Meeting:Board meeting 2008-09-09

Fedora Project Board Meeting :: Tuesday 2008-09-09

Roll Call

Attendees: Everyone on #fedora-board-meeting

Codecs (2008-05-13)

• Need to restart discussion on fedora-advisory-board redhat com to get plans in place at the start of F10
• Chris Aillon to make contact with Bastien Nocera to find out what current plans are
• Waiting on bug 438225 to proceed
  • this change will enable auto-provide for codec information
  • For Fedora 10 removing Codeina and using the distribution's built-in mechanism to install packages (if 438225) is implemented
  • For Fluendo to continue to provide codecs to Fedora they will need to provide them as packages in a yum repo
  • This errs on the side of more "free-ish" software

RESOLUTION:

1. ACTION :: Paul - request feature page from developer
2. FESCo should track bug 438225 since this falls into their mandate

• FOLLOWUP (2008-08-05):
  • Feature page still in the works and FESCo is tracking bug 438225
• FOLLOWUP (2008-09-09):
  • Paul Frields has pinged the RPM dev team again about that feature page, but having difficulty reaching them
  • Panu has said that he will handle bug 438225

Trademark Guidelines (2008-07-01)

• Board would like to help guide the process of expanding the use of the Fedora trademark
• Helpful to brainstorm by thinking of Fedora trademark usage in four ways:

1. Things the board wants Fedora to be able to do with the trademark
2. Things the board wants the Fedora community to be able to freely do with trademark
3. Things the board wants other people to reasonably be expected to be able to do, but ask the Fedora Board first
4. Things that the board never wants people to use the Fedora trademark for

• OWNER: Paul Frields
• ACTIONS:
  1. circulate ideas and foster discussion on fedora-advisory-board@redhat.com list
  2. return feedback to the board for discussion on: 2008-08-05
  3. Latest updates: User:Pfrields/NewTrademarkGuidelines (see also discussion tab)
• FOLLOW-UP (2008-08-05):
  • Board definitely wants a Fedora trademark of some sorts for spins and other uses--derivative works
  • Still unsure on how best to proceed on issues related to:
    1. official spins
    2. unofficial spins
    3. branded USB keys
    4. OEM pre-loads
    5. Fedora business cards
    6. Fedora apparel and conference materials (see section on Non-software goods)
  • Everyone should add uncovered use cases to wiki page (see above) ASAP
  • Paul Frields will be working with Red Hat Legal starting this week to move the process forward
• FOLLOW-UP (2008-09-09):
  • RH Legal is reviewing them and the newest state of that page incorporates their most recent review
  • would really like to have that wrapped up by the end of the month if at all possible.
  • Related discussion about SELinux being required for spins
    • This should not block or impact trademark work
    • Will add a section to trademark guidelines to encompass issues like SELinux under using the wording "pursuant to other technical requirements"
  • ACTIONS:
    1. Continue discussion about SELinux on fedora-advisory-board@redhat.com list
    2. Release Engineering and Spins SIG should draw up minimum technical requirements to use the Fedora name

Board Questions & Answers

• Topics covered included:
  • Infrastructure intrusion
  • Creating a response plan
  • SELinux, custom Spins, and trademark usage
  • Infrastructure secured
• See transcript (below) for details

IRC Transcript

The public discussion IRC log is at Meeting:Board_Public_IRC_log_20080909.

stickster	<meeting>	11:02
spoleeba	here	11:02
<stickster The Secretary should be arriving in a moment :-)		11:03
spoleeba	stickster, stalin?	11:03
quaid	hey kids	11:03
stickster	Hi everybody. Max is moderating in #fedora-board-public, and I think we have a couple short agenda items to get out of the way	11:04
* stickster gives mic to poelcat		11:04
poelcat	first followup item is: Board/Meetings/2008-08-05#Codecs_.282008-05-13.29	11:05
poelcat	fesco meets tomorrow so if a feature page is coming it needs to be submitted ASAP	11:05
mdomsch	everyone see http://itmanagement.earthweb.com/osrc/article.php/3770216/The+Fedora-Red+Hat+Crisis.htm	11:06
mdomsch	?	11:06
mdomsch	that's why I love transparency and meeting minutes	11:06
skvidal	mdomsch: yah - I read it	11:06
quaid	OMGCRISIS!	11:06
spot	does the Flash have to die this time?	11:06
stickster	poelcat: I've pinged the RPM dev team again about that feature page.	11:07
f13	sorry I'm late, turns out 'cheese' will crash your system if you try to take a video.	11:07
stickster	poelcat: At worst, this may fit into the overall 'new RPM 4.6' feature category	11:07
stickster	And we could call out specfic new RPM features as desired	11:07
spoleeba	f13, oh thats a new feature	11:08
stickster	Maybe we should call that one out too?	11:08
spoleeba	mdomsch, do i really have to read it?	11:08
mdomsch	spoleeba, you can surmise from the title	11:08
stickster	poelcat: I believe that Panu's on travel today but I've also emailed jnovy and ffesti	11:09
stickster	Panu's said that he will have this in by the final dev freeze.	11:09
spoleeba	mdomsch, i do love how he surmizes how i feel about the situation as a Board member	11:09
* stickster not ignoring the conversation thread on the Byfield article, just trying to get through the agenda		11:10
poelcat	anything else to note on the "codecs" topic?	11:10
mdomsch	stickster, agenda++	11:10
quaid	mdomsch: your fault! :D	11:11
stickster	Oh, hang on --	11:11
f13	'by the final dev freeze' seems rather late if we need to do something on top of this feature in other packages.	11:11
stickster	Yeah, that's why I've sent a couple emails about it.	11:12
stickster	The most recent one was yesterday.	11:12
stickster	I checked the RPM git repos and didn't see the proposed patch in there.	11:12
f13	hrm.	11:14
spot	do we need to say anything else about this or can we move on?	11:15
stickster	I invited jnovy to talk about it, but let's move on for now.	11:15
stickster	poelcat: next	11:15
poelcat	prograess on update to trademark usage guidelines	11:16
stickster	Ah	11:16
stickster	User:Pfrields/NewTrademarkGuidelines	11:16
stickster	I've been actively working on them, through last week and up until yesterday	11:16
stickster	RH Legal is reviewing them, and the newest state of that page incorporates their most recent review.	11:16
stickster	So, progressing.	11:16
poelcat	ref: Board/Meetings/2008-08-05#Trademark_Guidelines_.282008-07-01.29	11:17
stickster	I'd really like to have that wrapped up by the end of the month if at all possible.	11:17
stickster	(preferably sooner)	11:17
spoleeba	stickster, uhm... there needs to be a decision about whether trademark usage is going to require technical specifics	11:17
mdomsch	stickster, "not disparaging to Red Hat or the Fedora Project"	11:18
mdomsch	to what extent?	11:18
mdomsch	presumably the board would have to enforce	11:18
stickster	spoleeba: we can add a statement that says usage is pursuant to separate technical requirements	11:18
* mdomsch is not in favor of requiring selinux		11:19
stickster	spoleeba: Please use the "discussion" tab and enter your comments there	11:19
spoleeba	stickster, i dont have a problem with it as it stands..... there are others	11:19
ctyler	stickster: I have at least one more use case for you, too	11:19
stickster	spoleeba: They're free to do the same :-)	11:19
stickster	spoleeba: I've invited the community repeatedly to help with use cases, etc.	11:20
spoleeba	stickster, here's my point.. i dont think we can "wrap this up in a month" considering what we just had a discussion in fab	11:20
stickster	Many have already, including Jeroen, BKearney, Max, others...	11:20
* stickster continues to happily accept more input		11:20
mdomsch	EOM is a decent goal though	11:21
quaid	+1 to pursuant to other technical requirements	11:21
quaid	then we can update that list on going without jiggling the trademark rules with details it don't need	11:22
stickster	quaid: Right.	11:22
stickster	Legal documents and technical requirements are two different kettles of fish.	11:22
quaid	thus, eomonth can work	11:22
stickster	buckets of meat?	11:22
quaid	eww^2	11:22
stickster	baskets of asparagus	11:23
f13	mdomsch: I'm also not really in favor of seeing something out there under the Fedora name that /doesn't/ ship with selinux	11:23
spoleeba	stickster, we must decide if the Board is going to continue to be one of the groups who gets to decide on technical requirements or not	11:23
stickster	(for the veggiesauri)	11:23
spot	i think i dated that once in college.	11:23
f13	mdomsch: under the full Fedora name, not a 'based on Fedora' or 'built on Fedora' name	11:23
quaid	at least Kettle of Fish was a decent dive bar in Greenwich Village	11:23
* f13 loads the wiki page to comment		11:23
quaid	+1 to continuing the SELinux et al discussion on f-a-b, as part of the technical kettle	11:23
spoleeba	stickster, i have no problem with a moving target for technical requirements..but as the trademark policy stands as drafted the Board isnt going to be building those roadblocks	11:24
spoleeba	stickster, and if the Board shouldnt be doing it..then we should firmly state who should be doing it	11:24
* spot coughs *rel-eng*		11:24
quaid	spoleeba: explain "isn't going"	11:24
spot	sorry. something stuck in my throat.	11:24
stickster	spoleeba: The page indicates that the trademark owner always retains rights to the TMs, and the Board is always responsible for enforcing compliance.	11:25
f13	erm, I thought the point of the new policy was that /nobody/ had to review it, there was no blocker	11:25
spoleeba	stickster, enforcing compliance.. and defining the technical hurdles are not the same	11:25
stickster	RelEng has the Spins group tapped to create the technical requirements	11:25
spoleeba	f13, that was what i thought as well	11:25
stickster	f13: Correct?	11:25
f13	stickster: those are for things that Fedora as a project puts out for users to consume	11:26
mdomsch	as long as usage is within the policy, yes, no apriori review	11:26
f13	stickster: but I thought under the new guidelines, anybody could make whatever they want, as long as it adheres to the guidelines and publish it as "Fedora"	11:26
f13	ergo there is no chance for somebody like releng to vette it for technical items	11:26
notting	well, was aos being reviewed under the new or old guidelines?	11:26
f13	therefor, we need to codify technical restrictions into the policy	11:27
spoleeba	mdomsch, the question becomes which group is tasked with coming up with the moving target policy	11:27
notting	i don't recall saying one way or another that they can't be Fedora if they turned off selinux. i was just curious *why* they were doing it	11:27
spot	notting: you should talk to bryan_kearney1	11:28
notting	spot: i was the first post on the thread	11:28
mdomsch	notting, f13 would like to say "if they turn of selinux, it's not Fedora". I'm not of the same opinion. :-)	11:28
quaid	f13: why codify in to the policy? the policy can just state, "follow this moving target over here or don't use the mark"	11:28
f13	mdomsch: to be the top tier trademark, "Fedora", I feel that there should be a bare minimum it meets	11:28
f13	yum, selinux, etc..	11:29
ctyler	f13: that minimum should be coded somewhere else and the policy should point to it	11:29
f13	anything less than that falls to the next tier, Based on Fedora or whatever	11:29
ctyler	so the policy doesn't change when the tech does	11:29
f13	ctyler: that's acceptable	11:29
f13	it still has the same net effect though	11:29
spoleeba	quaid, I really would like to avoid having the Board be the group which codifies the moving policy... id rather have the Board just enforce it or arbitrate when the group who does deal with the policy gets deadlocked	11:29
f13	policy will change over time	11:29
stickster	OK, so far I see a lot of us in essentially violent agreement.	11:30
quaid	spoleeba: the Board cannot absolve itself of the responsibility, it can assign it to other people, and I think that chain has clearly been established!	11:31
quaid	Board asked Releng, which has asked Spins, right?	11:31
stickster	At least as far as decoupling and linking the technical requirements for TM usage.	11:31
quaid	yes	11:31
spoleeba	quaid, the fab discussion would suggest...otherwise	11:31
quaid	spoleeba: don't do that	11:32
quaid	spoleeba: just because one is on the Board doesn't mean you cannot be involved in the assigned task	11:32
quaid	spoleeba: you saw people speaking as individuals	11:32
spoleeba	quaid, but not in the context of the spins sig's communication channel	11:32
quaid	for example, I am a bit of an SELinux historian and feel strongly about it, so I spoke up	11:32
spoleeba	quaid, my point is... the selinux came up..as part of the Board's step in the process...	11:32
f13	guys	11:33
quaid	simply because it hasn't been codified	11:33
quaid	by anyone yet	11:33
f13	we're talking about multiple things here	11:33
spot	perhaps we should ask the Spins group to provide a list of "suggested minimum technical requirements" for a spin.	11:33
f13	there are the things that Fedora produces itself, which we have a clear path of review for	11:33
spot	then we can argue about that ad infinitum	11:33
f13	then there are the things that individuals would be producing, under the name of Fedora	11:33
f13	where there is 0 review path, and 0 proposed review path	11:33
spoleeba	quaid, are we always going to see that happen? new policy will come up at the Board step..and then have to be pushed back to the Spin SIG to deal with?	11:33
f13	my only issue is with the latter, not the former.	11:33
f13	spoleeba: my issue doesn't really involve the spin sig	11:34
quaid	spoleeba: Spins/Releng needs to show the technical list early enough to the Board to get input, that's all	11:34
f13	because my issue is with the folks that will be producing content outside the spins process	11:34
quaid	f13: yes, and that discussion belongs in a thread about what technical requirements we get from Spins/releng; so you can make sure SELinux is on that list with your releng hat, and we can debate in our final vetting at the Board side.	11:35
quaid	spot: +1 to asking Spins (+ releng) to come up with the initial technical list	11:35
quaid	and yes I think it does need Board vetting.	11:35
quaid	otherwise we are passing on accountability that we cannot pass on!	11:35
f13	agreed	11:35
ctyler	+1	11:36
spot	+1 from me (obviously)	11:36
skvidal	+1	11:36
notting	+1	11:36
mdomsch	+1	11:37
stickster	f13: Can you own the task of starting and collecting that discussion?	11:37
stickster	we really need to get to the Q&A, guys.	11:38
f13	stickster: yeah, I'll take it. add it to the ever growing list of doom.	11:38
spot	the answer to all of the pending questions is: thinly sliced lunch meat	11:39
stickster	OK, anything more on this? Let's move on if not	11:39
f13	damnit, now i'm hungry	11:39
* poelcat notes that wraps up previous business		11:39
poelcat	back to you stickster	11:39
stickster	Q&A time	11:39
stickster	spevack: Go!	11:39
stickster	:-)	11:40
spevack	ok.	11:40
spevack	we have a number of questions.	11:40
spevack	there are a few about the infrastructure stuff.	11:40
spevack	so give me a moment to paste them all in, and then you can sort of answer from different bits	11:40
spevack	since there will be some overlap	11:40
spevack	the first was from vallor:	11:40
spevack	"I'm sure one of the questions on everybody's mind is the status of "Infrastructure" -- and are the rumors true that the bogusly-signed openssh packages were trojaned? (Max edit: we asked for some clarification and the response follows) I'm referring to anything and everything in the incident where systems were compromised -- and if that flows slightly into RHEL space, I think it is only prudent to explain that part of the incident, too."	11:40
spevack		11:41
spevack	the second from lwnjake and nirik:	11:41
spevack	"also, when might we find out more about exactly what happened to the infrastructure?"	11:41
spevack		11:41
spevack	and the third from rdieter:	11:41
spevack	"another hard ball, why wasn't the board informed of anything? (afaik, they're as much uninformed as anyone). or so says mr. spoleeba"	11:41
spevack		11:41
spevack	that's all the infrastructure questions we have right now.	11:41
f13	I can take the last one	11:41
spevack	there's two others on different topics	11:41
* spevack goes silent		11:41
f13	A few board members became aware of what was going on, due to other roles played by those board members.	11:41
f13	Some of these people were Red Hat employees, others were under a Red Hat NDA for various other reasons.	11:42
stickster	The Board has no NDAs with Red Hat.	11:42
stickster	Sorry, the people on the Board who are volunteers --	11:42
stickster	and have no prior formal relationship with Red Hat --	11:42
stickster	don't have any NDA.	11:43
quaid	!	11:43
f13	when it became apparent that the breakin effected Red Hat itself, and not just Fedora infrastructure, Red Hat asked for no further discussion with anybody else, unless it was approved by the people workign the issue	11:43
skvidal	stickster: not the ndas would have helped in terms of disclosure...	11:43
f13	my assumption was because we at that time had no idea who had broken in and did not want to divulge any information that would leak to the wrong ears.	11:43
quaid	f13: not only fair but smart assumption	11:44
f13	for better or worse, I and the other board members who were "in the know" followed that request and did not further inform any other board members	11:44
f13	people were brought into "the know" based on what we needed from them on individual issues	11:44
spoleeba	so how do i feel about that..as being a non-NDA'd Board member...	11:44
mdomsch	and even then, the extent of "in the know" varied person-to-person by their duties	11:44
quaid	I was personally totally unsurprised that I was kept in the dark nearly the entire time the whole world was.	11:45
stickster	As is true of all security investigations, progress reports are somewhat closely contained.	11:45
spoleeba	im not signing an NDA just to be on the board	11:45
f13	It's pretty easy to tear this apart post-incident, but in the heat of the moment it did not seem prudent to strain the Fedora/RH relationship by blatingly ignoring requests.	11:45
quaid	since I have no role in Fedora or RHT that puts me in touch with infrastructure	11:45
f13	now, had we thought of it, we likely could have gotten approval to inform the full Fedora board of what was going on, and kept them in formed.	11:45
quaid	I expected that the IT professional colleagues and community members were doing the right thing.	11:46
spot	On question 1: No "bogusly-signed" Fedora packages were distributed via any official mechanism. No "bogusly-signed" RHEL packages were distributed via any official mechanism (RHN).	11:46
f13	the question really is "what value would that have added" other than having more people who could not/should not tell anybody else.	11:46
quaid	f13: +1	11:46
spoleeba	I think we can do a lot just by having a generally useful infrastructure incident plan..with known interaction points with Red Hat	11:46
stickster	f13: I did think of it, but it was simply not possible given the sensitivity of the investigation.	11:46
quaid	f13: I was hapy to not know because it wasn't my job to be in the know.	11:46
f13	stickster: fair point.	11:46
quaid	spoleeba: +1 that is a great shakeout from this	11:46
quaid	obvious holes in our communication plan, etc.	11:46
quaid	but only after the fact	11:47
f13	absolutely	11:47
quaid	how do you know is too much or too little for community folks?	11:47
f13	lmacken has agreed to work on an incident response plan	11:47
quaid	to be honest	11:47
mdomsch	if it had been solely a Fedora thing, we would have treated it differently I'm sure	11:47
quaid	if we sent out the same thing each day, it would have been appreciated, aiui	11:47
quaid	mdomsch: +1	11:47
stickster	And we do have to understand that there are still places where our project touches what is essentially a commercial entity, Red Hat.	11:47
f13	mdomsch: I think so too. Fedora isn't legally responsible to a number of customers (:	11:47
skvidal	mdomsch: _maybe_	11:47
quaid	stickster: same is true in other cases	11:47
quaid	what if something had happened at a hosting provider that has Fedora boxen?	11:48
skvidal	mdomsch: Given what I've understood after the event	11:48
quaid	we would have been in the same situation	11:48
stickster	Our incident response plan will need to recognize that in some situations there are going to be decision points that lead into Red Hat where we can't dictate how every detail will run	11:48
stickster	Although we can set the stage --	11:48
skvidal	I'm not at all clear that we could have announced the status of things if it were purely a fedora intrusion	11:48
skvidal	not w/o clearance from red hat legal, at the least	11:48
spoleeba	stickster, and in the future.. possibly not Red Hat...if we have donated infrastructure services from other companies	11:48
stickster	-- by setting up reasonable expectations internally and externally for how to communicate incidents like this.	11:48
ctyler	I don't think anyone really minded being in the dark, but it seemed like a long time to be in the dark, especially with production systems out there	11:48
f13	skvidal: you make a good point, and I think every incident will be different and have slightly different results	11:49
spot	ctyler: it takes a LONG time to audit everything in cvs.	11:49
skvidal	f13: I think from here on out we can expect a lot more scrutiny in public announcements of anything like this	11:49
skvidal	that's just my impression, though	11:49
quaid	ctyler: I guess what bothered me during and after was the presumption that Fedora leadership had left community members high and dry in an effort to save RHT's bacon.	11:49
skvidal	quaid: we left community members b/c we had no choice in the matter	11:49
skvidal	wait	11:49
skvidal	I'm wrong	11:49
f13	ctyler: it's pretty hard not to infuse somebody with a false sense of security, while at the same time not infusing them with a false sense of insecurity	11:50
skvidal	our choices were 'do not talk about it or be in breach of contract'	11:50
mdomsch	quaid, I'm not sure how common that perception i	11:50
mdomsch	is	11:50
quaid	mdomsch: it's what Byfield's article is around	11:50
mdomsch	AFAICT, people "in the know" worked their tails off to protect our end users - our #1 priority	11:50
stickster	I tried not to take any presumptions personally.	11:50
quaid	total ignorance of IT practice in favor of freaking out about Red Hat.	11:50
ctyler	But there's a difference between software that just says "please wait" and software that says "please wait" and has a spinning icon so you know it hasn't crashed	11:50
spevack	stickster: there are a number of follow-ups whenever you are all ready for them.	11:51
ctyler	we need the spinning icon	11:51
quaid	but anyway, that's an old and dull adze.	11:51
spot	spevack: okay, lets hear those follow-ups	11:51
quaid	ctyler: ok, fair; even daily repeats of previous announcements is better than nothing.	11:51
f13	have we sufficiently hit the first 3 questions?	11:51
spevack	i think you have. and the follow-ups will provide more opportunity.	11:51
spot	well, i answered Q1.	11:51
skvidal	f13: there's still a little un-kicked horse, I'm sure	11:51
spevack	so let me paste that all in.	11:51
spevack	and then give it back to you guys	11:51
spevack		11:52
spevack		11:52
f13	k	11:52
stickster	I think a lot of people were frustrated about the lack of information, or the timing, and I truly sympathize.	11:52
spevack		11:52
spevack	vwbusguy: "I'd like to know what security changes in regard to the repos / updates and stuff, if any other than the key change, if it hasn't been discussed yet"	11:52
spevack		11:52
spevack	LyosNorezel: "why is RH's blanket restraint order still in effect? the problem's over... no? why not give a detailed explanation?"	11:52
spevack		11:52
spevack	vallor: "sounds like they've brought up having an incident response plan -- I guess I have to wonder is there a security group developing such a plan...and should the board security have a private mailing list (ONLY FOR INITIAL SECURITY INCIDENTS), where they can have full disclosure with each other?" (Max edit: it was mentioned already that fedora-board-list @ redhat.com is private to just the Board.)	11:52
spevack		11:52
spevack	go at it	11:52
spot	LyosNorezel: the investigation is _still_ ongoing.	11:52
stickster	As for #2, it's *not* over.	11:52
skvidal	spevack: it's an ongoing investigation - the problem is not resolved	11:52
* quaid votes that stickster give the first set of answers this time		11:52
f13	#1) we've had a number of chagnes coming up that were unrelated to the break in	11:53
stickster	vwbusguy: The changes you're seeing are all happening openly and transparently.	11:53
f13	gpg signing of repodata, a more secure signing server, and better signing practices had all been under discussion before the breakin, and made more important because of the break in	11:53
stickster	No one is trying to make changes to Fedora on the sly. Period, full stop.	11:53
* mdomsch is amazed, and proud, that the Fedora Infrastructure team could rebuild _every single box_ in a week, to ensure they were all clean		11:54
spevack	stickster: also, nirik has mentioned that he does not feel that his and lwnjake's initial question was addressed. It was (paraphrasing) "when will we find out more about what happened?"	11:54
skvidal	mdomsch: I don't think that's really at issue	11:54
f13	vallor: lmacken is part of the Fedora security SIG and he's the primary driver for the incident response plan.	11:54
f13	vallor: the plan will be developed in teh open and will be open to comment if you'd like to participate.	11:54
mdomsch	skvidal, it was part of the recovery plan	11:54
f13	Unfortunately we'll find out more when ... we find out more.	11:54
stickster	vallor: And I think we'd continue to use fedora-board-list for any such conversations, with the understanding -- as always -- that we try and use it as little as possible, and keep discussions open and transparent to the maximum extent.	11:55
skvidal	mdomsch: 'recovery plan' might be a bit strong of a statement	11:55
spevack	f13: vallor asks me to give you his thanks.	11:55
skvidal	mdomsch: I mean the plan was more or less 'pull back nuke everything from orbit'	11:55
f13	the investigation is still ongoing, and while I don't have any knowledge of it, I wouldn't be surprised if there is law enforcement involved somewhere.	11:55
mdomsch	granted	11:55
skvidal	mdomsch: we opted to scorch the earth rather than second guess	11:55
stickster	skvidal: With which plan I was in 100% agreement.	11:56
spot	lwnjake: when we're told that we can by the parties running the investigation, not a second before, and not a second later.	11:56
skvidal	right - but a plan with 1 step is not quite a plan :)	11:56
* stickster +1's spot.		11:56
* spot would like to point out that Byfield's chicken little attitude is really irrational. No other FOSS publicly traded company (note that I said company) has ever had to deal with anything like this before.		11:57
spot	yeah, it wasn't as good as it could be, but in true FOSS fashion, we're taking lots of notes and submitting patches	11:58
skvidal	spot: it would be nice to get something resembling a status update from folks internal	11:58
skvidal	spot: I agree with that concern, entirely	11:58
spot	it would be nice, and hopefully we'll have something new soon.	11:59
spevack	stickster: when the Board is ready, there are two additional questions on different topics.	11:59
spevack	then i'll start looking for other follow-ups in the public room	11:59
stickster	Anything else on the intrusion matter?	12:00
stickster	If not, fire away spevack!	12:00
spevack	ok	12:00
spevack	vallor: "sounds like they've brought up having an incident response plan -- I guess I have to wonder is there a security group developing such a plan...and should the board security have a private mailing list (ONLY FOR INITIAL SECURITY INCIDENTS), where they can have full disclosure with each other?" (Max edit: it was mentioned already that fedora-board-list @ redhat.com is private to just the Board.)	12:00
spevack	wait, wrong paste	12:00
spevack	i already did that one	12:00
spevack		12:00
spevack		12:00
spevack		12:00
spevack	bryan_kearney1: I would like to get feedback on the AOS Trademark request (Max edit: What is AOS, for those who don't know? Also, bryan is referring specifically to the SELinux question, and the "minimal set of technical requirements to call something fedora" question)	12:00
stickster	AOS is appliance operating system I think	12:01
f13	we just spent 20 minutes arguing about that earlier in the meeting	12:01
f13	one problem with "release early, release often" when it comes to policy is that sometimes we're not ready :/	12:01
spevack	f13: bryan is typing a modified/follow-up question right now	12:01
spevack	hang on	12:01
spoleeba	f13, does the version he recently submitted with selinux set to permissive work for you..until the new trademark policy and its technical measures go into effect?	12:02
stickster	Bryan has been actively partipating in the TM guidelines stuff, partly because it directly affects a projet on which he's working	12:02
f13	also, a lot of discussions got put to the side when the "incident" happened, and we're slowly bringing things back into the foreground	12:02
spot	bryan_kearney1: congratulations! you have stumbled into an unimplemented section of the map. beware of grues. we're scribbling as fast as we can. ;)	12:02
spevack	while we wait for bryan's follow-up, here's the other question:	12:02
spevack		12:02
spevack		12:02
spevack	inode0: less touchy I think question: why no new installation media? seems a large pain to install systems with keys that we need to replace after installation?! (Max edit: rdieter says this was possibly addressed in rel-eng meetings.)	12:02
f13	spoleeba: maybe? I honestly haven't taken a moment to look at it, I've been entirely focused on getting updates out to users once again.	12:02
f13	oh, and beta.	12:02
stickster	OK, let's answer John's question.	12:03
spot	<nirik> inode0: because that doesn't help any of the already burned media out there, and for doing something like 9.1 there would be export approval/legal to go thru	12:03
f13	We decided not to respin media because the content on the media is verified via other means than the keys on teh packages	12:03
stickster	I think the human-power cost of this is far too high vs. the current plan.	12:03
f13	and that there was already a rather large amount of pre-mastered media out in the wild, that there was no real good reason to invalidate	12:03
spoleeba	f13, right... right... i realize.. im just saying that for in the meanwhile if his new kickstart is okay...then we should bless that for F10 timeframe	12:03
quaid	spoleeba is correct	12:03
f13	spoleeba: it's on my list to look at.	12:03
quaid	f13: thanks	12:04
quaid	that's the blocker since we have no guidelines in place :D	12:04
spevack		12:04
spevack	bryan_kearney1: AOS spin is still awaiting trademark approval, with selinux enabled (--permissive). We need additional feedback. I made changes per the feedback I got, and have gotten no new feedback	12:04
spevack		12:04
notting	'see the minutes from earlier in the meeting'?	12:04
spoleeba	f13, as to media... are we going to leave the new release rpm with the new key..signed with the old key..up until F9 eol?	12:04
f13	we verified that the content on the media is good, we're going to re-sign the SHA1SUM file with the new key, and we're preparing our repos and mirrormanager so that fresh installs from those media will only ever hit our mirrors (the ones we control) for the updates, which will get them the transition bits to point them to the newly signed content.	12:05
spot	please hold, while we determine what the minimum technical requirements will be (once we receive them from the Spins team).	12:05
f13	spoleeba: that is the plan. The repo will hold that and the PK updates and only those. Mirrormanager will force all requests to those repos into mirrors we control.	12:05
spoleeba	f13, excellent... so a very small mirror pool specifically for those updates	12:05
f13	yes	12:06
spoleeba	f13, yeah mirrormanager!	12:06
mdomsch	spoleeba, d.f.r.c isn't really a small pool :-)	12:06
spevack	stickster: there are currently no other questions queued up	12:06
spoleeba	mdomsch, small is relative	12:06
stickster	bryan_kearney1: to add to what notting said, I think you're seeing the effects of many of the parties involved being wrapped up in the work to get F8/F9 updates back on the horse	12:06
quaid	question:	12:07
quaid	what is going on with secondary marks?	12:07
* quaid waits to see if that question is clear enough :)		12:07
mdomsch	quaid, the guidelines call for a new secondary mark	12:08
mdomsch	"Powered by Fedora", "Derived from Fedora", something like that	12:08
stickster	There are three questions -- Can we have one? What can it say? What does it look like?	12:08
spoleeba	mdomsch, i seem to remember this discussion happening before..way way way back wehn	12:08
notting	it has happened before.	12:09
mdomsch	and will again	12:09
stickster	So far, the answers I have, from talking with Red Hat Legal, are (1) Probably, (2) Not sure yet, (3) Not sure yet.	12:09
mdomsch	stickster, but we could get the artwork team to start 3)	12:09
f13	am I watching a BSG episode?	12:10
spoleeba	mdomsch, i could suggest a briefcase with an infinite symbol on it...oh wait..nevermind	12:10
stickster	Well, it's very possible we can use the existing mark as *part* of the secondary mark.	12:10
mdomsch	f13, she was boxed	12:10
stickster	i.e. "Based on Fedora."	12:10
stickster	Current legal minds are telling me that's not necessarily verboten.	12:10
spoleeba	stickster, i like these new legal minds	12:11
mdomsch	"Fedora Inside"	12:11
mdomsch	+ chimes	12:11
stickster	Something tells me they won't be nearly as happy about a secondary mark that infringes another trademark :-D	12:11
mdomsch	stickster, spoleeba +1	12:11
stickster	So until we know what text we can use, and whether we can use the official logo, as part of the secondary mark, starting a design process is probably premature	12:12
quaid	so this is a depedency on these trademark guidelines being finished.	12:13
stickster	Especially if it comes down to, "Sure, use 'Based on Fedora'" with the official logo in XX specific configuration	12:13
ctyler	so eom+art team?	12:13
stickster	Because that art design will probably take about 5 minutes.	12:13
stickster	In fact, I already did one myself.	12:13
* mdomsch gets out fingerpaints		12:13
ctyler	uh oh	12:13
stickster	(but will leave it to real artists and not dilettantes like myself)	12:13
stickster	ctyler: I really, really hope so.	12:13
quaid	this rolls back a bit to the AOS question	12:14
stickster	So quaid +1, the guidelines need to be finished.	12:14
stickster	Meaning that if there's a further dependency on technical guidelines, those need to be done pronto.	12:14
quaid	the AOS with SELinux removed could use the secondary marks ... if they exist in the future.	12:14
stickster	FESCo discussed this in their recent meeting too.	12:14
stickster	sorry, indefinite "this"	12:14
stickster	FESCo discussed technical Spin requirements in their recent meeting too.	12:15
stickster	We should make sure that we, as the Board, are working in coordination with FESCo	12:16
* stickster ponders.		12:16
stickster	If it's super-duper easy for anyone to use the secondary mark, and that secondary mark is a great pointer to the official project...	12:17
stickster	Why will people want to bother with the primary mark?	12:17
stickster	That's a rhetorical questions.	12:17
stickster	*questions	12:17
* stickster gives up and shoots typist.		12:17
ctyler	stickster has quit (Shot)	12:17
stickster	heh	12:17
stickster	OK, traffic has died, I think spevack fell asleep listening to me ramble, and there may be an empty question queue.	12:18
stickster	spevack: Shall we call it?	12:19
spoleeba	stickster, congratz you have just completed the full discussion about the value and danger of the sencondary mark..all inside your own head	12:19
spoleeba	stickster, you will fail to sleep this evening	12:19
f13	stickster: you mean like the debian official mark vs the one everybody actually uses?	12:19
stickster	f13: That's precisely why I like the idea of embedding words in the mark.	12:19
* f13 too		12:20
spevack	stickster: sure	12:20
f13	I think it's a worry, but something we'll just have to deal with	12:20
f13	by continuing to make things marked with the official mark relevant and exciting to use	12:20
mdomsch	It's more likely official spins with the full mark will get hosting from the project?	12:20
spevack	stickster: one last thing	12:20
spevack	stickster: then the queue is empty	12:20
f13	and if our best competition comes from outselves, isn't that a good ting?	12:20
stickster	spevack: Oh no, that's always a bad sign.	12:20
spevack	< herlo> spevack: Not sure if this is applicable to the previous	12:20
spevack	discussoin in the board but, So the patches that have been	12:20
stickster	:-D	12:20
spevack	made and fixes that were applied to the infrastructure, did	12:20
spevack	they help in solving this issue?	12:20
spevack	ugh, sorry for the bad formatting	12:20
f13	mdomsch: I'm almost of the opinion that only things hosted/produced officially by the project get the full mark, but I haven't fully thought that out yet.	12:21
spot	OUR MAGICAL FAIRY SHIELD NOW PROTECTS US FROM ALL INVADERS, FOREIGN AND DOMESTIC.	12:21
f13	spot: that's a +3 FAIRY SHIELD mind you	12:21
stickster	We believe that the changes we've made did help, yes. It would be silly for us to claim we're now 100% IMMUNE from bad peeplez	12:21
stickster	-- but --	12:21
f13	many of the changes we made will help us to recover from future attacks	12:22
stickster	as all security practitioners know, security's a process, not an end state	12:22
spot	+3 FAIRY SHIELD HAS A +1 AGAINST TROLLS	12:22
f13	leaving us less with our pants hanging down	12:22
f13	so that next time, we may not have to nuke from orbit and spend a month trying to get updates out again	12:22
ctyler	f13: So then a spin with the full mark could use the Fedora infrastructure for spin distribution? That's a reason to aim for it over the secondary mark.	12:22
* spevack has nothing else from #fedora-board-public		12:22
spoleeba	mdomsch, i think im firmly in the camp that we are going going to be officially hosting spins which go through the release process..regardless of primary/secondary mark	12:23
stickster	OK, let's call it.	12:23
f13	cable guy is here, I'm out.	12:23
stickster	You heard the man.	12:23
stickster	</meeting>	12:23
stickster	Board members, thank you for being here.	12:23
stickster	Community, thank you even more for being here.	12:23
ctyler	stickster, spevack, thank you both.	12:24
spoleeba	we need to move this to a time so I can be drinking heavily while in this meeting	12:24
spevack	my pleasure guys	12:24
stickster	spoleeba: It's always happy hour somewhere.	12:24
stickster	spevack: Thank you my friend	12:24
* stickster hopes he can bend poelcat's arm to do summary/log		12:24
-!- stickster changed the topic of #fedora-board-meeting to: Next public Board meeting: TBA		12:28

Generated by irclog2html.py 2.7 by Marius Gedminas - find it at mg.pov.lt!