[16:37] <mdeslaur> yes, it'll be awesome for confining apps in user mode
[16:38] <mdeslaur> and after that, I'll continue going down the CVE list
[16:38] <mdeslaur> and, of course, I will be attending uds
[16:38] <mdeslaur> that's it from me, sbeattie, you're up
[16:38] <sbeattie> I'm again focused on apparmor related items this week, specifically focused on the security-s-appisolation-sdk blueprint
[16:38] <sbeattie> I'm currently working on getting easyprof to support json input
[16:39] <sbeattie> I'll also be attending uds this week
[16:39] <sbeattie> that's pretty much it for me... tyhicks?
[16:39] <tyhicks> I'm working on https://blueprints.launchpad.net/ubuntu/+spec/security-s-appisolation-dbus-performance
[16:39] <tyhicks> I gathered performance numbers late friday and over the weekend and I'm analyzing them now
[16:40] <tyhicks> I need to circle back around to the dbus policy language thread on the apparmor list and see if we can get a consensus on how the dbus rules should be structured and then make those changes
[16:41] <sbeattie> ah yeah, I need to focus some more time there as well.
[16:41] <tyhicks> also, I'd like to start fixing one of the known performance problems in how we're doing the AA access checks in dbus
[16:41] <tyhicks> (and then rerun the tests)
[16:41] <tyhicks> I'll be attending UDS as well
[16:41] <tyhicks> that's it for me
[16:42] <tyhicks> sarnold: I think you're up and then we can come back to jj
[16:43] <sarnold> I'm in the happy place this week; I'll be spenidng most of my time reviewing jj's patches, but I'll probably dust off my auto* and m4 knowledge and fake python 3 porting knowledge and review someof the patches sent last week .. or two weeks back ..
[16:44]  * tyhicks still needs to send a few prereq patches for dbus support in apparmor
[16:44] <sarnold> I'm also going to look at mdeslaur's upstart patches, though earlier versions looked pretty well baked, it feels like that ought to go quickly
[16:44] <jdstrand> actually, we missed chrisccoulson
[16:44] <sarnold> and I'll be doing UDS :)
[16:44] <jdstrand> ah, sorry, sarnold is still going (sorry)
[16:44] <sarnold> chrisccoulson: you're up, hand the baton to jj when he shows up :)
[16:45] <chrisccoulson> hi :)
[16:46] <chrisccoulson> so, i spent some time last week getting more familiar with chrome, following the discussions from the sprint
[16:46] <chrisccoulson> i've put that to one side now to handle the regular firefox  and thunderbird updates
[16:46] <chrisccoulson> which are nearly done
[16:46] <sarnold> (woot)
[16:47] <chrisccoulson> although, been hitting a hang frequently in raring. it turns out this is a glib bug, and i think explains some of the recent bug reports i've been getting (bug 1179554)
[16:48] <chrisccoulson> also, the arm builds failed because some jit tests timed out. i reproduced the same failures on my pandaboard at the weekend, and verified that lengthening the timeout fixes it
[16:48] <chrisccoulson> also working on an embargoed update
[16:48] <chrisccoulson> i think that's me done
[16:48] <chrisccoulson> jjohansen, i think it's your turn now :)
[16:48] <jjohansen> hey
[16:49] <jjohansen> so I will be working on my apparmor bp work items
[16:49] <jjohansen> https://blueprints.launchpad.net/ubuntu/+spec/appdev-s-appisolation-signals-ipc-ptrace
[16:50] <jjohansen> I have some prep to do for tomorrows apparmor IRC meeting
[16:51] <jjohansen> and I need to finish finding/fixing a bug with the default profile, that made its way into the most recent devel kernels
[16:52] <jjohansen> I think that is it for /me
[16:52] <jjohansen> jdstrand: back to you
[16:52] <jdstrand> [TOPIC] Highlighted packages
[16:52] <jdstrand> The Ubuntu Security team will highlight some community-supported packages that might be good candidates for updating and or triaging. If you would like to help Ubuntu and not sure where to start, this is a great way to do so.
[16:52] <jdstrand> See https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures for details and if you have any questions, feel free to ask in #ubuntu-security. To find out other ways of helping out, please see https://wiki.ubuntu.com/SecurityTeam/GettingInvolved.
[16:53] <jdstrand> http://people.canonical.com/~ubuntu-security/cve/pkg/tomboy.html
[16:53] <jdstrand> http://people.canonical.com/~ubuntu-security/cve/pkg/xmp.html
[16:53] <jdstrand> http://people.canonical.com/~ubuntu-security/cve/pkg/pwlib.html
[16:53] <jdstrand> http://people.canonical.com/~ubuntu-security/cve/pkg/gnome-shell.html
[16:53] <jdstrand> http://people.canonical.com/~ubuntu-security/cve/pkg/inetutils.html
[16:53] <jdstrand> [TOPIC] Miscellaneous and Questions
[16:53] <jdstrand> I had one for sbeattie: were you able to finish your easyprof templates?
[16:54] <sbeattie> jdstrand: not quite, still finishing those up as well
[16:54] <jdstrand> ok
[16:54] <jdstrand> Does anyone have any other questions or items to discuss?
[16:55] <sarnold> I'm curious about our proposed favored ssl/tls bindings in our SDK.. do we have an API there that's better than OpenSSL's for application authors to use?
[16:56] <sarnold> do we get some nice ones for free with Qt/QML? or are they just thin wrappers around the painful API? :)
[16:56] <jdstrand> sarnold: Qt has some, yes
[16:56] <jdstrand> QML is just presentation, so it doesn't have anything
[16:57] <jdstrand> well, it is more than just presentation
[16:58] <jdstrand> but what I meant is that to get to the Qt SSL bits you need to write C++, but we don't expect many apps to be written in that (but it is there if they need it)
[16:58] <sarnold> hrm.
[16:59] <jdstrand> the webkit view should just handle that all transparently
[16:59] <jdstrand> sarnold: it might be worth asking the sdk team about. they are quite responsive
[16:59] <sarnold> for webby things, perhaps, but apps will likely have structured data that they want private and authenticated...
[16:59] <sarnold> jdstrand: aha, got a favored contact?
[17:00] <jdstrand> sarnold: I'd go to bzoltan
[17:00] <sarnold> jdstrand: thanks :)
[17:00] <jdstrand> np
[17:01] <jdstrand> mdeslaur, sbeattie, tyhicks, jjohansen, sarnold, ChrisCoulson: thanks!
[17:01] <jdstrand> #endmeeting
[17:01] <sarnold> thanks jdstrand :)
[17:01] <jjohansen> thanks jdstrand
[17:01] <sbeattie> jdstrand: thanks!
[19:56] <pitti> hello
[20:01] <pitti> oh, so mdz and cjwatson are out
[20:01] <soren> o/
[20:01] <pitti> kees, stgraber: ?
[20:04]  * stgraber waves
[20:06] <pitti> hm, so cjwatson was chair originally, and seems kees is out, too
[20:06] <pitti> so I guess I'm next in line
[20:07] <pitti> #startmeeting
[20:07] <meetingology> pitti: Error: Can't start another meeting, one is in progress.
[20:07] <pitti> oh
[20:07] <pitti> hm, who started this?
[20:07] <pitti> meetingology: help
[20:07] <meetingology> pitti: (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
[20:07] <stgraber> #endmeeting
[20:07] <meetingology> Meeting ended Mon May 13 20:07:45 2013 UTC.
[20:07] <meetingology> Minutes (wiki):        http://ubottu.com/meetingology/logs/ubuntu-meeting/2013/ubuntu-meeting.2013-05-13-16.31.moin.txt
[20:07] <meetingology> Minutes (html):        http://ubottu.com/meetingology/logs/ubuntu-meeting/2013/ubuntu-meeting.2013-05-13-16.31.html
[20:07] <pitti> ah, merci
[20:07] <pitti> #startmeeting
[20:07] <meetingology> Meeting started Mon May 13 20:07:53 2013 UTC.  The chair is pitti. Information about MeetBot at http://wiki.ubuntu.com/meetingology.
[20:07] <meetingology> Available commands: #accept #accepted #action #agree #agreed #chair #commands #endmeeting #endvote #halp #help #idea #info #link #lurk #meetingname #meetingtopic #nick #progress #rejected #replay #restrictlogs #save #startmeeting #subtopic #topic #unchair #undo #unlurk #vote #voters #votesrequired
[20:08] <pitti> #topic action review
[20:08]  * pitti looks for "See previous meeting "
[20:08] <pitti> https://wiki.ubuntu.com/TechnicalBoard/TeamReports/April doesn't exist
[20:09] <pitti> nor https://wiki.ubuntu.com/TechnicalBoard/TeamReports/13/April
[20:09] <pitti> assuming "no actions"; stgraber, soren, do you remember any?
[20:09] <soren> I don't even remember whether I was there :-/
[20:10] <pitti> #topic SRU request for custom unity-greeter indicators
[20:10] <pitti> (mopping up mailing list now)
[20:10] <pitti> I already replied on the ML; soren, stgraber, do you have any objections/points to discuss ther?
[20:10] <pitti> e
[20:10] <soren> No, I've got half a reply written up already anyway.
[20:11] <stgraber> pitti: last meeting was 10min long, no action and no agenda
[20:11] <stgraber> pitti: I'm fine with discussing on the mailing-list
[20:11] <pitti> formally, one ack is enough anyway, but more opinions can't hurt
[20:12] <pitti> #topic openssl as a system library
[20:12] <pitti> TBH, I read the mail and half of Colin's reply, but I must say this legal mock attacking is slightly beyond me :/
[20:13] <pitti> I find the Debian stanza way too extreme; I consider this incompatibility a bug, it has obviously not been designed to exclude free software from using each other; but I have no legally sound counterarguments
[20:15] <soren> Fedora considers it a system library, right?
[20:15] <pitti> yes
[20:15] <soren> Or did I misunderstand that somehow?
[20:15] <soren> Ok.
[20:16] <pitti> this is exactly the kind of legal loophole which indicates to me that this whole conflict is just an unintended side effect (aka bug) of the two licenses
[20:16] <soren> I've been inclined to agree, but ISTR Colin having sound arguments against it.
[20:16] <pitti> I'm curious whether there has been any actual uproar from OpenSSL's upstreams about linking with GPL programs
[20:16] <stgraber> pitti: oh actually my statement that the past meeting was 10min long and without action/agenda was wrong, that was the one before last. Last meeting was during the Canonical sprint and did happen, though it looks like Colin didn't get to post the minutes.
[20:17] <soren> Well, the conflict between the licenses it pretty clear.
[20:17] <pitti> I wouldn't like to come to a conclusion about this without cjwatson, so I propose to move that to the next meeting and/or email
[20:17] <soren> GPL clearly says that you can't put forth further restrictions, while the OpenSSL license says that you must include some notice about it being used.
[20:18] <stgraber> so based on what I saw on the mailing-lists and discussed in person with cjwatson last week, it sounds like squid may be a case where it's fine to allow linking with SSL on the basis that upstream is fine with this but can't reach all copyright holders to add the exception
[20:18] <pitti> soren: yes, but the GPL itself enforces the mentioning of the license/copyright of the program, so in practice it's the very same "restriction"
[20:18] <stgraber> for the other one (mongo I believe), IIRC upstream clearly stated in the bug report that they're not willing to change the license and that someone should contact their legal or sales department
[20:18] <stgraber> which makes it sound like this is a case where we really shouldn't let it link against SSL
[20:19] <pitti> so forcing distributors to mention the GPL and copyright while denying it to software using different FOSS licenses doesn't make sense
[20:19] <pitti> stgraber: yes, I know; as I said, I have no firm legal arguments against that, but it still feels just plain stupid and against the spirit of the licenses
[20:20] <pitti> cf. bug in the licenses
[20:20] <soren> pitti: IIRC, GPL doesn't force you to do that. It says "should", doesn't it?
[20:20] <soren> pitti: It doesn't even do that.
[20:21] <pitti> it is a must clause for interactive programs at least
[20:21] <soren> pitti: It says that that's how you apply the license to your program. It's not a requirement of the license itself.
[20:23] <soren> They're instructions for licensors.
[20:23] <stgraber> anyway, I agree with pitti that we definitely want to have cjwatson present before we make a decision on this, so should probably defer to the next meeting (unless we can come to an agreement on the mailing-list)
[20:23] <pitti> well, how is "applying a license to a program" any different than "the license itself"
[20:23] <soren> Not requirements of the licensee.
[20:24] <pitti> ok, so let's carry this to the next meeting then, I'll put it on the agenda
[20:24] <soren> Very well.
[20:24] <pitti> #topic SRU approved without waiting in unapproved
[20:24] <pitti> that was Riddell's request
[20:24] <pitti> I responded by email already
[20:25] <soren> Yo did?
[20:25] <pitti> in short, I'd consider it an invalid workaround for long SRU waiting queues, and replacing one problem with a much worse one
[20:25] <soren> I didn't see a response from you. Not that I recall at least.
[20:25] <soren> Nope.
[20:25] <soren> Nothing.
[20:25] <pitti> oh?
[20:25] <pitti> Date: Fri, 10 May 2013 13:25:48 +0200
[20:25] <pitti> From: Martin Pitt <martin.pitt@ubuntu.com>
[20:25] <stgraber> I see it
[20:25] <soren> orly?
[20:25] <soren> Weird.
[20:26] <pitti> https://lists.ubuntu.com/archives/technical-board/2013-May/001615.html
[20:26] <soren> Never received that. How odd.
[20:26] <stgraber> I agree that we have one problem which is the time it takes for something to hit -proposed but the way to fix that is with more people looking at the queue not by bypassing it
[20:26] <pitti> anyway, if anything I think this should be discussed with the SRU team instead of circumventing peer review
[20:27] <pitti> yeah, the turnaround should not exceed half or perhaps one week
[20:28] <pitti> I'll mail the SRU team and discuss with them, with TB in CC:
[20:28] <stgraber> sounds good
[20:29] <pitti> #action pitti to start ubuntu-sru delay discussion by email
[20:29] <meetingology> ACTION: pitti to start ubuntu-sru delay discussion by email
[20:29] <pitti> #topic brain storm review
[20:29] <pitti> it's May again
[20:30] <pitti> but I think the last round already showed that there is very little interest from developers in this
[20:31] <pitti> we just got some five responses, and none of them resulted in anything actionable AFAIR
[20:31]  * pitti tries to check wiki, but it currently times out
[20:32] <pitti> does someone volunteer to do another round? or should we just bin this, as it has by and large been replaced with design driven development anyway these days?
[20:33] <stgraber> I think it's time to bin this
[20:33] <soren> If we do stop doing it, we should probably close brainstorm as well.
[20:34] <soren> Otherwise, it's just going to be where ideas go to die.
[20:34] <soren> Even moreso than it was before.
[20:34] <pitti> comparing the absolute numbers of voters from my december 2012 review to the ones I saw a year or two before that also showed radical decline of users
[20:34] <stgraber> I'd be pretty happy with that considering nobody maintains it anyway and bug reports are piling up (it's on a very old Drupal version, full of bugs and requires quite a lot of work to be ported to something supported)
[20:34] <pitti> ack
[20:36] <pitti> ok, so we agree on that: stop brainstorm reviews and brainstorm itself
[20:36] <stgraber> yep
[20:36] <soren> Can we even make that decision?
[20:36] <soren> (the latter, I mean)
[20:36] <pitti> well, we can at least propose it
[20:36] <pitti> not sure who "owns" that
[20:36]  * soren neither
[20:36] <pitti> that = brainstorm.u.c.
[20:36] <soren> probably the CC.
[20:36] <stgraber> well, I'm probably as close to an owner as can be for brainstorm (having started the project and being the only one still vaguely around)
[20:36] <pitti> yeah, good point; I'll mail them
[20:37] <soren> Nope.
[20:37] <soren> Ubuntu QA set it up, apparently.
[20:37] <soren> http://netsplit.com/2008/02/28/ubuntu-brainstorm-announced/
[20:37] <stgraber> soren: correct, brainstorm was initially part of the same service as the QA tracker
[20:37] <pitti> ah, Ubuntu community QA -- ok, I'll forward the proposal to balloons then
[20:38] <pitti> balloons: if you are online, do you have a gut feeling about the fate of brainstorm.u.c.?
[20:38]  * balloons floats in
[20:38] <stgraber> anyway, AFAIK I'm the only admin left for brainstorm and the only few times I logged in recently was to purge some data after IS assigned me some tickets
[20:39] <jcastro> I can take the item to close it/sunset it
[20:39] <jcastro> it was assigned to me a while back
[20:39] <jcastro> and everyone who set it up that I used to work with is gone
[20:40] <pitti> jcastro: it seems both developers and most users have lost their interest in it (not that surprising given how the design process of Ubuntu changed over the years)
[20:40] <jcastro> yeah
[20:40] <jcastro> it's always been an odd site
[20:40] <balloons> pitti, jcastro and stgraber are correct.. It's a nest of unmaintainedness
[20:40]  * balloons notes that's not a word
[20:40] <jcastro> so how do I go about doing this, propose on -devel and go from there?
[20:41] <stgraber> jcastro: right, I just had a quick look at when the other admin logged in and they clearly don't seem very active ;) nand logged in 28 weeks ago so I'm apparently the most active admin with 3 logins this year ;)
[20:41] <pitti> jcastro, balloons: ok, seems we all agree then; can we hand stgraber or you the task to shut it down?
[20:41] <jcastro> yeah
[20:41] <jcastro> I'll take the task, stgraber has more important things to do. :)
[20:41] <pitti> heh
[20:41] <pitti> thank you
[20:41] <balloons> we'll need to mention the proper avenues to push ideas.. aka, join in UDS, mailing lists, etc
[20:41]  * soren hugs jcastro 
[20:41] <pitti> #topic Scan the mailing list archive for anything we missed
[20:41] <pitti> did I miss anything?
[20:41] <jcastro> balloons: yeah I'll handle all of that.
[20:41] <stgraber> jcastro: thanks! let me know if you need any detail on how to actually kill that thing (if we need to extract/archive any data from it)
[20:42] <jcastro> stgraber: I'd like to see if we can do a readonly dump of it or something, I'll ask IS
[20:43] <pitti> #topic community bugs
[20:43] <pitti> zarro
[20:43] <pitti> #topic chair for next meeting
[20:43] <pitti> carrying over cjwatson?
[20:43] <pitti> #topic AOB
[20:43] <stgraber> no, he chaired the last meeting
[20:43] <stgraber> (during the sprint)
[20:43] <pitti> oh, ok; kees then
[20:44] <pitti> un
[20:44] <pitti> deux
[20:45] <pitti> trois
[20:45] <pitti> le fin
[20:45] <pitti> #endmeeting
[20:45] <meetingology> Meeting ended Mon May 13 20:45:22 2013 UTC.
[20:45] <meetingology> Minutes (wiki):        http://ubottu.com/meetingology/logs/ubuntu-meeting/2013/ubuntu-meeting.2013-05-13-20.07.moin.txt
[20:45] <meetingology> Minutes (html):        http://ubottu.com/meetingology/logs/ubuntu-meeting/2013/ubuntu-meeting.2013-05-13-20.07.html
[20:45] <pitti> thanks everyone!
[20:45] <stgraber> thanks pitti!
[21:31]  * Daviey curses himself for missing the meeting.