)]}'
{"security-notes/OSSN-0050":[{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"aba5c2e20a67a1d277f2b66fbc3a3fae5666f21d","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Affected Services / Software ###"},{"line_number":13,"context_line":"keystone (all releases), also any additional services relying upon"},{"line_number":14,"context_line":"keystone tokens for authorisation."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"### Discussion ###"},{"line_number":17,"context_line":"When users or groups are disabled through the keystone API the already"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_a1ac0336","line":14,"updated":"2015-07-13 21:50:20.000000000","message":"might want to get Nathan Kinder\u0027s advice on how we should codify this part.","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"### Affected Services / Software ###"},{"line_number":13,"context_line":"keystone (all releases), also any additional services relying upon"},{"line_number":14,"context_line":"keystone tokens for authorisation."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"### Discussion ###"},{"line_number":17,"context_line":"When users or groups are disabled through the keystone API the already"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_a173f5e6","line":14,"in_reply_to":"9a41bdd9_a1ac0336","updated":"2015-07-16 17:53:41.000000000","message":"What we usually do is list the affected service first, followed by releases.  If it affects all releases, we don\u0027t need to list everything since the dawn of time.  I usually just list whatever is currently supported based off of the stable release policy.  Given that this is a design issue that will never be fixed, I would just format it like this though:\n\n  Keystone, All releases","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":14,"context_line":"keystone tokens for authorisation."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"### Discussion ###"},{"line_number":17,"context_line":"When users or groups are disabled through the keystone API the already"},{"line_number":18,"context_line":"issued tokens are invalidated by keystone itself."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"However, users and groups may be managed externally of Keystone such as:"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_41578926","line":17,"updated":"2015-07-16 17:53:41.000000000","message":"(nit) Add a comma - \"...API, the...\"","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":17,"context_line":"When users or groups are disabled through the keystone API the already"},{"line_number":18,"context_line":"issued tokens are invalidated by keystone itself."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"However, users and groups may be managed externally of Keystone such as:"},{"line_number":21,"context_line":" - LDAP (or AD) Identity provider."},{"line_number":22,"context_line":" - Federation IdP"},{"line_number":23,"context_line":" - Private Key Infrastructure (PKI)"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_3cd4e845","line":20,"updated":"2015-07-16 17:53:41.000000000","message":"I would combine this sentence in the same paragraph as the previous sentence.  Also, say \"externally to keystone\", or \"outside of keystone\".\n\nNote that \"keystone\" should not be capitalized.","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":18,"context_line":"issued tokens are invalidated by keystone itself."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"However, users and groups may be managed externally of Keystone such as:"},{"line_number":21,"context_line":" - LDAP (or AD) Identity provider."},{"line_number":22,"context_line":" - Federation IdP"},{"line_number":23,"context_line":" - Private Key Infrastructure (PKI)"},{"line_number":24,"context_line":" - Direct SQL updates to the database."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_9cc3b48a","line":21,"updated":"2015-07-16 17:53:41.000000000","message":"Spell out \"Active Directory\".  Also, \"identity provider\" is overused, and has a specific meaning for federation.  I would say \"identity source\", or just say \"LDAP or Active Directory\".","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"However, users and groups may be managed externally of Keystone such as:"},{"line_number":21,"context_line":" - LDAP (or AD) Identity provider."},{"line_number":22,"context_line":" - Federation IdP"},{"line_number":23,"context_line":" - Private Key Infrastructure (PKI)"},{"line_number":24,"context_line":" - Direct SQL updates to the database."},{"line_number":25,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_5cf1ac94","line":22,"updated":"2015-07-16 17:53:41.000000000","message":"I would spell out \"Identity Provider\", or just say \"Federated identity\".","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":20,"context_line":"However, users and groups may be managed externally of Keystone such as:"},{"line_number":21,"context_line":" - LDAP (or AD) Identity provider."},{"line_number":22,"context_line":" - Federation IdP"},{"line_number":23,"context_line":" - Private Key Infrastructure (PKI)"},{"line_number":24,"context_line":" - Direct SQL updates to the database."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Unlike disabling using keystone API\u0027s, these above mechanisms do not"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_1ced648e","line":23,"updated":"2015-07-16 17:53:41.000000000","message":"Are you talking about the PKI token format, or client certificate authentication?\n\nWe don\u0027t really have a good way of using PKI to provide identity info right now for Keystone.  It\u0027s theoretically possible to use client certificates for authentication (though there is a lot of missing functionality that makes this not viable right now).  Still, that is only authentication.  It doesn\u0027t provide the rest of the user information.\n\nI get the intent here - we don\u0027t detect that a certificate has been revoked, and hence can\u0027t disable the user and expire their tokens.  I just don\u0027t think client certificates is far enough along that anyone actually uses it with Keystone yet.  I\u0027m not sure that we should list it.","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":21,"context_line":" - LDAP (or AD) Identity provider."},{"line_number":22,"context_line":" - Federation IdP"},{"line_number":23,"context_line":" - Private Key Infrastructure (PKI)"},{"line_number":24,"context_line":" - Direct SQL updates to the database."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Unlike disabling using keystone API\u0027s, these above mechanisms do not"},{"line_number":27,"context_line":"have a revocation procedure.  This is a limited issue to situations such"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_7ceef0b5","line":24,"updated":"2015-07-16 17:53:41.000000000","message":"Ewww...  It could happen, but it\u0027s obviously not something that is considered \"supported\".  If you touch the database, you\u0027re on your own.  Given that, I\u0027m not sure we should list this here.","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"aba5c2e20a67a1d277f2b66fbc3a3fae5666f21d","unresolved":false,"context_lines":[{"line_number":23,"context_line":" - Private Key Infrastructure (PKI)"},{"line_number":24,"context_line":" - Direct SQL updates to the database."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Unlike disabling using keystone API\u0027s, these above mechanisms do not"},{"line_number":27,"context_line":"have a revocation procedure.  This is a limited issue to situations such"},{"line_number":28,"context_line":"as when a user is disabled outside of keystone."},{"line_number":29,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_014b6f88","line":26,"updated":"2015-07-13 21:50:20.000000000","message":"i think maybe add \"users\" here to be a little more explicit, so \"Unlike disabling users using keystone API\u0027s, ...\"","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":24,"context_line":" - Direct SQL updates to the database."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Unlike disabling using keystone API\u0027s, these above mechanisms do not"},{"line_number":27,"context_line":"have a revocation procedure.  This is a limited issue to situations such"},{"line_number":28,"context_line":"as when a user is disabled outside of keystone."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Keystone is not informed that the user was disabled because no API call"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_3c994820","line":27,"updated":"2015-07-16 17:53:41.000000000","message":"I think of it more as a notification procedure, not revocation.","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"aba5c2e20a67a1d277f2b66fbc3a3fae5666f21d","unresolved":false,"context_lines":[{"line_number":32,"context_line":"invalidate already issued tokens."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Whilst it is possible for Keystone to add additional validation for"},{"line_number":35,"context_line":"the identify providers of LDAP and SQL, this cannot be achieved with"},{"line_number":36,"context_line":"the Federation extension, as the user is required to be in the path for"},{"line_number":37,"context_line":"SAML assertions and this cannot be possible at token validation time."},{"line_number":38,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_c13b47ea","line":35,"updated":"2015-07-13 21:50:20.000000000","message":"s/identify/identity/","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":8074,"name":"Jin Nan Zhang","username":"zhangjinnan","inactive":true},"change_message_id":"5070eb045f2d6622887bd025e86adc6dcc2d166f","unresolved":false,"context_lines":[{"line_number":32,"context_line":"invalidate already issued tokens."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Whilst it is possible for Keystone to add additional validation for"},{"line_number":35,"context_line":"the identify providers of LDAP and SQL, this cannot be achieved with"},{"line_number":36,"context_line":"the Federation extension, as the user is required to be in the path for"},{"line_number":37,"context_line":"SAML assertions and this cannot be possible at token validation time."},{"line_number":38,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_d1fe87ad","line":35,"in_reply_to":"9a41bdd9_c13b47ea","updated":"2015-07-14 16:44:33.000000000","message":"done","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Whilst it is possible for Keystone to add additional validation for"},{"line_number":35,"context_line":"the identify providers of LDAP and SQL, this cannot be achieved with"},{"line_number":36,"context_line":"the Federation extension, as the user is required to be in the path for"},{"line_number":37,"context_line":"SAML assertions and this cannot be possible at token validation time."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"In addition, this cannot be solved in a robust way to solve this for"},{"line_number":40,"context_line":"PKI due to signed datasets.  This means that this mechanism is at a"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_379f23b6","line":37,"updated":"2015-07-16 17:53:41.000000000","message":"This paragraph is confusing for me, even though I have a thorough understanding of Keystone\u0027s federation extension.  Could you clarify the point you are trying to make with this paragraph?\n\nI think you are saying that keystone could be modified check if the user is enabled/disabled in the backend during token validation with LDAP or SQL are being used.  This would be bad from a scalability perspective, as we would have a round trip to LDAP for every validation, but it\u0027s possible.  With SAML, it\u0027s not even possible.  We can only consume assertions that the user presents to us, so we have no capability to \"look up\" user information on the fly.  Is this what you are trying to convey here?","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":36,"context_line":"the Federation extension, as the user is required to be in the path for"},{"line_number":37,"context_line":"SAML assertions and this cannot be possible at token validation time."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"In addition, this cannot be solved in a robust way to solve this for"},{"line_number":40,"context_line":"PKI due to signed datasets.  This means that this mechanism is at a"},{"line_number":41,"context_line":"disadvantage compared to  uuid/Fernet tokens.  However, the exposure is"},{"line_number":42,"context_line":"limited to deferring the invalidation until the declared expiry lifetime"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_f729bb38","line":39,"updated":"2015-07-16 17:53:41.000000000","message":"This reads odd since you have \"solve/solved\" in here twice.  Just say \"...this cannot be solved in a robust way for PKI formatted tokens...\".","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":37,"context_line":"SAML assertions and this cannot be possible at token validation time."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"In addition, this cannot be solved in a robust way to solve this for"},{"line_number":40,"context_line":"PKI due to signed datasets.  This means that this mechanism is at a"},{"line_number":41,"context_line":"disadvantage compared to  uuid/Fernet tokens.  However, the exposure is"},{"line_number":42,"context_line":"limited to deferring the invalidation until the declared expiry lifetime"},{"line_number":43,"context_line":"of the token."}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_370963de","line":40,"updated":"2015-07-16 17:53:41.000000000","message":"We should explicitly say \"PKI formatted tokens\".  You probably want to include PKIZ too.","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"aba5c2e20a67a1d277f2b66fbc3a3fae5666f21d","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"In addition, this cannot be solved in a robust way to solve this for"},{"line_number":40,"context_line":"PKI due to signed datasets.  This means that this mechanism is at a"},{"line_number":41,"context_line":"disadvantage compared to  uuid/Fernet tokens.  However, the exposure is"},{"line_number":42,"context_line":"limited to deferring the invalidation until the declared expiry lifetime"},{"line_number":43,"context_line":"of the token."},{"line_number":44,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_612b5b95","line":41,"updated":"2015-07-13 21:50:20.000000000","message":"should this be UUID ?","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":40,"context_line":"PKI due to signed datasets.  This means that this mechanism is at a"},{"line_number":41,"context_line":"disadvantage compared to  uuid/Fernet tokens.  However, the exposure is"},{"line_number":42,"context_line":"limited to deferring the invalidation until the declared expiry lifetime"},{"line_number":43,"context_line":"of the token."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Keystone configuration has the default token expiration value of 3600"},{"line_number":46,"context_line":"seconds (1 hour), which is usually an acceptable risk for most"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_d7335761","line":43,"updated":"2015-07-16 17:53:41.000000000","message":"PKI/PKIZ tokens do have revocation, so I\u0027m not sure that this paragraph is valid.  Services taht validate tokens should be consuming the revocation functionality of Keystone if they are not comfortable trusting the token for it\u0027s validity period.","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":49,"context_line":"Based on feedback it seems that many deployments increase the"},{"line_number":50,"context_line":"time-to-live (ttl) of the token from the default of 3600 seconds up to"},{"line_number":51,"context_line":"86400 seconds because the default was insufficient for some operations,"},{"line_number":52,"context_line":"specifically glance and cinder actions."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"### Recommended Actions ###"},{"line_number":55,"context_line":"This issue has not yet been resolved for any of the Identity services,"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_574d07c3","line":52,"updated":"2015-07-16 17:53:41.000000000","message":"I think we need a conclusion sentence here.  Something that states you need to be comfortable with whatever token validity period you choose, given that users can be disabled in an external identity system without keystone\u0027s awareness of it.","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b495009f055c9605e561dfe3dd665efc75d3aca8","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"### Recommended Actions ###"},{"line_number":55,"context_line":"This issue has not yet been resolved for any of the Identity services,"},{"line_number":56,"context_line":"but it is expected that LDAP and SQL will receive remediation shortly."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"To help reduce weakness surface (and general hardening), it is"},{"line_number":59,"context_line":"recommended to reduce the [token] expiration to a value that is an"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_f27f8964","line":56,"updated":"2015-07-16 17:53:41.000000000","message":"Is this really coming soon?  I\u0027m not sure if we\u0027ll ever really have remediation aside from Fernet tokens.  I\u0027d rather not have people think something is coming soon if it\u0027s not.","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"aba5c2e20a67a1d277f2b66fbc3a3fae5666f21d","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"### Recommended Actions ###"},{"line_number":55,"context_line":"This issue has not yet been resolved for any of the Identity services,"},{"line_number":56,"context_line":"but it is expected that LDAP and SQL will receive remediation shortly."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"To help reduce weakness surface (and general hardening), it is"},{"line_number":59,"context_line":"recommended to reduce the [token] expiration to a value that is an"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_fcff0eff","line":56,"updated":"2015-07-13 21:50:20.000000000","message":"are there any reviews or mailing list discussions we could add as references?","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"81932442c94dce6274b19684ebfda159f2057673","unresolved":false,"context_lines":[{"line_number":65,"context_line":"Original LaunchPad Bug : https://launchpad.net/bugs/1434034"},{"line_number":66,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":67,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_afd63cef","line":68,"updated":"2015-07-17 20:18:52.000000000","message":"A link to fernet tokens might be helpful, such as http://dolphm.com/openstack-keystone-fernet-tokens/","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"},{"author":{"_account_id":6804,"name":"bruce-benjamin","email":"bruce.benjamin@jhuapl.edu","username":"bruce-benjamin"},"change_message_id":"81932442c94dce6274b19684ebfda159f2057673","unresolved":false,"context_lines":[{"line_number":66,"context_line":"OpenStack Security ML : openstack-security@lists.openstack.org"},{"line_number":67,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":2,"id":"9a41bdd9_af8e3cce","line":69,"updated":"2015-07-17 20:18:52.000000000","message":"Maybe have the contact info under a separate header","commit_id":"57553f53e5a0cdf72d54dfb1c9179cfd92f809d7"}]}