# Agenda

## Handling Security Vulnerabilities in the Future
- Always get a CVE entry?
- Always make a security announcement (threat, impact, etc.)
- Makes handling the issue much easier for downstream
- Compile a list of OpenVPN package maintainer (e.g. *BSD, Linux) email addresses, so that they can be notified in advance of security updates.

## OpenVPN 3.0
- Was released along with API documentation under AGPL v3 at FOSDEM 2013
- Currently used primarily/only in OpenVPN Connect clients for Android/iOS from OpenVPN Technologies, Inc.
- Getting the code to Git: currently only an outdated tarball is available
- [OpenVPN 3.0 staging site](http://staging.openvpn.net/openvpn3/)

## OpenVPN 2.4
- What is the goal of the 2.4 release?
- What patches in "master" are 2.4-only material?

### Patches
- Android patchsets
- Dual stack client patches
- utun on macOS
  - Native tun, no need for extra tun.kext
  - Supported for all OS X >= 10.6.8 (latest PPC version)
  - Unfortunately requires root
  - Real question: Drop tun.kext support and support only utun or "try utun first, fall back to tun.kext if it fails"
- svn 2.1 patchset (snappy support, push-peer-info changes, see trac#268-273)
- Management interface changes (status 2/3)
- Formatting and whitespace fixes (just before 2.4 release)

### Additional Considerations
- `--version` to include git commit id and branch?