AB Meeting/October 2014 Minutes

== Attendees ==
* Paul Voccio, Antony Messerli (Rackspace)
* Matt Wilson (Amazon)
* Larry Wikelius (Cavium)
* Sherry Hurwitz (AMD)
* Philippe Robin (ARM)
* Mark Hinkle (Citrix)
* Konrad R Wwilk (Oracle)

* Mike Woster (LF)
* Sarah Cconway (LF)

Quorum

== Open Actions from last meeting (the rest is closed) ==

{{Action|All}} expand membership list

Description: Member companies to come up with a list of their partners
that are potential Advisory Board members + contact details by the next
board meeting.  

Status:
* No news from Konrad and Larry;
* Lars : Update on SUSE - will not join, due to multi-hypervisor strategy.
Joining Xen Project would imply having to join other organisations too


{{Action|Mike}} will check on Applied Micro status and get back to board

{{Action|Konrad}} 4.5 Feature List

Description: go through the 4.5 feature list and communicate KEY features
to Sarah.

Status:
* Sarah sent some questions yesterday
* {{Action|Sarah}} will set up a call early next week (after RC1)
* {{Action|Mike}} share Linux Foundation process documentation with Lars


== Revised Test Infrastructure HW  Equipment and Installation ==
We had originally approved the test infrastructure HW at
http://lists.xenproject.org/archives/html/advisory-board/2014-08/msg00014.html - 
Due to a change in HW list to accommodate for AMD machines, the originally approved
amount of $58388 (excluding the installation of the HW at the COLO) was insufficient. Note
that we have structured the AllNet agreements into two separate agreements: a)
procurement of HW and installation cost (attached), b) ongoing service and maintenance
Agreement

If you look at Appendix A of the attached document you will see the
changes.

Equipment Total          $60,502.00 (approved under "2014.8e: One-off
                                     cost for Hardware", but insufficient)
Mass State Tax @ 6.25%   $3,781.38  (see above)
Installation and Config  $ 8.500.00 (this has been approved under
"2014.11e)
------------
Grand Total              $72,783.91
Grand Total for HW only  $64,283.38

Just to restate, we had previously approved
1:  Labor and costs for set-up  $9,500
2:  Labor and service monthly   $3,300
3:  Hardware                    $58,388

{{RESOLUTION}} approve $65,000 for HW for COLO replacing the previously
approved $58,388
Approved

== XSA 108 and Security Process Post Mortem ==
Given the significance of XSA 108, I think it makes sense to have a
post-mortem
A) Media post-mortem (Sarah)
B) Process post-mortem
C) Is/should there any follow-up (Sarah had some ideas)
D) Should we support an initiative to enable Xen hot patching (avoiding
further reboots)

Lars: I think overall, the project came out well of this issue. I also
wanted to thank everyone who helped put together the projects response
under pressure.

Lars: Also note that there is a process post mortem ongoing on xen-devel@
(see
https://blog.xenproject.org/2014/10/22/xen-project-security-policy-improvements-get-involved/).

So far predominately members of the security team have participated,
despite the process being open to all. Planning a blog post.

Sarah: October 282 articles were mentioned, in Sept 249 that mentioned Xen
& Security
This is high for a single topic and was driven by AWS and RAX coverage, as
well as the survey from RightScale and its coverage.

Recommendation: quicker turn-around on media coverage would have been
better. If we had had the blog earlier, we would have been able to be more
pro-active.

However, all things considered PR was handled well and the impact was big.
Once we had been able to get our own viewpoint out : the coverage was
fairly positive. Some 3rd party vendors appear to have capitalised on the coverage, such as
RightScale and various security experts.

Sarah: would the project be able to do a survey such as the one from
RightScale Or something similar in future?

Note: I don't think we answered that question. But it is difficult to see
how the Project could do this without making use of a 3rd party or member
companies.

Sarah: There is a general uptake in security related content and topics
related to Security, cloud and virtualisation are hot and likely to stay so. This
would enable us to get some messages out, such as highlight the security process as it
works, highlight Xen Project's track record, etc.

There would be an opportunity if there was agreement by the board around
it.
Would this something which would work?

Antony and Paul from Rackspace agreed.

--- Otherwise no objections were voiced ---

Sarah: do we think we can take a leadership position on this issue? Maybe
some technical blogs (e.g. something re Coverity, security features, George
Dunlap's LinuxCon presentation, ...) – it is a positive differentiator. It is also
a topic that is of interest to business press.

Sarah: Is anyone against pro-active outreach

--- NO OBJECTIONS ---


Lars: I believe a concrete proposal on topics should be made to the board.

Sarah: One area which was difficult, was that we had no spokesperson to
give interviews.
However the prepared statement (aka the blog post) with no spokesperson
worked reasonably
well. Is this something we should do in future in such situations?

Antony and Paul Agreed. (Lars: I think there was one more, but I didn't
capture it).

Lars: I believe we were actually able to turn this around quickly. We only
really started on Mon night (29th), which gave us 1.5 days to turn this
round. I think we were all surprised about the media hype. If there is a
significant security issue in future, we can start to
prepare communication (taking account the security process) earlier in
anticipation of media interest.

Matt: explained that *only after* the speculation that XSA 108 was the
cause of the AWS reboot, AWS published the blog post and made a statement.

Lars: maybe the lesson is not to publish an opaque XSA number on the Xen
Project website. If the media would not have the capability to cross-reference to
XSA 108, there would maybe not have been so much of an issue

Matt: This should be discussed on xen-devel as part of the process
discussion

Lars: Agreed

{{Action|Lars}} Send a link with information to the AB list, such that AB
members who do not follow xen-devel@ can participate in the discussion easily

{{Tick}} Also see
https://blog.xenproject.org/2014/10/22/xen-project-security-policy-improvements-get-involved/ - which provides instructions

Matt: reported from Linux Plumbers where there was a session on Linux and
Xen hot patching. Th goal there is to align feature work between Xen and the Linux
Kernel for hot patching and to make some connections with people at RedHat
and Suse and work on some common problems (e.g. shared tooling).

At the meeting, we did get good collaboration between Xen and Linux.


Next step: get some PoC work out onto the list.

Matt: has some concrete PoC code already, and may consider a prototype
patch submission

Konrad: maybe a design first would be better?

Matt: given that there is code, it may be better to make the code available

== Startup Membership class concerns ==
Although, we in principle have approved this new membership class, Daniel Kiper 
from Oracle raised some concerns that the new membership class is unfair. See
http://lists.xenproject.org/archives/html/advisory-board/2014-10/msg00047.html

Lars: Although I stated in the agenda that there was contradicting
statements from Daniel Kiper (Oracle) and Konrad (Oracle), this was
actually incorrect. Daniel first voted in favour and then raised concerns, 
which I am assuming should be treated as an objection.

Criticisms raised were:
* Name may exclude other small vendors that are not startups
* The voting power to price mapping seems unfair
* The cap of 3 elected representatives

Mike: Board can choose to do what it wants to do. Fairness does not
necessarily have to come into it. You also nee to consider the first mover advantage and
whether the board believes that the new class will attract more members. Also, other
LF projects do not have exact voting parity between different membership classes.

Sherry: influence comes predominantly from technical contributions, not
board membership. Agrees with Mike on the balance of larger paying
contributors vs. smaller ones.


Note: Lars, who was taking notes missed some of the conversation. Sherry
raised some concerns, which Lars didn't capture in the notes. @Sherry and others, feel
free to add and correct the minutes here.

Matt: Had a concern in how the resolution was worded. Startup membership
class includes 1 AB seat for every 10 members. If 1 company joins, there would be an
automatic seat for that company. But I didn't object, as I was not part of the discussion
leading to the draft.

Mike: Do you take issue with having a single seat for a an initial member
of the new membership class?

Matt: Yes, the main concern is that there is not a minimum threshold for a
board seat, which devalues votes of existing members.

Others agreed with this point too (Mark Hinkle, and one more)

Lars: clarified that the bootstrapping issue was not discussed as far as
he recalls and that this was an omission.

Mike: would adding a bootstrapping clause address Matt's concern?

Matt: Yes, that would address the concern. Maybe go for an approach that is
proven in other projects.

{{ACTION|Mike}} to re-write proposal and add a provision for bootstrapping

Mark: 1 : 5 – equity makes sense. We could also have a provision for
non-voting participation.

Matt: Should we have a larger discussion about membership. However I am
also happy to focus on smaller companies / start-ups.

The board did not conclude and agree on a specific threshold (aka number X
of members, before an election can be held) as we ran out of time. Also we did not
agree on whether the buckets for the membership class should be 5, 10 or somewhere in
between.

--- PROPOSE TO WAIT FOR MIKE's REVISION AND TAKE THE DISCUSSION TO THE LIST ---