# Basic info - **Time:** Wednesday 6 December 2023 at 13:00 CEST (11:00 UTC) - **Place:** #openvpn-meeting channel on LiberaChat IRC network # Topics ## Current topics - **New: spam on forums.** - "It just keeps coming. We need a solution." - "Asked pippin_ if he could maybe get attention from ecrist to try and solve this." - **Updated: Website release process woes** - "Website team continues to report that they are on the verge of launching the new stuff." - "But there is a release freeze planned for last weeks of December so we may not actually get it this year." - **Updated: TLS 1.0 PRF problem** - "A patch for this has been created and it needs reviews." - **Updated: License amendment for OpenVPN2 to solve openssl/mbedtls licensing issues** - "For new contributions the new license already applies." - "The --tls-export-cert code was removed, and plaisthos will reimplement it." - "Then it is up to dazo to review things so we can work on finalizing this." - "One of the last tasks is reviewing if remaining items are trivial patches, and maybe get legal advice on those if necessary." - **New: OpenVPN 2.6.9 release** - "After --export-peer-cert/--tls-export-cert issue is clarified and code merged, we feel we're ready for a new release." - "Tentatively next week." - **Donations for OpenVPN community** - "There is currently no place to donate money to the community." - "The question is, do we want to allow donations? The answer is yes." - "We need to figure out how to deal with that legally, and what payment methods to accept and how." - "Probably credit card is a must. Maybe PayPal as well. Bitcoin seems to encounter some resistance in the discussions." - "We definitely do not want the donation thing to be forced - have a mechanism to do it, but keep it out of the way." - "Random things yelled out (to investigate): legal entity? stripe? PayPal? credit card? open collective? GitHub sponsors? Linux foundation? sf conservancy?" - **Tunnelcrack progress** [TunnelCrack community wiki article](https://openvpn.net/wiki/TunnelCrack) - "Current status: when mitigations start appearing we will mention them in meeting notes." - **OpenVPN community meetup 2024** - "Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome." - "Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged." - "When: At the moment tentatively set to 20-22 September 2024." - "Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest." - "Shirts: There is plenty of time still to prepare a shirt design." - **Static-key mini how-to is outdated.** - "This page is outdated badly: [Static Key Mini How-To](https://openvpn.net/community-resources/static-key-mini-howto/)" - "Company will send this to tech writer to redo based on [GitHub doc](https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst) info and also retain a link to that GitHub doc." - "Having a simple guide online will help adoption." - **OpenVPN 2.6 performance results.** - "Tests should cover: GRE, IPSec, userland, DCO, Linux, FreeBSD, Windows." - "Requires time to be dedicated to doing this." - "When time available will do it." - **What's going on with new taskbar icons?** - "Matt provided icons in [GitHub Issue #595](https://github.com/OpenVPN/openvpn-gui/issues/595)" - "**Update:** will be picked up by selva when he has time." - **security@openvpn.net mailing list** - "Company is trying to get to SOC2 compliance." - "Probably will need a simple NDA to be signed by recipients of emails to security@openvpn.net." - "Company guy took standard NDA we use for contractors, suggests to use that." - "Novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all." - **Another key signing topic** - "Company switched EV code signing to CloudHSM, this is the same cert type we use for driver signing, is also suitable for binary signing." - "In future we could possibly switch community to that same key. Saves having to maintain 2 different keys." - "Depends on how hard/easy it is to access company key signing thing from community infrastructure." - "Also no high priority at the moment, we have a working solution now." - **SBOM topic** - "Cron2 was asked if OpenVPN has a software bill of materials. Answer was no." - "Coincidentally, in OpenVPN Inc a security requirement is to have an SBOM so this is on our list of things to do." - "When we pick up this task we can coordinate on it." - **Forums machine on community infrastructure is only non-Linux system.** - "Mattock made a new forums system that runs on Rocky Linux 8 as agreed with ecrist." - "Ecrist has looked at it but the current state of the migration is unknown." - **Management interface documentation on main website will be updated with info from doc/management-notes.txt** - "Novaflash will pick this up at some point."