== Meeting information == * #ubuntu-meeting Meeting, 05 Jan at 17:02 — 17:30 UTC * Full logs at [[http://ubottu.com/meetingology/logs/ubuntu-meeting/2015/ubuntu-meeting.2015-01-05-17.02.log.html]] == Meeting summary == ''LINK:'' https://wiki.ubuntu.com/SecurityTeam/Meeting === Weekly stand-up report === The discussion about "Weekly stand-up report" started at 17:02. === Announcements === The discussion about "Announcements" started at 17:02. === Weekly stand-up report === The discussion about "Weekly stand-up report" started at 17:03. === Highlighted packages === The discussion about "Highlighted packages" started at 17:20. * ''LINK:'' http://people.canonical.com/~ubuntu-security/cve/pkg/oath-toolkit.html * ''LINK:'' http://people.canonical.com/~ubuntu-security/cve/pkg/gcc-4.9-ppc64el-cross.html * ''LINK:'' http://people.canonical.com/~ubuntu-security/cve/pkg/merkaartor.html * ''LINK:'' http://people.canonical.com/~ubuntu-security/cve/pkg/libplack-perl.html * ''LINK:'' http://people.canonical.com/~ubuntu-security/cve/pkg/texmacs.html === Miscellaneous and Questions === The discussion about "Miscellaneous and Questions" started at 17:21. == Vote results == == Done items == * (none) == People present (lines said) == * jdstrand (36) * chrisccoulson (8) * teward (7) * sbeattie (6) * sarnold (4) * mdeslaur (4) * ubottu (4) * meetingology (3) == Full Log == 17:02 #startmeeting 17:02 Meeting started Mon Jan 5 17:02:24 2015 UTC. The chair is jdstrand. Information about MeetBot at http://wiki.ubuntu.com/meetingology. 17:02 17:02 Available commands: action commands idea info link nick 17:02 The meeting agenda can be found at: 17:02 [LINK] https://wiki.ubuntu.com/SecurityTeam/Meeting 17:02 [TOPIC] Weekly stand-up report 17:02 actually, I skipped something 17:02 [TOPIC] Announcements 17:03 Thomas Ward (teward) provided an update for utopic for wireshark (LP: #1397091) Your work is very much appreciated and will keep Ubuntu users secure. Great job! :) 17:03 Launchpad bug 1397091 in wireshark (Ubuntu Trusty) "[Security] Update Wireshark in Precise, Trusty, and Utopic to include relevant security patches." [High,In progress] https://launchpad.net/bugs/1397091 17:03 [TOPIC] Weekly stand-up report 17:03 I'll go first 17:03 I'm in the happy place this week 17:03 I'm catching up on a few things 17:04 I have several snappy tasks to attend to this week, the first being some seccomp investigations 17:05 I'm going to be pulling people in for discussions, reviews, etc over the coming few weeks to make sure everything is sound and make sense 17:06 I've got two pending issues I'm working on: mercurial and glance. mercurial is community supported though, but if people had tips for getting the trusty testsuite to pass (a no change rebuild fails in tghave), feel free to contact me in #ubuntu-hardened 17:06 I'll figure it out eventually, but it'll go out faster if I get help from the community 17:07 mdeslaur: you're up 17:07 I'm on triage this week 17:07 and tomorrow I'm on patch piloting 17:08 We have a backlog of about 50 packages that need security updates, so I'll be working on that 17:08 that's it from me, sbeattie, you're up 17:08 I've got a variety of things on my plate this week: 17:09 I need to get back to the compiler pie-on-amd64 stuff: I've discovered it breaks dkms compilation for some reason 17:09 I'll try to pick up one or two of the outstanding updates 17:10 I was also working on updating vivid's apparmor to the upstream 2.9.1 release, and discovered that lp: #1407437 is an upstream issue 17:10 Launchpad bug 1407437 in apparmor (Ubuntu) "aa-enforce fails with ImportError: No module named rule.capability" [Undecided,New] https://launchpad.net/bugs/1407437 17:11 That's pretty much it for me. 17:11 tyhicks is not here, so sarnold? 17:11 I'm on community this week 17:12 I'll be catching up on two weeks of unread email and probably helping out with updates 17:13 I believe there's also a huge backlog of apparmor patches, but that'll probably only be short-and-easy patches reviewed initially 17:13 that's it for me, chrisccoulson? 17:13 This week, I need to fix bug 1398174 17:13 bug 1398174 in firefox (Ubuntu) "Move search provider defaults from Ubufox to Firefox" [Critical,Triaged] https://launchpad.net/bugs/1398174 17:14 I'll also be working on bug 1337506, and working through Oxide reviews 17:14 bug 1337506 in Oxide "FATAL:texture_manager.cc(76)] Check failed: texture_count_ == 0u (1 vs. 0)" [High,In progress] https://launchpad.net/bugs/1337506 17:14 And I finally managed to land http://bazaar.launchpad.net/~oxide-developers/oxide/oxide.trunk/revision/901 at the weekend :) 17:14 that's me done 17:15 chrisccoulson: for 1337506, is that an oxide crasher? 17:15 It is 17:15 chrisccoulson: do you have a feel for how often it happens? I occasionally see webbrowser-app crash and was curious 17:16 It's only a shutdown crash, but it's a symptom of a bigger issue 17:16 re LocationBarController API> cool! :) 17:16 chrisccoulson: ack 17:16 also, what prompted the fix for 1398174? 17:17 This is related to the change in default search engine 17:18 chrisccoulson: I guess I was really asking: is ubufox going away and if so, why? 17:18 It's not going away, but it won't define the default search engines anymore 17:20 [TOPIC] Highlighted packages 17:20 The Ubuntu Security team will highlight some community-supported packages that might be good candidates for updating and or triaging. If you would like to help Ubuntu and not sure where to start, this is a great way to do so. 17:20 See https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures for details and if you have any questions, feel free to ask in #ubuntu-security. To find out other ways of helping out, please see https://wiki.ubuntu.com/SecurityTeam/GettingInvolved. 17:20 http://people.canonical.com/~ubuntu-security/cve/pkg/oath-toolkit.html 17:20 http://people.canonical.com/~ubuntu-security/cve/pkg/gcc-4.9-ppc64el-cross.html 17:20 http://people.canonical.com/~ubuntu-security/cve/pkg/merkaartor.html 17:20 http://people.canonical.com/~ubuntu-security/cve/pkg/libplack-perl.html 17:20 http://people.canonical.com/~ubuntu-security/cve/pkg/texmacs.html 17:21 [TOPIC] Miscellaneous and Questions 17:21 Does anyone have any other questions or items to discuss? 17:21 *raises hand* 17:21 teward: hi, go ahead 17:21 jdstrand: thanks for the acknowledge on the wireshark updates - on that note, work has stalled on the other versions, the community is welcome to start picking up on that. 17:22 new upload to Vivid for nginx has effectively mitigated POODLE out of the box - this was an issue on my radar for some time and has effectively been mititgated as of last week out of the box thanks to Debian changes. 17:22 /done 17:22 re nginx> oh, neat :) 17:23 jdstrand: yeah, i thought so, it's handled at the nginx.conf (nginx-instance-wide) level instead of at the site config level, which is why i say it effectively mitigates POODLE 17:23 definitely a plus :) 17:24 since nginx-core is in main, i thought it relevant to mention. all done here. 17:30 mdeslaur, sbeattie, sarnold, chrisccoulson, teward: thanks 17:30 #endmeeting Generated by MeetBot 0.1.5 (http://wiki.ubuntu.com/meetingology)