Hello TSC,

The time has come for the TSC to approve the release of the Composer audit report.  The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.

The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.

The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.

The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages.

Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange for you to receive a copy.

Cheers!
Dave
---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

Hello TSC,

The time has come for the TSC to approve the release of the Composer audit report.  The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.

The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.

The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.

The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages.

Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange for you to receive a copy.

Cheers!
Dave
---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

That's a good proposal Hart. The policy now is to ask for approval to release these but it probably should be revised to: "release them as soon as all high and medium issues are resolved and only ask for TSC approval if there are any outstanding issues.".

If y'all agree, I'll make a formal policy change request to this list and we can do a quick vote on Thursday. That will streamline things.

Dave

---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

On Tue, Feb 19, 2019 at 4:00 PM Montgomery, Hart <hmontgomery@...> wrote:

+1.  As usual, I’m pretty much always in favor of releasing these.

 

Can we automate this process?  It seems like we should have some kind of policy in the vein of “release the security audits unless there are major outstanding issues.”

 

Thanks,

Hart

 

From: tsc@... [mailto:tsc@...] On Behalf Of Mic Bowman
Sent: Tuesday, February 19, 2019 3:29 PM
To: Dave Huseby <dhuseby@...>
Cc: Hyperledger List <tsc@...>
Subject: Re: [Hyperledger TSC] Proposed release of the Composer security audit report

 

seems low risk to release. 

+1

 

--mic

 

 

On Tue, Feb 19, 2019 at 2:19 PM Dave Huseby <dhuseby@...> wrote:

Hello TSC,

The time has come for the TSC to approve the release of the Composer audit report.  The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.

The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.

The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.

 

The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages.

Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange for you to receive a copy.

Cheers!
Dave
---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

+1.  As usual, I’m pretty much always in favor of releasing these.

 

Can we automate this process?  It seems like we should have some kind of policy in the vein of “release the security audits unless there are major outstanding issues.”

 

Thanks,

Hart

 

From: tsc@... [mailto:tsc@...] On Behalf Of Mic Bowman
Sent: Tuesday, February 19, 2019 3:29 PM
To: Dave Huseby <dhuseby@...>
Cc: Hyperledger List <tsc@...>
Subject: Re: [Hyperledger TSC] Proposed release of the Composer security audit report

 

seems low risk to release. 

+1

 

--mic

 

 

On Tue, Feb 19, 2019 at 2:19 PM Dave Huseby <dhuseby@...> wrote:

Hello TSC,

The time has come for the TSC to approve the release of the Composer audit report.  The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.

The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.

The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.

 

The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages.

Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange for you to receive a copy.

Cheers!
Dave
---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

Hello TSC,

The time has come for the TSC to approve the release of the Composer audit report.  The Composer audit done by Nettitude found a total of five issues, 2 medium risk, 2 low risk, and 1 data leakage notice.

The first of the medium risk errors was simple to fix. Credentials for logging into blockchain instances were stored in world-readable files instead of only user-readable files.

The second of the medium risk errors was the playground server accepting connections from any source IP address. This was solved by changing the code to bind to the loopback interface.

The other issues were about accepting non-TLS connections and leaking unnecessary information in log error messages.

Now that all of the issues of medium or higher have been fixed, it is time to publish the report and announce it. As always, if you are a member of the TSC and would like to read the reports before approving them, please email me directly and I will arrange for you to receive a copy.

Cheers!
Dave
---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

---
David Huseby
Security Maven, Hyperledger
The Linux Foundation
+1-206-234-2392
dhuseby@...

Hyperledger Technical Community:

Today, we’re excited to open the call for the 2019 internship mentors and project ideas. We’re looking to sponsor 15 internship projects this year.

The Hyperledger internship program is aimed at creating a structured hands-on learning opportunity for college students who may otherwise lack the opportunity to gain exposure to Hyperledger open source development and entry to the technical community. It also provides a more defined path for Hyperledger to connect with the next generation of student developers to inject more talent into its developer base.

If you’ve identified a project or task that’s suitable for an internship project and you’re interested in mentoring a student developer, please define the project by completing the internship project proposal template on the wiki before February 22. Additional timeline for this year’s program is as follows:

• Call for Internship Projects and Mentors: January 28 - February 22, 2019
  
• TSC Review and Approval of Internship Projects: February 22 - February 28, 2019
  
• Application Period: March (and possible through April 12, 2019)
  
• Application Review and Applicant Interview: April
  
• Intern Acceptance: end of April
  
• Intern/Mentor Introduction and Onboarding: May
  
• Intern Start Date: June 3, 2019
  
• Full-time Intern Completion Date: August 23, 2019 (12 consecutive weeks)
  
• Part-time Intern Completion Date: November 15, 2019 (24 consecutive weeks)
  

A few things to note as you plan to submit a project for consideration:

• Multiple mentors supervising one intern per project would be desirable as this helps spread the workload and reduce the challenge of coverage caused by working remotely with an intern in a different time zone.
  
• The mentor(s) need to be familiar with the project and is/are expected to directly supervise the intern’s technical work.
  
• The proposed project needs to be clearly scoped and structured to be suitable for an internship project.
  
• The project should be related to one of the current Hyperledger frameworks or tools.
  
• The mentor(s) should be ready to be the sponsor of the internship project as a Hyperleger Lab when the internship commences. This ensures that the project progress can be tracked and the project output can be publicly accessible to the community.
  

Interns will be eligible to receive a stipend. The stipend will be paid in several installments provided that regular interval evaluations show the intern is making satisfactory progress. Each intern who has successfully completed the program will be invited and financially sponsored by Hyperledger to attend an event/conference and present their work to the broader community (specific event TBD but will be during Q3 or Q4 of this year). 

We look forward to your submission of a project and thank you in advance for volunteering your time to contribute to the training of the new talent pool in the Hyperledger community.

Kind regards,
Min

--
Min Yu
Operations Manager
The Linux Foundation
+1(530) 902-6464 (m)
myu@...

https://wiki.hyperledger.org/display/HYP/2019+02+14+TSC+Agenda

Please feel free to add inline comments.  Don't need to click "edit". simply highlight and wait a second and a comment button will occur.

Cheers,

Silona

--

Silona Bonewald

VP of Community Architecture, Hyperledger

Mobile/Text: 512.750.9220
https://calendly.com/silona

The Linux Foundation
http://hyperledger.org

Mark Wagner created a page

Performance and Scale WG Working Group Performance and Scale Working Group (PSWG) Working Group Health The PSWG published the Metrics Document late last year.  This provides low level metric definitions that should apply to most DLT implementations. (Latency, throughput, etc) The group is now going to "move up the stack" and define metrics that pertain to general use cases (verticals).  We have started to focus on supply chain and look to define basic performance and scalability measurements for that area. We reached out to the community a few weeks ago and received a lot of positive energy. Now we need to follow up. We also need to reach out specifically to project Grid and there are rumors of a Supply Chain SIG that we will also explore common areas with. In January 2019 we also had a call with STAC. STAC is a for profit organization focused on performance in the securities and financial space.  The goal of our interaction is to see if there is some common ground between Hyperledger and STAC and look for areas of cooperation. If we (PSWG) proceed down this path, we will also need to look at the specific use cases that would pertain to the STAC members. We will also reach out to the Hyperledger Financial SIGs as appropriate. The group has maintained a core of eight regular participants spread across the globe and across many companies and academia. The discussions remain very technical and perhaps we get too deep. We continue to reach outside of the Hyperledger community and have regular contributions and feedback on our work from this population. Issues If we proceed with STAC there is concern about being able to get everything done. We discussed the need to increase participants via direct recruiting or leveraging other Hyperledger activities (SIGs, projects, WGs), or drop the supply chain effort for now.  Because of this, the Supply Chain effort has been intentionally slowed a bit, which in hindsight is probably an error on my part. Overall Activity in the Past Quarter Due to holidays , winter breaks, and vacation schedules, meetings have been less frequent but that will change now as we get into the doldrums of February.  There was also a natural slowdown due to publishing our Metric Document.  Overall the group has been active and there have been many discussions on what to do next. We decided on defining metrics metrics for supply chain. Planned Work Products At this point we need to move forward with our supply chain work. This will also get more involved with other Hyperledger efforts. We will also continue to pursue the STAC relationship. This will get us involved with the external community and help make Hyperledger visible to the STAC members. We will also work with Hyperledger activities focused in the financial and securities space. The output of any of this work will be to define metrics that apply to the specific verticals and use cases. Participant Diversity This is a very active and diverse group of people from North America, Europe, and Russia. As mentioned above, we have a good mix of companies and folks from academia. From a gender diversity perspective, It is mainly male with an occasional female participant. We received positive feedback on the shout out for help with Supply Chain and should and see an increase in participation from that effort. Additional Information Reviewed By Arnaud Le Hors Baohua Yang Binh Nguyen Christopher Ferris Dan Middleton Hart Montgomery Kelly Olson Mark Wagner Mic Bowman Nathan George Silas Davis View page • Add comment • Like

Stop watching space • Manage notifications This message was sent by Atlassian Confluence 6.11.2