[21:32] hey there! [21:33] proposed agenda: continue triage for next v1 release [21:33] then examine result & see how long this is gonna take [21:56] Action: Dymaxion bounces in. [21:57] ugh, long walk. [21:57] That sounds like a good plan to me. [21:57] do we have an ara? [21:58] (did you get her on the telly?+ [21:58] yes [21:59] well, go look @ the on hold issues & see if any look like they shouldn't be [22:00] i applied the will-the-bug-exist-in-v2 check & these failed [22:01] Action: Dymaxion looks [22:02] Are we likely to have trees in 2? [22:03] i don't think so [22:03] i mean, the rules tree is replaced by ross method [22:03] & the attack trees didn't sound like trees anymore last we talked [22:03] Action: Dymaxion nods [22:04] there might be graphs, but i don't think the display method will be tree-like [22:04] those all sound good to me. [22:04] (i was thinking of tamara's stuff) [22:04] so is ara on her way, then? [22:04] I SMSd her to remind her... [22:04] or should we call her? [22:05] hmm [22:05] i think i'll call her [22:07] voicemail [22:07] i hope she's ok... [22:07] hrm [22:07] yeah [22:07] how about page 1 of the open or taken issues? [22:08] http://bugs.octotrike.org/bugs/bugs/ListIssues/sortorder-urgency?Filterlogic=block&saved_filter=&f-statuses=on+hold&f-statuses=rejected&f-statuses=completed&f-fromname=&f-email=&filteroptions=1&ListIssues%3Amethod=Apply+filter+settings&page=ListIssues [22:08] eek, sorry [22:08] yay! there you are [22:08] sorry sorry sorry [22:08] yay! [22:08] fell asleep [22:08] no, no problem [22:08] Action: Dymaxion didn't leave work early enough again. [22:09] just so you didn't get mugged on your way home or something, i'm happy [22:09] oh, man...yesterday I was walking home and there were like 5 cop cars in the street [22:09] and this large black woman yelling at this very bored looking cop [22:09] mugged by cops? [22:09] and as I'm passing her by I look down and noticed I was stepping through blood splatter :/ [22:09] ewww! [22:09] oh my [22:10] I dunno what happened, but it was weird [22:10] see, your walk home is frequently _way_ too exciting [22:10] eww [22:10] where was this? [22:10] hmmm...pine and bellvue ish? [22:11] so, ara, do you see any bugs in the on hold issues which you think we should stick back into the next release of v1? [22:11] wow, right by dym's house [22:11] well, not right by [22:11] nah, 4 or 5 blocks away [22:11] haha, 1 block in seattle makes a big difference ^^ [22:11] Action: Dymaxion grins and nods [22:11] oh, I have something to add to the agenda! [22:11] what is it? [22:11] server-space [22:11] oh. yes indeed [22:12] mmm, server space. [22:12] so I found out about this hosting provider that the metasploit guys are using [22:12] called domaingurus [22:12] or sthing [22:12] cheap & good? [22:12] and it's a dedicated box with good specs and 10mbit (I think) unmetered access [22:12] for $50 / mo [22:13] cool [22:13] w/ a $99 setup fee [22:13] we admin, or they admin? [22:13] so I'm thinking I'm going to get one [22:13] and then set up a bunch of xen instances on it [22:13] with some extra ips [22:13] and then I could put octotrike's stuff on one seciton [22:13] section* [22:13] and have all the other domains I'm hosting be seperate too [22:13] that sounds pretty good [22:14] Sounds great, yeah [22:14] yeah, I'm looking forward to it...I can logically seperate my mail & chat servers from teh web servers [22:14] and each domain can then have their own ssl certs [22:14] without having to run on weird ports [22:15] yum, yum. [22:15] yay [22:15] so I was thinking that if it were seperated, then you guys could have shells [22:16] because I wouldn't worry so much about you poking around things that weren't trike-related [22:16] Action: Dymaxion nods [22:16] that would be really convenient [22:16] if i had a way to put content up on the web site that is all i need [22:16] well, okay, it wouldn't be bad to do the squeaksource thing & be able to kill it if needed [22:17] hmmm..putting content on the site wouldn't be difficult with our current configuration [22:17] i don't know how stable it is [22:17] yeah [22:17] that's the other thing [22:17] I don't want squeaksource up on my server :P [22:17] oh, ok [22:17] unless it were logically seperated [22:17] that's cool [22:17] I think the source code repository bits should be sep'd from the web server bits [22:17] we can stick it at my house if we are willing to port knock before we get in [22:18] yes, i agree [22:18] a xen partition is enough seperation though, right? [22:18] yeah, that would be fine [22:18] would you guys be willing to pitch in a little for extra ips? [22:18] absoloodle [22:18] of course [22:18] http://domaingurus.com/Dedicated-Servers.php [22:19] that's what I'm looking at [22:19] oh, nvm...i[s are only an extra $1 / mo [22:19] boy, my net is so fast that when i click on a link i get no opportunity to change my mind before it is right there in front of me [22:19] :) you can just buy lunch sometime [22:19] the base linux box? [22:20] Action: Dymaxion grins. [22:20] Works for me. :-) [22:20] okay! i would be thrilled, as always, to buy you lunch [22:21] i love how the windows box is more expensive [22:21] hee hee [22:21] gotta pay for that license some how. :-) [22:22] the thing i really like about the virtual solution is that if we move servers, we can just gzip it and take it with, no setup [22:22] yeah ^^ [22:23] zat it on server space? [22:23] i think so [22:24] k.. here's your link to bugs i want to postpone past the next v1 release: [22:24] http://bugs.octotrike.org/bugs/?Filterlogic=show&saved_filter=126&f-statuses=on+hold&f-fromname=&f-email=&filteroptions=1&ListIssues%3Amethod=Apply+filter+settings&page=ListIssues [22:24] paul looked at 'em already; ara, do you see any you really want fixed in the next v1? [22:25] 4looking [22:29] hmm...the one that says there's no way to bulk expand / contract the trees is innacurate, isn't' it? [22:29] I thought the plusses did that [22:30] i think it's shift-click or something [22:30] this is the equivalent of hitting '*' in a windows explorer view [22:30] you can right click to expand the tree, but it works oddly; I think we wanted better docs or something. [22:30] yes, they do. but nobody knows it. we were talking about adding balloon help, i think [22:30] ah, that doesn't seem very difficult [22:30] it does work oddly [22:31] want to untriage it? [22:31] hmmm...I think the editing one is kinda important with the focus change [22:31] that's going to persist into v2, right? [22:31] no, no trees in v2 [22:31] we don't think [22:31] ah, ok [22:32] yeah, nothing's really popping out at me, then [22:32] even the bulk expansion? [22:32] hmmm...I'd throw balloon help at it [22:33] but wouldnt' change the functionality if they're going to disappear [22:33] ok. re-opened on the balloon help plan [22:34] now we should all go to http://bugs.octotrike.org/bugs/bugs/ListIssues/sortorder-urgency?Filterlogic=block&saved_filter=&f-statuses=on+hold&f-statuses=rejected&f-statuses=completed&f-fromname=&f-email=&filteroptions=1&ListIssues%3Amethod=Apply+filter+settings&page=ListIssues [22:34] Action: asparagi looks forward to a bug tracking system with shorter URLs [22:34] Action: ar4chne looks forward to aspa finding one :D [22:35] Action: asparagi blushes [22:35] ;P [22:35] just teasing [22:35] i forgot that was my do [22:35] hmmm...is that known issues? [22:35] as in open? [22:35] yes. open or "taken", i.e. assigned [22:36] it doesn't include everything from our feature list as of last week [22:36] ok [22:36] but i think we were down to class comments or so last time [22:36] after we finish triaging these, i was figuring one of us could add the remaining stuff from our feature list & then we'll have it all in one place [22:37] yeah, sounds good [22:38] so, i'm in favor of class comments for v1. it will make people who want to interoperate have an easier time of it and it will be less tacky. [22:38] (dym, you still here?) [22:38] yup [22:39] sorry [22:39] I guess I'm willing to go with that, but it seems like a lot of time... [22:39] can we mark the bugs as v1 or v2? [22:39] god, i wish [22:39] lemme see here [22:39] I'd certainly say that any code that will be transitioning to v2 should get commented. [22:40] we could create v1 and v2 accounts and assign them to each [22:41] it's a bit hackish, but.. [22:41] good for now [22:41] that works [22:41] or I could be v1 [22:41] and you guys could be v2 [22:41] so thqat we don't have to add accts [22:43] while you were suggesting that, i added the accts [22:43] so it's too late [22:44] :+ [22:44] er, :+ [22:44] er> [22:44] heeehee :D [22:44] :) [22:44] no worries ^^ [22:44] + and ) are right next to each other on my keyboard [22:44] like x and lf [22:44] and every other character :) [22:45] :P [22:46] ok, let's just do class comments for classes that translate to v2 [22:46] ok [22:46] who determines which classes those are? [22:47] us [22:47] :) [22:47] !me [22:47] actually my first guess would be practically none [22:47] I wouldn't know [22:48] well, we don't have a plan for v2 yet, so i don't know either [22:48] but actually, it looks like not much of the existing class structure will be useful [22:50] hmm, there's a problem with the v1 vs. v2 thing [22:50] there doesn't seem to be an interface for assigning bugs,only "taking" them [22:50] and the password i just set doesn't work [22:51] huh [22:51] i think we should contine with "on hold" meaning "not v1" and i will look at bug tracking systems this week [22:51] and i guess i'm willing to put class comments on hold [22:52] Action: Dymaxion nods [22:52] so, tab dragging to re-order models [22:53] i think we are not going to go straight to focus+context for v2, so i think we should fix this in v1 [22:53] Action: Dymaxion agrees [22:55] so that means the bounds thing should be in v1 as well [22:55] yup [22:56] I think we're going to have to solve that either way, really [22:56] hmm, good point [22:56] oh! [22:57] i think i just figured out how to solve it [22:58] so, alphabetize open threat models by name [22:58] not really needed, exactly, but could be handy [22:58] would still apply in v1 [22:58] er, v2 [22:59] Action: asparagi feels like this is going really slowly [22:59] is this how y'all want to do triage? [22:59] sorry [22:59] I keep getting distracted by stuff here [22:59] (alex just made me come get dinner. :-) ) [22:59] it's not that slow...I just ordered our new server :D [23:00] ahh :) [23:00] oh! [23:00] awesome [23:00] :) [23:00] alphabetization would be nice to have for both, and would apply... dunno how much it really matters, though. [23:00] I'd rather just have them show up in creation/opening order and allow dragging, I think. [23:00] ara? [23:01] Action: asparagi is about to put it on hold [23:01] hmmm...yeah, I think just dragging is fine [23:01] (it being alphabetizing tms) [23:01] awesome. [23:02] actually i guess that's a reject, not on hold [23:02] notes section for model overall [23:02] I want this [23:03] ok, server ordered [23:03] :D [23:03] i feel like there is a huge philosophical can of worms there. [23:03] but ok. [23:03] yay, server! [23:04] Action: asparagi does the server dance [23:04] hehe ^^ [23:04] yeah, there definitely are a bunch of issues, and I think we should revisit it later, but it's something that I think will be very useful in the shorter term. [23:04] Yay server! [23:05] hmmm..I think we need an in person hash out day [23:05] it seems we keep running into these sticking points [23:05] that sap up a lot of time, and nothing is really getting resolved [23:05] Action: Dymaxion nods [23:05] negative value assets: this will automagically vanish in v2, since the risk model won't directly put values on assets. is it bad enough to include a fix in the last v1 release? [23:06] yah, an in-person hash-out might be good [23:06] I don't care about it for v1 [23:06] but if we can just finish triage for v1 tonight i would be really happy [23:07] ara, do you care about negative asset values? [23:08] Action: asparagi is going to put it on hold [23:08] no, I don't care [23:08] sorry, trying to find food [23:09] I dunno wassup, but I've been starving like every 3 hours lately [23:09] ahh :) good luck [23:09] cut/copy/paste rules & attacks [23:10] goes away? [23:10] if i were ever going to do another attack tree, i would care [23:10] yeah [23:10] didn't we already look at this when we were talking about undo, etc? [23:10] it does go away, but the general clipboard/cut & paste management system could be portable [23:10] i can't remember, sorry. [23:11] Action: Dymaxion nods [23:11] Action: Dymaxion hunts [23:11] last time i think everybody assumed someone else was updating the bugs [23:11] so we didn't get it synced up [23:12] i think right now i'm in favor of a clipboard system [23:12] yeah, it's useful [23:12] Action: Dymaxion eyes the irc logs [23:12] just in general [23:12] sounds good [23:12] squeak doesn't have anything? [23:13] i think v2 will be useless without it, so we may as well get a little longer burn-in time [23:13] i have no idea [23:13] i haven't looked yet [23:13] we need something that integrates into our model and update event system, anyway [23:13] so there's going to be some code, no matter what. [23:16] k. spurious NOT in role rules [23:16] yeah, no worries [23:16] i think this problem, unfortunately, is a necessary side effect of the roles-are-not-mutually-exclusive thing [23:16] yeah [23:16] let's keep ignoring it. [23:16] and in my last project, in fact roles were not mutually exclusive. so i vote reject [23:16] that works, too. [23:16] that way we don't have to keep triaging it over & over :) [23:16] Action: Dymaxion grins. [23:16] clicking outside any text box should accept changes [23:16] hehe, fine by me [23:17] i vote v1 [23:17] I think that one's important [23:17] yeah [23:17] it's bloody annoying, too. [23:17] tabs beyond window width [23:17] i vote v1: it'll still be present in v2 [23:17] yup [23:17] same for automatically scroll large panes [23:18] sounds good [23:18] yeah [23:18] (i'm using the algorithm that one v1 vote is enough, but everyone must reject/on hold, in case that isn't clear) [23:19] k. visible indication of editable text [23:19] ok [23:19] v1 [23:19] v1, i think [23:19] balloon help for threat model tabs [23:19] i could go either way [23:19] v1; we may have to change the details, but we might as well get in the habit of doing it now. [23:20] k. it may require notebook changes, too [23:20] sync tab & page names? [23:20] i think this is essential for v1 [23:20] hang on, reading bug [23:21] huh, ok [23:21] I hadn't run into that; is this a "changing things with code" issue? [23:21] well, right now there is no UI to change the name of a threat model [23:21] i think. [23:22] yeah, there isn't [23:22] currently this bug is half-fixed. now if you programmatically change the model name, the tab changes [23:22] you should be able to click on the tab, edit the name, and have it stick [23:23] Action: Dymaxion nods [23:23] i could turn on click to edit the tab name easily, but i turned it off because it only changes the tab, not the model, which seems bad [23:24] that doesn't sound too bad [23:24] Action: Dymaxion nods [23:25] i see paul wanted the notes field so much we have 2 open bugs on that. :) [23:25] i'm going to reject one. [23:25] Action: Dymaxion whistles innocently. [23:25] Sounds good. [23:26] ok. 'create' &c called verbs consistently in code & xml [23:26] i don't care [23:27] I'm inclined to leave it alone... it's a lot of work for consistency in code we're not carrying on. [23:27] I don't understand that one [23:27] there are instance variables named "action", for example [23:28] when we finally agreed on xml, we called those same pieces of data (crud, basically) verbs [23:28] so the idea was, make the code use the same names as the xml, so interoperation folks, and us for that matter, wouldn't get confused. [23:29] plus the existing names are really confusing [23:29] you see lines of code including phrases like "threat action action" [23:29] which is weird. "threat action verb" seems less like a typo [23:30] ara, we have a vote for on hold and an abstention. you are the swing vote... [23:32] sorry, 1 s [23:32] Action: ar4chne has no food :( [23:32] aww [23:32] none in your whole apartmentD [23:32] ? we could send you pizza? [23:33] I might order one [23:33] hmmm...I'd say leave for v1 [23:33] but as we code for v2, we should match them [23:33] k.. now order food before you come back! [23:33] Action: ar4chne grumbles [23:33] I wish more stuff were deliverable [23:34] I don't really feel like pizza [23:34] yeah; that specific issue isn't going to be in v2, because actions won't be, but if anything like it comes up, we should definitely do it right from the start. [23:34] teapot delivers [23:34] ooooh [23:34] they do? [23:34] they're vegan, i think [23:34] Action: Dymaxion shouldn't know that. [23:34] ooooh, no way :D :D [23:34] i think so. i think i've had it delivered at danger house before [23:34] teapot rocks [23:34] several times, in fact [23:34] cool [23:34] mmmmmm [23:34] oh, man [23:35] I don't think I should know this [23:35] order quick tho, i think they might close @ 10 [23:35] <3 [23:35] Action: Dymaxion slips out real quick to run over to steph's. [23:35] no, you should, you really should go order some right now :) [23:35] Action: asparagi laughs [23:36] no delivery :( [23:36] haha, she laughed at me [23:36] noo! [23:36] oh no [23:36] bah! [23:37] i could swear there was a guy with big boxes of chinese at my door [23:37] sorry to get your hopes up. :( [23:37] :) no worries [23:37] ok, what's next [23:38] Action: ar4chne goes and microwaves a gluten free waffle [23:38] *sigh* [23:40] :( [23:40] Action: asparagi was looking for other places [23:40] need more space around UI strings [23:41] i vote on hold, but fix the next issue in v1 [23:41] that should solve the same problem [23:41] not really [23:41] no? [23:41] the spacing issue is one of space proportional to the text size [23:41] yes [23:42] fixing the next issue could include a fix to the current one, but doesn't have to. [23:42] so making the text resizable, which it isn't now, will fix that [23:42] i don't see how you could make the text resizable without addressing issues like that [23:42] Basically, if we make the text resizable, we need to make the padding on the text adjustable. [23:42] yeah [23:43] so, once we make the padding proportional, then we can figure out what the proportion should be. [23:43] Different bug. [23:44] i mean, that's basically what got us to the current state: changing to caps changed the size of the text when we have no plan for changing the size of the text [23:44] I agree w/ aspa [23:44] I think they can be rolled [23:44] i can leave them both open if you want, but i think it's the same fix [23:44] yes [23:45] so can i close need more space with a reference to change text size easily? [23:45] yes, that works [23:45] k [23:46] ah, then we get to display preferences sections & menu [23:47] the title on that one is difficult to grok [23:47] especially since the bug has been half-fixed [23:48] yes :) [23:48] if i half-fix 2 bugs, can i close one? ;) [23:49] yes, but only if you do so in a nondeterministic fashion, so it's always the other bug which is closed when you look at one of them. [23:49] Action: Dymaxion grins. [23:49] i guess i think the other half-fix should go into v1 [23:49] i think i'm going to change its title [23:49] no, no i'm not [23:49] there's no ui [23:50] heh [23:51] so, the USB stick that's been my portable dev environment and password safe, among other things, died today for real. [23:51] I didn't lose any data, but its replacement is still not here. [23:52] Fortunately, I got a free 512MB stick in the mail today, which came with my laptop. :-) [23:52] (and then had to go toss 2/3 of the images I have sitting around, so it would fit, but) [23:54] just in time USB sticks [23:54] yup [23:55] Action: Dymaxion got the people e's getting the new one from to waive shipping and send it next day for being late. :-) [23:56] ara fell off the net [23:56] doh! [23:57] so we should finish triage & send a report to the list [23:57] ok [23:57] vertical text in grid views. [23:58] No more grid views, but we'll still have vertical text. Is this still going to be a problem? [23:58] yes [23:58]