Basic info

Topics

In discussion with community members looks like next week would be a good time for a 2.6.9 release.

Pippin_ and novaflash reported lots of spam on the forums. rob0 got into contact with ecrist, looks like anti-spam module had expired. It was renewed.
ecrist suggests to decouple authentication system for forums from community PWM. Almost all forum users never use other community resources, so it makes sense.
There is the pending migration from BSD to Linux for the forums machine.
In collaboration with ecrist, we'll look into arranging for OpenVPN Inc. to provide a new VM and a license for vBulletin. ecrist can then convert the existing forums content.
Regarding CloudFlare; currently not enabled on forums, but we will enable it on the new VM.

ordex has an initiative he wants to bring up regarding dev resources to be added to community.
This may tie into the donations topic.
In short ordex convinced OTF (Open Tech Fund) to provide a "test FOSS funding scheme" to OpenVPN.
This would for example allow to pay for allocated hours for mattock and cron2 to work on OpenVPN community tasks.
This is to be worked out more and in collaboration between OpenVPN Community, OpenVPN Inc., and OTF.

There is currently no place to donate money to the community, and we do want to allow that.
We need to figure out how to deal with that legally, and what payment methods to accept and how.
Probably credit card is a must. Maybe PayPal as well. Bitcoin seems to encounter some resistance in the discussions.
We definitely do not want the donation thing to be forced - have a mechanism to do it, but keep it out of the way.
Random things yelled out (to investigate): legal entity? stripe? PayPal? credit card? open collective? GitHub sponsors? Linux foundation? sf conservancy?
ordex suggested that he will take a look in January to figure out what legalities etc. are involved in getting a legal entity for OpenVPN community.

Website team continues to report that they are on the verge of launching the new stuff.
But there is a release freeze planned for last weeks of December so we may not actually get it this year.

A patch for this has been created and it needs reviews.

For new contributions the new license already applies.
The --tls-export-cert code was removed, and plaisthos will reimplement it.
Then it is up to dazo to review things so we can work on finalizing this.
One of the last tasks is reviewing if remaining items are trivial patches, and maybe get legal advice on those if necessary.

Current status: when mitigations start appearing we will mention them in meeting notes. TunnelCrack community wiki article

Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome.
Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged.
When: At the moment tentatively set to 20-22 September 2024.
Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest.
Shirts: There is plenty of time still to prepare a shirt design.

This page is outdated badly: Static-key mini how-to

The company will send this to a tech writer to redo based on GitHub document information and also retain a link to that GitHub doc.
Having a simple guide online will help adoption.

The company is trying to get to SOC2 compliance.
Probably will need a simple NDA to be signed by recipients of emails to security@openvpn.net
Company guy took the standard NDA we use for contractors, suggests to use that.
Novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all.

Company switched EV code signing to CloudHSM, this is the same cert type we use for driver signing, is also suitable for binary signing.
In future, we could possibly switch community to that same key. Saves having to maintain 2 different keys.
Depends on how hard/easy it is to access company key signing thingee from community infrastructure.
Also, no high priority at the moment, we have a working solution now.

Cron2 was asked if OpenVPN has a software bill of materials. Answer was no.
Coincidentally, in OpenVPN Inc a security requirement is to have an SBOM so this is on our list of things to do.
When we pick up this task we can coordinate on it.