# Basic Info - **Time:** Wednesday 20 December 2023 at 13:00 CEST (11:00 UTC) - **Place:** #openvpn-meeting channel on LiberaChat IRC network # Topics ## Current Topics ### New: No Meeting on 27th December or 3 January - Normal meetings to resume on January 10, 2024. ### Updated: OpenVPN 2.6.9 Release - Given that we're close to the end of the year, we'll push this to next year. - The --tls-export-cert PR needs a little love first. - Tentative new release date is January 10. ### Updated: Forums Topics - There has been a lot of spam. An antispam module had expired. We fixed that, but there's still the occasional bit of spam. - We agreed in the last meeting to commit to getting a new VM and switch to vBulletin and disconnecting from community LDAP logins. - The new VM is delivered, the license should be delivered this week too, so then ecrist can get to work. - Regarding CloudFlare, currently not enabled on forums, but we will enable it at some point on the new VM. ### New: Status of Trac/Wiki - ordex wanted to discuss the state of trac/wiki. Do we move to something else? Do we update existing? - mattock has been volunteered to look into alternatives. - It must be open source. Self-hosted or hosted open-source both fine. - There is no hard requirement for LDAP capability. - Should have access controls so only approved members can edit. ### New: Status of Community LDAP Sign-in Solution - We use it currently for forums, wiki, gerrit, patchwork. We are seriously considering getting rid of it. - The reality is that 99.99% of forums users do not interact with the other tools. - And that the small group of contributors to wiki and gerrit does not justify the need for an LDAP sign-in solution. - So we're inclined to disconnect from LDAP. For the forums, we already intend to do that now. - No final decision reached at this time. Considering our options. ### New: Packet Header Order - plaisthos wanted to get a consensus/decision on whether we do that as part of the rekeying improvements. - Generally in favor of adding a new negotiable packet format, so long as plaisthos and syzzer are in agreement. ### New: Plan to Improve Server Side Testing - mattock posted a plan to improve server-side testing. mattock would like to get eyes on this and feedback. ### Updated: TLS 1.0 PRF Problem - Patches for this have been created and are in review, have not made it in yet. ### Community Funding - ordex has an initiative he wants to bring up regarding dev resources to be added to the community. - This may tie into the donations topic. - In short, ordex convinced OTF (Open Tech Fund) to provide a "test FOSS funding scheme" to OpenVPN. - This would, for example, allow paying for allocated hours for mattock and cron2 to work on OpenVPN community tasks. - This is to be worked out more and in collaboration between OpenVPN Community, OpenVPN Inc., and OTF. ### Donations for OpenVPN Community - There is currently no place to donate money to the community, and we do want to allow that. - We need to figure out how to deal with that legally, and what payment methods to accept and how. - Probably, a credit card is a must. Maybe PayPal as well. Bitcoin seems to encounter some resistance in the discussions. - We definitely do not want the donation thing to be forced - have a mechanism to do it, but keep it out of the way. - Random things yelled out (to investigate): legal entity? stripe? PayPal? credit card? open collective? GitHub sponsors? Linux foundation? sf conservancy? - ordex suggested that he will take a look in January to figure out what legalities etc. are involved in getting a legal entity for OpenVPN community. ### Website Release Process Woes - Website team continues to report that they are on the verge of launching the new stuff. - But there is a release freeze planned for the last weeks of December, so we may not actually get it this year. ### License Amendment for OpenVPN2 to Solve OpenSSL/mbedTLS Licensing Issues - For new contributions, the new license already applies. - The --tls-export-cert code was removed, and plaisthos will reimplement it. - Then it is up to dazo to review things so we can work on finalizing this. - One of the last tasks is reviewing if remaining items are trivial patches and maybe get legal advice on those if necessary. ### Tunnelcrack Progress - Current status: when mitigations start appearing, we will mention them in meeting notes. ### OpenVPN Community Meetup 2024 - Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome. - Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged. - When: At the moment tentatively set to 20-22 September 2024. - Who: We'll do an open invitation to the openvpn-devel mailing list, but also CC: specifically past attendees and people of interest. - Shirts: There is plenty of time still to prepare a shirt design. ### Static-key Mini How-to is Outdated - This page is outdated badly: [Static Key Mini Howto](https://openvpn.net/community-resources/static-key-mini-howto/) - The company will send this to a tech writer to redo based on info from [GitHub doc](https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst) and also retain a link to that GitHub doc. - Having a simple guide online will help adoption. ### OpenVPN 2.6 Performance Results - Tests should cover: GRE, IPSec, userland, DCO - Platforms: Linux, FreeBSD, Windows - Requires time to be dedicated to doing this - When time is available will do it. ### What's Going on with New Taskbar Icons? - matt provided icons in this [GitHub issue](https://github.com/OpenVPN/openvpn-gui/issues/595) - Last update: will be picked up by selva when he has time. ### Security Email List - Company is trying to get to SOC2 compliance. - Probably will need a simple NDA to be signed by recipients of emails to security@openvpn.net - Company guy took the standard NDA we use for contractors, suggests to use that. - novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all. ### Another Key Signing Topic - Company switched EV code signing to CloudHSM, this is the same cert type we use for driver signing, is also suitable for binary signing. - In the future, we could possibly switch the community to that same key. Saves having to maintain 2 different keys. - Depends on how hard/easy it is to access the company key signing thing from community infrastructure. - Also, no high priority at the moment, we have a working solution now. ### SBOM Topic - cron2 was asked if OpenVPN has a software bill of materials. The answer was no. - Coincidentally, in OpenVPN Inc, a security requirement is to have an SBOM so this is on our list of things to do. - When we pick up this task, we can coordinate on it. ### Management Interface Documentation on Main Website Will Be Updated - Information from doc/management-notes.txt will be updated. - novaflash will pick this up at some point.