18:00:18 #startmeeting FESCO (2013-10-16) 18:00:18 Meeting started Wed Oct 16 18:00:18 2013 UTC. The chair is sgallagh. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:00:18 Useful Commands: #action #agreed #halp #info #idea #link #topic. 18:00:22 #meetingname fesco 18:00:22 The meeting name has been set to 'fesco' 18:00:25 #chair abadger1999 mattdm mitr mmaslano notting nirik pjones t8m sgallagh 18:00:25 Current chairs: abadger1999 mattdm mitr mmaslano nirik notting pjones sgallagh t8m 18:00:28 #topic init process 18:00:32 Hello 18:00:33 hello party people. 18:00:34 * abadger1999 here 18:00:35 hello 18:00:48 hi 18:01:02 hi! 18:01:02 I am here, but it turns out I have a hard stop in two hours. Hopefully this is irrelevant information. 18:01:06 * nirik is here. 18:01:29 sgallagh: thanks, you've just cursed the rest of us to a thre hour meeting. ;-) 18:02:22 i think notting is likely to be busy 18:02:23 sgallagh: two? 18:02:46 Ok, with notting out, I think we're all accounted for 18:03:08 First, old business: 18:03:13 #topic #1164 F20 Changes - Progress on Changes Freeze 18:03:18 .fesco 1164 18:03:19 sgallagh: #1164 (F20 Changes - Progress on Changes Freeze) – FESCo - https://fedorahosted.org/fesco/ticket/1164 18:03:39 jreznik helpfully provided us with an update this morning 18:04:40 I'm slightly concerned about the few changes that haven't responded about their incomplete status 18:05:04 abadger1999: You're one of those :) 18:05:08 sorry I wasn't able to ping everyone personally and get status but will try to do so 18:05:10 How's setuptools 0.7? 18:05:24 baked, done. 18:05:38 yep, the incomplete features with no recent updates are worrying 18:05:47 abadger1999: so pls ON_QA in the bug :) 18:06:44 sgallagh: It's a little tiresome, OTOH what's the adverse effect? (on the distribution and on the change owners?) 18:06:46 jreznik: ah okay... where is it published that we're supposed to change status to that? The last status change was in an email sent to me or in the bug? 18:06:51 I'm fine with this particular set of unknowns 18:07:34 abadger1999: sent to devel-announce and then in bug itself, I tried to ping as many people I saw online 18:07:37 abadger1999: "Fedora 20 Schedule reminders - Changes 100% Complete in one week" to devel-announce 18:07:42 Well, setuptools concerned me a bit. I thought I remembered that needing a rebuild in most cases. 18:07:50 But if abadger1999 says all is well. I'm good. 18:07:59 sgallagh: the change was in before the mass rebuild 18:08:21 sgallagh: and things didn't need a rebuild; rebuild was thought nice to determine if anything would be broken by the update. 18:08:28 Got it 18:08:52 Ok, anyone else have any concerns at this time, or shall we just politely request that jreznik hound these folks for updates? 18:09:06 well, when do we drop the ones that aren't responding. 18:09:17 Ryu, hadoop... 18:09:39 Good point 18:10:35 do all of the blockers for the web assets change need to be done for the feature to be considered done, or is having a place for those packages to be updated to considered "done" for the feature? 18:11:07 nirik: unfinished ones are not in announcement... that is main idea of having that list tracked 18:11:12 Proposal: all Changes not currently marked as complete should be treated as postponed unless the maintainer shows that they were already completed before this meeting started/ 18:11:45 s/maintainer/owner/ 18:12:24 Proposal: All Changes not marked as complete and not updated within the last month will be dropped from the list of changes to be announced at F20 (... with no way to re-add expected) 18:12:45 well I just want a way how to track what's done and not for release announcements and what should be in release notes and docs but don't thing with a new process it has to be removed from the list - it's not features list anymore 18:12:49 hrm. 18:13:27 sgallagh: I think it would be fine if the "complete" state happens by Beta Release, not necessarily today. 18:13:28 mitr: that seems a little weird - if they haven't been changed in the last month, that means it's /more/ likely that merely the feature page is wrong 18:13:51 s/feature/you know what I meant/ ;) 18:14:11 mitr: Well, the process suggests that it should have been complete by beta freeze, not beta release 18:14:27 (Freeze-exception bugs notwithstanding) 18:14:31 let me a week to try to get missing updates but still I prefer not to remove it from list - the reason why we renamed it from features to changes 18:14:48 well, if it's not done, we shouldn't announce it... 18:14:48 also I have the same question as above for the unversioned docdirs 18:14:50 https://bugzilla.redhat.com/showdependencytree.cgi?id=998579&hide_resolved=1 18:14:56 "Bug 998579 depends on 201 open bugs" 18:15:16 pjones: "things" happen upstream all the time; I think that what makes this a Fedora Change worthy of marketing is that it has been coordinated and tested within Fedora. 18:15:52 mitr: right. but the change not being maintained isn't the same thing as the actually thing being changed and testing being done within Fedora. 18:16:01 the *Change* not being maintained. 18:16:03 mattdm: yeah... although I don't think we expect them all to be done. 18:16:47 pjones: yes. That would lead to a conversation of what the change process is for... 18:16:58 ... which I'd rather not have at this hour. 18:17:02 fair. 18:18:21 well, I guess I would personally be in favor of dropping/moving to f21 the ryu and hadoop ones... since they are completely unknown 18:18:25 I'd like to withdraw my proposal, and back giving jreznik one more week for updates 18:18:31 and giving more time for others. 18:18:35 could we move on? I would ask jreznik to ask people in simple mail - update your bugs or they won't be included 18:18:49 mmaslano, +1 18:19:03 +1 18:19:18 + to me 18:19:21 +1 18:19:22 +1 18:20:05 Doesn't really sound any different from my proposal above. So +1 18:20:31 ok 18:20:53 nirik: Was that a +1? 18:21:03 +1 18:21:24 sgallagh: differs in that we aren't commiting to actually not including them? 18:21:30 sure, +1 18:21:35 ok 18:21:37 sure, +1 18:21:57 #agreed Ask jreznik to ask people in simple mail - update your bugs or they won't be included (+8, 0, -0) 18:22:09 Moving on... 18:22:11 * jreznik will do so 18:22:21 #topic #1166 F20 System Wide Change: Migrate to Bluez 5 - https://fedoraproject.org/wiki/Changes/Bluez5 18:22:24 My understanding of the process hasn't meant that they'd be removed from some list at beta freeze but the contingency plans enacted then. 18:22:27 if needd. 18:22:29 .fesco 1166 18:22:30 sgallagh: #1166 (F20 System Wide Change: Migrate to Bluez 5 - https://fedoraproject.org/wiki/Changes/Bluez5) – FESCo - https://fedorahosted.org/fesco/ticket/1166 18:22:50 We were explicitly going to check on this at Beta Freeze 18:23:14 this is done, we have BlueZ 5 in F20 and important users have been ported over 18:23:24 great 18:23:26 abadger1999: yes 18:23:40 kalev: That's great to hear 18:23:48 awesome 18:23:57 Excellent work. 18:24:03 * nirik still never looked at the split out applet. oh well. 18:24:31 Nothing to see here, moving right along... 18:24:33 #topic #1170 Working Group call for Volunteers 18:24:38 .fesco 1170 18:24:40 sgallagh: #1170 (Working Group call for Volunteers) – FESCo - https://fedorahosted.org/fesco/ticket/1170 18:24:50 So... nomination period is over. 18:25:26 I suppose it's time for us to at least volunteer for who is going to liase with each of the Working Groups. 18:25:55 Yes -- I think we should get the fesco members assigned 18:26:16 Given that my $DAYJOB is pretty much in perfect alignment with the Server WG, I volunteer for that role there. 18:26:17 and then those people should work with the list of candidates to select the initial membership 18:26:31 mattdm: Right, as agreed in the FESCo meeting two weeks ago 18:26:57 sgallagh right that second part was just restating 18:27:14 +1 sgallagh for server wg 18:27:34 do we need to have a full fesco vote on each of these? 18:27:46 +1 for sgallagh for server wg 18:27:56 +1 18:27:57 I'm inclined to suggest that we only vote if anyone objects to a volunteer. 18:28:08 as you wish 18:28:08 sgallagh: +1 to that 18:28:09 that sounds good to me. 18:28:19 I volunteer for Cloud WG 18:28:39 sure, sounds reasonable 18:28:40 surprise 18:28:43 I volunter for Stack&environment WG 18:28:43 :) 18:28:46 right :) 18:28:50 So one thing that came up two meetings ago that affects this is -- the scope of the Base design and the environments and stacks group. 18:28:56 if abadger1999 doesn't want it 18:29:24 mmaslano: yeah --trying to decide... I have a thought that we might want to have another group as well. 18:29:39 I think working out the scope is part of the process for each group 18:29:49 and for all of us here 18:30:53 abadger1999: I would take it, you already suffer on two meetings ;-) and it's close to my job anyway 18:30:57 mattdm: The thing I'm thinking of is that "how things are packaged" was brought up as an item that would fall under the scope of the WGs which wasn't really something I'd thought was in play there. 18:31:12 yeah 18:31:13 mmaslano: yeah -- if you wnt to lead, I think that would be good. 18:31:52 * mitr owns up to the "how things are packaged" 18:32:00 mattdm: After thinking about it-- I don't think it really falls under any of the working groups. 18:32:03 So "Base Design" and "Workstation" are left. 18:32:24 and it's a larger scope than FPC handles atm (beyond rpm packaging). 18:32:29 Or, more precisely, "what is a Linux application?" is, I think, a core are of the Base Design WG; I'd love to see if others view it differently. 18:32:35 I rather wish notting was here today, as I suspect he'd volunteer for the former. 18:32:37 I think we should create a new group for that. 18:32:38 notting for base design? 18:32:49 * abadger1999 would like to volunteer notting for base design too :-) 18:33:14 all this volunteering is for fesco leads? 18:33:16 or? 18:33:25 let's do that and then if he comes back and says "wait no" then we will revisit 18:33:25 jwb: For FESCo liason, yeah 18:33:28 jwb, yep 18:33:29 ok 18:33:33 coordinators... 18:33:35 abadger1999: I'd suggest putting a 1-year moratorium to creating more bureaucracy. We already have the problem of having established groups and not being precisely sure what their scope is, let's not make that worse. 18:33:38 He can read that as a vote of confidence or a vote of get-someone-else-to-do-that-work as he wishes :-) 18:33:38 Sure 18:33:40 basically provide reports back to fesco 18:33:50 mitr, +1 18:34:13 nirik, yeah. i just came in late, so i wanted to make sure it wasn't some bizarre in-person volunteering for being on the gruop 18:34:22 so the obvious problem we have here is this: nobody on FESCo works on desktop stuff, so nobody is volunteering for Workstation. 18:34:31 * nirik nods. 18:34:42 pjones, one could imagine a delegate would be acceptable. 18:35:01 #info notting was volunteered as co-ordinator for Base Design WG 18:35:06 jwb: i.e. the liason being /from/ the WG? 18:35:23 #info sgallagh has volunteered as coordinator for Server WG 18:35:31 #info mattdm has volunteered as coordinator for Cloud WG 18:35:51 pjones, yes. i mean, if nobody is comfortable doing the liason for the WG because of lack of experience in that area... not to knock anyone but it doesn't take a lot of experience to provide status to FESCo 18:36:01 #info mmaslano has volunteered as coordinator for Environments/Stacks WG 18:36:06 i could obviously be missing something 18:36:13 mitr: Only if you're fine with the FPC carrying that burden for now (talked with geppetto earlier and he felt FPC could carry that if needed so there was at least one other person who felt that could be done). 18:36:23 jwb: Well, the FESCo coordinator will be a voting member of the WG 18:36:38 so we want someone who will participate (and potentially be a tie-breaking vote) 18:37:10 abadger1999: In principle i'm not, in practice I don't expect things in this area to change for F21 so I don't care that much... 18:37:13 I was rather hoping that nirik would volunteer for this, since of all of us he has the most desktop experience (with XFCE) 18:37:50 sgallagh, forcing a voting member that doesn't understand what they're voting for sounds... well it sounds strange :) 18:38:06 well, I am low on time... and I don't know that the workstation product will have anything to do with xfce 18:38:08 sgallagh: ... which arguably either makes him most or least qualified ;) 18:38:39 mitr: k. then we can call it a compromise until we are ready to get a new group formed :-) 18:38:40 sgallagh, i understand the intentions, i really do. sometimes things don't work out perfectly 18:38:44 pjones: I'm willing to say that having a non-GNOME voice on that WG would be a good sign that it's not going to be "Whatever GNOME upstream does" 18:38:47 so, if we could find someone more involved I think it might be better... 18:39:14 sgallagh: ... or signs them up for an exercise in endless frustration? 18:39:19 nirik: who else from fesco? 18:39:31 mitr: They're already on FESCo. Plenty of practice. 18:39:59 sgallagh: or that they will be continuously pushing round rocks uphill :-) 18:40:10 I don't think the person necessarily needs to be involved with the development as long as they're involved in the fedora community and are willing to _become_ involved in the topic enough to contribute 18:40:33 mattdm, yes, fair 18:41:06 sure, which means more time... :) 18:41:14 but that still apparently leaves us stuck :) 18:41:18 i see everyone now jumping at once with mattdm's clarification. 18:41:24 :) 18:41:28 nirik yes -- it's definitely a time commitment 18:42:23 so, for that would we consider a non fesco coordinator? 18:42:29 Ok... does anyone want to vacate their chair and make room for a new member? 18:43:17 again don't everyone jump at once :) 18:43:29 * abadger1999 thinks that as long as fesco is elected we'll need to cross nirik's bridge eventually. 18:43:42 "nirik 18:43:45 's bridge"? 18:43:47 Actually, I have an important question: with the schedule delay, are we pushing back the elections cycle as well? Or should we be concerned about one of these coordinators being booted next month? 18:44:02 * pjones nominates jwb 18:44:07 mattdm: having non-fesco WG liasons/coordinators. 18:44:17 abadger1999: I really think you're right. 18:44:29 I think we should push back the elections as well. 18:44:40 abadger1999, +1 18:44:45 abadger1999: I'm inclined to agree, until at least after the WG report-out 18:44:54 Although I *think* that may need to come from the Board. 18:45:14 What about giving the non-fesco WG coordinator voting power in FESCo for topics related to the WG? 18:45:17 I think that does have to come from the board, but I think it's a reasonable thing for us to request from them. 18:45:23 well I always wanted to have fesco aligned with release 18:45:39 yes, I don't think fesco should have the ability to unilaterally declare ourselves president for life 18:45:43 but +1 to asking for it 18:45:50 wait, which thing are you asking the board about? 18:45:58 elections or non-fesco WG liasons? 18:46:00 jwb: Moving the elections 18:46:07 fesco elections 18:46:10 oh, ok. i don't find that unreasonable 18:46:11 mattdm: fwiw yeah that sounds very odd to me 18:46:27 mattdm: in theory fesco could always "push back the elections" and never get relected 18:46:54 Yeah, I suggest we ask the Board for a one-time push until after WG report-out, lest we end up doing this dance again then 18:46:56 except nobody on fesco seems to think we can ;) 18:47:07 though tbh, i don't think there's anything that says the board has to approve changes to the fesco election cycle/composistion 18:47:17 so, I'm okay with non fesco wg liason _or_ with someone stepping down and electing that position 18:47:30 Anyway, back to the original issue: jwb are you volunteering for the Workstation WG as non-FESCo coordinator if we opted for one? 18:47:46 * nirik wonders if kalev might be willing if we are looking for non fesco 18:47:48 Partly joking 18:48:03 Ah, yeah kalev might be a good choice 18:48:05 i would do it if needs be. you might also ask mjg59, who has dealt with more of that area than i 18:48:09 or kalev 18:48:24 but yes, i would volunteer if a more suitable person wasn't found 18:48:26 Or possibly Marina? 18:49:02 sgallagh: who? 18:49:16 I think either of the former-FESCo members (jwb, mjg59) would be completely reasonable choices. 18:49:22 mitr: http://blogs.gnome.org/marina/ 18:49:44 sgallagh: I'd rather somebody who has more history with fesco. 18:50:07 mjg59 had some strong feelings about the direction of the product in the board meeting 18:50:25 mattdm: and also some history working with e.g. gnome successfully. 18:50:58 Not that I don't like anyone here, but if someone was tired of their role in FESCo, having the community vote for a replacement that would fill this role as well might be a good move. 18:51:27 * nirik notes jwb then kalev were the two runners up in the last election. 18:52:24 I think any of these proposals would work. (Which is nice, but doesn't help make a decision.) 18:52:40 nirik: good point 18:52:55 I'm happy to do it 18:53:07 But obviously this is a fesco decision 18:53:32 proposal: FESCo would like jwb to coordinate the workstation WG. 18:53:53 mitr: +1 18:54:04 * nirik is +1 to mitr's proposal provided jwb wants it. ;) 18:54:05 If we have to decide, let's stop dancing around it... 18:54:15 i said i would 18:54:23 ok, great 18:54:41 great 18:54:42 no offense intended to jwb, but I'd rather hear kalev turn it down first. 18:54:53 mitr: +1 18:55:11 sgallagh: why? we have a volunteer who seems to be a perfectly reasonable person to do it? 18:55:26 perhaps sgallagh is trying to save me suffering. 18:55:28 :) 18:55:37 jwb: I do owe you a favor for the krb5 fixes 18:55:59 anyway, you have two people who said they'd do it (me and mjg59). if you want kalev to do it that's fine with me. just let me know 18:56:05 i just want things to progress 18:56:09 Yeah, me too. 18:57:08 Ok, I'm +1 for jwb as well 18:57:21 I am +1 too in case that wasn't clear 18:57:36 assuming mitr is +1 that's +6 18:57:42 * mitr is +1 for the record 18:57:48 pjones: wouldn't mclasen fit best in your description? 18:58:06 drago01: did mclasen volunteer for the job? 18:58:29 sgallagh: not that I am aware off just done reading scrollback 18:58:59 (sgallagh: to be fair he wasn't given a chance) 18:59:13 this isn't a lifetime job, in any case. 18:59:27 +1 to jwb 18:59:35 my feelings will not be hurt if someone more suitable is found 18:59:50 mitr: I don't think that's a fair statement. jwb and mgj59 both showed up and mentioned they'd be willing to do it. 19:00:08 +1 for jwb 19:00:08 Do we want to send a message to the devel list and ask for volunteers? 19:00:22 although sometimes showing up at an irc meeting doesn't match with timezones and schedules and whatever else 19:00:27 no. we don't need to find the best person ever. we need to find somebody good enough and willing. 19:00:31 * nirik thinks we approve jwb and move on 19:00:32 pjones: you're right 19:00:32 Given that we're selecting outside of FESCo in any case, it seems limiting to only pick people who happened to come to the meeting 19:00:43 look, if it makes it easier you can call me interim coordinator and do the call 19:00:45 nirik: yes 19:00:51 mattdm: having available time during the time FESCo meets is somewhat of a precondition 19:01:16 otherwise we'll hit sgallagh's two hour limit ;-) 19:01:19 jwb: Well, the first order of business is to select the rest of the group 19:01:37 jwb: So it seems a little obnoxious to let you pick the WG and then dump it on someone else :) 19:01:49 is there a deadline set for that? 19:01:52 If we go with you, it's you until January 19:02:00 Not yet, that was going to be the next order of business. 19:02:19 ok 19:02:24 I was originally going to suggest that the coordinators prepare their lists for ratification at next week's meeting 19:03:42 to be clear, picking the group is much sooner than january. 19:03:49 like, something for the next two weeks. 19:03:51 Right 19:04:02 there's nothing listed about numbers either, correct? 19:04:07 number of members i mean 19:04:33 Proposal: Ask the volunteers listed on the WG_Nominations page if any of them want to be the non-FESCo coordinator and select from that list next week. Ratify working groups in the meeting after that one. 19:04:37 jwb: correct. 19:04:48 I thought we agreed on nine, was I imagining that? 19:05:14 well, 8 19:05:17 sgallagh: yeah -- we tossed numbers around but never said you shall be nine, no more no less. 19:05:24 if we have a coordinator taking one slot already 19:05:24 Right, eight besides the coordinator 19:05:33 the wiki pages (which i've been following) make no mention 19:05:45 jwb: It was discussed in the meeting two weeks ago 19:05:57 I think we may not have come to an agreement on that, though 19:06:05 and you didn't update the wiki pages ;) 19:06:05 sgallagh: oooh... or perhaps we said the wg should determine how many were in its final going-forward form. 19:06:13 whereas this is an initial seed. 19:06:16 abadger1999: Yeah, I think that's what it was. 19:06:25 Nine to bring the ring to Mordor... 19:06:26 8 voting members and so many as want attend? 19:06:26 19:06:30 sgallagh: yeah 19:06:45 mmaslano yes, absolutely want to encourage non-voting-member participation 19:06:55 yes. +100 19:07:04 Unreservedly, yes 19:07:16 everything should default to open, public meetings and discussion and input from anyone who wants in the community 19:07:17 okay, so: proposal: working groups will have 9 initial voting members, including fesco coordinator 19:07:27 mattdm: +1 19:07:28 sure, +1 19:07:29 mattdm: +1 19:07:37 mattdm, +1 19:07:38 mattdm: you write faster, +1 19:07:41 mattdm: +1 19:08:13 Assuming mattdm is +1 to his own proposal, that's +7 19:08:14 +1 (I don't care let's stop talkig about this) 19:08:28 #agreed working groups will have 9 initial voting members, including fesco coordinator (+8, 0, -0) 19:08:56 Ok, so can we vote on my proposal? A +1 indicates waiting a week to find a Workstation coordinator, a -1 means select jwb as we already voted. 19:09:06 -1 19:09:10 We can vote on the second half (timing for group selection) separately. 19:09:14 -1 19:09:16 I'm +1 19:09:22 let's get to having the working groups selected by next week already :-) 19:09:24 Let's start getting things done 19:09:43 -1 19:09:45 I'm in favor of jwb as coordinator _and_ of moving on, but I want to make sure we have a fair, transparent process 19:09:53 so +1 19:10:20 +2,-3 thus far 19:10:45 mattdm, read the vote question you may want to change your vote 19:11:06 -1 19:12:12 +2, -4. mmaslano? t8m? 19:12:15 sgallagh: as I read that, your proposal is not going to get enough votes to pass with the current number of people present. 19:12:23 yes 19:12:23 at best it could tie. 19:12:27 sgallagh: I was waiting for proposal, which I can parse 19:12:38 -1 19:12:53 Ok, with -5 we go with jwb 19:13:21 mmaslano: Sorry, the idea was to spend a week looking for other volunteers before making a decision. It did not pass 19:13:55 #agreed Proposal to defer a week to seek other volunteers for Workstation WG coordinator fails (+2, 0, -5) 19:14:14 Next proposal: Initial working groups due next FESCo meeting for ratification 19:14:43 yeah, I think that would be nice. 19:14:48 sure, +1 19:14:51 jwb: Sorry for your loss :-P 19:15:10 i'm a big boy. i'll be fine 19:15:15 +1 19:15:36 +1 19:15:49 +1 (for the record) 19:15:55 +1 if it wasn't clear above 19:15:58 * mattdm looks at calendar 19:16:03 okay +1 let's do it 19:16:10 +1 19:16:27 +1 19:16:43 #agreed Initial working groups due next FESCo meeting for ratification (+8, 0, -0) 19:16:53 Ok, let's put this topic to rest for today 19:17:02 New business! 19:17:09 #topic #1181 Fedora still vulnerable to BEAST 19:17:13 .fesco 1181 19:17:14 sgallagh: #1181 (Fedora still vulnerable to BEAST) – FESCo - https://fedorahosted.org/fesco/ticket/1181 19:18:07 So we have a known security vulnerability in Fedora that's unpatched because it negatively impacts unknown programs. 19:18:36 (One program, pidgin-sipe is listed, others are suggested but not named) 19:18:47 I'd rather prefer making TLS1.2 default in nss in Fedora 19:19:02 t8m: versus what? 19:19:05 this solves BEAST as well 19:19:14 as I understand it, the security team is in favor of patching it now and fixing any problems in the packages as they come up 19:19:18 sgallagh: versus taking the patch again 19:19:19 versus the fix for BEAST which is a hack 19:19:30 t8m: Ok 19:19:43 Are the two moves mutually-exclusive? 19:19:47 nope 19:20:07 . 19:20:12 the better question is: is moving to TLS1.2 by default enough, or do we also need to disable TLS1.0? 19:20:21 Proposals: 1) Re-apply the patch and ask maintainers to fix their packages. 2) Change the default to TLS 1.2 19:20:28 I'm +1/+1 19:20:42 pjones, of course you'll be still vulnerable to beast if the TLS1.0 is negotiated 19:20:42 sgallagh: could we talk about this for long enough to have an understanding before making and voting on proposals? 19:20:55 2) isn't that simple, I think it might require per-application patches again (t8m?) 19:21:18 mitr, nope no application patches I think 19:21:19 proposal: tell maintainer we want beast fixed, even if it causes problems for some fringe package, ask them to figure out the best way to do that. 19:21:37 _what_ would be change to default to tls 1.2? is that just changing the library? 19:21:41 * nirik is trying to do as little micromanaging as possible 19:21:46 Note that the BEAST issue/broken applications have been around for almost two years. If application patching hasn't happened by itself so far, I don't think we should assume that it will happen by itself now. 19:22:07 nirik: that appears to have already happened and /unhappened/ which is why this is here now? 19:22:19 +1 nirik 19:22:31 mitr: I'm willing to say that if they don't fix themselves, it's not our problem. 19:22:31 the problem is that the fix breaks applications/protocols interoperability so I can understand why nss devs do not want it 19:22:43 mitr: drop packages that won't fix? isn't that the normal Fedora procedure? 19:22:46 pjones: well, the maintainer didn't think beast fixing was important enough to break some apps, but we do? or do we? 19:22:57 abadger1999: drop them within F18/F19? The bug suggests that F20 is already OK 19:23:04 nirik: I don't think we've answered that yet. *I* do. 19:23:06 nirik security team does 19:23:29 sgallagh: In principle, yes. (Change page for F18 :-)?) 19:23:32 * nirik does too. Sorry pidgin-cipe. ;) 19:23:44 sipe. 19:25:05 t8m: hrm. so either way breaks compatibility then, since we effectively need to either a) do this hacky patch, or b) disable TLS1.0 19:25:31 pjones, the severity of BEAST attack is very low 19:25:43 can tls1.0 be renabled by individual applications that want to be insecure? 19:25:45 Given the schedule, I think requiring this for F18 is not really worth it. 19:25:58 t8m but BEAST sounds very scary! 19:26:01 mitr lol 19:26:19 mattdm: That's what the bug asks for - fixing this in f18 and f19 19:26:37 mattdm: It's also a matter of interoparability; deployment of 1.2 is not that widespread 19:27:01 If I may... 19:27:06 Sparks: Please 19:27:50 implementing TLSv1.2 is a great idea but won't fix BEAST since many servers only support TLSv1.0 as their high end. 19:28:29 Disabling TLSv1.0 fixes BEAST (kinda) but leaves us with not many options for establishing a circuit since TLSv1.1 and 1.2 aren't really out there. 19:29:41 BEAST is low, right now, because most servers "fixed" it by using an awful encryption option: RC4. We're trying to get away from the bad cipher now but that introduces the BEAST problem when the clients aren't "fixed". 19:30:00