Home A - Z
Page Index

An Otter Wiki

Blame

6f02e7 Samuli Seppänen 2025-01-29 06:40:08 1 
# Basic info
2
3
- **Time**: Wednesday 10 January 2024 at 13:00 CEST (11:00 UTC)
4
- **Place**: #openvpn-meeting channel on LiberaChat IRC network
5
6
# Topics
7
8
## Current topics
9
10
- **New: small security issue reported in OpenVPN GUI**
11
- *lev is looking into this.*
12
- *dazo will work with lev to arrange a CVE report.*
13
14
- **Mattock needs things to do**
15
- [TracWikiReplacements](https://community.openvpn.net/openvpn/wiki/TracWikiReplacements)
16
- There are a couple of potential Wiki alternatives in that list
17
- More research or deploy something to get some experience on the options?
18
- [ServerSideTestingImprovementPlan](https://community.openvpn.net/openvpn/wiki/ServerSideTestingImprovementPlan)
19
- Do we want to start doing some improvements on this front? If so, which would be a priority?
20
- Buildbot
21
- Mattock set up Buildbot master successfully on Ubuntu 20.04 (current production instance?) as well as Ubuntu 22.04 and Ubuntu 23.10
22
- Any buildbot-related improvement we could do?
23
- Maybe building snapshot packages (deb/rpm) in buildbot and publishing them automatically?
24
- The pragmatic way would be to use FPM instead of "official" packaging tools
25
- Cloudfront + S3 + aptly might be a good solution for public repos with minimal/non-existent management overhead
26
27
- **Closed: No meeting on 27th December or 3 January.**
28
- *Normal meetings to resume on January 10 2024.*
29
30
- **OpenVPN 2.6.9 release**
31
- *Given that we're so close to end of year, we'll push this to next year.*
32
- *The --tls-export-cert PR needs a little love first.*
33
- *Tentative new release date is January 10.*
34
35
- **Forums topics**
36
- *There has been a lot of spam. An antispam module had expired. We fixed that. But there's still the occasional bit of spam.*
37
- *We agreed in last meeting to commit to a path to get a new VM and switch to vBulletin and disconnect from community LDAP logins.*
38
- *The new VM is delivered, the license should be delivered this week too, so then ecrist can get to work.*
39
- *Regarding CloudFlare, currently not enabled on forums, but we will enable it at some point on the new VM.*
40
41
- **Status of trac/wiki**
42
- *ordex wanted to discuss state of trac/wiki. Do we move to something else? Do we update existing?*
43
- *mattock has been volunteered to look into alternatives.*
44
- *It must be open source. Self-hosted or hosted open-source both fine.*
45
- *There is no hard requirement for LDAP capability.*
46
- *Should have access controls so only approved members can edit.*
47
48
- **Status of community LDAP sign-in solution**
49
- *We use it currently for forums, wiki, gerrit, patchwork. We are seriously considering getting rid of it.*
50
- *The reality is that 99.99% of forums users do not interact with the other tools.*
51
- *And that the small group of contributors to wiki and gerrit does not justify the need for an LDAP sign-in solution.*
52
- *So we're inclined to disconnect from LDAP. For the forums we already intend to do that now.*
53
- *No final decision reached at this time. Considering our options.*
54
55
- **Packet header order**
56
- *plaisthos wanted to get consensus/decision on whether we do that as part of the rekeying improvements.*
57
- *Generally in favor of adding a new negotiable packet format, so long as plaisthos and syzzer are in agreement.*
58
59
- **Plan to improve server side testing**
60
- *mattock posted a plan to improve server side testing. mattock would like to get eyes on this and feedback.*
61
62
- **TLS 1.0 PRF problem**
63
- *Patches for this have been created and are in review, have not made it in yet.*
64
65
- **Community funding**
66
- *ordex has an initiative he wants to bring up regarding dev resources to be added to community.*
67
- *This may tie into the donations topic.*
68
- *In short ordex convinced OTF (Open Tech Fund) to provide a "test FOSS funding scheme" to OpenVPN.*
69
- *This would for example allow to pay for allocated hours for mattock and cron2 to work on OpenVPN community tasks.*
70
- *This is to be worked out more and in collaboration between OpenVPN Community, OpenVPN Inc., and OTF.*
71
72
- **Donations for OpenVPN community**
73
- *There is currently no place to donate money to the community, and we do want to allow that.*
74
- *We need to figure out how to deal with that legally, and what payment methods to accept and how.*
75
- *Probably credit card is a must. Maybe PayPal as well. Bitcoin seems to encounter some resistance in the discussions.*
76
- *We definitely do not want the donation thing to be forced - have a mechanism to do it, but keep it out of the way.*
77
- *Random things yelled out (to investigate): legal entity? Stripe? PayPal? Credit card? Open Collective? GitHub Sponsors? Linux Foundation? SF Conservancy?*
78
- *ordex suggested that he will take a look in January to figure out what legalities etc are involved in getting a legal entity for OpenVPN community.*
79
80
- **Website release process woes**
81
- *Website team continues to report that they are on the verge of launching the new stuff.*
82
- *But there is a release freeze planned for last weeks of December so we may not actually get it this year.*
83
84
- **License amendment for OpenVPN2 to solve openssl/mbedtls licensing issues**
85
- *For new contributions the new license already applies.*
86
- *The --tls-export-cert code was removed, and plaisthos will reimplement it.*
87
- *Then it is up to dazo to review things so we can work on finalizing this.*
88
- *One of the last tasks is reviewing if remaining items are trivial patches, and maybe get legal advice on those if necessary.*
89
90
- **Tunnelcrack progress [TunnelCrack community wiki article](https://community.openvpn.net/openvpn/wiki/TunnelCrack)**
91
- *Current status: when mitigations start appearing we will mention them in meeting notes.*
92
93
- **OpenVPN community meetup 2024**
94
- *Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome.*
95
- *Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged.*
96
- *When: At the moment tentatively set to 20-22 September 2024.*
97
- *Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest.*
98
- *Shirts: There is plenty of time still to prepare a shirt design.*
99
100
- **Static-key mini how-to is outdated.**
101
- *This page is outdated badly: [Static-key mini how-to](https://openvpn.net/community-resources/static-key-mini-howto/)*
102
- *Company will send this to tech writer to redo based on [example-fingerprint information](https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst) and also retain a link to that GitHub doc.*
103
- *Having a simple guide online will help adoption.*
104
105
- **OpenVPN 2.6 performance results.**
106
- *Tests should cover: GRE, IPSec, userland, DCO; Linux, FreeBSD, Windows.*
107
- *Requires time to be dedicated to doing this.*
108
- *When time available will do it.*
109
110
- **What's going on with new taskbar icons?**
111
- *Matt provided icons in [GitHub issue #595](https://github.com/OpenVPN/openvpn-gui/issues/595).*
112
- *Last update: will be picked up by selva when he has time.*
113
114
- **security@openvpn.net mailing list**
115
- *Company is trying to get to SOC2 compliance.*
116
- *Probably will need a simple NDA to be signed by recipients of emails to security@openvpn.net.*
117
- *Company guy took standard NDA we use for contractors, suggests to use that.*
118
- *Novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all.*
119
120
- **Another key signing topic**
121
- *Company switched EV code signing to CloudHSM, this is same cert type we use for driver signing, is also suitable for binary signing.*
122
- *In future we could possibly switch community to that same key. Saves having to maintain 2 different keys.*
123
- *Depends on how hard/easy it is to access company key signing thingee from community infrastructure.*
124
- *Also no high priority at the moment, we have a working solution now.*
125
126
- **SBOM topic**
127
- *Cron2 was asked if OpenVPN has a software bill of materials. Answer was no.*
128
- *Coincidentally, in OpenVPN Inc a security requirement is to have an SBOM so this is on our list of things to do.*
129
- *When we pick up this task we can coordinate on it.*
130
131
- **Management interface documentation on main website will be updated with info from doc/management-notes.txt**
132
- *Novaflash will pick this up at some point.*