From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id YUtZAPskgmqg1CoAWB0awg (envelope-from ) for ; Sun, 16 Aug 2026 17:00:43 -0400 Received: by simark.ca (Postfix, from userid 112) id F29341E0A3; Sun, 16 Aug 2026 17:00:42 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-5.3 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=unavailable autolearn_force=no version=4.0.1 Received: from vm01.sourceware.org (vm01.sourceware.org [38.145.34.32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id 209D11E09B for ; Sun, 16 Aug 2026 17:00:42 -0400 (EDT) Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id B45374BA2E2B for ; Sun, 16 Aug 2026 21:00:34 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B45374BA2E2B Received: from gnu.wildebeest.org (gnu.wildebeest.org [45.83.234.184]) by sourceware.org (Postfix) with ESMTPS id 7D2AB4BA5433; Sun, 16 Aug 2026 21:00:02 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 7D2AB4BA5433 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=klomp.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=klomp.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 7D2AB4BA5433 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=45.83.234.184 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1786914002; cv=none; b=xkmFILWHdrOe5600G50ngfANTApGmqCuUatkYMeXdmtdq7zojFRE4TSZTSD6tvh5bI+BTLZRVty+jn1nItdXC3bp/90cQ+tn4dgAswLj/kOhmOL856KXj1rj5DPrmh5UPCo8YBUNZMsiuVUNXkKJT2I6v6PTeHtf2bhzCY6cRiA= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1786914002; c=relaxed/simple; bh=bPuJJgk09owjIfTAcLMxf4NnPfcDa5ZTc2xUA8PaE3A=; h=Date:From:To:Subject:Message-ID:MIME-Version; b=J5Llo3yKHkQq1Hm+hI8acPCcGpDb0Pyb7F2uPZNVy9fHWLbV0ZAGZF63D0OeVWfjEhjjR/DWBcwlC1Qa7VXQLxtceZTlVG2JsUkeCz0ZHNG227npfE10r4ioy8zKv/2ybkdAQqdIcZt2sPjd1t86NIUFpWGpunWi3hODF2vadKk= ARC-Authentication-Results: i=1; sourceware.org DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 7D2AB4BA5433 Received: by gnu.wildebeest.org (Postfix, from userid 1000) id 7914C3032F85; Sun, 16 Aug 2026 23:00:01 +0200 (CEST) Date: Sun, 16 Aug 2026 23:00:01 +0200 From: Mark Wielaard To: overseers@sourceware.org Cc: gcc@gcc.gnu.org, libc-alpha@sourceware.org, binutils@sourceware.org, gdb@sourceware.org Subject: Re: Sourceware Open Office, Fri 14, 15:00 UTC Message-ID: <20260816210001.GB5585@gnu.wildebeest.org> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-BeenThere: gdb@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-bounces~public-inbox=simark.ca@sourceware.org Sender: "Gdb" Hi, On Thu, Aug 13, 2026 at 10:13:26PM +0200, Mark Wielaard wrote: > Tomorrow is the second Friday of the month, so it is time for the > Sourceware Open Office again. For those that couldn't attend, the discussion notes. Thanks to Claudio for taking notes. > - ai scraper bot mitigation > We have a better setup now, but ai scraper bots keep adapting. > Which layers needs tweaking to give the best performance for users? - nginx rate limits non "goodguy" addresses - goodguys are people that log into the services, so it's an incentive to contribute - we still need to add a wiki login -> goodguys mapping [same for patchwork] - consider allowing git user agent through http but we did have lots of clone attacks, we could have a grey user agents in addition to grey locations list. it's hard to setup and causes opportunity for non isometric attacks - we could consider adding an "add me to good guys" service with a challenge mechanism sending an email, adding an ip to a verified email address. This may conflict with CGNAT as it would link way too many people with an email [or simply a form where you fill in your own ip address, and it only works if you are actually using that ip address]. - Anubis honeypot ip ingestion by fail2ban disabled as it only increases memory - Anubis difficulty 5 (javascript) on phones is horrible [lowered to difficulty 4, but also switched bugzilla and wiki from meta-refresh to the javascript challenge]. - At FOSSY discussed with others (FSF, Fedora, SFC, ...) how to handle the botnets. One idea was suing one of the residential proxy services but it looks like the scum is hard to reach legally. > - update on Sourceware fundraising > We got more donations and corporations joining the sponsorship > program! [got the actual numbers from Tracy after the meeting, updated below] - Individual donations increased from ~$250 in May, ~$400 in June, to ~$1200 in July. https://sourceware.org/donate.html - One corporation sponsorship at Supply Chain Defender level ($5000) cleared, we should add Open Source Security to the sponsors page [delayed because of vacation and conference, sorry] (they have also sponsored cauldron and gcc rust frontend) - Another corporate at Infrastructure Supporter ($2000) in the pipeline. - Other corporations interested, but we need to follow up https://sourceware.org/sponsor.html - We are currently on track to have more than what we budgeted for next year https://sourceware.org/financials.html - We don't express our in-kind donations in money because we don't know precisely what the companies spend to provide them. But we could show there's a continuous donation/sponsorship going on. - We could ask SFC to send yearly "invites" to renew corporate sponsorships > - forge updates > MAINTAINERS.yml to forge user sync. > Secrets management for production instance. > What should we prioritize before cauldron? - check if old emails can be used to gain access to an account and if so DONT - we have access to sourceware aliases and can potentially add forge accounts to all current developers. so use the sourceware user database (and group id memberships) to designate USERID@gcc.gnu.org as forge identities - we could simply add an inactive account to avoid their email being used - emails should not be sent for this - production secrets shared privately and gitignored. - Add force-account-request alias > - the FSF asked us to put our heads together to improve glibc services > https://inbox.sourceware.org/7021a9fb-2476-463c-8eab-a4e254d93df2@fsf.org/ - The developers present seemed OK with the status quo. But we are ready to help with technical, organizational, funding, etc. issues once FSF and community figure out what they want exactly.