19:01:11 <jsmith> #startmeeting Fedora Board IRC Meeting (open office hours)
19:01:11 <zodbot> Meeting started Fri Nov 12 19:01:11 2010 UTC.  The chair is jsmith. Information about MeetBot at http://wiki.debian.org/MeetBot.
19:01:11 <zodbot> Useful Commands: #action #agreed #halp #info #idea #link #topic.
19:01:16 <jsmith> #meetingname Fedora Board
19:01:17 <zodbot> The meeting name has been set to 'fedora_board'
19:01:44 <jsmith> #topic Roll Call of Board Members
19:01:52 * mdomsch 
19:02:07 <jsmith> Looks like we have mdomsch, ctyler, jds2001, smooge, and myself so far
19:02:50 <jsmith> Just a reminder that we use the protocol listed at https://fedoraproject.org/wiki/Board_public_IRC_meetings to help keep the conversation clear and focused
19:02:54 <smooge> I am sort of here. dealing with som einfra structure issues
19:03:09 <jsmith> Thanks smooge
19:03:38 <jsmith> #topic Open questions and answers
19:05:24 <jsmith> OK, if you've got a question, type a question mark, and we'll call on you in turn
19:05:41 <jsmith> If you've got a comment on the existing question, type an exclamation mark
19:06:36 <jsmith> Any questions?
19:06:54 <aTypical> <crickets />
19:07:39 <jsmith> Welcome rdieter :-)
19:07:41 <rdieter> hola
19:08:10 <jsmith> rdieter: No questions so far -- nice and easy Friday I guess :-)
19:09:10 <rdieter> so, why do we hate ninja's so much? esp sqlninja's.  I thought ninja's are supposed to be cool.
19:09:13 <ricky> ?
19:09:24 <enth> good question.
19:09:37 <enth> Ninjas need software support too.
19:11:26 <enth> lots of people ask for help in #fedora-social, how on earth do they run into #fedora-social before they find #fedora
19:11:44 <jsmith> That's a good question... I'm not sure.
19:12:02 <rdieter> #fedora requires nick registration, does #fedora-social too?
19:12:09 <EvilBob> rdieter: no
19:12:16 <enth> figures
19:12:57 <rdieter> so, it's likely just a barrier of entry kind of thing
19:13:05 <rdieter> for better or worse
19:13:37 <jsmith> Probably so...
19:13:51 <nirik> enth: it's not really all that common in my experence... but sure it happens. People also ask for end user support in other #fedora-* channel.
19:14:00 <EvilBob> rdieter: It cuts down the part/join noise a lot
19:14:01 <jsmith> I guess we could investigate having Freenode push unregistered users to something like #fedora-unregistered
19:14:06 <jebba> ?
19:14:14 <jsmith> jebba: Go ahead
19:14:20 <EvilBob> jsmith: that is what we do now
19:14:28 <DiscordianUK> We  do from #fedora, jsmith
19:14:32 <jsmith> EvilBob: Ah... great minds think alike :-)
19:14:42 <lenovolkan> how can i register #fedora channel?
19:14:46 <jsmith> jebba: Did you have a question?
19:14:57 <jebba> since it's so quiet in here, i thought i'd just ask/mention:  I built a bunch of updated f13 RPMS for the secondary mips architecture (which is having a bit of  a comeback under yeeloong in china).
19:14:59 <EvilBob> jsmith: We also have a bot that gives very clear instructions
19:15:04 <EvilBob> lenovolkan: ^^
19:15:05 <jsmith> lenovolkan: http://www.wikihow.com/Register-a-User-Name-on-Freenode
19:15:19 <jebba> So I just uploaded them to my fedorapeople account. I had built them all under mock.
19:15:26 <smooge> cool jebba where can I get hardware :)
19:15:31 <EvilBob> It is also covered in the channel topic
19:15:32 <jsmith> jebba: That's wonderful!  Keep up the good work on secondary architectures!
19:15:37 <jebba> Now I am getting set up koji under mips for fedora 14.
19:15:38 <EvilBob> the bot sends "You are here in #fedora-unregistered because you are not identified with freenode. Please: a) register - http://freenode.net/faq.shtml#nicksetup (including email step) b) configure your client to identify - http://freenode.net/faq.shtml#identify and/or /msg nickserv identify then c) /join #fedora for support."
19:16:01 <jebba> the fedora-mips list and channel are pretty dead, and the guy that did the f13 initial port is mostly MIA.
19:16:08 <ricky> ?
19:16:25 <jebba> So, coming to my question, if I beat koji into submission and finally get it spitting out RPMS, where should I put them. ;)
19:16:42 <jebba> ?   (i realize this may not just be for the board, but well, it's quiet here and you probably know!)
19:16:56 <jsmith> jebba: Work with the infrastructure team and the release engineering team -- they'll find a good home for them
19:17:03 <jebba> smooge: you can get the hardware here: http://freedomincluded.com/
19:17:03 <jsmith> ricky: You're next :-)
19:17:12 <jebba> smooge: and http://tekmote.nl in europe
19:17:23 <jsmith> => ricky
19:17:26 <ricky> From the meeting notes, I got the impression that the rejection of sqlninja wasn't really an application of the new legal text, but more of a specific one-off decision - does the board really want to be in the position of making packaging individual decisions as opposed to just writing/applying the policies behind these decisions?
19:18:01 <smooge> jebba, work with dgilmore. He startedfooling around on mips before his vacation
19:18:17 <ricky> s/packaging individual/individual packaging/
19:18:21 <jsmith> ricky: In general, no.  When they need legal review, however, it's important for the Board to be able to evaluate them on their individual merits.
19:18:33 <jebba> smooge: ok thx.
19:18:55 <jsmith> ricky: In this case, the packager marked it as blocking on fedora-legal, as I understand it
19:19:01 <smooge> speaking of which the decision has made the Register and the H :)
19:20:13 <jsmith> I'll be honest -- one of the things I like about Fedora is that we're more than just a collection of packages
19:21:11 <enth> kind of a st!pit question but: are there wiki pages for a list of packages installed by default in every distro?
19:21:18 <ricky> Followup: What are current thoughts for other security packages that have similar offensive capabilities?  I'd like/hope to see this decision deferred until sqlninja is revisited as spot mentioned
19:21:38 <jsmith> enth: Not that I'm aware of
19:21:40 <ricky> enth: You can probably generate one from the comps files - people in #fedora-devel might know a little better
19:22:03 <ricky> (I also wouldn't have minded seeing the sqlninja decision deferred too, though)
19:22:22 <jsmith> ricky: Well, sqlninja hasn't even undergone a package review -- so I'm not sure what deferring the decision would do
19:23:00 <rdieter> ricky: as far as I'm aware, sqlninja is the only one that gets close to being unacceptable.  there are no intentions or plans to take this any further
19:23:10 <ricky> I assume it'd give spot a chance to talk with legal some more and get a little more data on what the legal risk to distributors is
19:23:12 <rdieter> esp for any content currently in fedora
19:23:24 <rdieter> ricky: +1, yeah
19:23:39 <jsmith> ricky: I think it's pretty safe to assume he'll be talking to them more :-)
19:23:50 <ricky> Can't resist :-) http://nmap.org/ncrack/
19:23:56 <ricky> The recent press has found some more as well
19:24:23 <ricky> Of course, their website is nicer, but I think the intended audience and purpose is the same
19:25:22 <smooge> yes there are quite a few that probably make sqlninja look like childs play. the issue comes down to how do they present themselves.
19:25:32 <jsmith> Again, it's a gray area between software that has redeeming qualities as a security tool and software that's simply a script-kiddie's tool
19:26:06 <rdieter> true, in fairness to sqlninja that I hadnt noticed prior, its site does include the text "It should be used by penetration testers to help and automate the process of taking over a DB Server when a SQL Injection vulnerability has been discovered."
19:26:28 <ricky> I'll also note that the sqlninja author is a security professional: http://uk.linkedin.com/in/icesurfer.  He might be offended by people calling sqlninja a script kiddy tool :-)
19:26:29 <jsmith> I've said this before, but I'll paste it again (since I have it handy): There are *several* questions that we must ask ourselves:
19:26:36 <jsmith> * Does the application have the potential to increase our legal
19:26:37 <jsmith> liability in a significant way?
19:26:37 <jsmith> * Does the application have significant legitimate uses outside of
19:26:37 <jsmith> attacking a system?
19:26:37 <jsmith> * How does the application market itself?  As a security tool?  As an
19:26:37 <jsmith> easy way to exploit others?
19:26:39 <jsmith> * How difficult would it be for knowledgeable security professional to
19:26:41 <jsmith> build, versus an unskilled script-kiddie?
19:26:43 <jsmith> * Is this an application that could be easily hosted in a third-party
19:26:47 <jsmith> repository instead of Fedora?
19:26:53 <mizmo> ricky, his email address is leet speak...
19:27:16 <mizmo> he goes by a pseudonym
19:27:30 <jsmith> In the case of sqlninja, I understand it's already in one of the more popular 3rd-party repos, so it's not hard for people to find
19:27:56 <mdomsch> we're approaching 10k packages in the repos.  I don't mind if one questionable package doesn't make that 10k+1
19:28:04 <ricky> That's a really harsh way to pass judgement on the author based on his userames :-(
19:28:22 <walters> one question i have is would we remove a package like this if it got in (i.e. it didn't happen to get flagged during review)
19:28:33 <DiscordianUK> mizmo : linkedin gives his name as Alberto Ravelli which given he was educated in Italy seems likely to be his real name
19:28:37 <jsmith> ricky: Did you see "is their email address leetspeak" in my list above?  I think mizmo was being funny :-)
19:28:39 <ricky> Personally, I think the only questions that matter are: 1) is there a legit use, 2) what is the legal risk to Fedora/Red Hat
19:28:58 <mizmo> DiscordianUK, his real name is 'icesurfer'?
19:29:14 <DiscordianUK> No but mine isn't DiscordianUK either
19:29:29 <mizmo> 'Alberto Ravelli' doesn't appear anywhere i can find on the website
19:29:43 <rdieter> ricky: or just mostly 2.
19:29:43 <DiscordianUK> on the linkedin page
19:30:01 <mizmo> how do you know the linked in is the same person?
19:30:10 <EvilBob> Just because my nick is EvilBob does not mean that anything I do is Evil, but that does not change unreasonable attitudes.
19:30:12 * rdieter thinks the authors name, handles, email addresses have no place in this discussion either
19:30:22 <jsmith> Ok, we're over our eight-minute limit for the sqlninja question -- move on, or extend?
19:30:26 <smooge> rdieter, I agree
19:30:27 * DiscordianUK points at ricky's earlier comment
19:30:31 <mizmo> it may well be him, but if he wants to come off as a security professional the sqlninja website does not show that at all
19:30:31 <mdomsch> it's not about the author
19:30:50 <ricky> Just saying that I don't think that easy for the board to just decide whether a tool is targetted at script kiddies or not
19:30:50 <smooge> making it about the author is not helping.
19:31:08 <EvilBob> mdomsch: Apparently it is to some
19:31:09 <jsmith> ricky: Who said it was easy?
19:31:12 <ricky> I could ask the author who his target audience is, and I'm pretty sure I'd get a different answer
19:31:31 <rdieter> ricky: the delicate point is that it no only identifies vulnerabilities, that it takes advantage of them.  imo
19:31:39 <ricky> As in - it's so hard that maybe that shouldn't be the way the decision is made :-)
19:31:39 <DiscordianUK> Yes
19:31:41 <mizmo> i'm sorry, i think it's a valid point that the author of the code referring to himself only in leet speak and obviously made-up handles gives a certain impression.
19:31:50 <ricky> There are legitimate programs used by security researchers that do this
19:31:53 <mizmo> im not in any way insinuating that's why the decision was made
19:31:54 <ricky> metasploit is a popular one, for example
19:32:14 <ricky> It's a framework for generating and running exploits
19:32:23 <EvilBob> Perhaps he uses a pseudonym because of his employment
19:32:28 <DiscordianUK> Most of the stuff on the backtrack isos falls in the same category
19:32:32 <rdieter> ricky: is that in fedora?  I can't find it
19:32:47 <ricky> I know of college classes that use metasploit - it'd be a shame if software like that was rejected too
19:32:56 <ricky> rdieter: It's not - it's a mess of bundled libs, unfortunately
19:33:05 <mizmo> ricky, how much of a hardship is it if you have to get it from a 3rd party repo?
19:33:06 <DiscordianUK> The linkedin page acknowledges he is the author of sqlninja and tells you he works for Cigal Inc in the UK
19:33:08 <rdieter> ricky: ok, we'll tackle that when the time comes
19:33:25 <ricky> It's not so about hardship in getting the program as much as it is about the precendent that the decision sets
19:33:27 <mizmo> DiscordianUK, i can create a linked in page and say i built the brooklyn bridge and work for nasa on it
19:33:39 <DiscordianUK> Well yes you could
19:33:59 <rdieter> I'm starting to think that the "it's easy to get elsewhere" criterion is a bit weak.  I'd rather not try to use that as a justification for anything
19:34:10 <mizmo> ricky, the precedent that legally risky packages are not worth having in the main repo?
19:34:14 <ricky> Which is why I don't think "ease of alternative ways of getting it" is a big consideration
19:34:45 <mizmo> ricky, it's kind of a hard decision, potentially get sued and be really easy to install, don't get potentially sued and be only slightly more difficult to install
19:34:47 <ricky> mizmo: The core issue is that we disagree on whether it's legally risky enough to warrant blocking it
19:34:57 <mizmo> is this risk high enough, is the application worth the risk identified
19:35:00 <ricky> Which is why I was happy to see spot mention revisiting once this after talking more with legal
19:35:11 <DiscordianUK> The situation with libdvdcss then?
19:35:14 <ricky> *Everything* has legal risk involved - the question is how much is worth it and how much isn't
19:35:20 * jsmith reminds people that we're *way* over the eight minute mark
19:35:33 <ricky> Sorry :-)
19:35:36 <mizmo> ricky, the website for the application unfortunately doesn't inspire confidence in the legal risk involved compared to other penetration testing tools' websites
19:35:46 <stahnma> ?
19:35:56 <jsmith> Moving on to stahnma's question
19:36:17 <jsmith> (please continue the sqlninja discussion on the advisory-board list)
19:36:47 <stahnma> Who from the Fedora board, or anybody in the Fedora community, is consulted about what packages make it into RHEL?  And if it's anybody, is there a process for it?
19:37:13 <jsmith> That's a good question, and one that I don't know the answer to
19:37:32 <jsmith> I have no idea how Red Hat decides which packages to put into RHEL
19:37:35 <mdomsch> stahnma: RHEL has its own feature process.  Red Hat partners and customers have influence into what package sets wind up in the product
19:37:56 <mdomsch> and they look first to what Fedora has done
19:38:11 <EvilBob> stahnma: Why should that be any of fedora's business?
19:38:13 <mdomsch> as an example, there is a Fedora bugzilla to track getting the CIM / WS-MAN stacks into Fedora
19:38:16 <mizmo> if something that hasn't been in RHEL is considered to be added to RHEL, and is in EPEL, i know Red Hat messages the EPEL maintainers to let them know
19:38:32 <mdomsch> there is a duplicate feature request for that same stack to be included in RHEL
19:38:38 <stahnma> The main reason I ask, is that as a large customer, I found the best way to get influence and understanding of RHEL was to work heavily in Fedora/EPEL. However, there are still (at least to me) obvious gaps in what package make it into RHEL and wondered if there some weird criteria for that
19:38:48 <stahnma> mizmo: that's not always the case
19:38:53 <mdomsch> once the dev was done in Fedora and proven worthy, it dropped into RHEL
19:39:12 <jsmith> stahnma: In that case, it might be better to ping Red Hat directly to request it in parallel to following it in Fedora
19:39:15 <mizmo> stahnma, it happens but i dont know if it happens all the time
19:39:30 <stahnma> I also wasn't sure if it was a great question here, but I figured i'd give it a try
19:39:31 <stahnma> :)
19:40:14 <stahnma> mizmo: it was better for el6, but we're still quite confused on the producitivty channels, optional channels, setting up the builders etc for EPEL
19:40:31 <stahnma> I mean it will work out, but basically we couldn't much for quite a while until we actually saw the GA
19:40:59 <stahnma> but, I'm not trying to complain, mostly to understand how it works
19:41:12 <stahnma> I can discuss with RH as a customer also
19:42:34 <jsmith> Next question?
19:48:05 <jsmith> Any other questions for today's meeting?
19:49:31 <smooge> not from me
19:51:52 <jsmith> I'll leave the meeting running for a few more minutes, and then if we don't have any more questions, I'll propose that we adjourn
19:58:31 <jsmith> OK... I move to close the meeting.
19:58:51 <jsmith> Thanks everyone for participating!
19:58:56 <jsmith> #endmeeting