# Basic info - **Time**: Wednesday 10 January 2024 at 13:00 CEST (11:00 UTC) - **Place**: #openvpn-meeting channel on LiberaChat IRC network # Topics ## Current topics - **New: small security issue reported in OpenVPN GUI** - *lev is looking into this.* - *dazo will work with lev to arrange a CVE report.* - **Mattock needs things to do** - [TracWikiReplacements](https://community.openvpn.net/openvpn/wiki/TracWikiReplacements) - There are a couple of potential Wiki alternatives in that list - More research or deploy something to get some experience on the options? - [ServerSideTestingImprovementPlan](https://community.openvpn.net/openvpn/wiki/ServerSideTestingImprovementPlan) - Do we want to start doing some improvements on this front? If so, which would be a priority? - Buildbot - Mattock set up Buildbot master successfully on Ubuntu 20.04 (current production instance?) as well as Ubuntu 22.04 and Ubuntu 23.10 - Any buildbot-related improvement we could do? - Maybe building snapshot packages (deb/rpm) in buildbot and publishing them automatically? - The pragmatic way would be to use FPM instead of "official" packaging tools - Cloudfront + S3 + aptly might be a good solution for public repos with minimal/non-existent management overhead - **Closed: No meeting on 27th December or 3 January.** - *Normal meetings to resume on January 10 2024.* - **OpenVPN 2.6.9 release** - *Given that we're so close to end of year, we'll push this to next year.* - *The --tls-export-cert PR needs a little love first.* - *Tentative new release date is January 10.* - **Forums topics** - *There has been a lot of spam. An antispam module had expired. We fixed that. But there's still the occasional bit of spam.* - *We agreed in last meeting to commit to a path to get a new VM and switch to vBulletin and disconnect from community LDAP logins.* - *The new VM is delivered, the license should be delivered this week too, so then ecrist can get to work.* - *Regarding CloudFlare, currently not enabled on forums, but we will enable it at some point on the new VM.* - **Status of trac/wiki** - *ordex wanted to discuss state of trac/wiki. Do we move to something else? Do we update existing?* - *mattock has been volunteered to look into alternatives.* - *It must be open source. Self-hosted or hosted open-source both fine.* - *There is no hard requirement for LDAP capability.* - *Should have access controls so only approved members can edit.* - **Status of community LDAP sign-in solution** - *We use it currently for forums, wiki, gerrit, patchwork. We are seriously considering getting rid of it.* - *The reality is that 99.99% of forums users do not interact with the other tools.* - *And that the small group of contributors to wiki and gerrit does not justify the need for an LDAP sign-in solution.* - *So we're inclined to disconnect from LDAP. For the forums we already intend to do that now.* - *No final decision reached at this time. Considering our options.* - **Packet header order** - *plaisthos wanted to get consensus/decision on whether we do that as part of the rekeying improvements.* - *Generally in favor of adding a new negotiable packet format, so long as plaisthos and syzzer are in agreement.* - **Plan to improve server side testing** - *mattock posted a plan to improve server side testing. mattock would like to get eyes on this and feedback.* - **TLS 1.0 PRF problem** - *Patches for this have been created and are in review, have not made it in yet.* - **Community funding** - *ordex has an initiative he wants to bring up regarding dev resources to be added to community.* - *This may tie into the donations topic.* - *In short ordex convinced OTF (Open Tech Fund) to provide a "test FOSS funding scheme" to OpenVPN.* - *This would for example allow to pay for allocated hours for mattock and cron2 to work on OpenVPN community tasks.* - *This is to be worked out more and in collaboration between OpenVPN Community, OpenVPN Inc., and OTF.* - **Donations for OpenVPN community** - *There is currently no place to donate money to the community, and we do want to allow that.* - *We need to figure out how to deal with that legally, and what payment methods to accept and how.* - *Probably credit card is a must. Maybe PayPal as well. Bitcoin seems to encounter some resistance in the discussions.* - *We definitely do not want the donation thing to be forced - have a mechanism to do it, but keep it out of the way.* - *Random things yelled out (to investigate): legal entity? Stripe? PayPal? Credit card? Open Collective? GitHub Sponsors? Linux Foundation? SF Conservancy?* - *ordex suggested that he will take a look in January to figure out what legalities etc are involved in getting a legal entity for OpenVPN community.* - **Website release process woes** - *Website team continues to report that they are on the verge of launching the new stuff.* - *But there is a release freeze planned for last weeks of December so we may not actually get it this year.* - **License amendment for OpenVPN2 to solve openssl/mbedtls licensing issues** - *For new contributions the new license already applies.* - *The --tls-export-cert code was removed, and plaisthos will reimplement it.* - *Then it is up to dazo to review things so we can work on finalizing this.* - *One of the last tasks is reviewing if remaining items are trivial patches, and maybe get legal advice on those if necessary.* - **Tunnelcrack progress [TunnelCrack community wiki article](https://community.openvpn.net/openvpn/wiki/TunnelCrack)** - *Current status: when mitigations start appearing we will mention them in meeting notes.* - **OpenVPN community meetup 2024** - *Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome.* - *Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged.* - *When: At the moment tentatively set to 20-22 September 2024.* - *Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest.* - *Shirts: There is plenty of time still to prepare a shirt design.* - **Static-key mini how-to is outdated.** - *This page is outdated badly: [Static-key mini how-to](https://openvpn.net/community-resources/static-key-mini-howto/)* - *Company will send this to tech writer to redo based on [example-fingerprint information](https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst) and also retain a link to that GitHub doc.* - *Having a simple guide online will help adoption.* - **OpenVPN 2.6 performance results.** - *Tests should cover: GRE, IPSec, userland, DCO; Linux, FreeBSD, Windows.* - *Requires time to be dedicated to doing this.* - *When time available will do it.* - **What's going on with new taskbar icons?** - *Matt provided icons in [GitHub issue #595](https://github.com/OpenVPN/openvpn-gui/issues/595).* - *Last update: will be picked up by selva when he has time.* - **security@openvpn.net mailing list** - *Company is trying to get to SOC2 compliance.* - *Probably will need a simple NDA to be signed by recipients of emails to security@openvpn.net.* - *Company guy took standard NDA we use for contractors, suggests to use that.* - *Novaflash thinks we should review that first to see if it's really suitable or not, community members are not contractors after all.* - **Another key signing topic** - *Company switched EV code signing to CloudHSM, this is same cert type we use for driver signing, is also suitable for binary signing.* - *In future we could possibly switch community to that same key. Saves having to maintain 2 different keys.* - *Depends on how hard/easy it is to access company key signing thingee from community infrastructure.* - *Also no high priority at the moment, we have a working solution now.* - **SBOM topic** - *Cron2 was asked if OpenVPN has a software bill of materials. Answer was no.* - *Coincidentally, in OpenVPN Inc a security requirement is to have an SBOM so this is on our list of things to do.* - *When we pick up this task we can coordinate on it.* - **Management interface documentation on main website will be updated with info from doc/management-notes.txt** - *Novaflash will pick this up at some point.*