2026

2025

2024

2023

2022

2021

2020

2019

2018

Idpy-board

idpy-board@lists.sunet.se

1 participants
81 discussions

Start a nNew thread

Fwd: Press questions regarding the Pysaml2 vulnerability

by ivan.kanak＠gmail.com

Hello everyone, I just received the following email with questions on the recent vulnerabilities of pysaml2. The news site is https://www.bleepingcomputer.com/ Should we answer? and should we answer all questions? Cheers, PS: for those of you did not see our new page on the website, have a look at the security section: https://idpy.org/security/ ---------- Forwarded message --------- From: Lawrence Abrams <labrams at bleepingcomputer.com> Date: Wed, 20 Jan 2021 at 22:22 Subject: Press questions regarding the Pysaml2 vulnerability To: <ivan.kanak at gmail.com>, <info at idpy.org> I am a security reporter for the technology news site BleepingComputer. In regards to your pysaml2 security advisory released today for vulnerabilities CVE-2021-21238 and CVE-2021-21239. 1. Is it known if these vulnerabilities have been exploited in the wild? If so, can you share how? 2. For CVE-2021-21238, would this allow an attacker to tamper a signed file as long as the original legitimate signature is the first keyvalue element? 3. For CVE-2021-21239, a signed document would be valid if the same type of key is present in the document? 4. In what ways do you see these vulnerabilities being exploited and are these critical enough that they should be updated immediately? 5. Finally, what other software/packages utilize pysaml2 ? Thank you Lawrence Abrams BleepingComputer.com -- Ivan c00kiemon5ter Kanakarakis >:3

5 years, 9 months

2
3
0 0

Notes: idpy Board call, 13 October 2020

by hlflanagan＠sphericalcowgroup.com

Attendees: Ivan, Roland, Leif, Chris, Heather, Christos Absent: Mike Action items 1. The Dev team needs to come up with a few key points on change management and semantic versioning first, which will apply to projects, and then inform and educate the Board on what that all means 2. After Board agreement on the change management requirements, reach out to the djangosaml2 maintainer and verify they will be willing to adhere to these requirements Update since our last meeting (see https://github.com/IdentityPython/) • Status of volunteer engagement - seeing largely the same people participating. Given we always have the same people, we continued to be constrained in what we can do to improve the projects over on • Where are more resources required? • Until we improve our documentation, we won’t be able to bring new people on to participate. • Documentation is happening at two levels, at the architecture level and at the code level. Ivan is responsible for the architecture level, but it has not been as high a priority as feature enhancement, security issues, etc. We do have volunteers helping with some of the code-level documentation (Hannah Sebuliba). Not every project is in the same place with regards to the available documentation; OIDC libraries are better off than the other projects. • We also need “how to” documentation, on top of documenting the code and documenting the architecture. • An interesting example is the Norwegian federation team where the developers wrote the first pass of the documentation, but the group that did the implementation were required to improve (and probably rewrite) the documentation. • Our documentation needs at every level are very complex; this is powerful software with many options for implementation. It would be best if we had a strategy to use our resources most efficiently, but we’re limited by what volunteers we have and where their skills/experience lay. Proposal for a new project to be brought on board (See https://dracc.commonsconservancy.org/0025/ for a reminder of how we add new projects to idpy.) • https://github.com/knaperek/djangosaml2 (see email to the board from 15 September, subject line: "idpy 2020 board meeting and a new project") • There is a concern about expanding the idpy product catalog without a proper way to manage the whole catalog. Is this production grade? What is the release management process? • The Dev team needs to come up with a few key points on change management and semantic versioning first, which will apply to projects, and then inform and educate the Board on what that all means, then Quality of the project and how we manage our projects overall • We should be asking each idpy project to follow a consistent release management process and a consistent testing process. The tools we use, how we use them and invoke them, as well as the policies around them, whether we use docker images, etc. • We do have templates for issues and PRs, but they are optional. Similarly, people do not always include tests. • Process is no guarantee of quality. If our ultimate goal is quality improvement, then we need to figure out how to get there then determine what policy is need to keep us at that level. We need the culture to evolve to overall improvements, so the team makes its own rules. • Review is how we manage quality. This ties back to the architecture documentation, so that more people can do the review than just Ivan because they understand how it all fits. • Perhaps tag as “future” all items that are not 100% vetted. • IdentityPython is not so much about turnkey solutions as it is about building tool kits. • The different idpy projects are very different in terms of scale - pySAML2 has been around for 16 years and has an enormous following, whereas the OIDC libraries have a group of 5 committers. There is unlikely to be one model that fits all. • Can we at least get to an agreement to use semantic versioning across all projects? Board nominations for 2021-2023 • 3 slots, currently filled by Leif, Christos, and myself, will be open • Note that Heather’s role is also “At-Large Director of Identity Python" Thanks! Heather

6 years

2
1
0 0

IdentityPython Board Agenda & Reminder: 13 October 2020

by hlflanagan＠sphericalcowgroup.com

Date/time: 13 October 2020 @ 17:00 UTC Zoom link: https://us02web.zoom.us/j/85021594049?pwd=dWwzTG5vTGpmSXRCZXdzOHFSZXRtUT09 Meeting ID: 850 2159 4049 Passcode: 953486 Agenda 1 - Agenda bash 2 - Update since our last meeting (see https://github.com/IdentityPython/) • Status of volunteer engagement • Where are more resources required 3 - Proposal for a new project to be brought on board (See https://dracc.commonsconservancy.org/0025/ for a reminder of how we add new projects to idpy.) • https://github.com/knaperek/djangosaml2 4 - Board nominations for 2021-2023 • 3 slots, currently filled by Leif, Christos, and myself, will be open 5 - AOB Thanks! Heather

6 years, 1 month

1
0
0 0

idpy 2020 board meeting and a new project

by hlflanagan＠sphericalcowgroup.com

Hello idpy Board members! I hope this message finds you well and neither sick nor suffering from smoke inhalation. It has been quite some time since we’ve had a chance to meet, and we have a few things to cover as a board: 1 - We have a request to add a new project under the idpy umbrella: djangosaml2. I’m copying the note from Giuseppe de Marco about djangosaml2 below. See https://dracc.commonsconservancy.org/0025/ for a reminder of how we add new projects to idpy. 2 - We should think about the 2021 board selection. There are 3 slots, currently filled by Leif, Christos, and myself, that will be open. Individuals are always welcome to re-nominate for the Board. I’d like to get a call on the calendar to catch up on idpy activities, discuss the new project, and talk about plans for 2021 and beyond. If you would, please fill out the doodle poll by the end of this week: https://doodle.com/poll/ckh357gcctrekqvd --- Subject: djangosaml2 Hello everybody, As you may have guessed from the subject of this email, I have the pleasure of presenting here djangosaml2, in anticipation of its migration to Identity Python. In CC Jozef Knaperek, former contributor of pysaml2 and person who from 2016 to date has maintained the fork of this project, now hosted in the personal github, which today has a fair audience and satisfaction within the Django community. Here is: https://github.com/knaperek/djangosaml2 As is evident, djangosaml2 is an application designed for Django Framework, written above pysaml2 that presents closely related goals to this. This is why we believe that bringing djangosaml2 to idpy can be quite natural, and if we want it also advantageous, for the possibility of increasing its community. Currently the project is published on Pypi and the version release policy, and acceptance of contributions, depends on validating the code by running unit tests (Tox over Github actions). The coverage of djangosaml2 is currently less than 80% in the v0.40.1 but higher than 90% for the v1.0.0 version (see branch of the same name). The latter is in the process of being released and it might be a good opportunity to release it directly within idpy. The versions from v0.19.0 to v1.0.0 were made possible by a great enthusiasm, which arose within its community, manifested following the first interactions for the requalification of the project, as regards the feedback offered both in the issues and in the PR pending. Having given so much trust activated several contributors in a relatively short time makes us optimistic about the general resilience of the project, such as to think about the good health of its community and not least the possibility that this project could hopefully continue to live on external contributions only. In any case, the people that are glad to present here djangosaml2, for whom we undertake the commitment of a management over time, are Me and Knaperek. I know that we have not written everything but rather we fear we have written too much. We are available to answer in this thread on further organizational and managerial aspects of the project. Sure of your kind reply, we greet you --- Thanks! Heather

6 years, 1 month

1
2
0 0

Board selection for 2020-2021

by hlflanagan＠sphericalcowgroup.com

Hola a todos! Thank you, Ivan, Chris, Mike, and Roland, for agreeing to serve on the board for a new two-year term! I’ll send out an announcement to the developers list shortly. -Heather

6 years, 9 months

1
0
0 0

Meeting today or tomorrow?

by hlflanagan＠sphericalcowgroup.com

Hola a todos! Given most (all?) of our board is here, let’s meet in the Hackathon room today or tomorrow. https://doodle.com/poll/fifi78wqkveq4ed2 <https://doodle.com/poll/fifi78wqkveq4ed2> What works for you all? -Heather

6 years, 11 months

1
1
0 0

An item for the idpy Board

by hlflanagan＠sphericalcowgroup.com

Hola a todos, and long-time no hear! I have an item for board consideration; several of you are aware of this, but it hasn’t come up formally on the board yet. As you all may recall, we had been working on an MoU with the OpenID Foundation around the OIDC libraries. OIDF has decided NOT to continue direct support for those libraries, which makes moot the need for an MoU. It also re-opens the question as to who, how, and where those libraries should find a home.. I have no suggestions as to next steps here, but Roland may have more information. Roland, can you write up a bit more detail for the board, so w can all consider next steps? Thanks! Heather

6 years, 11 months

3
4
0 0

Action items from our f2f Board meeting

by hlflanagan＠sphericalcowgroup.com

Hola a todos! Yay for our first f2f meeting! Thank you all for making your way to Estonia and taking time out of your Sunday evening to catch up. There was a lot of ideas and suggestions discussed last night. I took away two particular action items, but there may be more. What would you add to the list of things to do below? * Follow up on the possibility of an NGI grant to focus on talent development * Draft a marketing/branding plan for idpy I think we can discuss this on list for a bit, and then schedule our next meeting for August, when hopefully we can review an outline and/or first draft for the above items. Thanks again for your time, Heather

7 years, 4 months

1
0
0 0

Fwd: Re: IdentityPython Board approval to move ahead with Commons Conservancy

by hlflanagan＠sphericalcowgroup.com

Hola a todos, Michiel’s response re: license/copyright info in each file. Thanks! Heather ---------- Forwarded message ---------- From: Michiel Leenaars <michiel at nlnet.nl> Date: May 8, 2019, 8:15 AM -0700 To: Heather Flanagan <hlflanagan at sphericalcowgroup.com> Subject: Re: IdentityPython Board approval to move ahead with Commons Conservancy > Hi Heather, > > > Why does CC think having a single license file per project is > > insufficient? Our thought is that if we can avoid adding a header to > > every single file, that would be nice, esp. given we already have this > > info in the license file and we have the Note Well. > > this is not just our opinion, but something that is an industry and > community standard for legal compliance these days. When companies like > Siemens, Samsung or Honeywell use some code in one of the hundreds or > thousands of devices and systems in their product line, they need to be > able to provide the correct license and a download of the exact version. > This means machine readability too. > > To quote from https://reuse.software/practices/2.0/ : > > Scroll to the section "2. Include a copyright notice and license in each > file"... > > "Source code files are often reused across multiple projects, taken from > their origin and repurposed, or otherwise end up in repositories where > they are separate from its origin. You should therefore ensure that all > files in your project have a comment header that convey that file’s > copyright and license information: Who are the copyright holders and > under which license(s) do they release the file? > > It is highly recommended that you keep the format of these headers > consistent across your files. It is important, however, that you do not > remove any information from headers in files of which you are not the > sole author. > > You must convey the license information of your source code file in a > standardised way, so that computers can interpret it. You can do this > with an SPDX-License-Identifier tag followed by an SPDX expression > defined by the SPDX specifications." > > (the text goes on for a while after this, to clarify the point but this > is the basic gist of it) > > There is a nice Python tool to check: > > https://github.com/fsfe/reuse-tool > > I hope this makes sense > > > -- > Support NLnet, the open internet and open source with just 5 minutes of > your time. Make a difference today. Visit: > > https://nlnet.nl/help (English) > https://nlnet.nl/ayuda (Espanol) > > -- > Michiel Leenaars > Director of Strategy > > NLnet Foundation > Science Park 400 (Matrix 2) > 1098 XH Amsterdam > The Netherlands > > https://nlnet.nl > sip/xmpp: michiel [@t] nlnet.nl > > --------------- > 'If you want the Internet to grow strong, safe and free, > but you don't know how to help, contribute to NLNet: > they do know and care." > > Giorgio Maone, NoScript > > Interested what Richard Stallman, Karsten Nohl, Andy Tanenbaum and > many others have to say about what NLnet helped them do for you? > Feel your wallet tingling already? Check out: > > https://nlnet.nl/donating/quotes.html >

7 years, 5 months

2
1
0 0

Updating the idpy.org website, pyOIDC, and pyJWT

by hlflanagan＠sphericalcowgroup.com

Hola a todos! I’ve updated the idpy.org website with pointers to the idpy statues as held by the Commons Conservancy, as well as the pointer to how to add/remove projects (also officially recorded at CC). As I was doing this, I noticed the following: Other projects are still under consideration: • pyOIDC • pyJWT Should these be removed as being under consideration at this point, given the code now under OIDF’s care? Thanks! Heather

7 years, 6 months

2
3
0 0

← Newer
1
2
3
4
5
6
7
8
9
Older →