#metabrainz

I have no feedback, but it seems fine to me.

i only do releases via github so they're verified

Approval for/of what?

I agree the email we use should be verified

I'm not sure who the stakeholders are, but ruaok has said it seems fine, so let's go with that and move on?

+1

This is just deciding on common practices, but I guess I will just harras people during the rest of the week, move on :)

these things might be best done in a smaller meeting or just informally in the channel.

Alright!

Yeah.

yea

ruaok: MBH-513 dev sec policies

MBH-513: Metabrainz policy for software dependencies / package upgrades https://tickets.metabrainz.org/browse/MBH-513

ok, now that we're all here... how should we proceed on this?

hullo.

my brain is so addled I can't even recall what we talked about last week.

every project lead should come up with a way they want to handle this and we'd see which ones we want.

I think we agreed that we needed to each of us keep up on security warnings and then have some sort of way to hold each other accountable as to how to do it.

I think there ought to be one process for all metabrainz that we all follow.

that way we can see when another team isn't following it and threaten to take their chocolate allowance away.

iirc we were talking about using jira to track relevant/non-relevant security warnings

wait, I guess there needs to be a chocolate allowance first. hmm.

I think Jira makes sense.

:o

but even jira can be easy to ignore.

yes.

zas: in the end security is your responsibility.

if yo uut me on the job i'm good at nagging people :D

but doing the work to get there is not.

would it be fair to have you have the responsibility for making sure we're following the process we set out?

zas?

hmmm

sorry just discovering i'm responsible of a can of worms

oh no

not directly no.

but like i said. tell me who to nag and i wil lnag them

I'm just trying to think of the right person to follow up on this who is not a dev.

CatQuest: thanks, but we need someone with much deeper tech skills.

meh

i tried

let's leave the who part off the table for now.

if we use jira, do we make one new project that covers security adivsories for all projects?

i'd say so

i can do that, but to be clear: security doesn't really exist, so we'll have to define what you call "security", because i know guys in many secret services in the world who are still wondering who hacked them...

bitmap: iliekcomputers: yvanzo: y'all should've thought about this more by now.

zas: I'm not going to play the game of define everything right now.

MBH-513 defines your scope.

MBH-513: Metabrainz policy for software dependencies / package upgrades https://tickets.metabrainz.org/browse/MBH-513

I' not in secret services, not yet.

a new project makes sense to me, personally

github security vulnerabilities, open tickets in JIRA in a new project

ruaok: ok, i guess you got what i mean anywya

Hi Freso, Sorry for not being there for the meeting, i had to attend a family wedding. To put it briefly, this week was a bit slow work wise, i worked on resolving the changes requested my previous PRs,resumed working on filtering mbids, will push the changes in a day or two and i read about t-SNE.

otherwise they'll be scattered everywhere

yup

ok, what is the workflow for a given week then?

we see a notification on github. then what?

my take: create tickets in SEC project when they appear

open a ticket on jira, close if it's non-relevant?

how can you verify that this happening?

then, on regular basis, we define priority for them

or close if not relevant yes

(Meeting time is almost up, I propose to push "april fools" to next week, close the meeting for non-devs, and let the discussion between ruaok, bitmap, iliekcomputers, Mr_Monkey, yvanzo, and zas (and reosarevok?) continue instead of cutting off in 4 minutes.)

+1

who opens the tikcets? project leads?

and there is a way to receive all emails for a particular project

it seems it's like that already :D

everyone noticing a potential security-related issue

ok.

Freso: what is that april fool agenda?

that makes it easy for no one to do anything.

pristine--: ruaok's, so you should ask him. :)

SEC is a good idea

well it's also mie

mine*

Will ask later

Thanks but:)

ruaok: no one can have a view over all projects, libs, etc...

We can probably use webhooks to handle vulnerability alerts and forward it to JIRA.

we can make it part of the weekly agenda to see if there are any open SEC tickets and prod people?

yvanzo: THAT!

+1 bitmap

Yes, that is what we need!

bitmap: +1 to that too.

the combo of both of those gives us enough visibilty and accountabiity.

hell i will subscribe to it and nag people i mena, i want to help

ruaok: yes :)

yvanzo: please investigate if this is possible (webhook)

and +1 for webhooks

Just checked, GitHub can send events for "Vulnerability alert created, resolved, or dismissed on a repository."

awesome!

nice!

ok, yvanzo please make that happen.

yay!

can you also create the SEC project in jira?

lol one minute left

one sec left ;)

ok, let's close for the week.

(sorry)

the biggest points have been covered.

Alright!

</BANG>

10 seconds past.

I'm glad we even had april fools on the agenda for once

Thanks for your time everyone! :)

it's a good thing we still ahve a week

Freso:

Thanks Freso:)

Ah.

yvanzo: i'll create SEC project

which is why I removed that from the list.

but

if someone wants an april fools joke, they will need to run with it.

CatQuest: :)

i mena https://onedublin.files.wordpress.com/2014/06/m... but

iliekcomputers: up!?

sorry, no http://www.quickmeme.com/img/71/712be92c4bd4a36...

Ok, I will look into the webhook-to-jira part.

!m reosarevok

You're doing good work, reosarevok!

pristine--: yes, sup

What did I do! :D

I mean thanks, but

CatQuest: I guess we'll talk about it next week and see what happens.

reosarevok: 😂

Now that it's in the agenda/topic, maybe people will give it some thoughts.

reosarevok: ah, I knew you did nothing!

iliekcomputers: ListenBrainz doesn't have a "love" feature like Last.FM, correct?

Freso: yay!

Freso: not yet.

Oh, and also, everyone: Humble Bundle has a "Web Programming" book bundle from O’Reilly currently; tier 1 includes a book on React, and tier 2 one on Flask: https://www.humblebundle.com/books/web-programm...

:O

(And tier 2 also has "Data Visualization with Python & JavaScript")

iliekcomputers: we had 1 partition for users and recordings df

And 3611 partitions for listens df

Repartitioning to 1 is making situations worse, consuming a lot more time than the previous 270 sec on join operation

It will be great if you could also look into joins. Because that is the only operation which is causing 270 sec.

I think this time can be reduced.

yvanzo, ruaok, bitmap: i'm not sure what will be the best to manage those, but i create a new project, prefix MBSEC: https://tickets.metabrainz.org/projects/MBSEC/i...

In case anyone's interested, I've just added a PR which totally replaces `gulp` with `webpack` in CB. Guess what's comin next? 😃 I'm excited ... 🤗

we'll have to define components, and available options

hah: http://starecat.com/content/wp-content/uploads/...