George Dunlap

The open-source software plays a vital role in our worldwide computing infrastructure. When vulnerabilities are discovered in our software, our response can have a major impact on how much risk our end users are exposed to.

The XenProject's security response process has been hardened and tested over years of experience, and has weathered several storms. This talk will share some war stories from our security response process that explain how we got to where it is today, so that you can learn the easy way, from our experience, rather than the hard way, from your own experience.

This talk will briefly cover the history of response processes -- from non-disclosure to full disclosure to coordinated or "responsible" disclosure, and pre-disclosure.

We'll then cover two major events -- XSA-7, the Intel SYSRET vulnerability; and XSA-108 -- that highlighted some weaknesses in our process, and how we tweaked the process in response.

Finally, we'll cover how we handled the a very controversial community discussion after XSA-7 in a way which, we hope, gave everyone in the community an opportunity to have their voice heard and counted, in spite of the complete lack of consensus.

CentOS is a "distribution" with a rather unique description: it is a free (gratis) clone of a commercially-supported "distribution" with all the branding removed. Being enterprise-grade distribution means solid and well-tested; but it also means not having the latest functionality. It also means having a small enough feature set to provide commercial support in a viable manner: and that typically means choosing one technology and sticking with it.

But what if you wanted your entire system to be solid, and well-tested, but want the latest features for one particular package or program? Or what if you really wanted an enterprise system, but wanted to use one of the alternate technoligies that were not selected?

This is where CentOS SIGs come in. The new CentOS is still at its core a clone of an upstream enterprise distribution. But having had success with the Xen4CentOS project, which provided a version of Xen to run on CentOS 6, they have now generalized the process.

This talk will talk about CentOS SIGs: the vision, the structure, what SIGs are available. We will compare and contrast them to other community distro development models like Fedora, OpenSuSE, Debian, Ubuntu, and so forth. We will also share lessons from the CentOS Virt SIG, in which a number of virtualisation and related technologies such as Xen, oVirt, Docker and others collaborate.

Xen is a mature enterprise-grade virtual machine with many advanced security features which are unique to Xen. For this reason it's the hypervisor of choice for the NSA, the DoD, and the new QubesOS Secure Desktop project. However, while much of the security of Xen is inherent in its design, many of the advanced security features, such as stub domains, driver domains, XSM, and so on are not enabled by default. This session will describe all of the advanced security features of Xen, and the best way to configure them for the Cloud environment.