AB Meeting/May 2015 Minutes: Difference between revisions
From Xen
Jump to navigationJump to search
Lars.kurth (talk | contribs) (Created page with "Category:Advisory Board") |
Lars.kurth (talk | contribs) No edit summary |
||
| Line 1: | Line 1: | ||
= Attendees = |
|||
<pre> |
|||
Lars Kurth |
|||
Sarah Conway (LF) |
|||
Laura Kempke (LF) |
|||
Larry Wikelius (Cavium) |
|||
Donald Slutz (Verizon) |
|||
Antony Messerli (Rackspace) |
|||
Guido Trotter (Google) |
|||
Philippe Robin (ARM) |
|||
Sherry Hurwitz (AMD) |
|||
James Bulpin Citrix), joined late |
|||
(quorum) |
|||
</pre> |
|||
= Agenda = |
|||
Attached documents at [[File:May 15 AB Meeting.pdf]] |
|||
== Xen Project Developer Summit (Lars) == |
|||
<pre> |
|||
* Quick update on talk submissions and schedule (see attached PDF) |
|||
RESOLUTION: Travel stipend of $2500 (the estimate is $2200) for Martin Lucina who is in the top 5 rated talk submissions covering flights from Vienna to Seattle + Accommodation. |
|||
* We have budgeted for $5K in 2015 and not spent anything |
|||
Carried |
|||
</pre> |
|||
== Test Lab Update (Lars) == |
|||
<pre> |
|||
* Status Update (see attached PDF) |
|||
RESOLUTION: Do we accept APM's Donation of 2 X-C1 EVK kits (total value $5,200) - the test framework WG recommends to do so |
|||
Carried |
|||
* Reminder: we should start to plan expansion – aka what type of new kit do we want to procure in Q3 |
|||
</pre> |
|||
== OpenStack Update (Lars) == |
|||
<pre> |
|||
* CI Loop Status Update & Next steps (see attached PDF) |
|||
Action: Lars to take steps for project to carry cost of CI loop |
|||
Cost breakdown by Bob Ball |
|||
--- |
|||
Server cost for Feb 21 to Mar 21: $1223 |
|||
Server cost for Mar 21 to Apr 21: $1744 – but that’s end-of-cycle rush so would be higher than normal traffic. |
|||
Then there is a small extra cost for cloud files storage and CDN, but I can’t split that out from the esiting charges; I estimate $50 per month. |
|||
On average I’d guess that might be $1,500 per month or $18k per-annum then? |
|||
--- |
|||
Action: Lars – discuss at next meeting re CI loop (done) |
|||
</pre> |
|||
== PR Update (Sarah) == |
|||
<pre> |
|||
Venom post-mortem |
|||
* The press cycle went quickly this time |
|||
* CloudStrike was pro-active and branded the vulnerability |
|||
* CloudStrike did break the embargo (press interview, website went live 4 hours before the embargo time) |
|||
* Technically they are not on the pre-disclosure list and are the discoverers of the issue, thus we cannot take any action |
|||
Sarah: has now a pre-prepared statement for the press in case we have similar issues in future |
|||
Sarah: after a day or two the articles related to Venom were more balanced and partly called out CloudStrike |
|||
Sarah: Tamas' article was too late for the news cycle (see https://blog.xenproject.org/2015/05/14/hardening-hypervisors-against-venom-style-attacks/) |
|||
Antony: I posted a message on the security list to investigate whether in cases where no fix can be found two weeks prior to disclosure, the disclosure list can be informed with information that is available at that given time |
|||
Action Lars: follow up when back from the OpenStack summit |
|||
For A) get the timeline : see http://lists.xenproject.org/archives/html/xen-devel/2015-05/msg02872.html ([SECURITY] XSA-133 Retrospective) |
|||
For B) for the process change, see http://lists.xenproject.org/archives/html/xen-devel/2015-06/msg00052.html ([Formal Vote] Changes to Xen Project Security Vulnerability Process - Open until June 8th, 2015) |
|||
Sarah: interesting that CrowdStrike gained the coverage they got, which makes it more likely that there will be more branded vulnerabilities with attached marketing campaign in future |
|||
* Upcoming press releases and opportunities |
|||
Mirage: 2.5 Release - want to release at QCON (will come through as draft pretty quickly, assuming the Mirage team provides the relevant information) |
|||
Mirage Jitsu Release: Jitsu - not quite ready to be releases. Expect release in Sept/Oct |
|||
Mirage 3.0: Q3 |
|||
Xen 4.6: Q3 |
|||
Lars: Note that there was a proposal to change Xen version numbering, but it seems there is not enough traction for it http://lists.xenproject.org/archives/html/xen-devel/2015-05/msg00365.html ([Xen-devel] (release) versioning). On a related note, there was also a proposal to change the maintenance release cadence to 4 months (instead of 3) - see http://lists.xenproject.org/archives/html/xen-devel/2015-05/msg00361.html ([Xen-devel] stable release cadence) for which there was agreement. We didn't think a formal vote was required. |
|||
Lars asked Sarah whether moving up quality groups in OpenStack was worthy a press release or whether a blog post is enough |
|||
*All agreed that a blog post is better* |
|||
See: https://blog.xenproject.org/2015/05/20/xen-project-now-in-openstack-nova-hypervisor-driver-quality-group-b/ |
|||
</pre> |
|||
== Live Patching (Konrad) == |
|||
<pre> |
|||
* A draft solution was discussed at the Hackathon |
|||
* Konrad posted an RFC v1 design to interested parties before it went toxen-devel@ list |
|||
* v2 was posted on xen-devel at http://lists.xenproject.org/archives/html/xen-devel/2015-05/msg02142.html |
|||
There has been some discussion, but I expect this to be stalled until Konrad is back from vacation |
|||
</pre> |
|||
== AOB == |
|||
<pre> |
|||
None |
|||
</pre> |
|||
[[Category:Advisory Board]] |
[[Category:Advisory Board]] |
||
Latest revision as of 11:31, 9 June 2015
Attendees
Lars Kurth Sarah Conway (LF) Laura Kempke (LF) Larry Wikelius (Cavium) Donald Slutz (Verizon) Antony Messerli (Rackspace) Guido Trotter (Google) Philippe Robin (ARM) Sherry Hurwitz (AMD) James Bulpin Citrix), joined late (quorum)
Agenda
Attached documents at File:May 15 AB Meeting.pdf
Xen Project Developer Summit (Lars)
* Quick update on talk submissions and schedule (see attached PDF) RESOLUTION: Travel stipend of $2500 (the estimate is $2200) for Martin Lucina who is in the top 5 rated talk submissions covering flights from Vienna to Seattle + Accommodation. * We have budgeted for $5K in 2015 and not spent anything Carried
Test Lab Update (Lars)
* Status Update (see attached PDF) RESOLUTION: Do we accept APM's Donation of 2 X-C1 EVK kits (total value $5,200) - the test framework WG recommends to do so Carried * Reminder: we should start to plan expansion – aka what type of new kit do we want to procure in Q3
OpenStack Update (Lars)
* CI Loop Status Update & Next steps (see attached PDF) Action: Lars to take steps for project to carry cost of CI loop Cost breakdown by Bob Ball --- Server cost for Feb 21 to Mar 21: $1223 Server cost for Mar 21 to Apr 21: $1744 – but that’s end-of-cycle rush so would be higher than normal traffic. Then there is a small extra cost for cloud files storage and CDN, but I can’t split that out from the esiting charges; I estimate $50 per month. On average I’d guess that might be $1,500 per month or $18k per-annum then? --- Action: Lars – discuss at next meeting re CI loop (done)
PR Update (Sarah)
Venom post-mortem * The press cycle went quickly this time * CloudStrike was pro-active and branded the vulnerability * CloudStrike did break the embargo (press interview, website went live 4 hours before the embargo time) * Technically they are not on the pre-disclosure list and are the discoverers of the issue, thus we cannot take any action Sarah: has now a pre-prepared statement for the press in case we have similar issues in future Sarah: after a day or two the articles related to Venom were more balanced and partly called out CloudStrike Sarah: Tamas' article was too late for the news cycle (see https://blog.xenproject.org/2015/05/14/hardening-hypervisors-against-venom-style-attacks/) Antony: I posted a message on the security list to investigate whether in cases where no fix can be found two weeks prior to disclosure, the disclosure list can be informed with information that is available at that given time Action Lars: follow up when back from the OpenStack summit For A) get the timeline : see http://lists.xenproject.org/archives/html/xen-devel/2015-05/msg02872.html ([SECURITY] XSA-133 Retrospective) For B) for the process change, see http://lists.xenproject.org/archives/html/xen-devel/2015-06/msg00052.html ([Formal Vote] Changes to Xen Project Security Vulnerability Process - Open until June 8th, 2015) Sarah: interesting that CrowdStrike gained the coverage they got, which makes it more likely that there will be more branded vulnerabilities with attached marketing campaign in future * Upcoming press releases and opportunities Mirage: 2.5 Release - want to release at QCON (will come through as draft pretty quickly, assuming the Mirage team provides the relevant information) Mirage Jitsu Release: Jitsu - not quite ready to be releases. Expect release in Sept/Oct Mirage 3.0: Q3 Xen 4.6: Q3 Lars: Note that there was a proposal to change Xen version numbering, but it seems there is not enough traction for it http://lists.xenproject.org/archives/html/xen-devel/2015-05/msg00365.html ([Xen-devel] (release) versioning). On a related note, there was also a proposal to change the maintenance release cadence to 4 months (instead of 3) - see http://lists.xenproject.org/archives/html/xen-devel/2015-05/msg00361.html ([Xen-devel] stable release cadence) for which there was agreement. We didn't think a formal vote was required. Lars asked Sarah whether moving up quality groups in OpenStack was worthy a press release or whether a blog post is enough *All agreed that a blog post is better* See: https://blog.xenproject.org/2015/05/20/xen-project-now-in-openstack-nova-hypervisor-driver-quality-group-b/
Live Patching (Konrad)
* A draft solution was discussed at the Hackathon * Konrad posted an RFC v1 design to interested parties before it went toxen-devel@ list * v2 was posted on xen-devel at http://lists.xenproject.org/archives/html/xen-devel/2015-05/msg02142.html There has been some discussion, but I expect this to be stalled until Konrad is back from vacation
AOB
None
