Subject: [TOOLS-DEVELOPMENT] TMC Conf Call Notes 4-27-07

From: Ray Pelletier <[email-masked]>
Date: Fri, 27 Apr 2007 12:17:03 -0400

TMC Conf Call Notes 4-27-07

NSS
Jon
Barbara

IETF
Russ
Brian
Lucy
Bob
Cullen
Henrik
Bill
Ray

Agenda
1.  Security Fix status and next steps
2.  Proposal to re-write ID Tacker Tools in Python
3.  Proposal & Tools Dev Report

1.  Security Fix status and next steps

Ray summary:
 5 April - Jon Proposal to fix not take more than three months and
              should not cost more than $42K.

5 April - Ray asks Bill, Henrik, Brian, Russ and Kurtis to evaluate 
merits of proposal

7 April - Ray authorized 50 hours of work to Near or at the end of these 
50 hours, I need an update on the assessment of how quickly this job can 
be completed and the hours necessary to complete the task. 

7 April - Jon will do

18 April - Jon
1. Michael and Sunny have spent the allotted/approved 50 hours working
to update/create various modules and subroutines as described in the
proposal.

2. John Korpi is reviewing the codes that Sunny and Michael updated 
and examing all of the codes form all of the tools for other possible
holes.

3. Ted Swearingen, from NeuStar security, will run a tool on all IETF
tools to find any possible security holes.

4.  Based on the initial work, and assuming that we do not find
additional issues, we believe that the remaining work could be completed
in no more than 300 additional hours.

5.  We also believe that we could have the rest of the work completed in
30 days from the time that we receive your approval to continue.

6.  We would like to discuss on Friday your inquiry to re-write the ID
Tracker in Python.  In short, it seems like an inefficient use of
resources given the likelihood that we can make all of the tools secure
for open source in a shorter and much less expensive time.

Brian - how solid 300?
Jon - could be less, depending what Ted and John say
Ray - status of other work?
Jon - IDST on track for May 9th
Jon - contract approved for LSMT; but wanted to wait for decision on Python

Jon - Ted and John input to you next week.

Ray - Security fix work on hold until further notice.
Ray - Do *not* deploy the work done during 50 hours until I authorize.  
We want to review what has been done.

2.  Proposal to re-write ID Tracker Tools in Python

Ray - Request April 16th

Jon - Michael's take is he wants to take a small tool, re-write it in 
Python and extrapolate development time and cost to develop the 
proposal.  That would take several weeks  Plus we want to see if there 
are off-shore Python assets available.

Russ - This is disturbing.  Perl and Python not that different; Risk 
averse approach.

Bill - Really securing it requires a re-write anyway.  And less work to 
re-write than fix. Framework makes a lot of things easier.  As for tools 
to do, leave off Secretariat tools.

Jon - clear on direction as to re-write; Michael may be missing the 
efficiency of Django.  Actions on our end are clear; research Django, 
Python, get expertise in; have framework for solution; proposal asap.

Bob - Have Michael talk to Bill
Jon - Will do

Ray - target proposal by 11 May, with an update if that date cannot be 
met and when it will be delivered. 

Ray - If a fix could take 30 days and a re-write as much or less, than 1 
July may be a reachable deliverable.

As to continuing risk:

Bill - risk; SQL security exploit; common problem; random values in 
request fields to probe vulnerability

Russ - could be toast if someone looks; SQL and Shell

Barbara - there other advantages to Python
Bill - using framework like Django

Henrik - have fixes been deployed
BF - No

Ray - do not deploy until we review.

_______________________________________________
TOOLS-DEVELOPMENT mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tools-development