On Wed, Aug 04, 2021 at 04:17:53PM +0100, Derek Buitenhuis wrote: > On 8/3/2021 11:59 PM, Michael Niedermayer wrote: > > somehow this reads a bit offensive to me, iam not sure its meant to > > It's not meant as an attack towards you pesonally, but rather to point out > the absurdity of the situation:
ill try to reply to as much as i have time ATM brevety is due to lack of time not lack of will to write a nicer reply > > * There is no public documentation on: > * Who owns the physical infra. its all donated one way or another IIRC, I am a bit hesitant to post a names who provide the servers in public for the main server i think its all on the mailing list. Our fate machiene is seperate and provided and payed for by a FFmpeg developer Theres also a server hosting backups, that reminds me that the backups should be tested. That requirres a volunteer probably > * Where it is located or who hosts it. traceroute ffmpeg.org points to telepoint.bg > * Who has admin access and how to contact them. project server line in MAINTAINERS file, not everyone is active but even inactive ones can help in an emergency potentially > * Any way to audit admin access. What do you mean by "audit admin access" ? > * Who to contact in case of issues. r...@ffmpeg.org and if that doesnt work the people listed in MAINTAINERS directly via mail or IRC or if you know phone# and its critical SMS > > * There is no monitoring of infra at all. Stuff does down for hours and it > doensn't get fixed until somene figures out who to poke so they can manually > fix it. Its a open source project, setup some monitoring and make it tell admins > > * There is no auto-restat after crashes. thats not true. Many daemons do auto restart, some do not because thats how their defaults are. There are security implications with auto restarting and for the case where it happened (a out of memory issue) auto restart would not have solved it > > * Nobody is forthcoming with logs to help debug the issue, if there even are > logs, and if we even know who has access. See point one. We are totally > reliant > on what the admin thinks it may be. I posted some logs now. And yes i avoid posting logs because it provides alot of details about the servers configuration. Such details can be useful to an attacker. Also there can be privacy issues with posting logs All this said, the truth with open source projects probably is as long as it works well enough noone volunteers to help. ALso we seem to fail in quickly informing all the admins on an issue maybe we should setup a mail alias / forwarding thingy elsewhere than ffmpeg.org so the admins can be reached when the server is down Thanks [...] -- Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Avoid a single point of failure, be that a person or equipment.
signature.asc
Description: PGP signature
_______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
