Server Security Group: the pitch and meeting poll

Gelareh_Taban · 2017-01-25T22:17:47.000Z

Hi all,

I've put together a draft pitch for the Security Group to be discussed in
the next Server Security Group. We would discuss the project design goals
and overall approach.

Please fill up the Doodle poll below so we can schedule it at a time that
best fits everyone.

To review the pitch:

github.com

swift-server/security/blob/master/README.md

# Status

:warning: This project is unmaintained experimental legacy code. It has been obsoleted by [swift-nio-ssl](https://github.com/apple/swift-nio-ssl) which contains the recommended TLS API of the [Swift Server Work Group](https://swift.org/server/).

It remains here for historical interest only.

# Introduction

Currently there is no standard Swift security library that is compatible with all of the current Swift platforms (Apple and Linux). This lack of standardization has resulted in multiple projects which either write their own Swift security functionality or use their security library of choice (be it OpenSSL, LibreSSL, etc.).  This is not desirable because it can lead to:
- incompatibility of dependencies if more that one security package is needed by different modules (a project cannot have both OpenSSL and LibreSSL in its dependency graph)
- insecurity (using an unpatched or insecure library)
- unmaintainability (using non-standard or non-native libraries)
- more complex code (using different APIs for each platform).

This proposal outlines a set of design goals as well as an approach to be adopted by the Swift Server APIs project's Security Working Group for the creation of a single Swift security component that is cross-compatible on Apple and Linux (Ubuntu) platforms. The Security APIs will consist of both lower level crypto APIs (including hashing, symmetric and asymmetric crypto) as well as higher level APIs (including key/certificate management and secure communication such as TLS).

# Motivation

Having a consistent development experience for Swift across Apple and Linux helps drive higher developer productivity, safer code as well as better reuse of Swift assets/libraries across these platforms.

This file has been truncated. show original

Meeting schedule poll:
http://doodle.com/poll/hmakcgbqby2biudc

Regards,
Gelareh

Fastmail · 2017-01-26T14:58:52.000Z

Reading through the agenda, I see that focus is on providing crypto APIs with a bias towards FIPS compliance (great!).

However, this is omitting discussion of the language and compiler infrastructure. Should there be a separate team, or some involvement with the compiler developers?

Tom

···

On 25 Jan 2017, at 17:17, Gelareh Taban via swift-server-dev <swift-server-dev@swift.org> wrote:

Hi all,

I've put together a draft pitch for the Security Group to be discussed in the next Server Security Group. We would discuss the project design goals and overall approach.

Please fill up the Doodle poll below so we can schedule it at a time that best fits everyone.

To review the pitch:
https://github.com/swift-server/security/blob/master/README.md

Meeting schedule poll:
Expired Group Poll - Create a New Poll or Contact the Owner

Regards,
Gelareh

_______________________________________________
swift-server-dev mailing list
swift-server-dev@swift.org
https://lists.swift.org/mailman/listinfo/swift-server-dev

johannesweiss · 2017-01-26T11:12:23.000Z

sorry, this might be a stupid question. Last time Doodle told me something about the timezone but this time it didn't. Does Doodle correctly show me the time in my timezone? I kind of doubt it because the times are between 9am and 3pm. If that's my timezone (London), then that all looks a bit early for say the US west coast which is 8 hours bind London which would make the time slots 1am to 7am :).

···

On 25 Jan 2017, at 22:17, Gelareh Taban via swift-server-dev <swift-server-dev@swift.org> wrote:

Hi all,

I've put together a draft pitch for the Security Group to be discussed in the next Server Security Group. We would discuss the project design goals and overall approach.

Please fill up the Doodle poll below so we can schedule it at a time that best fits everyone.

To review the pitch:
https://github.com/swift-server/security/blob/master/README.md

Meeting schedule poll:
Expired Group Poll - Create a New Poll or Contact the Owner

Regards,
Gelareh

_______________________________________________
swift-server-dev mailing list
swift-server-dev@swift.org
https://lists.swift.org/mailman/listinfo/swift-server-dev

Gelareh_Taban · 2017-01-26T14:58:47.000Z

** Please use the new and improved Doodle poll that supports time zones! **

(including people who already signed up to the old one)

Doodle

Expired Group Poll - Create a New Poll or Contact the Owner

The Group Poll you're trying to access isn’t up-to-date and has been archived

Hi Johannes,

You're absolutely right - I had forgotten to enable time zones.
Unfortunately I can't enable time zones on an existing doodle, so I had to
create a new one. http://doodle.com/poll/vihp99y3xhac67hs

Thanks for your question!

cheers,
Gelareh

···

From: Johannes Weiß <johannesweiss@apple.com>
To: Gelareh Taban/Austin/IBM@IBMUS
Cc: swift-server-dev@swift.org
Date: 01/26/2017 05:12 AM
Subject: Re: [swift-server-dev] Server Security Group: the pitch and
meeting poll
Sent by: johannesweiss@apple.com

sorry, this might be a stupid question. Last time Doodle told me something
about the timezone but this time it didn't. Does Doodle correctly show me
the time in my timezone? I kind of doubt it because the times are between
9am and 3pm. If that's my timezone (London), then that all looks a bit
early for say the US west coast which is 8 hours bind London which would
make the time slots 1am to 7am :).

On 25 Jan 2017, at 22:17, Gelareh Taban via swift-server-dev <swift-server-dev@swift.org> wrote:

Hi all,

I've put together a draft pitch for the Security Group to be discussed in

the next Server Security Group. We would discuss the project design goals
and overall approach.

Please fill up the Doodle poll below so we can schedule it at a time that

best fits everyone.

To review the pitch:
https://github.com/swift-server/security/blob/master/README.md

Meeting schedule poll:
http://doodle.com/poll/hmakcgbqby2biudc

Regards,
Gelareh

_______________________________________________
swift-server-dev mailing list
swift-server-dev@swift.org
https://lists.swift.org/mailman/listinfo/swift-server-dev

Fastmail · 2017-01-26T14:54:24.000Z

Same here – currently on East Coast until Feb 7 (flying home that day to UK).

···

On 26 Jan 2017, at 06:12, Johannes Weiß via swift-server-dev <swift-server-dev@swift.org> wrote:

sorry, this might be a stupid question. Last time Doodle told me something about the timezone but this time it didn't. Does Doodle correctly show me the time in my timezone? I kind of doubt it because the times are between 9am and 3pm. If that's my timezone (London), then that all looks a bit early for say the US west coast which is 8 hours bind London which would make the time slots 1am to 7am :).

On 25 Jan 2017, at 22:17, Gelareh Taban via swift-server-dev <swift-server-dev@swift.org> wrote:

Hi all,

I've put together a draft pitch for the Security Group to be discussed in the next Server Security Group. We would discuss the project design goals and overall approach.

Please fill up the Doodle poll below so we can schedule it at a time that best fits everyone.

To review the pitch:
https://github.com/swift-server/security/blob/master/README.md

Meeting schedule poll:
http://doodle.com/poll/hmakcgbqby2biudc

Regards,
Gelareh

_______________________________________________
swift-server-dev mailing list
swift-server-dev@swift.org
https://lists.swift.org/mailman/listinfo/swift-server-dev

_______________________________________________
swift-server-dev mailing list
swift-server-dev@swift.org
https://lists.swift.org/mailman/listinfo/swift-server-dev

Michael_Ilseman · 2017-01-27T20:29:40.000Z

Reading through the agenda, I see that focus is on providing crypto APIs with a bias towards FIPS compliance (great!).

However, this is omitting discussion of the language and compiler infrastructure. Should there be a separate team, or some involvement with the compiler developers?

How do you envision this affecting the compiler?

···

On Jan 26, 2017, at 6:58 AM, swizzlr via swift-server-dev <swift-server-dev@swift.org> wrote:

Tom

On 25 Jan 2017, at 17:17, Gelareh Taban via swift-server-dev <swift-server-dev@swift.org <mailto:swift-server-dev@swift.org>> wrote:

Hi all,

I've put together a draft pitch for the Security Group to be discussed in the next Server Security Group. We would discuss the project design goals and overall approach.

Please fill up the Doodle poll below so we can schedule it at a time that best fits everyone.

To review the pitch:
https://github.com/swift-server/security/blob/master/README.md

Meeting schedule poll:
http://doodle.com/poll/hmakcgbqby2biudc

Regards,
Gelareh

_______________________________________________
swift-server-dev mailing list
swift-server-dev@swift.org <mailto:swift-server-dev@swift.org>
https://lists.swift.org/mailman/listinfo/swift-server-dev

_______________________________________________
swift-server-dev mailing list
swift-server-dev@swift.org
https://lists.swift.org/mailman/listinfo/swift-server-dev