Date   

Upcoming Event: EdgeX Security WG Meeting (Weekly) - Wed, 06/10/2020 4:00pm-5:00pm, Please RSVP #cal-reminder

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <EdgeX-TSC-Security@...>
 

Reminder: EdgeX Security WG Meeting (Weekly)

When: Wednesday, 10 June 2020, 4:00pm to 5:00pm, (GMT+00:00) UTC

Where:https://zoom.us/j/576218946

An RSVP is requested. Click here to RSVP

Organizer: EdgeX-TSC-Security@...

Description: EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


EdgeX Security WG Meeting (Weekly) - Wed, 06/03/2020 #cal-notice

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <noreply@...>
 

EdgeX Security WG Meeting (Weekly)

When:
Wednesday, 3 June 2020
4:00pm to 5:00pm
(GMT+00:00) UTC

Where:
https://zoom.us/j/576218946

Organizer:
EdgeX-TSC-Security@...

Description:
EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


Upcoming Event: EdgeX Security WG Meeting (Weekly) - Wed, 06/03/2020 4:00pm-5:00pm, Please RSVP #cal-reminder

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <EdgeX-TSC-Security@...>
 

Reminder: EdgeX Security WG Meeting (Weekly)

When: Wednesday, 3 June 2020, 4:00pm to 5:00pm, (GMT+00:00) UTC

Where:https://zoom.us/j/576218946

An RSVP is requested. Click here to RSVP

Organizer: EdgeX-TSC-Security@...

Description: EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


Cancelled Event: EdgeX Security WG Meeting (Weekly) - Wednesday, 27 May 2020 #cal-cancelled

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <EdgeX-TSC-Security@...>
 

Cancelled: EdgeX Security WG Meeting (Weekly)

This event has been cancelled.

When:
Wednesday, 27 May 2020
4:00pm to 5:00pm
(UTC+00:00) UTC

Where:
https://zoom.us/j/576218946

Organizer: EdgeX-TSC-Security@...

Description:
EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


EdgeX Security WG Meeting (Weekly) - Wed, 05/20/2020 #cal-notice

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <noreply@...>
 

EdgeX Security WG Meeting (Weekly)

When:
Wednesday, 20 May 2020
4:00pm to 5:00pm
(GMT+00:00) UTC

Where:
https://zoom.us/j/576218946

Organizer:
EdgeX-TSC-Security@...

Description:
EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


Upcoming Event: EdgeX Security WG Meeting (Weekly) - Wed, 05/20/2020 4:00pm-5:00pm, Please RSVP #cal-reminder

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <EdgeX-TSC-Security@...>
 

Reminder: EdgeX Security WG Meeting (Weekly)

When: Wednesday, 20 May 2020, 4:00pm to 5:00pm, (GMT+00:00) UTC

Where:https://zoom.us/j/576218946

An RSVP is requested. Click here to RSVP

Organizer: EdgeX-TSC-Security@...

Description: EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


EdgeX Security WG Meeting (Weekly) - Wed, 05/13/2020 #cal-notice

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <noreply@...>
 

EdgeX Security WG Meeting (Weekly)

When:
Wednesday, 13 May 2020
4:00pm to 5:00pm
(GMT+00:00) UTC

Where:
https://zoom.us/j/576218946

Organizer:
EdgeX-TSC-Security@...

Description:
EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


Upcoming Event: EdgeX Security WG Meeting (Weekly) - Wed, 05/13/2020 4:00pm-5:00pm, Please RSVP #cal-reminder

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <EdgeX-TSC-Security@...>
 

Reminder: EdgeX Security WG Meeting (Weekly)

When: Wednesday, 13 May 2020, 4:00pm to 5:00pm, (GMT+00:00) UTC

Where:https://zoom.us/j/576218946

An RSVP is requested. Click here to RSVP

Organizer: EdgeX-TSC-Security@...

Description: EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


EdgeX Security WG Meeting (Weekly) - Wed, 05/06/2020 #cal-notice

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <noreply@...>
 

EdgeX Security WG Meeting (Weekly)

When:
Wednesday, 6 May 2020
4:00pm to 5:00pm
(GMT+00:00) UTC

Where:
https://zoom.us/j/576218946

Organizer:
EdgeX-TSC-Security@...

Description:
EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


Re: Upcoming Event: EdgeX Security WG Meeting (Weekly) - Wed, 05/06/2020 4:00pm-5:00pm, Please RSVP #cal-reminder

Zeng, Tingyu <tingyu.zeng@...>
 

Security group members,


Please notice today's security meeting has been cancelled. We were unable to cancel the meeting from the calendar in advance. Apologize for any confusion. 



Thanks,

Tingyu




From: EdgeX-TSC-Security@... <EdgeX-TSC-Security@...> on behalf of EdgeX-TSC-Security@... Calendar <EdgeX-TSC-Security@...>
Sent: Wednesday, May 6, 2020 11:50 AM
To: EdgeX-TSC-Security@...
Subject: [Edgex-tsc-security] Upcoming Event: EdgeX Security WG Meeting (Weekly) - Wed, 05/06/2020 4:00pm-5:00pm, Please RSVP #cal-reminder
 

[EXTERNAL EMAIL]

Reminder: EdgeX Security WG Meeting (Weekly)

When: Wednesday, 6 May 2020, 4:00pm to 5:00pm, (GMT+00:00) UTC

Where:https://zoom.us/j/576218946

An RSVP is requested. Click here to RSVP

Organizer: EdgeX-TSC-Security@...

Description: EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


Upcoming Event: EdgeX Security WG Meeting (Weekly) - Wed, 05/06/2020 4:00pm-5:00pm, Please RSVP #cal-reminder

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <EdgeX-TSC-Security@...>
 

Reminder: EdgeX Security WG Meeting (Weekly)

When: Wednesday, 6 May 2020, 4:00pm to 5:00pm, (GMT+00:00) UTC

Where:https://zoom.us/j/576218946

An RSVP is requested. Click here to RSVP

Organizer: EdgeX-TSC-Security@...

Description: EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


Cancelled Event: EdgeX Security WG Meeting (Weekly) - Wednesday, 29 April 2020 #cal-cancelled

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <EdgeX-TSC-Security@...>
 

Cancelled: EdgeX Security WG Meeting (Weekly)

This event has been cancelled.

When:
Wednesday, 29 April 2020
4:00pm to 5:00pm
(UTC+00:00) UTC

Where:
https://zoom.us/j/576218946

Organizer: EdgeX-TSC-Security@...

Description:
EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


EdgeX Security WG Meeting (Weekly) - Wed, 04/22/2020 #cal-notice

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <noreply@...>
 

EdgeX Security WG Meeting (Weekly)

When:
Wednesday, 22 April 2020
4:00pm to 5:00pm
(GMT+00:00) UTC

Where:
https://zoom.us/j/576218946

Organizer:
EdgeX-TSC-Security@...

Description:
EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


Upcoming Event: EdgeX Security WG Meeting (Weekly) - Wed, 04/22/2020 4:00pm-5:00pm, Please RSVP #cal-reminder

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <EdgeX-TSC-Security@...>
 

Reminder: EdgeX Security WG Meeting (Weekly)

When: Wednesday, 22 April 2020, 4:00pm to 5:00pm, (GMT+00:00) UTC

Where:https://zoom.us/j/576218946

An RSVP is requested. Click here to RSVP

Organizer: EdgeX-TSC-Security@...

Description: EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


Re: Question about gokey password generation?

espy
 

On 4/14/20 10:29 AM, Tingyu.Zeng@... wrote:

Tony, 

The link to the issue can be found here:

https://github.com/edgexfoundry/edgex-go/issues/1946

This issue was triaged at the end of last year by the group and it was decided it is no within the scope of Geneva release due to reasons below:

1. The move towards of Redis database and  leaving Mongo
2. Prefer to use built-in Vault as database generator for Redis 

I just discussed this with Andre (CC'd) last night, and it sounds like his initial implementation also uses gokey. ;/

I'll also point out that while working on the snap aspects of issue #1943 (configure password protection for postgres), I discovered we have yet another solution for setting an initial db password. Namely, the compose file checks for the existence of a password env var, and if not found, sets the env var to a fixed string (defined in the compose file).

/tony

3. Such issue needs to be consistent with a broader topic of how to vent/evaluate 3rd party components/plugins on a project level.


Thanks,
Tingyu


 

________________________________________
From: EdgeX-TSC-Security@... <EdgeX-TSC-Security@...> on behalf of espy <espy@...>
Sent: Tuesday, April 14, 2020 10:04 AM
To: edgex-tsc-security@...
Subject: [Edgex-tsc-security] Question about gokey password generation?

[EXTERNAL EMAIL]

While testing recent changes to the snap packaging over the past week
I've been doing quite a bit of log inspection.

One thing that recently caught my eye was the following WARNING logged
by security-secretstore-setup:

level=WARN ts=2020-04-14T00:21:45.156090587Z
app=edgex-security-secretstore-setup source=init.go:256 msg="WARNING:
The gokey generator is a reference implementation for credential
generation and the underlying libraries not been reviewed for
cryptographic security. The user is encouraged to perform their own
security investigation before deployment."

Have we actually performed a review of the underlying libraries and
approved their usage? If so, perhaps we should suppress this log message
so as not to raise concern by end-users?

Regards,
/tony






EdgeX Security WG Meeting (Weekly) - Wed, 04/15/2020 #cal-notice

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <noreply@...>
 

EdgeX Security WG Meeting (Weekly)

When:
Wednesday, 15 April 2020
4:00pm to 5:00pm
(GMT+00:00) UTC

Where:
https://zoom.us/j/576218946

Organizer:
EdgeX-TSC-Security@...

Description:
EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


Upcoming Event: EdgeX Security WG Meeting (Weekly) - Wed, 04/15/2020 4:00pm-5:00pm, Please RSVP #cal-reminder

EdgeX-TSC-Security@lists.edgexfoundry.org Calendar <EdgeX-TSC-Security@...>
 

Reminder: EdgeX Security WG Meeting (Weekly)

When: Wednesday, 15 April 2020, 4:00pm to 5:00pm, (GMT+00:00) UTC

Where:https://zoom.us/j/576218946

An RSVP is requested. Click here to RSVP

Organizer: EdgeX-TSC-Security@...

Description: EdgeX Security WG Meeting. Meeting content posted to Security WG Wiki.
Meeting Lead: David Ferriera, Security WG Chair, david.ferriera@...
-----
Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/576218946

Or iPhone one-tap (US Toll): +14086380968,,576218946# or +16465588656,,576218946#

Or Telephone:
    Dial: +1 408 638 0968 (US Toll) or +1 646 558 8656 (US Toll)
    +1 855 880 1246 (US Toll Free)
    +1 877 369 0926 (US Toll Free)
    Meeting ID: 576 218 946
    International numbers available: https://zoom.us/zoomconference?m=t6UX5OTIE0SFrIk-9MMnBPbFjE3dZ_xx


Re: Question about gokey password generation?

Zeng, Tingyu <tingyu.zeng@...>
 

Sure will do.

Thanks
Tingyu

________________________________________
From: Tony Espy <espy@...>
Sent: Tuesday, April 14, 2020 10:44 AM
To: Zeng, Tingyu; EdgeX-TSC-Security@...
Subject: Re: [Edgex-tsc-security] Question about gokey password generation?

[EXTERNAL EMAIL]

On 4/14/20 10:31 AM, Tony Espy wrote:

On 4/14/20 10:29 AM, Tingyu.Zeng@... wrote:

Tony,

The link to the issue can be found here:

https://github.com/edgexfoundry/edgex-go/issues/1946

This issue was triaged at the end of last year by the group and it
was decided it is no within the scope of Geneva release due to
reasons below:

1. The move towards of Redis database and leaving Mongo
2. Prefer to use built-in Vault as database generator for Redis
3. Such issue needs to be consistent with a broader topic of how to
vent/evaluate 3rd party components/plugins on a project level.
Thanks Tingyu!
Tingyu -

Just a heads-up re: another bug I just opened this morning concerning
our Root CA cert configuration:

https://github.com/edgexfoundry/edgex-go/issues/2495

Perhaps we can put this on tomorrow's agenda?

Regards,
/tony





/tony



Thanks,
Tingyu



________________________________________
From: EdgeX-TSC-Security@...
<EdgeX-TSC-Security@...> on behalf of espy
<espy@...>
Sent: Tuesday, April 14, 2020 10:04 AM
To: edgex-tsc-security@...
Subject: [Edgex-tsc-security] Question about gokey password generation?

[EXTERNAL EMAIL]

While testing recent changes to the snap packaging over the past week
I've been doing quite a bit of log inspection.

One thing that recently caught my eye was the following WARNING logged
by security-secretstore-setup:

level=WARN ts=2020-04-14T00:21:45.156090587Z
app=edgex-security-secretstore-setup source=init.go:256 msg="WARNING:
The gokey generator is a reference implementation for credential
generation and the underlying libraries not been reviewed for
cryptographic security. The user is encouraged to perform their own
security investigation before deployment."

Have we actually performed a review of the underlying libraries and
approved their usage? If so, perhaps we should suppress this log message
so as not to raise concern by end-users?

Regards,
/tony





Re: Question about gokey password generation?

espy
 

On 4/14/20 10:31 AM, Tony Espy wrote:

On 4/14/20 10:29 AM, Tingyu.Zeng@... wrote:

Tony,

The link to the issue can be found here:

https://github.com/edgexfoundry/edgex-go/issues/1946

This issue was triaged at the end of last year by the group and it was decided it is no within the scope of Geneva release due to reasons below:

1. The move towards of Redis database and  leaving Mongo
2. Prefer to use built-in Vault as database generator for Redis
3. Such issue needs to be consistent with a broader topic of how to vent/evaluate 3rd party components/plugins on a project level.
Thanks Tingyu!
Tingyu -

Just a heads-up re: another bug I just opened this morning concerning our Root CA cert configuration:

https://github.com/edgexfoundry/edgex-go/issues/2495

Perhaps we can put this on tomorrow's agenda?

Regards,
/tony





/tony



Thanks,
Tingyu



________________________________________
From: EdgeX-TSC-Security@... <EdgeX-TSC-Security@...> on behalf of espy <espy@...>
Sent: Tuesday, April 14, 2020 10:04 AM
To: edgex-tsc-security@...
Subject: [Edgex-tsc-security] Question about gokey password generation?

[EXTERNAL EMAIL]

While testing recent changes to the snap packaging over the past week
I've been doing quite a bit of log inspection.

One thing that recently caught my eye was the following WARNING logged
by security-secretstore-setup:

level=WARN ts=2020-04-14T00:21:45.156090587Z
app=edgex-security-secretstore-setup source=init.go:256 msg="WARNING:
The gokey generator is a reference implementation for credential
generation and the underlying libraries not been reviewed for
cryptographic security. The user is encouraged to perform their own
security investigation before deployment."

Have we actually performed a review of the underlying libraries and
approved their usage? If so, perhaps we should suppress this log message
so as not to raise concern by end-users?

Regards,
/tony




Re: Question about gokey password generation?

espy
 

On 4/14/20 10:29 AM, Tingyu.Zeng@... wrote:

Tony,

The link to the issue can be found here:

https://github.com/edgexfoundry/edgex-go/issues/1946

This issue was triaged at the end of last year by the group and it was decided it is no within the scope of Geneva release due to reasons below:

1. The move towards of Redis database and leaving Mongo
2. Prefer to use built-in Vault as database generator for Redis
3. Such issue needs to be consistent with a broader topic of how to vent/evaluate 3rd party components/plugins on a project level.
Thanks Tingyu!

/tony



Thanks,
Tingyu



________________________________________
From: EdgeX-TSC-Security@... <EdgeX-TSC-Security@...> on behalf of espy <espy@...>
Sent: Tuesday, April 14, 2020 10:04 AM
To: edgex-tsc-security@...
Subject: [Edgex-tsc-security] Question about gokey password generation?

[EXTERNAL EMAIL]

While testing recent changes to the snap packaging over the past week
I've been doing quite a bit of log inspection.

One thing that recently caught my eye was the following WARNING logged
by security-secretstore-setup:

level=WARN ts=2020-04-14T00:21:45.156090587Z
app=edgex-security-secretstore-setup source=init.go:256 msg="WARNING:
The gokey generator is a reference implementation for credential
generation and the underlying libraries not been reviewed for
cryptographic security. The user is encouraged to perform their own
security investigation before deployment."

Have we actually performed a review of the underlying libraries and
approved their usage? If so, perhaps we should suppress this log message
so as not to raise concern by end-users?

Regards,
/tony