Meeting started at 2026-08-20 15:00:17 UTC

The Meeting name is 'Fedora Meeting 3'

The Meeting Name is now security-sig

!hi

!hi

Chris (py0xc3): Christopher Klooz (py0xc3) - he / him / his

https://forge.fedoraproject.org/security/defensive-coding-guide/issues

There's only one item on the agenda this week, `Quick poll for SIG members (quorum 3) if there is no objection: move ff-disable-ai-ml repo to the SIG’s Forge-org for joint ownership/maintenance, before package review.`

Chris (py0xc3) since that's you're repo right now, do you want to say anything about it?

Communications about this seems currently not possible with the Firefox maintainer, there are many rumors about this "Firefox AI" around (many wrong or exaggerating the problem), and for average users it's not trivial to solve this if they want to disable it (given some reports they might read, being forced to use it can be quite deterring; but there are logical reasons too, including battery life time & performance).

There was a suggestion from Neal Gompa (patch the "Block AI" option) how this could be resolved and I aimed to collaborate with the maintainer to define and delimit a discussion that captures possibilities acceptable for all sides and to allow deleting everything "extreme" as offtopic to keep the discussion focused and constructive before starting it in public. But that is not realistic without the maintainer.

It is unclear why that is, as he also proposed an AI article for the magazine and then disappeared (the Fedora Magazine team tries to reach them for some weeks now). So maybe they are just overworked or so, but the issue remains.

That package would create a subtle incentive to maybe facilitate something constructive to discuss in future (especially if people start to use it), with something specific to keep a discussion focused (I intentionally embedded Neal's idea in the README.md with a policy how such a patch would "auto-obsolete" the package). And in the meantime, the package allows (mostly average) users to solve the issue.

I would add a short wiki page (shorter than the README.md) because for average users, identifying that a package solves such problem is not trivial.

If anyone has concerns about this or a general objection, we can either discuss it or skip the topic at all: it's not critical after all. Otherwise, I suggest a quick poll, and if we reach a quorum (+3) for it, I would open a ticket, prepare everything, but not start the package review process (nor publishing any docs page) for at least 1 more week to allow others to object or raise concerns.

!hi

!hi

!hi

who dissappeared? Neal or the maintainer you were working with?

sure, that sounds good

I assume *not* Neal

Firefox maintainer. I was not working with him, he never responded to me, but also does not respond to the Magazine Team whom he proposed an AI feature article. Many explanations possible, so I don't expect anything hostile or so.

I just wanted to make sure I understood what Chris was meaning to say. :)

I'm not sure the "security" org is the best place for this

Yeah it deploys a very broad definition of security.

But it also feels not good to have something like this maintained by a single person outside Fedora org.

Security does seem like an awkward place for it. Obvious question that people will be wondering is 'how is this security related'.

But I agree to your concern...

ah, good point

sorry, I meant to reply to this one

Well, less technical security, except security of availability when the battery dies :)

ask for "Anti-LLM cabal" as a Forge group ;)

But security in a policy way, creating an incentive to this not evolving to privacy/security-threatening, though this might be a little exeggerated at this time

Asking a different way - is there a reason why this would be Fedora Forge material and not "personal repo on Codeberg" material?

the point, a security relation other than security of availabiltiy rises only on the long term,

its less immediate

and I can understand if we don't want to cross that line

it looks like it would not even necessarily Fedora specific, i.e. also applicable to other distributions if they want it

Fedora has an AI/ML Sig... maybe there should be a non-AI/ML sig 🤣 Would be a bit more polite than Anti-AI/ML Sig. haha

Yes, I want to get it to EPEL.

does Fedora have a Privacy Sig?

Its relevant for our downstream firefox builds too. Not flatpak though

I think not. So far privacy is either security or legal :)

poor Fabio, people keep proposing neat new SIGs he might be compelled to join

"privacy-sig" would be a better fit :)

we were just discussing having a benchmark/performance SIG the other day :P

Well, that SIG it would fit too, as the AI are a performance issue (for many that might be the biggest issue actually) :P

hmm ... idk, wouldn't really be a good fit whether to toggle something or on off by default

`SIG Enjoyers SIG`. Where People who like SIGs can sit around and talk about other SIGs.

Following the more recent discussions and issues that came up in recent conferences, the most critical SIG we need is the holiday SIG and the vacation SIG and hiking SIG ... :O

The SIG Investigation Group, SIG SIG

omg :O

Sig Squared

Ok, tendency then, the package does not fit the current scope of the security sig?

"tendency" sounds like a good name for a cabal too

anywho... back on the topic... I like the subject matter of the task, I would probably use it myself.

I just dont know if Security is the best place for it, or where might be a better place that would give it more visiblity and be a better fit.

The SIG Managment Agency

we can start a group repo somewhere for hosting privacy tweaks and see if we can get it going enough to start a SIG

I would happily join

I'm not opposed to it landing in the Security SIG as a stop gap until it an find a better home, if it being in a personal repo is a blocker for EPEL.

I'm not opposed to it landing in the Security SIG as a stop gap until it can find a better home, if it being in a personal repo is a blocker for EPEL.

wait, why do we care about EPEL specifically?

shouldn't be a blocker

!hi

Neil Hanlon: Neil Hanlon (neil) - he / him / his

Yo dog, i heard you liked SIGs

Im 100% in favor of doing this, for reasons beyond this copr build.

the nice thing if we get it to a SIG status at some point is we can then have group COPRs

but I am OK with this (move it to /security/* until a better place is found)

The first rule of privacy SIG is you don't tell anyone about it, i guess?

Yeah, just like the second and third rule :P

Shhhh

The first rule of fight club is that we do not talk about fight club

You mean ask for a forge-org or within security sig or somewhere else (freedesktop or so?)?

I mean once there is a FAS group we can have a matching COPR group with just one click

but for now, idk how much trouble it is to ask for a forge org so if it's too hard, somewhere else is fine too

Im still not a fan of the effort of data collection in the Workstation Release.

Asking / requesting a forge org is easy, if it is accepted, well, something else :) I expect a SIG must be formed for it in advance.

The copr build is just if someone wants to test or see if it properly builds. My goal was to get it into Fedora's default repos.

the telemetry one that failed? yeah

we need something official that can push back against these sort of things

Yup, that one.

but we can discuss that elsewhere after this meeting

Well, then this goes towards a privacy (sub-)SIG? xD

If we start one... your COPR build would be a perfect fit

hmm .. SIG related Fedora Council managed team?

Yeah, if we create one, I would not move it to security or so but wait for the other one to have its repos or organization. It's nothing urgent after all

I can write up a P-SIG proposal this weekend and run it by everyone next week for input before I/We move forward on reaching out to more people about it.

All my cars are in various states of broken at the moment... so I wont be going anywhere and i'll have plenty of time at home to do things. haha

The disadvantage of the mountains :D

I think I'll keep their rental car for one full day if I can get them to hold my car overnight after servicing

anyway, so.. do we have an actual security topic?

I would be ok with that, if others agree to create a separate p-sig?

sgtm

Ok, +1

Less blame on the mountians, and more blame on the dealership that sold me a defective waterpump that ended up gernading itself and taking my engine with it... and who refuses to cover the damage because "We didn't install it"

I'm happy to give feedback if you want, also before the meeting or so, but I guess writing much myself is what I currently would prefer to avoid :)

When I get it written, I'll make it a ticket in our SIG for comment, and we can then talk about it more in the next meeting

so set this as action?

Sounds good

:D

(twiddles thumbs)

P-SIG = NP-SIG?

Privacy = NonPrivacy?

:D

Might be tough to prove

Dont phrase it like that... the math nerds will descent...

Dont phrase it like that... the math nerds will descend...

P ⊆ NP SIG is trivially true

🤫

We'll just ask AI to prove it with 'novel theorems'

We'll just ask AI to prove it with 'novel theorems' 🤣

but then you just went from Privacy to Probabilistic :p

isnt privacy probabilistic?

Im going to call the meeting at :40 unless anyone has anything else to bring up. Give everyone a little bit of their day back.

I'm free for another 20 mins if anyone want to hammer out some details about P != NP

because the next internal meeting I have to take, I'm not looking forward to it anyway so distractions will be nice

`Sorry, I cant come to the meeting, I'm busy solving the universe scale problems.`

ooh privacy is not probabilistic. P = NP

no worries, its just 42

haha

Anyway... have a great week/weekend everyone.