Meeting started at 2026-06-25 15:00:16 UTC

The Meeting name is 'security-sig (2026-06-25)'

Meeting already in progress

The Meeting Name is now security-sig

Regarding the discussion of the security channel, might we try the functions to see if they are useful?

!hi

!hi

Daniel Milnes: Daniel Milnes (thebeanogamer) - he / him / his

Chris (py0xc3): Christopher Klooz (py0xc3) - he / him / his

(I think we just started the meeting twice. I hope that ain't an issue ^^)

!hi

jforbes: Justin Forbes (jforbes) - he / him / his

it might be... but we'll find out I guess.

Ok, I think I will just go ahead and see if/how it works :)

!forge issue security/tickets 10

give me at least 30 seconds or so to start the meeting before you jump on it. lol

I thought I should take over, sorry for the confusion :)

Ok, the forge doesn't work.

that would have been an important thing to mention or discuss... if you're just trying to kick me out... maybe... idk... say something to the effect that you want to replace me.

Well, it was discussed to test the new functions, and there was no objection but some +1. I asked if I shall take over and no objection, I just saw you saw it, and it was not open at one past. So I thought that was intended. Sorry :) Feel free to take over

test new functions != replace the meeting chairperson without telling them current meeting chair person

anyone can use the !commands... it doesn't have to be the person who started the meeting.

But getting back on track... does anyone have any thing else to say about https://forge.fedoraproject.org/security/tickets/issues/10 that's not in the ticket?

no reason to debate it now though, we can hash all that out later.

I personally am in favor of running the meeting even if there are no topics as a sort of 'office hours' for the community. I'm fine with taking that responsibility so there is some regularity to the meetings. Does anyone object to that?

Well, I am fine with everything regarding the meeting. I just would like if people could know in advance about what meetings are, to know if they are relevnat for them or not, when people have to prioritze. At the moment, its a little arbitrary. Otherwise, the average value of a meeting can be low over time and people might have an incentive to no longer join at all.

I agree with q5sys, I don't want to get out of the rhythm of having the scheduled slot

I had it twice that i had to prioritze and it wasnt clear if something is discussed about a ticket I'm involved in. So if I'm needed or not.

I'm fine with that.

But improving the structures and make predictable what meetings are about might be worth to increase value. Also to avoid the overhead to find out what to do with the meeting

!hi

Michel Lind ☘ UTC+1 ⏱️: Michel Lind (salimma) - he / him / his

Half afk

Pending Security Tickets are the primary focus of there are people around who want to actively discuss them.

Is there a way to flag tickets on forge with priority levels?

Yes, I can create labels for prioritiy

on github and gitlab you can create labels... is something similar possible so we coudl label tickets with meeting dates?

I think a label with meeting date would be problematic, as its not intended to be used that way. but different prioritizations ain't an issue

Not sure how it relates to this issue though?

The general use of other teams is to tag for meetings in general, which we already to also, in terms of tagging.

And then discuss what is tagged

The overall number will increase over time. I think the overall number will thus be no longer relevant at some point (if not already now), as all cannot be discussed anyway

The cons are it will get messy and we'll have to prune labels once they're stale. Im willing to prune the labels weekly. if people think its a good idea but dont want to deal with the mess.

So for example, people will know on July 2nd we'll plan to discuss 'foo' and on July 9th, we'll plan to discuss 'bar'. So if they only care about bar and not foo, they could plan what week to attend.

The pros of date labels is that will give people time to see it and then prepare to talk about it at that point.

IDK if its the best idea, but its an idea. If anyone has a better one I'm all ears. :)

There may be a better way to accomplish the same goal.

You can set a Due Date on Forgejo tickets

Hmm... Well, we have to create a lot of labels over time, and the system will treat them correspondingly. What you want to achieve might be better served by two meeting labels

one for the meeting and then future-meeting, plus what Daniel said (or, instead, what daniel said ^^)

one for the meeting and then future-meeting, plus what Daniel said (or, justwhat daniel said ^^)

one for the meeting and then future-meeting, plus what Daniel said (or, just what daniel said ^^)

The point would be just to make it predictable what is to be discussed, and the structure of the meetings. Saves time, and makes clear to people what the meeting is about to maximize value, incl. when they have to prioritze

would due date be used for the 'meeting date' or...? as a dev that means... "this issue better be resolved by then" type of thing.

Well, we could decide to use it that way. But I think it will be confusing for others and those who are also in other teams, as usually its not intended to be "due for meeting"

I mean, the meeting label should suffice, as for other teams too? I think it is realistic to roughly predict a realistic number, and if one remains at the end, well, we cannot be prepared for everything

The tickets can be used to create a clear structure, with !topic & !link to the tickets, and then just the !topic open floor at the end. Also for reviews etc

I'm fine with anything that gives me some hint what a meeting is about in advance :)

crazy idea... anyone know how open the maintainer of forge is to feature requests/prs? Maybe there's a feature we could create and file a PR for? What is forge written in?

I think Go + JavaScript

Feature requests are possible. Prioritization is implemented by most teams I know by additional labels. Keep in mind we can label a ticket with several labels. So that would not conflict, if that is the issue?

I guess we could label 'next meeting'

you mean additional to "meeting"?

Unless something is prioritized urgent, I would have guessed its just number by number or so.

just saying 'meeting' could mean this week, next week, the week after next.

im just trying to give people an idea of which meeting something might be in. based on your concern not to waste peoples time... or to have them prioritize their schedule for things.

But I have no problem with it

Well, thats what we have the existing meeting label for. Its just not used in most meetings

Te

IDK how best to label things so people can plan their schedule... since using dates isn't liked.

or... we could have a single ticket that is a meeting outline that we just update.

I would try to align with other teams actually. Do what people are used to

the OpenZFS leadership meeting has a google doc which we update for our monthly call with all the things we want to discuss on what date, so people know when to attend for discussion around thier PR.

Not sure what others think?

but I wouldnt want to use something off Fedora's infra.

I have no problem with it, I just don't want to be forced to create a google account :)

my preference too :)

In the Docs we used a Discourse topic

for every week

But I think several engineers dont like discourse

Im one of them. lol

i'll use it begrudglingly... but I dislike it for many reasons

Another suggestion, that might be less confusing for people used to other work flows:

keeping the meeting label, create an additional urgent tag, and then do the meeting one by one with the meeting labeled topics. People can decide themselves and make their own guess if "their" tickets are likely to be processed or not (e.g., if they are at the 1st or 10th place of the marked tickets). Exception: if "meeting" labeled topics are marked also as "urgent", these get before those without.

I THINK that is widely compatible to what other teams do, to not re-invent the wheel, but still gives a good expectation of what a meeting will be about ?

If the then also use the !topic functions and such, we might further improve the summaries etc over time and get a better structure

If the then also use the !topic functions and such, we might further improve the summaries etc over time and get a better structure (also within/during the meeting)

Just a thought in between :)

This exploits the numbering of tickets, #1, #2 etc

Some of these things are really only going to applicable once we actually have a ton of things going on and a ton of activity.

Everyone is all excited to do stuff and build stuff initially... but after a few years the fun is gone and its just a slog.

I dont want to see us have the same problem, because that causes burnout and then a project or team will loose people.

I just worry that we're create so much structure that it becomes cumbersome to use with the minimal activity we have. Back in the day when I was a part of the PC-BSD/TrueOS Project... we tried to run regular meetings and a ton of structure was set up. But when it was the same 5-8 people every time, with nothing new to say that wasnt already said in the normal chat... it got to become a PITA to manage all that infra. It just became a digital form of paper pushing with no benefit.

I dont really care what structure is put in place to use. I'll use whatever even if I dont really like it. So if you can come up with a plan, cool.

I'm not suggesting we dont think about this stuff... we absolutely should. But right now I'm just trying to get people to realize the team exists and they can come talk to us.

Which currently we dont. :(

I think it might make sense to wait some minutes to see what others say, we (mostly me:) talked already too much :D

Anyone can jump in at any time...

Sure, I'm still reading your post :) mom

and of course they can comment later if they review the chat log or meeting notes.

So this time... I'm trying to take all the day to day monotony on myself, so maybe this time it can last... and let other people do the exciting bits as they want... so they dont have the pressure of the monotonous stuff.

People get excited... want to jump in... then the day to day monotony settles in and people find other things they're more excited to do.

The reason the security team has been a start/stop thing over more than the last decade... is because of the excitement/burnout cycle.

I think I would leave it for others to comment. The only thing I might add is the perspective of mine: the value of the meetings for me is on average quite low, and when I have to prioritize, I started to give this a low priority, because it's not predictable for me what is going on, and when I did otherwise in the past, the meeting was once started without any topic at all. So, I could have prioritized something else. Lost time. My feeling is the number of people has decreased, and there is a chance I can understand why. Security is broad, and not every security topic is relevant for everybody. That's the general issue :) Creating new structures is what you said, so I tend to stick with what works fine for others :)

I think I would leave it for others to comment. The only thing I might add is the perspective of mine: the value of the meetings for me is on average quite low, and when I have to prioritize, I started to give this a low priority, because it's not predictable for me what is going on, and when I did otherwise in the past, the meeting was once started without any topic at all. So, I could have prioritized something else. Lost time. My feeling is the number of people has decreased, and there is a chance I can understand why. Security is broad, and not every security topic is relevant for everybody. That's the general issue :) Creating new structures is what you said, so I tend to stick with what works fine for other teams :)

Sorry I got pulled away for $realjob

Slightly concerned that we're still on this topic

No worries, the real job is what pays the bills. It should take priority.

Yeah we definitely should not start the second ticket today :)

Well, if no one has points, I guess we might leave the security meetings as they are for now ? Or leave the ticket open? Not sure

While we do have some things we want to do, we dont really have a roadmap of work.

What works for other teams is a good place to start... but security work is very different than say infra work, or design work where they are clear plans/goals for tasks... a lot of what we do is reactive. Sure there's some project work, but that's less than everything else.

So we can take what works for others, but we'll have to adjust it for the differing nature of what things come our way.

Generally speaking, if a ticket comes in, we should discuss it in the next meeting... if its a large issue where many people will want to comment on it. We need some way to let people know when we're going to talk about it. If a discourse post is the best way to do that, I'm fine with that. If its a ticket in our forge... I'm fine with that too.

What would be nice is input from more than the three of us... about what would work for the people we want to attract to become active.

Sorry, I typically have another meeting during this time as well. I am mainly around in case there are kernel questions. I will say that these meetings do seem perhaps more frequent than is needed.

Yea the mix between tickets/issues and security team stuff... and 'Open Office Hours'... makes it a bit awkward.

I had thought about doing "Official meetings" every other and then on the off weeks have the 'Security team office hours' at the same time. But that seemed like more to juggle in peoples minds wondering which week is which.

Well, if we post agenda before each, that would take away that issue

that was originally the idea of the meeting labels

but its just one way to achieve that

I'm happy with every way that achieves the goal :)

And with security being reactive... if something does happen, we'll want to do something that week and not wait for the next. So it makes sense to just keep doing it every week.

And my plan was... if there's nothing team wise to discuss... I can ride solo if there's people in the community that wander in.

The thing with labels is people have to come looking to our issue tracker. Posting a meeting agenda similar to what other SIGs and meetings do is a push notification for people who care to see it on discuss/email

an agenda seems to be the easiest and quickest fix

yeah, someone needs to prepare it in advance though :) Maybe a day or so

correct

discourse + matrix might be useful

as these are the major channels

keeping it aligned, the people who dislike discourse might review it on matrix. I would assume for emails the sig is too "loose" at this time (?)

putting on the agenda just the tickets that are marked?

(I have to leave soon...)

There is a security mailing list we could also push to unless it finally got nuked from being inactive

if that's still around we could push to all three matrix/discourse/ml

I think it is archived

but not 100% sure off the cuff

Ok, let's start to publish an agenda on the day before meeting ? matrix + discourse ?

We can see what proves useful to be contained

On Docs it could be updated and people coud post, and see how it evolves

Sounds good to me. We can continue the discussion around the best way to notify people in the security channel.

I'll close out this meeting for now if there's not a final comment someone wants to get in on the record.

Im fine

do you want to publish it?

I could start it if you want, just adding open tickets or so, and see what people say or want to add. But you can do it either. I'm fine with anything

doesn't matter to me, if you want to take that on... that's fine with me. Or I can do it.

we can hash out the details in the sec channel, others that aren't avail for this meeting might have other good ideas we might want to use.

(this was somewhat easier when we had meetings in that channel so it wasnt jumping back and forth... but anywho...)