2026-08-20 15:00:17 <@q5sys:matrix.org> !startmeeting
2026-08-20 15:00:24 <@q5sys:matrix.org> !meetingname security-sig
2026-08-20 15:00:27 <@meetbot:fedora.im> Meeting started at 2026-08-20 15:00:17 UTC
2026-08-20 15:00:27 <@meetbot:fedora.im> The Meeting name is 'Fedora Meeting 3'
2026-08-20 15:00:27 <@q5sys:matrix.org> !link Issue Location : https://forge.fedoraproject.org/security/tickets
2026-08-20 15:00:28 <@meetbot:fedora.im> The Meeting Name is now security-sig
2026-08-20 15:00:32 <@q5sys:matrix.org> !link Discourse security tagged topics :https://discussion.fedoraproject.org/tag/security
2026-08-20 15:00:38 <@q5sys:matrix.org> !info Open floor to discuss anything security related. (2026-08-20)
2026-08-20 15:00:42 <@q5sys:matrix.org> !info Next Meeting (2026-08-27)
2026-08-20 15:00:42 <@py0xc3:fedora.im> !hi
2026-08-20 15:00:45 <@q5sys:matrix.org> !info There are 12 open tickets in the main Security Forge: https://forge.fedoraproject.org/security/tickets/issues
2026-08-20 15:00:49 <@py0xc3:fedora.im> !hi
2026-08-20 15:00:51 <@q5sys:matrix.org> !info There are 5 open tickets in the Security Docs Forge: https://forge.fedoraproject.org/security/docs/issues
2026-08-20 15:00:54 <@zodbot:fedora.im> Chris (py0xc3): Christopher Klooz (py0xc3) - he / him / his
2026-08-20 15:00:55 <@q5sys:matrix.org> !info There are 4 open tickets in the Defensive Coding Guide:
2026-08-20 15:00:55 <@q5sys:matrix.org> https://forge.fedoraproject.org/security/defensive-coding-guide/issues
2026-08-20 15:01:00 <@q5sys:matrix.org> !topic Agenda: https://discussion.fedoraproject.org/t/agenda-for-the-saecurity-sig-meeting-on-20th-august-2026/199707
2026-08-20 15:02:22 <@q5sys:matrix.org> There's only one item on the agenda this week, `Quick poll for SIG members (quorum 3) if there is no objection: move ff-disable-ai-ml repo to the SIG’s Forge-org for joint ownership/maintenance, before package review.`
2026-08-20 15:02:43 <@q5sys:matrix.org> Chris (py0xc3) since that's you're repo right now, do you want to say anything about it?
2026-08-20 15:02:54 <@py0xc3:fedora.im> !topic Quick poll for SIG members (quorum 3) if there is no objection: move ff-disable-ai-ml repo to the SIG’s Forge-org for joint ownership/maintenance, before package review.
2026-08-20 15:03:04 <@py0xc3:fedora.im> !link https://github.com/py0xc3/ff-disable-ai-ml
2026-08-20 15:03:12 <@py0xc3:fedora.im> Communications about this seems currently not possible with the Firefox maintainer, there are many rumors about this "Firefox AI" around (many wrong or exaggerating the problem), and for average users it's not trivial to solve this if they want to disable it (given some reports they might read, being forced to use it can be quite deterring; but there are logical reasons too, including battery life time & performance).
2026-08-20 15:03:12 <@py0xc3:fedora.im> 
2026-08-20 15:03:12 <@py0xc3:fedora.im> There was a suggestion from Neal Gompa (patch the "Block AI" option) how this could be resolved and I aimed to collaborate with the maintainer to define and delimit a discussion that captures possibilities acceptable for all sides and to allow deleting everything "extreme" as offtopic to keep the discussion focused and constructive before starting it in public. But that is not realistic without the maintainer.
2026-08-20 15:03:12 <@py0xc3:fedora.im> 
2026-08-20 15:03:12 <@py0xc3:fedora.im> It is unclear why that is, as he also proposed an AI article for the magazine and then disappeared (the Fedora Magazine team tries to reach them for some weeks now). So maybe they are just overworked or so, but the issue remains.
2026-08-20 15:03:12 <@py0xc3:fedora.im> 
2026-08-20 15:03:12 <@py0xc3:fedora.im> That package would create a subtle incentive to maybe facilitate something constructive to discuss in future (especially if people start to use it), with something specific to keep a discussion focused (I intentionally embedded Neal's idea in the README.md with a policy how such a patch would "auto-obsolete" the package). And in the meantime, the package allows (mostly average) users to solve the issue.
2026-08-20 15:03:12 <@py0xc3:fedora.im> 
2026-08-20 15:03:12 <@py0xc3:fedora.im> I would add a short wiki page (shorter than the README.md) because for average users, identifying that a package solves such problem is not trivial.
2026-08-20 15:03:12 <@py0xc3:fedora.im> 
2026-08-20 15:03:12 <@py0xc3:fedora.im> If anyone has concerns about this or a general objection, we can either discuss it or skip the topic at all: it's not critical after all. Otherwise, I suggest a quick poll, and if we reach a quorum (+3) for it, I would open a ticket, prepare everything, but not start the package review process (nor publishing any docs page) for at least 1 more week to allow others to object or raise concerns.
2026-08-20 15:03:19 <@salimma:fedora.im> !hi
2026-08-20 15:04:29 <@jforbes:fedora.im> !hi
2026-08-20 15:04:37 <@decathorpe:fedora.im> !hi
2026-08-20 15:04:51 <@q5sys:matrix.org> who dissappeared? Neal or the maintainer you were working with?
2026-08-20 15:05:33 <@salimma:fedora.im> sure, that sounds good
2026-08-20 15:06:11 <@salimma:fedora.im> I assume *not* Neal
2026-08-20 15:06:12 <@py0xc3:fedora.im> Firefox maintainer. I was not working with him, he never responded to me, but also does not respond to the Magazine Team whom he proposed an AI feature article. Many explanations possible, so I don't expect anything hostile or so.
2026-08-20 15:06:41 <@q5sys:matrix.org> I just wanted to make sure I understood what Chris was meaning to say. :)
2026-08-20 15:06:41 <@decathorpe:fedora.im> I'm not sure the "security" org is the best place for this
2026-08-20 15:07:22 <@py0xc3:fedora.im> Yeah it deploys a very broad definition of security.
2026-08-20 15:07:37 <@py0xc3:fedora.im> But it also feels not good to have something like this maintained by a single person outside Fedora org.
2026-08-20 15:07:45 <@q5sys:matrix.org> Security does seem like an awkward place for it. Obvious question that people will be wondering is 'how is this security related'.
2026-08-20 15:07:47 <@py0xc3:fedora.im> But I agree to your concern...
2026-08-20 15:08:06 <@salimma:fedora.im> ah, good point
2026-08-20 15:08:17 <@salimma:fedora.im> sorry, I meant to reply to this one
2026-08-20 15:08:17 <@py0xc3:fedora.im> Well, less technical security, except security of availability when the battery dies :) 
2026-08-20 15:08:47 <@salimma:fedora.im> ask for "Anti-LLM cabal" as a Forge group ;)
2026-08-20 15:08:50 <@py0xc3:fedora.im> But security in a policy way, creating an incentive to this not evolving to privacy/security-threatening, though this might be a little exeggerated at this time
2026-08-20 15:09:08 <@decathorpe:fedora.im> Asking a different way - is there a reason why this would be Fedora Forge material and not "personal repo on Codeberg" material? 
2026-08-20 15:09:22 <@py0xc3:fedora.im> the point, a security relation other than security of availabiltiy rises only on the long term,
2026-08-20 15:09:24 <@py0xc3:fedora.im> its less immediate
2026-08-20 15:09:32 <@py0xc3:fedora.im> and I can understand if we don't want to cross that line
2026-08-20 15:09:37 <@decathorpe:fedora.im> it looks like it would not even necessarily Fedora specific, i.e. also applicable to other distributions if they want it 
2026-08-20 15:09:45 <@q5sys:matrix.org> Fedora has an AI/ML Sig... maybe there should be a non-AI/ML sig 🤣 Would be a bit more polite than Anti-AI/ML Sig. haha
2026-08-20 15:09:48 <@py0xc3:fedora.im> Yes, I want to get it to EPEL.
2026-08-20 15:09:57 <@q5sys:matrix.org> does Fedora have a Privacy Sig?
2026-08-20 15:09:58 <@py0xc3:fedora.im> Its relevant for our downstream firefox builds too. Not flatpak though
2026-08-20 15:10:13 <@py0xc3:fedora.im> I think not. So far privacy is either security or legal :)
2026-08-20 15:10:25 <@salimma:fedora.im> poor Fabio, people keep proposing neat new SIGs he might be compelled to join
2026-08-20 15:10:28 <@decathorpe:fedora.im> "privacy-sig" would be a better fit :)
2026-08-20 15:10:45 <@salimma:fedora.im> we were just discussing having a benchmark/performance SIG the other day :P 
2026-08-20 15:11:08 <@py0xc3:fedora.im> Well, that SIG it would fit too, as the AI are a performance issue (for many that might be the biggest issue actually) :P
2026-08-20 15:11:29 <@salimma:fedora.im> hmm ... idk, wouldn't really be a good fit whether to toggle something or on off by default
2026-08-20 15:11:39 <@q5sys:matrix.org> `SIG Enjoyers SIG`.  Where People who like SIGs can sit around and talk about other SIGs.
2026-08-20 15:11:59 <@py0xc3:fedora.im> Following the more recent discussions and issues that came up in recent conferences, the most critical SIG we need is the holiday SIG and the vacation SIG and hiking SIG ... :O
2026-08-20 15:12:00 <@salimma:fedora.im> The SIG Investigation Group, SIG SIG
2026-08-20 15:12:13 <@py0xc3:fedora.im> omg :O
2026-08-20 15:12:22 <@q5sys:matrix.org> Sig Squared
2026-08-20 15:13:10 <@py0xc3:fedora.im> Ok, tendency then, the package does not fit the current scope of the security sig?
2026-08-20 15:14:05 <@salimma:fedora.im> "tendency" sounds like a good name for a cabal too
2026-08-20 15:14:45 <@q5sys:matrix.org> anywho... back on the topic... I like the subject matter of the task, I would probably use it myself.
2026-08-20 15:14:45 <@q5sys:matrix.org> I just dont know if Security is the best place for it, or where might be a better place that would give it more visiblity and be a better fit.
2026-08-20 15:14:49 <@niknikovsky:fedora.im> The SIG Managment Agency
2026-08-20 15:15:09 <@salimma:fedora.im> we can start a group repo somewhere for hosting privacy tweaks and see if we can get it going enough to start a SIG
2026-08-20 15:15:13 <@salimma:fedora.im> I would happily join
2026-08-20 15:15:14 <@q5sys:matrix.org> I'm not opposed to it landing in the Security SIG as a stop gap until it an find a better home, if it being in a personal repo is a blocker for EPEL.
2026-08-20 15:15:27 <@q5sys:matrix.org> I'm not opposed to it landing in the Security SIG as a stop gap until it can find a better home, if it being in a personal repo is a blocker for EPEL.
2026-08-20 15:15:38 <@salimma:fedora.im> wait, why do we care about EPEL specifically?
2026-08-20 15:15:41 <@decathorpe:fedora.im> shouldn't be a blocker
2026-08-20 15:15:46 <@nhanlon:beeper.com> !hi
2026-08-20 15:15:53 <@zodbot:fedora.im> Neil Hanlon: Neil Hanlon (neil) - he / him / his
2026-08-20 15:15:58 <@nhanlon:beeper.com> Yo dog, i heard you liked SIGs
2026-08-20 15:16:06 <@q5sys:matrix.org> Im 100% in favor of doing this, for reasons beyond this copr build.
2026-08-20 15:16:09 <@salimma:fedora.im> the nice thing if we get it to a SIG status at some point is we can then have group COPRs
2026-08-20 15:16:10 <@decathorpe:fedora.im> but I am OK with this (move it to /security/* until a better place is found) 
2026-08-20 15:16:38 <@nhanlon:beeper.com> The first rule of privacy SIG is you don't tell anyone about it, i guess?
2026-08-20 15:16:55 <@py0xc3:fedora.im> Yeah, just like the second and third rule :P
2026-08-20 15:16:57 <@q5sys:matrix.org> Shhhh
2026-08-20 15:17:22 <@niknikovsky:fedora.im> The first rule of fight club is that we do not talk about fight club
2026-08-20 15:17:34 <@py0xc3:fedora.im> You mean ask for a forge-org or within security sig or somewhere else (freedesktop or so?)?
2026-08-20 15:18:19 <@salimma:fedora.im> I mean once there is a FAS group we can have a matching COPR group with just one click
2026-08-20 15:18:41 <@salimma:fedora.im> but for now, idk how much trouble it is to ask for a forge org so if it's too hard, somewhere else is fine too
2026-08-20 15:19:11 <@q5sys:matrix.org> Im still not a fan of the effort of data collection in the Workstation Release.
2026-08-20 15:19:31 <@py0xc3:fedora.im> Asking / requesting a forge org is easy, if it is accepted, well, something else :) I expect a SIG must be formed for it in advance.
2026-08-20 15:19:50 <@py0xc3:fedora.im> The copr build is just if someone wants to test or see if it properly builds. My goal was to get it into Fedora's default repos.
2026-08-20 15:19:50 <@salimma:fedora.im> the telemetry one that failed? yeah
2026-08-20 15:20:11 <@salimma:fedora.im> we need something official that can push back against these sort of things
2026-08-20 15:20:13 <@q5sys:matrix.org> Yup, that one.
2026-08-20 15:20:19 <@salimma:fedora.im> but we can discuss that elsewhere after this meeting
2026-08-20 15:21:18 <@py0xc3:fedora.im> Well, then this goes towards a privacy (sub-)SIG? xD
2026-08-20 15:21:44 <@q5sys:matrix.org> If we start one... your COPR build would be a perfect fit
2026-08-20 15:22:10 <@niknikovsky:fedora.im> hmm .. SIG related Fedora Council managed team?
2026-08-20 15:22:13 <@py0xc3:fedora.im> Yeah, if we create one, I would not move it to security or so but wait for the other one to have its repos or organization. It's nothing urgent after all
2026-08-20 15:23:06 <@q5sys:matrix.org> I can write up a P-SIG proposal this weekend and run it by everyone next week for input before I/We move forward on reaching out to more people about it.
2026-08-20 15:23:55 <@q5sys:matrix.org> All my cars are in various states of broken at the moment... so I wont be going anywhere and i'll have plenty of time at home to do things. haha
2026-08-20 15:25:03 <@py0xc3:fedora.im> The disadvantage of the mountains :D 
2026-08-20 15:25:59 <@salimma:fedora.im> I think I'll keep their rental car for one full day if I can get them to hold my car overnight after servicing
2026-08-20 15:27:00 <@salimma:fedora.im> anyway, so.. do we have an actual security topic?
2026-08-20 15:27:02 <@py0xc3:fedora.im> I would be ok with that, if others agree to create a separate p-sig?
2026-08-20 15:27:20 <@salimma:fedora.im> sgtm
2026-08-20 15:27:30 <@py0xc3:fedora.im> Ok, +1
2026-08-20 15:28:01 <@q5sys:matrix.org> Less blame on the mountians, and more blame on the dealership that sold me a defective waterpump that ended up gernading itself and taking my engine with it... and who refuses to cover the damage because "We didn't install it"
2026-08-20 15:28:03 <@py0xc3:fedora.im> I'm happy to give feedback if you want, also before the meeting or so, but I guess writing much myself is what I currently would prefer to avoid :)
2026-08-20 15:28:42 <@q5sys:matrix.org> When I get it written, I'll make it a ticket in our SIG for comment, and we can then talk about it more in the next meeting
2026-08-20 15:28:45 <@py0xc3:fedora.im> so set this as action?
2026-08-20 15:28:58 <@py0xc3:fedora.im> Sounds good
2026-08-20 15:32:15 <@py0xc3:fedora.im> !action @q5sys to draft P-SIG and create a ticket for it once he is ready. 
2026-08-20 15:32:44 <@py0xc3:fedora.im> !agreed firefox-disable-ai package is on hold for now. Waiting for discussing draft of P-SIG
2026-08-20 15:32:51 <@py0xc3:fedora.im> !topic Open Floor 
2026-08-20 15:32:52 <@py0xc3:fedora.im> :D
2026-08-20 15:34:06 <@q5sys:matrix.org> (twiddles thumbs)
2026-08-20 15:34:28 <@decathorpe:fedora.im> P-SIG = NP-SIG? 
2026-08-20 15:35:02 <@py0xc3:fedora.im> Privacy = NonPrivacy?
2026-08-20 15:35:59 <@decathorpe:fedora.im> :D
2026-08-20 15:36:04 <@jforbes:fedora.im> Might be tough to prove
2026-08-20 15:36:08 <@q5sys:matrix.org> Dont phrase it like that... the math nerds will descent...
2026-08-20 15:36:15 <@q5sys:matrix.org> Dont phrase it like that... the math nerds will descend...
2026-08-20 15:36:25 <@salimma:fedora.im> P ⊆ NP SIG is trivially true
2026-08-20 15:36:25 <@decathorpe:fedora.im> 🤫
2026-08-20 15:36:35 <@q5sys:matrix.org> We'll just ask AI to prove it with 'novel theorems'
2026-08-20 15:36:48 <@q5sys:matrix.org> We'll just ask AI to prove it with 'novel theorems' 🤣
2026-08-20 15:36:56 <@salimma:fedora.im> but then you just went from Privacy to Probabilistic :p
2026-08-20 15:37:52 <@py0xc3:fedora.im> isnt privacy probabilistic?
2026-08-20 15:40:33 <@q5sys:matrix.org> Im going to call the meeting at :40 unless anyone has anything else to bring up.  Give everyone a little bit of their day back.
2026-08-20 15:42:36 <@salimma:fedora.im> I'm free for another 20 mins if anyone want to hammer out some details about P != NP
2026-08-20 15:42:52 <@salimma:fedora.im> because the next internal meeting I have to take, I'm not looking forward to it anyway so distractions will be nice
2026-08-20 15:43:26 <@q5sys:matrix.org> `Sorry, I cant come to the meeting, I'm busy solving the universe scale problems.`
2026-08-20 15:43:31 <@salimma:fedora.im> ooh privacy is not probabilistic. P = NP
2026-08-20 15:43:42 <@py0xc3:fedora.im> no worries, its just 42
2026-08-20 15:44:27 <@q5sys:matrix.org> haha
2026-08-20 15:44:36 <@q5sys:matrix.org> Anyway... have a great week/weekend everyone.
2026-08-20 15:44:38 <@q5sys:matrix.org> !endmeeting