
    * needs probably db upgrades
    * needs addtl. indices
    * needs testing
   1. archaios
    * builds daemon as unpreviliged user
  * vendor-api delayed
   * no coders
   * other projects
   * related to sql class project
  * portal project continues with a workaround, needs an assurer
   * arbitration case on locations database orders outsourcing of find-an-assurer asap
   * with portal function, update of data is possible vs. update of data on critical system is difficult (keep data current for assurers)
   * relation to location database
    1. website find an assurer
    1. scripted mailing for ATE invitations
   * user check that data is still valid eg every 1 year
    * notification at login upto 6 months not online
    * notification by email if not logged in within last 6 months

=== 10. next meeting ===
 * Tuesday, August 14th, 2012 22:00 CEST


== Minutes ==

 1. Benny tried to get dev vm running
  * had problems with network settings, finaly fixed

 1. "BlackJack" [[https://bugs.cacert.org/view.php?id=964|bug #964]] 
  * error "key length too short" don't redirects to new page, so session environment gets lost
  * testing default crypto providers
  * testing gooze crypto stick

 1. cacert git repository requires update

 1. [[https://bugs.cacert.org/view.php?id=1024|bug #1024]] passed to production
  * dfference seen under wot?id=1 (hidden stat)
  * displays users as "is assurer: yes" and "is assurer: not yet (in red)"

 1. Marcus testing [[https://bugs.cacert.org/view.php?id=964|bug #964]]
  * some error messages fixed

 1. Testing working session of [[https://bugs.cacert.org/view.php?id=1070|bug #1070]]
  || all || [[https://bugs.cacert.org/view.php?id=1070|bug #1070]] Certain account passwords are logged in web server error log || patch applied on production and testserver<<BR>>arbitration still open [[Arbitrations/a20120614.1|a20120614.1]]<<BR>>2nd review done by dirk<<BR>>Testing working session for agenda of upcoming meeting || {0} ||
  1. from testing side, good to go
  1. pass back to arbitration

 1. bug #922 debugging
  * probably distinct missing in sql query
  * current production: notifications not rcvd
  * emails on ca-mgr1 reset, done

 1. blog post for bug #1024 ?
  * Marcus will do

 1. Marcus: cap, ttpcap generation outsourcing to portal server?

 1. New SA candidates and Coders
  1. ABC Benny - possible Itzehoe (2012-09-14), mrmcd (2012-09-08) or other events before 2012-08-10 - 2012-08-11 BarCamp kiel
   * [[Arbitrations/a20120703.1|ABC Benny]]
   * ABC Benny, no fixed date set yet
   * potential dates: 2012-09-08 mrmcd or 2012-09-15 Itzehoe
  1. ABC David
   * [[Arbitrations/a20120721.1|ABC David]]
   * at board meeting 2012-08-05 ATE-Melbourne report by Ian the interview was probably named as ABC interview
   * Philipp will pickup [[Arbitrations/a20120721.1|ABC David a20120721.1]]
   * Case closed: 2012-08-10
   * Ruling:
   {{{
Since this Arbitration has been aborted, no conclusions are reached. David is a person who could help CAcert a lot. Doing so in a security sensitive are is not recommended at this time.
}}}

 1. next meeting
  * Tuesday, August 21st, 2012 22:00 CEST




==== Fixed Action Items since last or within meeting ====

 || neo || [[https://bugs.cacert.org/view.php?id=1024|bug #1024]] Assurer flag is not set correctly on updatesort.php run || tested by 4, ok<<BR>>2nd review done by dirk || 2 {g} ||
 || inopiae || [[https://bugs.cacert.org/view.php?id=981|bug #981]] OA overview (dupe of [[https://bugs.cacert.org/view.php?id=943|bug #943]]) || New layout of view for Organisation Administrators in account/id35 || 5 {g} ||
 || benny, NEO || [[https://bugs.cacert.org/view.php?id=922|bug #922]] will try to debug mass mailing problem with [[SystemAdministration/Systems/Development|local image]] || mass mailing prob fixed, continue testing || {g} ||
 || all   || [[https://bugs.cacert.org/view.php?id=1070|bug #1070]] Certain account passwords are logged in web server error log<<BR>>2nd review done by dirk<<BR>>Testing working session for agenda of upcoming meeting || ready to go || {g} ||


==== Action Items New ====

 || NEO || cacert git repository requires update || || {0} ||
 || Wytze, NEO || [[https://bugs.cacert.org/view.php?id=1070|bug #1070]] Certain account passwords are logged in web server error log || patch applied on production and testserver<<BR>>arbitration still open [[Arbitrations/a20120614.1|a20120614.1]]<<BR>>2nd review done by dirk<<BR>>from testing side, good to go<<BR>>pass back to arbitration || {0} ||


Action items: '''[[Software/Assessment/ActionItems|Meeting Action Items]]'''

----
 . CategorySoftwareAssessment