[07:06:41] #startmeeting "Foundation 2018-09" [07:06:41] Meeting started Sat Sep 15 22:06:41 2018 UTC and is due to finish in 60 minutes. The chair is antarus. Information about MeetBot at http://wiki.debian.org/MeetBot. [07:06:41] Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. [07:06:41] The meeting name has been set to '_foundation_2018_09_' [07:06:44] heh [07:07:11] rollcall prometheanfire robbat2 antarus alicef b-man [07:07:17] o/ [07:07:41] present but late [07:08:30] #info Rollcall: antarus, prometheanfire, robbat2 [07:08:44] well, quorum at least [07:08:50] yes quite :) [07:08:55] the bot is logging, supposedly [07:08:59] itnis [07:09:01] it is [07:09:02] I neglected to test that bit [07:09:14] I have text logs if you need them [07:09:19] #info old business [07:09:39] Updating the foundation address; I'm waiting until we update the NM filing [07:09:45] I expect to have it all done by next month [07:10:02] I need b-man's address to update the filing; I sent him an email abou tit [07:10:17] ack, and also seen via cc [07:10:32] Our registered addr has to stay in NM [07:10:36] (I may try to update ones I don't think I need the filing for) [07:10:50] NeddySeagoon: yes, we are updating other addresses [07:10:52] (not that one) [07:10:53] robbat2: should we update the bank info? or since I stayed on are we still good (iirc dabbott was the other person on the account) [07:11:00] antarus: :) [07:11:18] NeddySeagoon: its https://bugs.gentoo.org/show_bug.cgi?id=613950 if you are curious [07:11:30] one sec, checking the latest statemnets to confirm bank addresses [07:11:48] robbat2: and account 'holders'? [07:13:01] Money market #3246 definetly has the new mailing address [07:13:55] prometheanfire: can you login to the spark business account and confirm mailing address on there? it only has the registered agent addr [07:14:00] on the statements [07:14:10] ok [07:14:11] robbat2: can we just do this OOB and update teh bugs accordingly? [07:14:24] antarus: continue in the meantime [07:14:44] The question of who to keep on the accounts is an interesting one [07:14:54] i'm not familiar enough wth business accounts to say [07:15:24] the president & treasurer if possible is best-practice I've had elsewhere from research; [07:15:37] failing that, president & secretary [07:15:46] ack [07:15:53] either way, antarus should be added [07:16:07] question is also if b-man should be added; and when to remove dabbott [07:16:36] #action Change account holders to be [antarus,robbat2,b-man] [07:16:38] expand then contract [07:16:45] bot, I hope you are doing stuff ;) [07:16:53] you can't add me: because the bank won't add non us-resident [07:17:20] presently on the spark is prometheanfire, dabbott [07:17:38] presently on the moneymarket#3246 is tsunam (we were trying to close this one) [07:17:43] I aspire to add all 3, lets see how far we get [07:18:00] antarus: robbat2 we can talk offline and work on it [07:18:02] I think there is a branch in NY i can go to to hopefully get that MM one taken [07:18:10] #info votes [07:18:11] that'd be nice [07:18:17] they closed satx branches... [07:18:42] https://bugs.gentoo.org/645192 - Staff quiz and gpg competence should be required for foundation membership [07:19:09] any thoughts on this one? [07:19:16] I don't think the 'staff quiz' (now called the developer quiz) is fully suited as a foundation membership quiz [07:19:22] it's a good base though [07:19:28] https://projects.gentoo.org/comrel/recruiters/quizzes/developer-quiz.txt [07:19:32] #link https://projects.gentoo.org/comrel/recruiters/quizzes/developer-quiz.txt [07:19:45] What is 'gpg competence' ? [07:20:08] I think the real challenge is that the community doesn't understand what qualifies people to be members, or not [07:20:15] and this reduces credibility of membership [07:20:40] (and just of the foundation in general) [07:21:31] sure, I do think a quiz is a good idea (to ensure knowlege about what membership means and requires) [07:22:41] any other comments? otherwise we can vote? [07:23:19] i want a clear definition of the gpg competence for the implementation; but i'd like to vote now [07:23:28] please vote aye or nay [07:23:44] suggestion for a quiz to be adopted (give us something to vote on, rather than a concept) [07:24:39] I believe the current proposal is the staff quiz [07:24:50] Lets start with that then [07:24:51] ok [07:25:00] the proposal says staff quiz + gpg competence [07:25:07] on the staff quiz: aye [07:25:10] propose that new foundation members take the "developer quiz" [07:25:20] (as linked above) [07:25:37] nay [07:26:06] antarus: your vote is going to decide ;-) [07:26:14] I know, its terrible [07:26:16] I vote aye [07:26:19] lol [07:26:43] -*- prometheanfire would like to see the questions updated to be more applicable to foundation membership [07:27:02] happy to iterate on content there [07:27:06] k [07:27:12] I generally prefer some kind of concrete criteria over nothing [07:27:14] who will asess quizzes ? [07:27:16] whichi is why I voted aye [07:27:28] trustees@, clearly ;) [07:27:29] NeddySeagoon: the proposal states that the trustees do [07:27:48] #link https://bugs.gentoo.org/645192 [07:28:02] That works. So no @gentoo.org for members from that. [07:28:12] #agreed that new foundation members take the "developer quiz" [07:28:29] #info https://bugs.gentoo.org/536668 - Change grammar of social contract to be clearer [07:29:15] in particular I think we should vote on the update prometheanfire just added to the bug [07:29:15] do we have a proposal of the actual change to be made? [07:29:40] #link https://bugs.gentoo.org/536668#c5 [07:29:53] -*- prometheanfire will vote last on that [07:30:20] I thought i had to vote last as a matter of procedure ;p [07:30:24] to give another concrete example of something we do & must hide: PII as part of treasurer reimbursement process [07:30:29] any comments before voting? [07:30:44] antarus: nice to have, not needed, doesn't really mater much imo [07:30:47] for this at least [07:31:03] robbat2: ack [07:31:18] I wrote the update as I did to allow us leeway in what we decide to hide [07:31:24] chaned will to may as well [07:31:27] in general I prefer a culture where we assume people act in good faith [07:32:04] that means allowing them to actually act on their own and not have enumeration; within reason [07:33:02] please vote yay or nay [07:33:06] or aye or nay [07:33:10] ;) [07:33:46] aye [07:33:49] aye [07:33:50] aye [07:33:55] (afk, brb) [07:34:09] #agreed The social contract will be amended as per https://bugs.gentoo.org/536668#c5 [07:34:29] #info https://bugs.gentoo.org/642072 - Vote on new DCO [07:34:33] #link https://bugs.gentoo.org/642072 [07:35:04] before the meeting we talked about implimentation timeline [07:35:55] my opinion is that we delegate to council for implementation timeline [07:35:55] 2 weeks for interpreting it, 2 more weeks for enforcing [07:36:24] that's fine too [07:36:51] I want to see it happen, I'm not sure it matters if it happens tomorrow or 30 days from now, or whatever [07:36:57] I assume the council will do the right thing [07:37:12] robbat2: we can vote when you return [07:37:24] I don't quite like 'The term "open source" has been replaced by "free software" throughout. [07:37:33] because that's less exact imo [07:37:42] then again, open source isn't exactly great [07:38:05] The term "free software" is used for consistency with the language of the Gentoo Social Contract [1]. [07:38:10] but still... [07:38:14] hrm, https://dev.gentoo.org/~ulm/glep-copyrightpolicy.html is also 404 [07:38:27] https://www.gentoo.org/glep/glep-0076.html is I guess what we are voting on [07:38:28] it's at https://www.gentoo.org/glep/glep-0076.html [07:38:30] #link https://www.gentoo.org/glep/glep-0076.html [07:38:39] yep :) [07:38:46] yes, I'm looking at https://www.gentoo.org/glep/glep-0076.html [07:38:59] I'm fine to vote now [07:41:40] back [07:41:52] robbat2: any comments on glep 76 before voting? [07:42:19] i also disagree w/ open source vs free software, but understand why the change for consistency [07:43:00] esp that the social contract definition invokes OSI [07:43:10] so what it calls 'free software' is really what OSI calls open source [07:43:27] yep [07:44:17] so noted [07:44:28] please vote aye / nay on glep 76 [07:44:44] aye [07:45:58] aye [07:46:38] #agreed Glep 76 is accepted [07:46:53] antarus: did you vote? [07:46:54] ulm: congratulations on your hard work driving this process [07:46:56] i don't see it above [07:46:58] do I need to vote? [07:47:01] I didn't see a vote [07:47:03] thanks [07:47:04] it'd be good [07:47:07] aye [07:47:10] :D [07:47:30] much cats were herded [07:47:53] #info Bug 659620 - Please look into possibilities of providing crypto/enhanced security hardware to developers [07:47:55] antarus: https://bugs.gentoo.org/659620 "Please look into possibilities of providing crypto/enhanced security hardware to developers"; Gentoo Foundation, Proposals; IN_P; mgorny:trustees [07:47:56] ulm: the fun is just starting, now changes get to be implimented :P [07:47:58] #link https://bugs.gentoo.org/659620 [07:48:06] oh thanks willikins [07:48:18] prometheanfire: yeah, that will take some time [07:48:28] repoman, mainly [07:48:35] sure [07:48:56] antarus: my main comment for the token, is I'm not sure the use case [07:49:09] do we want it for gpg, or 2fa? (or both) [07:49:09] b-man's two motion texts were only in trustees email [07:49:25] i'd like them copied here for the record [07:49:33] (i'll paste if no objections) [07:49:42] please do (aye) [07:49:53] Motion: I move that the board vote to accept the offer from Yubico or [07:49:53] Nitrokey and begin our agreement with the accepted vendor beginning 1 [07:49:54] September 2018. This motion will provide security tokens to all current [07:49:54] developers listed in Gentoo's LDAP infrastructure as of 31 August 2018. [07:49:54] Motion: I move that the board vote to maintain the aforementioned [07:49:56] agreement in order to support future Gentoo developers with security [07:49:58] tokens. This motion includes the right to terminate future purchases [07:50:01] based on the Foundation's financials. [07:50:25] we could change the dates, I supposed [07:50:28] ya [07:50:44] but I'm still not sure what problem it's an attempt to solve [07:51:21] it's just trying to encourge better GPG practice [07:51:23] I know mgorny was testing 2fa [07:51:29] not trying to solve general 2FA requirement [07:51:31] The yubico keys were approximately 6600$, the nitrokeys were 4700 (both for a count of 150) [07:51:33] ok [07:51:39] (sorry both in USD) [07:51:48] nitrokey would dropship too [07:52:15] dropship and we're not on the hook for all of them, incremental billing [07:52:21] for gpg only purposes I have my vote ready on the two motions [07:52:32] (i'm going to have to go in a moment) [07:52:44] #info: We will publish the actual agreements, if possible, post meeting [07:53:33] I propose 3 votes [07:53:51] 1) Should we spend foundation funds to buy keys for Gentoo developers? [07:54:00] 2) Yubico or Nitrokey? [07:54:11] 3) the second b-man motion, essentially [07:54:17] i have a 4th vote to add [07:54:24] (as the first motion is only for existing developers) [07:54:30] or rather, it's a clarification of vote text [07:54:34] shoot [07:54:39] Trying to wrap this up in the next 5 minutes ;) [07:54:57] 1) Should we spend foundation funds to buy keys for Gentoo developers, for GPG signing? [07:55:03] ack, sgtm [07:55:06] 4) Should we spend foundation funds to buy keys for Gentoo developers, general 2FA? [07:55:18] k [07:55:29] antarus: you good with that #4? [07:55:35] Yes [07:55:40] Please vote on the first motion. [07:55:48] aye on #1 [07:55:53] aye to the ammended first motion [07:55:56] aye [07:56:10] #agreed We shall spend foundation funds to buy keys for Gentoo developers, for GPG signing. [07:56:49] 2) Given the two vendor options as secured by b-man, please vote by saying "yubico" or "nitrokey" [07:57:04] #2: nitrokey [07:57:05] #info vendor selection: Yubico or Nitrokey? [07:57:19] aye for nitrokey [07:57:24] nitrokey [07:57:34] #agreed We will more forward with the Nitrokey agreement [07:57:49] (yubico is better hardware choice I feel, but cannot ship to some of our developers and has other non-hardware downsides like open source concerns) [07:58:19] #info Do we agree to maintain the nitrokey agreement for potential future developers? [07:58:26] please vote aye or nay [07:58:29] robbat2: ack [07:58:37] aye [07:58:48] aye, for 12 months subject to renewal by later trustees [07:59:08] aye [07:59:23] #agreed The agreement shall cover potential future developers and will require annual renewal [07:59:30] sgtm [07:59:43] #info (4) Should the foundatoin spend funds to purchase hardware tokens for 2FA purposes? [07:59:57] nay, needs more clarification on usage / need [08:00:19] infra input there would be helpful [08:00:36] The only existing 2FA is blogs, github, and d.g.o (but not git.g.o) [08:00:39] (iirc) [08:00:47] nay, because the hardware options aren't solidified enough yet (no FIDO2 options per my other email) [08:01:00] nay for basically the same reasons [08:01:10] hopefully some tokens covering the new standards come out soon [08:01:13] gitolite has 2FA support, but no SSO-like integration which makes it really painful [08:01:32] specifically it's NOT SSH 2FA, it's a seperate layer [08:01:54] ya, I would like fido2 + gpg [08:01:55] #info Motion 4 failed to be accepted [08:02:31] #info prometheanfire update on wiki copy? [08:02:41] #link https://bugs.gentoo.org/662182 [08:02:47] sure [08:02:47] re the keys, I have a statement as treasurer I'd like on record [08:03:12] robbat2: go [08:03:35] if devs retire less than 6 months after having the key, i'm going to ask they wipe & ship it back to (exact locations to be decided later, to avoid international shipping) [08:03:43] after that, i intend to write off the cost [08:04:04] ok [08:04:17] if the return shipping cost is too high, it's an writeoff already [08:04:36] (because it's cheaper to ship a new unit to somebody else) [08:04:46] Return and ship out again cost [08:04:54] I emailed the whois contact (best I could find), reply was automated to go to a web form for contact, I did that, have not recieved a response, I think we need to escelate next, though I just checked and 404 https://www.linuxsecrets.com/gentoo-wiki/ [08:05:07] prometheanfire: excellent [08:05:38] I'm goign to skip jmbsvicetto for robbat2; any treasurer updates? [08:05:47] so they didn't respond but did act, I cc'd the trustees for my email, but I pointed to the name/usage guidelines for how they could come in compliance (and to the wayback machine as an example) [08:05:54] #info Treasurer updates [08:06:15] treasurer: thanks to NeddySeagoon for his work collecting in-kind history from wiki+public cvs [08:06:16] prometheanfire: that is similar to my experience when sending out these notifications [08:06:34] further collection is needed from infra inventory emails, infra cvs&git history [cfengine/puppet] [08:06:41] and old infra logs [08:06:52] on the assignment of value to machines [08:07:18] i have spoken to several sponsors so far, and they ask that I come up with a consistent form request for them to pass to their accountants/finance people [08:07:48] so far that's packet.net, OSL, bytemark, SevenL [08:07:55] that I asked about it [08:08:21] all of those were verbal discussion; packet & OSL were in person [08:08:35] (during open source summit conference) [08:08:59] that's all on the treasurer front [08:09:07] are we having a motion on the RFP? [08:09:31] my suggestion these is to use robbat2's suggestions with it [08:09:36] My preference is to send it out before the next board meeting [08:09:42] I was going to ask where it was at ;) [08:09:52] atm it's on K_F's site [08:10:19] #link https://dev.gentoo.org/~k_f/irs-rfp-wip2.pdf [08:10:19] there's latex source for it [08:10:24] was the last copy I have available [08:10:29] #link https://download.sumptuouscapital.com/gentoo/irs-rfp.pdf [08:10:37] that's 'current' [08:10:53] ya, latex is in get, somewhere [08:11:13] Original proposer here in regards to bug 645192. By "GPG competence" I mean that the prospective new member knows enough about GPG to actually sign the quiz when submitting it as part of their application. [08:11:15] Shentino: https://bugs.gentoo.org/645192 "Staff quiz and gpg competence should be required for foundation membership"; Gentoo Foundation, Proposals; CONF; shentino:trustees [08:11:45] robbat2: basically I think we need to amend the RFP with your draft comments, check the RFP in somewhere we know [08:11:56] sgtm [08:11:57] and we can do the motion over email on the nfp list [08:12:05] copy git history to our own repos [08:12:09] edit, publish [08:12:24] wfm [08:12:25] that other RFP that I saw during the week may have some further improvements too [08:12:36] who is owning that set of work [08:12:41] robbat2: do you have bandwidth for it? [08:13:07] (feel free to say no) [08:13:27] i do not have time presently [08:13:35] and I have to leave the meeting now [08:13:39] for kids [08:13:40] bye [08:13:48] ok [08:13:51] cya ;) [08:14:04] (for next meeting, weekend of the 20th or 27th plz) [08:14:11] -*- antarus will find someone [08:14:19] October is...a bad month for me ;) [08:14:36] #info bugs [08:14:38] I closed a bunch [08:14:43] the end [08:14:57] :D [08:15:00] I just closed mine [08:15:04] I'll post the logs, the motions, the emails, the agenda, and the topic [08:15:06] cause..why not [08:15:19] lol [08:15:33] prometheanfire: next meeting, any preference? [08:15:41] I suspect i am in europe both 20 and 27th [08:16:02] I'm doing wedding stuff 18-23 [08:16:18] other than that am open [08:16:28] so of the 20th and 27th, you prefer the latter? [08:16:36] yes [08:16:38] ack [08:16:53] -*- antarus bangs gavel [08:16:55] #endmeeting [08:16:55] Meeting ended Sat Sep 15 23:16:54 2018 UTC. Information about MeetBot at http://wiki.debian.org/MeetBot . (v 0.1.4)