GitLab Secure Stage, 16 Apr 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Secure Backlog Refinement Office Hours 2020-04-16

Description

Session on backlog refinement for weekly secure planning office hours

A

Okay, I could share my scheming, so I started. I started refining a little bit like half hour ago, or so so. I had pings ACK about this issue, which I think is second from I'll pull the planning board over to the work. I was looking looking here. Oh actually so I talked to Ross about this.

A

This was a card that got passed a Ross that I was working on and I think I about, haven't refined and I double-checked with him on slack the moment ago that he doesn't mind me, you know waiting it and adding group, basically working through the description and updating it with what we decided in our comments. So I can do that after this meeting. I don't think we need a synchronous call to do that, but I will do that today.

A

Get that one over then the next one that doesn't have anybody on it was this standardized security, analyzer lockers. So that's why I jumped in here and I saw that this seemed very similar to something Zack was already doing over here in this M. Our common logger, but I saw that he pulled himself off so I was asking him what he thought but I'll. Let you vocalize what what you said in slack exactly.

B

If you want sure yeah so that, mr that seventy three four they come in longer that just gives a standard josh was a.

B

Format for laundress, and so basically what we need to do is go through all the analyzers and see where we're logging with format prints and replace it with a actual logger. So all you need to do is I. Think I have in that, mr an example of how you would use it. So you just need to import log heiress and the common log you tell, then you can set the formatter to the default and then just go the code and replace.

B

Replace all the formats with logs, so that should be captured here, which this one I think what had happened was. This issue was a duplicate of something that I made and then the issue that I made was closed for this. So let's see what should we just I've mutation.

A

So I have one question about this card: I see that this is this is talking about touching all security products.

A

Lucas, what do you guys? Think of that? Should we scope this to just faster.

C

So I feel, like I've, been getting burdened by this exact conversation. A lot in that, like I've, been doing deprecation notices for us, but then all of Secours like hey, can we expand to all secure and then like oh yeah, by the way, auto dev ops and all the other configuration templates. So my my thought is yes start with us, but maybe check and see if it's logical to either get the work coordinated with other groups or if we care enough about it to go ahead and just do it ourselves.

D

Yeah I think that largely I completely agree with Taylor I think that it's a big part of that is level of effort for something like changing line of logging. It's probably a pretty simple change. The other thing that I think is worth addressing is not all security products are created, equal or rather or not, that different, so dependency scan is a store, obviously very tied in together the analyzers, so those two should probably be treated more similarly than say license. Management and des is always off doing its thing container.

A

Scanning is declare one right so that that might be straight for it, because it's also a go project and uses Carmen I believe yeah Aston license management should this doesn't really apply to that. Does it oh.

D

A

This is standardizing across.

D

All of them, though it does say analyzers, though so, unless we I don't know if that was a typo, but analyzers does not include dust container, skimming a license management, something.

B

That we could do because so Victor he created the the Golant issue that I was working on, and so we could just copy all those analyzers, because all those are go and then just apply the same thing here. Just update them walking for for those analyzers number for those projects which I think that would just be SAST and DAST.

A

All right, yes, re-entering.

B

A

Radom, so you have that list. That would be easy for you to just coffee paste in here. Yeah.

B

D

The only other thing I thought about this one was I, can't remember where this discussion happen, but Lagos is actually in meetings. Mode logging doesn't change that much, but do we want to standardize across a maintenance mode library? Oh.

A

That's a good question: I wonder if we just update this to not be loggers but to say uses common Locker right, so wait just to do wicked switch. Could then change from Lagos to something else if we wanted to in the future right?

A

What do you think of that? The.

B

The util is just it's: it's setting a laundress formatter, so it's specific to longer us! Oh I, see that right here, log yeah, so yeah.

B

But I mean yeah like with Lucas, was saying it's like logs. Don't change all that much and like I think the he had some message, we're like if there's a CV or something that pops up like he'll update that but like it's just not know, no new features are going to be added.

B

C

I'm fine with using.

B

Bloggers but um I like that other folks.

A

Yeah I've found a log risk as well I know we had a lot of different discussions about it, but we're also talking about you know analyzers, that are you know that that's a composition, analysis, so they might feel differently. Do we you want to open that conversation on this issue?

A

No, what do you think the appropriate step forward? There is Lucas.

D

If I recall correctly, they didn't care, so I would say just do it and again, it's mostly abstracted away in a common util. So I think that it's a fairly simple change to move forward later. But standardization is good, so standardized there and then, if we do things cool, but it's not like unless someone invents a new logging level this month now we need to use mm-hmm I, don't imagine it's a concern. Yeah I agree.

A

Cool, that's a good call out, though so, should I start editing. This live. Is that what we want to do this meeting or if I caught made you a different plan, I, don't feel like I've taken over and I. Don't need to do that. Well, I want to be I just moving us forward. Last.

B

Time we did this, was you.

A

B

Is your questions are answered, River we're all into that yep next person, okay,.

D

Taking some notes in the dock, so I hope I captured everything there. Oh cool.

A

Oh, look at that I'll stop sharing and then.

E

Okay, so okay I can, if nobody wants to party yeah I, can talk about the and I am working on all right.

E

Let me share my screen.

E

So I just took, and not this one yeah so I'm, trying to understand the scope of this issue brings a spook or can anybody please elaborate on this like this is completely new thing for me, like I'm, trying to understand why we need to move it to core. That's. Why I just I'm trying to read this one like this issue.

C

Why do you want to jump in here real fast, because I know sass decor has been around for a while. We have been blocked historically due to some licensing issues. Basically, we wanted to be careful with how we expose how we do license protection for our ultimate features.

C

There's an active discussion right now of leadership about is that a care that we have or not, you probably saw the blog post of us open sourcing or moving down 18 features to core that effectively already exposes the license check, so it's one we're kind of like if they did it. Let's also do it so I think we may go ahead and move this forward in 13.0 I'm meeting for a final approval on that. So now that we might get moving very quickly on sassed core, ok.

E

I found a list of like you, see here this table so which one should go to core SAS. Then yeah different things here, like access to security, dashboard, yeah, I'm, just digging into different start to understand the work scope, then I can define wire. We need to change yeah.

D

So um if you look at like the the entire lifecycle of how this works, we have a analyzer run in a job that produces an artifact that gets uploaded to the rails. Up to I could to render it in a merge request and eventually gets rendered in the security dashboard. That's a full lifecycle. Security dashboard is an ultimate feature, so that is not going to change. So that's fairly easy. Just don't show that item in the sidebar, and you know permissions and stuff.

D

The. According to the fourth item on this list, presentation of JSON reformers requests we're not actually showing the merge request, widget either. So all we need to do with this currently is allow the job to run without an ultimate license.

D

So if you look at our templates, there is a single line that prevents these things from running with our license, and that is checking whether get live features. Variable includes the word obsessed yeah.

D

We don't currently distinguish between any of our analyzers. In that way, we just check, if sassed as a feature and run the analyzers, so I'm, not sure that it makes sense to break down break these down per analyzer, with a lone exception being whether secret detection is separate which, based on the title, this it's not.

E

So there are a number of issues related to this. I can show you actually.

E

Well, is that not here actually.

E

Oh I forgot, ah so what I meant like there are similar issues in the breakdown I saw this just only says to court. There are other analyzers to call I saw I, don't know whether that is related.

E

Yeah, okay I can get back to this later. Let me let me dig into this. Then yeah I can discuss later on this yeah.

D

I would just say that this is a fairly big one, but I honestly, don't know if this is worth breaking down as separate issues per analyzer or treating at the up in the epic as a whole. So I would consider looking at that holistic way. Okay,.

E

Okay, I'll look into that Thanks.

E

Yeah yeah I'm done. If anyone wants to take over I.

A

Had a couple more clarifications now that I better understand how we're working through this, so in the DA in our Google Doc Lucas, you mentioned it to ignore container standing for the logging issue. That's actually a go repository that uses common. Should we Clark should we actually include that and just ignore license management and DAST I.

D

Like I forgot that Claire actually uses common, um yeah I should probably be included. Then okay, cool car.

B

Though I forgot, who who is who I was talking to about that, but they they implemented something I, think they have their own kind of loggers, Oh implementation. So let me, but but it's it's specific to declare it doesn't live in common, so I mean the way I seriously. We should have it standard across. You know. If you're using common, you should use a common law.

A

So that we should not have klar as a part of this issue and just do the two or should we try to also add in that I.

B

Think I, maybe I, think we should just do the two and then like. If could maybe paint them say, do we do want this because it's fairly low effort, you know um replacing it logs. So that's that's what I would do.

A

All right that guy ignores yes.

A

A

Okay and then in the in the issue where I could share my screen again, do.

A

In the issue, it actually says something about documentation, and it's talking about documenting the longer it's documentation here. Does that make sense like? Are people going to be able to modify the level of logging or what kind of documentation would we want to be seeing added here as a part of this issue, I.

D

Guess that link is supposed to go to the implementing custom scanners, which I'm trying to find where that documentation, lives. I think this.

A

Is oh yeah there's the product template that makes sense. I was just curious about oh yeah. Okay, let's add that yeah. We need a task to do to do that.

A

Okay, that makes sense, but in terms of Wow sorry kind of lost here there we go nope where'd you go there. It is this documentation task, I, don't see what do you? What do you all think that should be I think this probably goes away? We probably do want to add a checklist to our readme to our M. Our template is out. This is assuming.

A

Does that make sense that the M R? Is that what they mean by that you must be documented, o know when a new project. We also want to update our M. Our checklist to check for format calls. Would that be good? We.

B

Format calls them and of itself aren't bad because you can format strings, but it's printing.

A

So as part of the checklist or you think that we'll be able to see that pretty clearly that we should be logging in using the longer I.

B

Mean I I mean we could see that fairly easily. You know over checking a mark, so.

A

That's just in the project readme I.

D

Added a link in the dock to the the page, I was looking for, which I can I don't know where this is linked to, because I can never find it, but security scanner. Integration document M, which I think is it's primarily and a third party, is generating scanners. Agreeing with us I think that's probably where that would go. Okay, cool.

A

Do we want documentation on each of the analyzers read meas regarding it, or it's probably clear enough to have it in code right, okay, I'm thinking, I'll, probably just drop this whole little section of documentation, then we'll have one for the I. Don't know what would be put in the project template readme, though, what would the does this go away to what kind of documentation really want? I.

A

Think that's for like when we're spinning up a new analyzer to wrap right, yeah.

D

There's actually a template, a project template in analyzers, yeah I. Think it's right here right this.

A

Is it here what we would even put it's saying add something to the readme, but I, don't know what Victor was thinking we would document in that can.

D

You go back to the project. Is there a go mod file in here? Okay, no good! This is a template for security products. I, don't know I, don't I'm. Trying to remember I made this like a year ago. I never touched it so I'm trying to remember if there was a template for analyzer projects, which would actually be the one we be interested, yeah I, don't think it's necessary honestly. So I'm.

A

Gonna drop both of these and then all then I'll also add will add a documentation task for the custom scanners, cool all right. That I think gets me what I needed. So thank you.

A

Whoever's next.

A

Okay, I guess we're probably pretty close to the end of time here. But my next question is I see in a planning breakdown. We have.

A

We have a few that are assigned to other folks are all the ones that are assigned to folks ones that you get. You all are actively refining right now, yeah.

E

I'll, be there okay, so after refinement we can on assign ourselves right. Okay,.

A

Here's a slightly off-topic question when you create a new issue: what workflow labels it's supposed to get.

D

B

D

Feature or what I.

C

I struggle with this 2/3 way too many labels and I, don't fully understand always why and win make sure it gets tagged with our group if it's something that we expect to deliver the deliverable tag, if you just don't know, you can ping it to me, and I can figure out tags as well.

A

Right on yeah, but as long as it has group static analysis, then it'll show up on our board and will grow well, refine it at some point: okay, cool yeah, cuz, there's I, know one card. We stoped tighter and I need to create a couple issues to create new QA test projects and so curious where I was gonna, do with them so make sense.

E

There's a digged it dad right. I haven't checked that I need to use that.

D

There is a tuck, yet I, don't know how much we actually use that for three, but we we use backstage specifically I. Don't care you've used tech, debt, I, don't know if we'd use, I don't know in a more specific capacity. No.

C

Not really it's the pillar or it's a column in the pillars board that we're using. So it was just a way to have another bucket, yeah I, don't think it actually goes into any reporting or anywhere it's just more of metadata.

E

All right, I think we're running out of time. Yeah.

A

I gotta jump to another call. Thank you. Everybody. Okay,.

E