Hi,
On Thu, Aug 13, 2026 at 10:13:26PM +0200, Mark Wielaard wrote:
> Tomorrow is the second Friday of the month, so it is time for the
> Sourceware Open Office again.
For those that couldn't attend, the discussion notes.
Thanks to Claudio for taking notes.
> - ai scraper bot mitigation
> We have a better setup now, but ai scraper bots keep adapting.
> Which layers needs tweaking to give the best performance for users?
- nginx rate limits non "goodguy" addresses
- goodguys are people that log into the services, so it's an
incentive to contribute
- we still need to add a wiki login -> goodguys mapping
[same for patchwork]
- consider allowing git user agent through http but we did have lots
of clone attacks, we could have a grey user agents in addition to
grey locations list. it's hard to setup and causes opportunity for
non isometric attacks
- we could consider adding an "add me to good guys" service with a
challenge mechanism sending an email, adding an ip to a verified
email address. This may conflict with CGNAT as it would link way
too many people with an email [or simply a form where you fill in
your own ip address, and it only works if you are actually using
that ip address].
- Anubis honeypot ip ingestion by fail2ban disabled as it only
increases memory
- Anubis difficulty 5 (javascript) on phones is horrible [lowered to
difficulty 4, but also switched bugzilla and wiki from meta-refresh
to the javascript challenge].
- At FOSSY discussed with others (FSF, Fedora, SFC, ...) how to handle
the botnets. One idea was suing one of the residential proxy
services but it looks like the scum is hard to reach legally.
> - update on Sourceware fundraising
> We got more donations and corporations joining the sponsorship
> program!
[got the actual numbers from Tracy after the meeting, updated below]
- Individual donations increased from ~$250 in May, ~$400 in June, to
~$1200 in July. https://sourceware.org/donate.html
- One corporation sponsorship at Supply Chain Defender level ($5000)
cleared, we should add Open Source Security to the sponsors page
[delayed because of vacation and conference, sorry]
(they have also sponsored cauldron and gcc rust frontend)
- Another corporate at Infrastructure Supporter ($2000) in the pipeline.
- Other corporations interested, but we need to follow up
https://sourceware.org/sponsor.html
- We are currently on track to have more than what we budgeted for
next year https://sourceware.org/financials.html
- We don't express our in-kind donations in money because we don't
know precisely what the companies spend to provide them. But we could show
there's a continuous donation/sponsorship going on.
- We could ask SFC to send yearly "invites" to renew corporate
sponsorships
> - forge updates
> MAINTAINERS.yml to forge user sync.
> Secrets management for production instance.
> What should we prioritize before cauldron?
- check if old emails can be used to gain access to an account and if
so DONT
- we have access to sourceware aliases and can potentially add forge
accounts to all current developers. so use the sourceware user
database (and group id memberships) to designate [email protected]
as forge identities
- we could simply add an inactive account to avoid their email being
used
- emails should not be sent for this
- production secrets shared privately and gitignored.
- Add force-account-request alias
> - the FSF asked us to put our heads together to improve glibc services
> https://inbox.sourceware.org/[email protected]/
- The developers present seemed OK with the status quo. But we are
ready to help with technical, organizational, funding, etc. issues
once FSF and community figure out what they want exactly.
