Sourceware Open Office, Fri 14, 15:00 UTC

Sourceware Open Office, Fri 14, 15:00 UTC

[Mark Wielaard]

[-- Attachment #1: Type: text/plain, Size: 1720 bytes --]

Hi all,

Tomorrow is the second Friday of the month, so it is time for the
Sourceware Open Office again.

Friday August 14, from 15:00 UTC to 16:00 UTC
At #overseers on irc.libera.chat and
https://bbb.sfconservancy.org/rooms/sourceware

$ date -d "Fri Aug 14 15:00 UTC 2026"

Discussion topics:

- ai scraper bot mitigation
  We have a better setup now, but ai scraper bots keep adapting.
  Which layers needs tweaking to give the best performance for users?

- update on Sourceware fundraising
  We got more donations and corporations joining the sponsorship
program!

- forge updates
  MAINTAINERS.yml to forge user sync.
  Secrets management for production instance.
  What should we prioritize before cauldron?

- the FSF asked us to put our heads together to improve glibc services
https://inbox.sourceware.org/7021a9fb-2476-463c-8eab-a4e254d93df2@fsf.org/

Sourceware relies on cooperation among a broad diversity of core
toolchain and developer tool projects, hackers, organizations,
ideas, and communication styles. The monthly Sourceware Open Office
meetings are one way of coming together as a community and discuss
our shared development infrastructure. For other ways to participate
see https://sourceware.org/mission.html#organization

Keep Sourceware worry-free, friendly and independent by donating
https://sourceware.org/donate.html support our fiscal sponser SFC
https://sfconservancy.org/sustainer and/or support OSUOSL for
hosting Free Software projects https://osuosl.org/donate/

Do you or your company want to sponsor Sourceware financially, donate
hardware or services, then see the Sourceware sponsorship program at
https://sourceware.org/sponsor.html

[-- Attachment #2: so.ics --]
[-- Type: text/calendar, Size: 244 bytes --]

BEGIN:VCALENDAR
VERSION:2.0
CALSCALE:GREGORIAN
BEGIN:VEVENT
DTSTART:20260612T150000Z
DURATION:PT1H
SUMMARY:Sourceware Open Office
LOCATION:#overseers on irc.libera.chat
RRULE:FREQ=MONTHLY;INTERVAL=1;BYDAY=FR;BYSETPOS=2
END:VEVENT
END:VCALENDAR

Re: Sourceware Open Office, Fri 14, 15:00 UTC

[Mark Wielaard]

Hi,

On Thu, Aug 13, 2026 at 10:13:26PM +0200, Mark Wielaard wrote:
> Tomorrow is the second Friday of the month, so it is time for the
> Sourceware Open Office again.

For those that couldn't attend, the discussion notes.
Thanks to Claudio for taking notes.

> - ai scraper bot mitigation
>   We have a better setup now, but ai scraper bots keep adapting.
>   Which layers needs tweaking to give the best performance for users?

- nginx rate limits non "goodguy" addresses
  - goodguys are people that log into the services, so it's an
    incentive to contribute
  - we still need to add a wiki login -> goodguys mapping
    [same for patchwork]
  - consider allowing git user agent through http but we did have lots
    of clone attacks, we could have a grey user agents in addition to
    grey locations list. it's hard to setup and causes opportunity for
    non isometric attacks
  - we could consider adding an "add me to good guys" service with a
    challenge mechanism sending an email, adding an ip to a verified
    email address. This may conflict with CGNAT as it would link way
    too many people with an email [or simply a form where you fill in
    your own ip address, and it only works if you are actually using
    that ip address].
- Anubis honeypot ip ingestion by fail2ban disabled as it only
  increases memory
- Anubis difficulty 5 (javascript) on phones is horrible [lowered to
  difficulty 4, but also switched bugzilla and wiki from meta-refresh
  to the javascript challenge].
- At FOSSY discussed with others (FSF, Fedora, SFC, ...) how to handle
  the botnets. One idea was suing one of the residential proxy
  services but it looks like the scum is hard to reach legally.

> - update on Sourceware fundraising
>   We got more donations and corporations joining the sponsorship
>   program!

[got the actual numbers from Tracy after the meeting, updated below]

- Individual donations increased from ~$250 in May, ~$400 in June, to
  ~$1200 in July. https://sourceware.org/donate.html
- One corporation sponsorship at Supply Chain Defender level ($5000)
  cleared, we should add Open Source Security to the sponsors page
  [delayed because of vacation and conference, sorry]
  (they have also sponsored cauldron and gcc rust frontend)
- Another corporate at Infrastructure Supporter ($2000) in the pipeline.
- Other corporations interested, but we need to follow up
  https://sourceware.org/sponsor.html
- We are currently on track to have more than what we budgeted for
  next year https://sourceware.org/financials.html
- We don't express our in-kind donations in money because we don't
  know precisely what the companies spend to provide them. But we could show
  there's a continuous donation/sponsorship going on.
- We could ask SFC to send yearly "invites" to renew corporate
  sponsorships

> - forge updates
>   MAINTAINERS.yml to forge user sync.
>   Secrets management for production instance.
>   What should we prioritize before cauldron?

- check if old emails can be used to gain access to an account and if
  so DONT
- we have access to sourceware aliases and can potentially add forge
  accounts to all current developers. so use the sourceware user
  database (and group id memberships) to designate USERID@gcc.gnu.org
  as forge identities
- we could simply add an inactive account to avoid their email being
  used
- emails should not be sent for this
- production secrets shared privately and gitignored.
- Add force-account-request alias

> - the FSF asked us to put our heads together to improve glibc services
> https://inbox.sourceware.org/7021a9fb-2476-463c-8eab-a4e254d93df2@fsf.org/

- The developers present seemed OK with the status quo. But we are
  ready to help with technical, organizational, funding, etc. issues
  once FSF and community figure out what they want exactly.