Standup Notes 2020 12 15

Participants (alphabetical): Allie, Conor, Erik, John, Kevin, Kushal, Mickael, Ro

Topics and Call-outs

fedora-32 breakage due to pulseaudio

• Fix should have landed in stable earlier today: https://github.com/QubesOS/qubes-issues/issues/6234#issuecomment-739998536

Heads up: v2/v3 discussion at Support Sync

• Should banner language change for 1.7.0 release?
• Other technical changes or messaging related to v3/Focal transition?

Update Required: Your SecureDrop servers are still running v2 onion services, which are being phased out for security reasons. In February 2021, v2 onion services will be disabled, and your SecureDrop servers may become unreachable. Learn More -> https://docs.securedrop.org/en/stable/v3_services.html

[Security discussion if we have time]

Allie

Yesterday:

• PTO

Today:

• Support Sync

• Review audit feedback

• Debug: Run SDC on Qubes in the background today to see if I get network connectivity issues in the client even though the proxy is still connected to the server

  • Best guess without digging in yet is that the issue is in the error handling between proxy, sdk, and client

• Work on Docs for the client if there's time

Blockers or Asks:

• N/A

Conor

Yesterday:

• PTO

Today:

• Review of most recent preliminary audit findings
• Start work on metapackage distro split https://github.com/freedomofpress/securedrop/issues/4134

Blockers or Asks:

• None

Erik

Yesterday:

• git workshop prep
• Investigating security issue, posted initial report
• Budget final review

Today:

• v2/v3 transition chat (deferred from yesterday)
• git workshop round 2
• Infosec council
• Some pre-holiday backlog curation

Blockers or Asks: None; reminder I'm out til 2021 starting Thursday

John

Yesterday:

• Rebuilding workstation to check more audit feedback
• merged passphrase PR (#5600)
• reviewed org name PR (#5629)

Today:

• Continuing on audit feedback

Blockers or Asks:

• None

Kev

Yesterday:

• PR to allow Focal prod VM builds using local packages

Today:

• Reviewed bandit related PR
• Rebased outstanding PR
• v2/v3; Git workshop support

Blockers or Asks: None

Kushal

Today:

• Bandit fix https://github.com/freedomofpress/securedrop/pull/5670
• Reviewed https://github.com/freedomofpress/securedrop/pull/5669
  • I will stamp and merge tomorrow (rebased by kev)
• Updated https://github.com/freedomofpress/securedrop/issues/1261#issuecomment-745425252 to explain how to get unix sockets for web server + tor with our application.

Tomorrow:

• next tasks + 5669 Blockers or Asks:
• None

Mickael

Yesterday:

• unattended upgrades research
• PTO
• Review of audit findings

Today:

• SSHd config
• ossec docs
• meetings
• more reviews as needed

Blockers or Asks:

Ro

Yesterday:

• Support comms
• followup nudges with prospective trainees/SD instances
• looking at last OS migration notes in prep for meeting today
• short day

Today:

• support-related meetings + comms
• Prospective SD instance followup meeting
• redmine cleanup

Blockers or Asks:

• none