Home A - Z
Page Index

An Otter Wiki

Basic info

  • Time: Wednesday 10 January 2024 at 13:00 CEST (11:00 UTC)
  • Place: #openvpn-meeting channel on LiberaChat IRC network

Topics

Current topics

  • New: small security issue reported in OpenVPN GUI

    • lev is looking into this.
    • dazo will work with lev to arrange a CVE report.

  • Mattock needs things to do

    • TracWikiReplacements
      • There are a couple of potential Wiki alternatives in that list
      • More research or deploy something to get some experience on the options?
    • ServerSideTestingImprovementPlan
      • Do we want to start doing some improvements on this front? If so, which would be a priority?
    • Buildbot
      • Mattock set up Buildbot master successfully on Ubuntu 20.04 (current production instance?) as well as Ubuntu 22.04 and Ubuntu 23.10
      • Any buildbot-related improvement we could do?
      • Maybe building snapshot packages (deb/rpm) in buildbot and publishing them automatically?
        • The pragmatic way would be to use FPM instead of "official" packaging tools
        • Cloudfront + S3 + aptly might be a good solution for public repos with minimal/non-existent management overhead

  • Closed: No meeting on 27th December or 3 January.

    • Normal meetings to resume on January 10 2024.

  • OpenVPN 2.6.9 release

    • Given that we're so close to end of year, we'll push this to next year.
    • The --tls-export-cert PR needs a little love first.
    • Tentative new release date is January 10.

  • Forums topics

    • There has been a lot of spam. An antispam module had expired. We fixed that. But there's still the occasional bit of spam.
    • We agreed in last meeting to commit to a path to get a new VM and switch to vBulletin and disconnect from community LDAP logins.
    • The new VM is delivered, the license should be delivered this week too, so then ecrist can get to work.
    • Regarding CloudFlare, currently not enabled on forums, but we will enable it at some point on the new VM.

  • Status of trac/wiki

    • ordex wanted to discuss state of trac/wiki. Do we move to something else? Do we update existing?
    • mattock has been volunteered to look into alternatives.
    • It must be open source. Self-hosted or hosted open-source both fine.
    • There is no hard requirement for LDAP capability.
    • Should have access controls so only approved members can edit.

  • Status of community LDAP sign-in solution

    • We use it currently for forums, wiki, gerrit, patchwork. We are seriously considering getting rid of it.
    • The reality is that 99.99% of forums users do not interact with the other tools.
    • And that the small group of contributors to wiki and gerrit does not justify the need for an LDAP sign-in solution.
    • So we're inclined to disconnect from LDAP. For the forums we already intend to do that now.
    • No final decision reached at this time. Considering our options.

  • Packet header order

    • plaisthos wanted to get consensus/decision on whether we do that as part of the rekeying improvements.
    • Generally in favor of adding a new negotiable packet format, so long as plaisthos and syzzer are in agreement.

  • Plan to improve server side testing

    • mattock posted a plan to improve server side testing. mattock would like to get eyes on this and feedback.

  • TLS 1.0 PRF problem

    • Patches for this have been created and are in review, have not made it in yet.

  • Community funding

    • ordex has an initiative he wants to bring up regarding dev resources to be added to community.
    • This may tie into the donations topic.
    • In short ordex convinced OTF (Open Tech Fund) to provide a "test FOSS funding scheme" to OpenVPN.
    • This would for example allow to pay for allocated hours for mattock and cron2 to work on OpenVPN community tasks.
    • This is to be worked out more and in collaboration between OpenVPN Community, OpenVPN Inc., and OTF.

  • Donations for OpenVPN community

    • There is currently no place to donate money to the community, and we do want to allow that.
    • We need to figure out how to deal with that legally, and what payment methods to accept and how.
    • Probably credit card is a must. Maybe PayPal as well. Bitcoin seems to encounter some resistance in the discussions.
    • We definitely do not want the donation thing to be forced - have a mechanism to do it, but keep it out of the way.
    • Random things yelled out (to investigate): legal entity? Stripe? PayPal? Credit card? Open Collective? GitHub Sponsors? Linux Foundation? SF Conservancy?
    • ordex suggested that he will take a look in January to figure out what legalities etc are involved in getting a legal entity for OpenVPN community.

  • Website release process woes

    • Website team continues to report that they are on the verge of launching the new stuff.
    • But there is a release freeze planned for last weeks of December so we may not actually get it this year.

  • License amendment for OpenVPN2 to solve openssl/mbedtls licensing issues

    • For new contributions the new license already applies.
    • The --tls-export-cert code was removed, and plaisthos will reimplement it.
    • Then it is up to dazo to review things so we can work on finalizing this.
    • One of the last tasks is reviewing if remaining items are trivial patches, and maybe get legal advice on those if necessary.

  • Tunnelcrack progress TunnelCrack community wiki article

    • Current status: when mitigations start appearing we will mention them in meeting notes.

  • OpenVPN community meetup 2024

    • Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome.
    • Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged.
    • When: At the moment tentatively set to 20-22 September 2024.
    • Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest.
    • Shirts: There is plenty of time still to prepare a shirt design.

  • Static-key mini how-to is outdated.

  • OpenVPN 2.6 performance results.

    • Tests should cover: GRE, IPSec, userland, DCO; Linux, FreeBSD, Windows.
    • Requires time to be dedicated to doing this.
    • When time available will do it.

  • What's going on with new taskbar icons?

    • Matt provided icons in GitHub issue #595.
    • Last update: will be picked up by selva when he has time.

  • security@openvpn.net mailing list

    • Company is trying to get to SOC2 compliance.
    • Probably will need a simple NDA to be signed by recipients of emails to security@openvpn.net.
    • Company guy took standard NDA we use for contractors, suggests to use that.
    • Novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all.

  • Another key signing topic

    • Company switched EV code signing to CloudHSM, this is same cert type we use for driver signing, is also suitable for binary signing.
    • In future we could possibly switch community to that same key. Saves having to maintain 2 different keys.
    • Depends on how hard/easy it is to access company key signing thingee from community infrastructure.
    • Also no high priority at the moment, we have a working solution now.

  • SBOM topic

    • Cron2 was asked if OpenVPN has a software bill of materials. Answer was no.
    • Coincidentally, in OpenVPN Inc a security requirement is to have an SBOM so this is on our list of things to do.
    • When we pick up this task we can coordinate on it.

  • Management interface documentation on main website will be updated with info from doc/management-notes.txt

    • Novaflash will pick this up at some point.
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9