Meeting started at 2026-06-04 15:00:35 UTC

The Meeting name is 'Fedora Meeting 3'

The Meeting Name is now security-sig

FYI, I will not be around next Thursday due to Southeast Linuxfest. Someone else will have to run the meeting.

!hi

Chris (py0xc3): Christopher Klooz (py0xc3) - he / him / his

!hi

jforbes: Justin Forbes (jforbes) - he / him / his

!hi

Daniel Milnes: Daniel Milnes (thebeanogamer) - he / him / his

Is there any ticket that needs urgent processing or is due somehow? Or something else?

Nothing from me, $DAYJOB has been full on these last few weeks unfortunately

Yea I know what that's like.

I might do some bash improvements as that part is currently not be highest quality I think (little experience with bash -> usually its too ugly for me :P ). See channel or ticket for what would be necessary for someone else to take over. Whatever remains of it, at least it brought some knowledge about Fedora and identified bugs in systemd, gdm and selinux :) No immediate need for discussion

I have just what I posted yesterday. Happy to hear thoughts if anyone has something about it. The value has decreased, and it might currently not the best time-investment/return-in-investment compromise when more time overhead is necessary, largely due to the bugs revealed by it. So its unclear if and how to go ahead with it. I think it makes sense to go ahead but only if everyone involved does not need to dig into stuff they have no involvement with yet, that would be too much time overhead.

I consider to put it on "temporary unmaintained but open for collaboration" and see if something comes up. It seems some people are following it. Maybe something comes up or not. The possibility will remain

I havent had time to follow up on the tickets this past week, so I'll have to read it later.

!hi

Michel Lind ☘ UTC+1 📛: Michel Lind (salimma) - he / him / his

sorry, got held up by some post-meeting stuff

No worries, such is life.

indeed :)

Doesn't seem like there's really anything pressing today anyway

I liked the idea to start evaluating to create upstream ties to another browser that is independent of Firefox. Not to replace it as default or so, but the recent events about Firefox (not a serious issue so far) revealed that effectively it can be a single point of failure for us. Having ties to other directions might also mitigate some "tunnel vision" about future technologies. Trivalent felt interesting to me as we have already some ties to Secureblue through the atomics and Secureblue's use of our base images. No firefox dependency in terms of code as well. If anyone has an opinion about this, happy to hear it. Generally, not just about browsers.

I guess I will check out at Flock what those already involved with our current browsers upstream and those involved with "Secureblue" downstream think about it :P I find its an interesting topic, but there is nothing urgent or a concrete need. Not sure if anyone has thoughts about it. Whatever comes up, if it is in an organized manner, it should be coordinated with the maintainers incl. firefox to avoid this is perceived somehow as hostile or so, which it is not. It shouldn't replace firefox or so after all.

Again, nothing that needs immediate feedback or discussion. But looking forward if that might raise some interesting discussion. Maybe also beyond browsers :)

Again, nothing that needs immediate feedback or discussion. But looking forward if that might raise some interesting discussions. Maybe also beyond browsers :)

Yeah I doubt we'd ever leave Firefox, but I don't know how frequently our policy files to turn off the spyware have been reviewed

So might be worth a pass over

I was considering another proposal to turn off AI in firefox in fedora, at least until the developers allow normal users to disable it. But I have had my share of critical change proposals for this year :)

I think this came up during the telemetry debacle a few years ago too but idk if there's any follow up

Yeah I worry that we're getting into the area of user preference there

I'd love to have a policy that basically say telemetry and AI have to be off by default in anything we ship as default

users can turn it on, but we default to a noninvasive setting

There has to be a method for users to be able to turn it on

not sure if that needs to be a Council thing or not - is Fabio Valentinihere?\

Certainly would be worth discussing at Flock

agreed, users should be able to turn it off

sorry, turn it on

It also sounds like a great way to start some more mailing list arguments...

yeah I'd rather have some more quiet discussion first and not start a flamewar

YYes, indeed.

so as Justin said Flock is a good time for this

Yeah, it was on my To Discuss list too

since sadly both the mailing lists and Discourse are .. not great at avoiding flamewars

yeah...

But I love discussing somewhere that Phoronix will get clickbait out of claiming was a heated argument!

I was hoping to have a discussion with the firefox maintainer on flock, but don't know yet if he is there, but my expectation is that he is not interested, given some recent posts. But thats just a guess

(Excited to see the AI summary of this meeting)

"I am bad, please turn me off" :)

Who is at Flock by the way?

I will be

I still see it most critical that two stakeholder groups ignore each other, and work only with assumptions about each other.

happily the AI models I know are still OK trash talking themselves

I still see it most critical that two stakeholder groups ignore each other, and work only with assumptions about each other, if at all.

contributors and users? or council and fesco? :P

or whynotboth

Its somewhat a mix, depending on the debate :)

To some extend also different types of contributors

(whatever the term contributor currently means / is defined)

The different ideas of what it means and taken the one of the own group for granted might be related :D

I saw that first in the ptrace_scope debate, as definitons came up both in discourse and mailing lists. very different

oh yeah the mailing list / Discourse split is regrettable

I feel like Discourse got push just heavily enough to annoy the mailing list diehards, but not hard enough to kill off mailing lists so we're now stuck in no man's land

Well, at least some stuff for conversations at Flock these days...

I wish I can attend this one but Real Life TM

Well I shall watch on from home with envy

I'm interested in hearing this rant but I suspect it's not one for now

feel free to DM

feel free to speak :)

I think there is no other topic for today :D

(if you want)

well - I guess it's tangentially security related

Devs who do the work and dont want to move... wont be forced to move. No matter how much people may 'want' them to move becuase 'this is how all the youths want to talk". I suspect if it was fully forced and the mailing lists were shut down, there would have been a substantial exodus.

immovable object meets unstoppable force... never works out how people expect

to properly operate mailman you need a lot of web components - that require a lot of Django dependencies. Django LTS is kind of doable in Enterprise Linux but the latest versions tend to ... aggressively require the latest setuptools etc

so if anyway I need to run to another meeting :P

Ok xD See you later 👋

There are many implications around it. It seems also hard for people to get used to if coming from mailing lists, etc. The performance seems to be an issue too.

And I think the noise in some categories can be deterring too.

At the moment, we have to emphasize also to get a better understanding of OUR discourse, as a lot of people have experimented over the time, without documenting... :(

I will likely try using Discourse in mailing list mode

It would have gone down a lot better.

All that should have been figured out and documented and explained... BEFORE the "we're transitioning over to ${thing} message went out.

I don't disagree :)

But instead there was a lot of 'we're transitioning... and we'll see what we can do in the future to make it better.'

I personally dont care, I can use either.

But sadly fedora has a tendency to jump to half baked ideas... just to transition again.

how many git forges are we on now? haha

anywho, as we've wandered off topic I'll close it out here, and chuckle as I read the summary.

Ok, see you around or in the channel 👋