02:56:00 <brainycmurf> #startmeeting Workstation WG (2023-05-16)
02:56:01 <zodbot> Meeting started Wed May 17 02:56:00 2023 UTC.
02:56:01 <zodbot> This meeting is logged and archived in a public location.
02:56:01 <zodbot> The chair is brainycmurf. Information about MeetBot at https://fedoraproject.org/wiki/Zodbot#Meeting_Functions.
02:56:01 <zodbot> Useful Commands: #action #agreed #halp #info #idea #link #topic.
02:56:01 <zodbot> The meeting name has been set to 'workstation_wg_(2023-05-16)'
02:56:01 <brainycmurf> #meetingname workstation
02:56:01 <zodbot> The meeting name has been set to 'workstation'
02:56:01 <brainycmurf> #chair Allan
02:56:01 <zodbot> Current chairs: Allan brainycmurf
02:56:26 <brainycmurf> #info Present members: Matthias, Tomas, Chris, Owen, Allan, Jens, Kalev, Michael
02:56:27 <brainycmurf> #info Guests:
02:56:27 <brainycmurf> #info Regrets: Neal
02:56:27 <brainycmurf> #info Missing:
02:56:27 <brainycmurf> #info Secretary: Owen
02:56:27 <brainycmurf> #topic Suggest upgrading KDF (Key Derivation Function) for encrypted drives
02:56:29 <brainycmurf> #link https://pagure.io/fedora-workstation/issue/372
02:56:31 <brainycmurf> We have new information in the ticket.
02:56:33 <brainycmurf> - Owen: I don't fully agree with mbroz's comment on the ticket (people do have "weak" passphrases), but we shouldn't proceed without mbroz's approve
02:56:36 <brainycmurf> #action: owen to comment on ticket
02:56:38 <brainycmurf> #topic encryption of user data (excludes system)
02:56:40 <brainycmurf> #link https://pagure.io/fedora-workstation/issue/82
02:56:44 <brainycmurf> #link https://discussion.fedoraproject.org/t/future-of-encryption-in-fedora-desktop-variants/80397
02:56:47 <brainycmurf> #link https://hackmd.io/j0rQLW8mQ1uFKELZNliORQ?view
02:56:49 <brainycmurf> Summary of the Discourse discussion:
02:56:51 <brainycmurf> * A lot of the discussion was about how to bind the passphrase to the TPM. Doesn't necessarily change the overall plan.
02:56:54 <brainycmurf> * One takeaway: we can't go ahead with this until we know what will be used for the next gen bootloader. Our plan wouldn't be possible with grub2.
02:56:57 <brainycmurf> * fscrypt - discussion about whether it provides privacy. It doesn't encrypt metadata. In most cases people don't care about that, but in some situations they might.
02:57:00 <brainycmurf> * Recent bootloader discussion about opening an untrusted Btfrs filesystem.
02:57:02 <brainycmurf> * Lennart advocated for homed. Owen - one issue is that homed doesn't allow remote login. However, there may also be issues with remote login with the btrfs/fscrypt plan.
02:57:05 <brainycmurf> * One positive - we didn't get much push for entire disk encryption. People seemed comfortable with the separate approaches to / and ~/.
02:57:08 <brainycmurf> Owen is more positive about homed than previously, since it provides a place to add code and provides options for encryption rather than rolling our own solution.
02:57:11 <brainycmurf> We'd need a way to have centrally managed account details and local home directories.
02:57:15 <brainycmurf> We're still waiting for btrfs-fscrypt to land upstream. Could happen this year?
02:57:17 <brainycmurf> We should dig more into homed - what would our list of requirements be to make it work?
02:57:19 <brainycmurf> Are we leaning more towards fscrypt or homed? Owen is still leaning more towards fscrypt, but wants to investigate the unenypted btrfs filesystem security concern. Lack of metadata encryption is a little bit of a concern.
02:57:23 <brainycmurf> We could do homed+fscrypt. That would give us more flexibility, so the same approach could be used without btrfs.
02:57:26 <brainycmurf> Michael - filesystem code has to be trusted. Filesystems hacking the kernel is not OK.
02:57:28 <brainycmurf> #action Owen  to identify homed requirements and try to move that side of things forward.
02:57:30 <brainycmurf> homed has implications for user manaagement in GNOME - it would require changes there.
02:57:32 <brainycmurf> homed can lock home while the system is suspended. Would require changes to how the lock screen works. This might not be necessary initially.
02:57:35 <brainycmurf> #topic append commands to bash history instead of overwriting
02:57:37 <brainycmurf> #link https://pagure.io/fedora-workstation/issue/364
02:57:39 <brainycmurf> Chris is proposing to drop this proposal. Anything more to say before we do that?
02:57:41 <brainycmurf> Chris considers his understanding of Bash insufficient push back against the detailed feedback he got on the mailing list - it would have to be advocated by a Bash expert.
02:57:46 <brainycmurf> Michael thinks that we shouldn't avoid making a change that helps most users to avoid causing negative effects for users - we could have a subpackage that enables it (installed or not installed by default).
02:57:49 <brainycmurf> #action Michael and Chris will prepare a change proposal based on the idea of making this a drop-in #link https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/JNA5OVGRVEL5WQKYNMBKANTT5NO2Q4ME/
02:57:53 <brainycmurf> #topic can we have wifi macid randomized by default
02:57:55 <brainycmurf> #link https://pagure.io/fedora-workstation/issue/350
02:57:57 <brainycmurf> Seems like we need a consensus on the NetworkManager side. Can someone push it forward?
02:57:59 <brainycmurf> Currently some NetworkManager-side disagreement about how it is handled.
02:58:01 <brainycmurf> #action Michael to ask thaller if he can proceed based on his idea (of changing the defaults in the NetworkManager configuration)
02:58:04 <brainycmurf> #topic Move Fedora bookmarks to Fedora start page
02:58:06 <brainycmurf> #link https://pagure.io/fedora-workstation/issue/313
02:58:08 <brainycmurf> Action has been waiting on Neal for 10 months. Do we want to pass it on?
02:58:10 <brainycmurf> #action Deferred
02:58:14 <brainycmurf> #topic GUI-based recovery environment
02:58:16 <brainycmurf> #link https://pagure.io/fedora-workstation/issue/288
02:58:18 <brainycmurf> This seems to have stalled. Do we want to reboot it, or put it on the backlog?
02:58:20 <brainycmurf> #action Deferred
02:58:22 <brainycmurf> #topic Announcements and status updates
02:58:24 <brainycmurf> The minutes from last meeting have been posted online:
02:58:26 <brainycmurf> #link https://meetbot.fedoraproject.org/fedora-meeting-2/2023-05-10/workstation.2023-05-10-23.43.log.html
02:58:29 <brainycmurf> - Now are nightly Flatpaks of GNOME incubator apps
02:58:31 <brainycmurf> - Some action on Console vs. Workstation requirements after publicity via https://blogs.gnome.org/mcatanzaro/2023/05/10/gnome-core-apps-update/
02:58:34 <brainycmurf> - EOL of Fedora 36 today
02:58:36 <brainycmurf> #endmeeting