- **Time:** Wednesday 13 March 2024 at 13:00 CEST (11:00 UTC)

- **Place:** #openvpn-meeting channel on LiberaChat IRC network

- Would like to discuss the `--inactive` option that disconnects a VPN when it is not sending/receiving more than the set seconds timeout.

- One part of it is that openvpn2 only counts outgoing packets and openvpn3 counts incoming and outgoing. Which is correct?

- Another part is the type of packets to count - this is all not so clear.

- For now, we are counting any packets and ICMP spam from the router resets inactive timeout very often for openvpn3 so it disconnects later than 2.

- Current proposal: count also incoming packets for openvpn2 and do not reset inactive timeout on ICMP packets for both ovpn3 and ovpn2.

- There was an argument made that "this is how it has been in openvpn2 forever and we had no complaints" but oddly the documentation claims incoming and outgoing is counted.

- After looking into this a bit some screwiness was found with tracking the data in openvpn2 that could use fixing, and illia will work on it.

- There is some voodoo happening in openvpn2 that skips inactive reset packets and similar magic is missing in ovpn3, so illia will work on that too.

- During the upstreaming process to the Linux kernel, some alterations had to be made.

- This made the updated implementation different enough from ovpn-dco-v2 that OpenVPN 2.6 won't work with it anymore.

- The plan is to adjust OpenVPN 2.6 so it can support the ovpn-dco-v2 delivered as out-of-tree kernel module, and the in-tree new kernel module.

- We can then update the out-of-tree kernel module to work in the new way and have a graceful transition period.

- So when it goes upstream and is in the Linux kernel, or DCO is installed out-of-tree, it will work the same.

- We can later decide on when to drop the support for ovpn-dco-v2 old methods.

- There are some Windows related issues to be resolved in this release.

- Was planned for this week - pushed to begin next week.

- Next week a website release is planned that will enable a new way for updating Community Downloads page.

- The new way has a much faster release method separate from the rest of the website's release schedule.

- Mattock has created a PoC of `--dev null` "does a client connect" check.

- Client config has `--dev null` and `ifconfig-noexec`.

- Uses an "up" script to stop the parent (openvpn) process gracefully soon after connection initialization.

- The "up" script almost certainly includes some Linux-specifics.

- Example usage:

- Integration with `make check`, buildbot, etc. is still missing.

- Next steps:

- Integrate the PoC with `make check`.

- Make the script portable.

- Buildbot integration (if required separately).

- We want to continue on this topic once a bit more progress has been made.

- A new forum is under construction. But already spammers have found it.

- Suggestion is to give openvpn_inc user novaflash and Pippin_ full admin rights so they can help find a solution and help maintain the forums.

- To be discussed with ecrist.

- Layout and categories look ok?

- Access for Mod to delete users that put spam URL in profile and never post a message.

- Related to above, Access for Mod to edit user profiles (asks for AdminCP password).

- Mod guide, hard or soft delete (chuck board?), what to do with GDPR, etc. (write it down and actually make it available to mods, maybe a hidden topic).

- Access for mods to logs so one can see what others did.

- Email confirmation on register?

- [Forgot password or user name?](https://forums-new.openvpn.net/lostpw) and [Contact](https://forums-new.openvpn.net/contact-us).

- Considering some existing platform to do discussions next to the forum.

- There was a discussion between MaxF and djpig and others.

- For OpenVPN2 / OpenVPN-NL, there is not much overlap, as OpenVPN2 doesn't ship much in terms of libraries, but OpenVPN-NL does.

- The interesting use-case for an SBOM is really the OpenVPN Windows GUI client.

- Cloudfront + S3 + aptly PoC is complete and seems to work fine.

- Cloudfront caches need to be invalidated when new packages are added or removed, or the apt repository will end up in an inconsistent state almost immediately.

- If we use swupdate.openvpn.net to publish the snapshots, we will have to deal with cloudfront + cloudflare.

- We can choose to just publish snapshots on build.openvpn.net. This seems the preferred option.

- Alternatively, a new S3 bucket + cloudfront can be done. Whatever people like best.

- Buildbot integration is missing, but should be fairly straightforward.

- This will probably have to wait until `--dev null` is done.

- No progress since the last meeting.

- This will probably have to wait until `--dev null` is done.

- Should have access controls so only approved members can edit.

- To be discussed in more detail later.

- Ordex has an initiative he wants to bring up regarding dev resources to be added to the community.

- This may tie into the donations topic.

- In short, ordex convinced OTF (Open Tech Fund) to provide a "test FOSS funding scheme" to OpenVPN.

- This would, for example, allow paying for allocated hours for mattock and cron2 to work on OpenVPN community tasks.

- This is to be worked out more and in collaboration between OpenVPN Community, OpenVPN Inc., and OTF.

- What are the options?

- Current status: when mitigations start appearing, we will mention them in meeting notes.

- Naming: We decided to rename from 'Hackathon' to 'OpenVPN community meetup'. This has a more open spirit to it, as we want to encourage developers and those interested in contributing to feel welcome.

- Where: Karlsruhe, Germany. It is a relatively central location in Europe and is fairly easily reachable by train. A meeting location is yet to be arranged.

- When: At the moment tentatively set to 20-22 September 2024.

- Who: We'll do an open invitation to openvpn-devel mailing list, but also CC: specifically past attendees and people of interest.

- Shirts: There is plenty of time still to prepare a shirt design.

- This page is outdated badly: [Static Key Mini How-To](https://openvpn.net/community-resources/static-key-mini-howto/)

- The company will send this to a tech writer to redo based on [GitHub doc info](https://github.com/OpenVPN/openvpn/blob/master/doc/man-sections/example-fingerprint.rst) and also retain a link to that GitHub doc.

- Having a simple guide online will help adoption.

- Tests should cover: gre, ipsec, userland, dco.

- Linux, FreeBSD, Windows.

- Requires time to be dedicated to doing this, when time available will do it.

- Matt provided icons in [GitHub Issue](https://github.com/OpenVPN/openvpn-gui/issues/595)

- Last update: will be picked up by selva when he has time.

- The company switched EV code signing to cloudhsm, this is the same cert type we use for driver signing, is also suitable for binary signing.

- In the future, we could possibly switch the community to that same key. Saves having to maintain 2 different keys.

- Depends on how hard/easy it is to access the company key signing thing from community infrastructure.

- Also, no high priority at the moment, we have a working solution now.

- Novaflash will pick this up at some point.