--- layout: post title: Logs for the Kovri Dev Meeting Held on 2017-03-26 summary: Brief review of what has been completed since last meeting, Monero HackerOne Bounty, and code & open tickets discussion tags: [dev diaries, i2p, crypto] author: dEBRUYNE / fluffypony --- *March 26th, 2017* # Logs **\** 1. Greetings **\** 2. Brief review of what's been completed since the previous meeting **\ {-vtnerd}** oh I guess there is one more thing. the backend was going to hopefully push updates to connected clients **\** 3. Monero HackerOne Bounty https://www.reddit.com/r/Monero/comments/5zmywx/monero_bounty_for_hackerone/ **\ {-fluffypony}** ok anonimal, all yours **\** 3. Code + ticket discussion / Q & A **\** 4. Any additional meeting items **\** 5. Confirm next meeting date/time **\** Greetings. **\** hey! **\** Hi **\ {-olark}** o/ **\** Sweet olark **\ {-olark}** Yeah I missed the monero meeting unfortunately :/ **\ {-olark}** I'll read the logs **\** Really good meeting **\** On topic please **\** 2. Brief review of what's been completed since the previous meeting **\** https://forum.getmonero.org/9/work-in-progress/86967/anonimal-s-kovri-full-time-development-funding-thread?page=&noscroll=1#post-90733 **\** ^ for a summary on my part **\** moroccanmalinois has done some great work since the previous meeting. We have a new utility binary with multiple features. He's also done work elsewhere in the codebase. **\** :) **\** guzzi has also contributed to the utility binary. guzzi can you link to your FFS if you're doing work summaries/reports? **\** What does this utility binary do, in a nutshell ? **\* anonimal** wants to say ./kovri-util -h **\** I will add summary tonight **\** On phone **\** OK, I'll try to pull someday and check :P **\** guzzi: then give us a tl;dr for point 2. please **\** moneromooo base32, base64, routerinfo( reads a RI file) and su3file (reads an su3file) **\** and the crypto benchmark **\** Added benchmarks to utility **\** guzzi: I already said that, didn't you do other things too? Like research, etc.? **\** Starting in on instance class refactor a d todos **\** Researched address book for possible lmdb **\** Sgould be easy **\** Should **\** What should be easy? None of that looks easy... **\** Anyway, we'll save that for later. Anything else on point 2.? **\** Relatively easy from db perspective. Difficult from kovri perspective yes **\** 3. Monero HackerOne Bounty https://www.reddit.com/r/Monero/comments/5zmywx/monero_bounty_for_hackerone/ **\** fluffypony: ^ thoughts? **\ {-fluffypony}** so my thoughts is that we should just do a general fund across all the projects **\ {-fluffypony}** because HackerOne let's us basically apportion stuff as needed **\ {-fluffypony}** so we don't have to give out the entire bounty for some stupid XSS attack **\** Ok. I'll have to talk with them about setting up Monero. Do we include the GUI into /monero or create /monero-gui? We can probably wrap it into /monero if needed. Do we create /monero-site ? **\ {-fluffypony}** anonimal: everything goes under the Monero umbrella / bounty, right? **\ {-fluffypony}** just that each actual sub project can be represented **\** I'm speaking purely about H1 accounts. **\** We do whatever we want with fund management. **\** fluffypony: it's possible but then all monero developers have access to all bug reports for all subprojects **\** So that brings up a trust issue. I'm fine with the idea but it should be mentioned. **\ \* fluffypony** ponders **\** Also I'd like to have access to the account as account holder. This is something I couldn't do if we throw into one account. **\** And whoever is the account holder for all subprojects has *that* responsibility. And if the single account is ever compromised... **\** In other words, it's not very decentralized in terms of who controls accounts. **\ {-fluffypony}** anonimal: doesn't really matter if it's compromised, because there's no money there? **\** fluffypony: it's about access to reports. If we don't care about who has access to reports, then there's not much reason to use HackerOne **\ {-fluffypony}** mooneroo: for the monero-project GitHub account the core team all have the password, because there's no easy way to share that control otherwise - could we not do the same for H1? **\** I mean, there are features/benefits, but access to vulnerabilities is a big issue. **\ {-fluffypony}** amongst maintainers I mean **\** pinging mooneroo or moneromooo? **\** We could do that I think. **\** Well, some members of hte monero core team are pretty much inactive AIUI. So no need to get them access to this. **\ {-fluffypony}** whoops **\ {-fluffypony}** I meant anonimal **\ {-fluffypony}** sorry ignore typo **\ {-fluffypony}** anonimal: for the monero-project GitHub account the core team all have the password, because there's no easy way to share that control otherwise - could we not do the same for H1? **\ {-fluffypony}** moneromooo: would be among maintainers **\ {-fluffypony}** lol **\ {-fluffypony}** the core team have passwords for stuff like this as a fallback **\** I don't think inactive people should have access to H1. Only on a as-needed basis. Maybe when they become active again? **\* moneromooo** misread anonimal's ping, nevermind **\** The drop dead theory **\ {-fluffypony}** ^^ **\ {-fluffypony}** it's just an anti-bus factor **\ {-fluffypony}** the main people using it would be maintainers, which are currently just me and anonimal **\** I was given access a while back (though might have been rescinded by now). **\** No, you have access to kovri **\ {-fluffypony}** and I don't think there's a big issue with maintainers having visibility on other reports **\** As does EinMByte but is he still alive? **\** Alright, so any other big issues with merging everything into a single account? **\** And how many subprojects do we apply this too? I can PR the VRP to all appropriate subprojects and update docs as needed. **\ {-fluffypony}** we can always split it out later **\ {-fluffypony}** I think the only relevant projects are: GUI, CLI, Kovri, site **\** I imagine the site and forum could gain from this too. **\ {-fluffypony}** forum is being deprecated, so let's leave it off **\ {-fluffypony}** but there will be some forum functionality moving into the site (FFS in particular) **\ {-fluffypony}** so keeping the site there is necessary **\** Ok **\ {-fluffypony}** anonimal: maybe an infrastructure one too, which is pigeons' domain? **\** Nodepool code perhaps? **\** Meh. And no real maintainer. **\** Snipa's work **\ {-fluffypony}** @JacobJeweler no, that's not a core project **\ {-fluffypony}** external projects can do their own H1 stuff **\** fluffypony: sure, as long as we can communicate that to people e.g., use the Meta repo has a point of contact + place to post VRP etc. **\ {-fluffypony}** I think we should come up with a paragraph for the READMEs **\** Ok. We need the VRP somewhere though. It's solid (moreso than having nothing). **\** we lost irc2p again **\ {-pigeons}** ok i'll file a few reports as someone else for a bounty then **\ {-fluffypony}** works here pigeons **\** One thing also that's probably needed: a list of "this does not count". Like all that's known already. **\ {-pigeons}** hmm yeah, just some selective drops, oh well **\** But this is easily a bone of contention otherwise. **\** moneromooo: that's included in H1. We can incorporate that into one of the features they have. **\ {-fluffypony}** moneromooo: agreed **\ {-fluffypony}** every report is subjective **\** (iirc) **\** Ok, so I will contact them and move these into a single account. **\** And do all the related things necessary. **\** As for funding, **\* anonimal** reads backlog for fluffypony's message **\** "general fund across all projects" **\** Ok, **\** separate from the dev fund? i.e., separate address too? **\ {-fluffypony}** this will be an FFS **\ {-fluffypony}** just open-ended with some minimum **\** Ok, so no separate donation address. All FFS, and funds are held like the dev fund? **\** (or like any FFS project) **\ {-fluffypony}** yes **\ {-olark}** How much money should we aim to raise for H1? **\ {-olark}** Assuming this will need to be replenished every now and then. **\ {-fluffypony}** I have no idea - suggestions? **\** https://forum.getmonero.org/6/ideas/87597/monero-bounty-for-hackerone suggested 500 total for all projects **\** (500 XMR) **\* anonimal** checks value **\ {-fluffypony}** olark: yes but bounties are normally denominated in USD **\ {-fluffypony}** so potentially it wouldn't need to be replenished, or hardly **\ {-fluffypony}** unless we have lots and lots of exploits **\** Hmmm... well, at current price, 500 seems reasonable IMHO. That could attract some serious researchers. **\** Thoughts? **\ {-olark}** Probably easier to outline what the rewards should be for LOW, MEDIUM, and HIGH severity of vulnerabilites and then figure out how much money should be raised. **\** We don't have X thought: X being how many of Y. **\** *though **\** If we run out of the fund, we can always open a new FFS. **\ {-olark}** 500 xmr seems like a good start anyway. **\ {-fluffypony}** yeah let's just stick to that and see how it goes **\** Ok **\ {-olark}** Right. **\** Awesome. Anything else on point 3.? **\ {-fluffypony}** next? **\** Do we extend 20 minutes or are we screwed because of earlier? **\** There are two point 3s. **\** Extend, and whoever wants to leave leaves :) **\ {-fluffypony}** we can extend to finish up, but let's do it ASAP so I can move on to tagging and releasing **\** lol, yes. Github turns that into 4 if I copypasta. If I get original text, it's 3. **\** 4. Code + ticket discussion / Q & A **\** Damn, well, I could easily spend 20-30 minutes on this point because we haven't had a meeting in so long. **\* anonimal** grabs link instead **\** Ok, here we are https://github.com/monero-project/kovri/issues?q=is%3Aopen+is%3Aissue+milestone%3A0.1.0-alpha **\** A little question about the reload : what is supposed to happen if no param changed ? **\** #187 isn't as obvious as I had hoped. I'll have to approach it differently, from the basics, and start by actually getting some unit-tests for ntcp. **\** if the user didn't specified a port, should it get a new random one ? **\** So that will be fun. **\** As for #340, #369 is moot because of the other open ticket for cutting out all unnecessary sig types, **\** #305 should actually be closed for now, **\** guzzi is working on #96. It's not mandatory for 0.1.0-alpha release so I may move it to next milestone, **\** #9 needs review and may not really be needed after all **\** I can work on those unit tests for ntcp if u want **\** No that's fine guzzi, thank you. **\** All that leaves is #46 and #362 **\** ajs is on #46. He's supposed to be in talks with pigeons I think. I haven't heard from ajs in a little while though. ping ajs. **\** #362 comes at the very end once we tag. I'll throw it on AUR and away we go. **\* anonimal** reads moroccanmalinois's lines **\** moroccanmalinois: if no port specified in config, that would be a default option. I don't like that though. **\** What I think we should do is add a default random port to the config somehow. **\** Otherwise we jump through these kinds of hurdles. But doing that for binary releases... hmm... **\ {-olark}** We could just set a random port when a new router context is initialized. **\** moroccanmalinois: worst case scenario, if the app is still running during restart (assuming because client and core are the only things being restarted), we reuse the previous port. **\** ok **\ {-olark}** It currently just defaults to 0 afaik. **\** ? **\ {-olark}** In router context. **\ {-olark}** m_Port **\ {-olark}** Assuming we are talking about the same thing. **\** Nope, you're not looking in the right area. **\ {-olark}** k **\** I can explain more after the meeting. moroccanmalinois can probably too because it sounds like he understands the design as well. **\** m_Port == 0 means choose a random one. another question : i read somewhere in the java doc about a "Laptop mode", i think the pb it tries to solve is more about dynamic ips. Is it on the roadmap ? **\** Nope, not on the roadmap but it can be. **\** Just open a feature request. **\** :) ok **\** it was just brought to my attention yesterday? that there's a ticket for pr'ing the logo - i was under the impression that my involvement with that was done, but looks like there's some miscommunication and i can get around to that soon-ish **\** Anything else on point 4.? We don't have to rush this part if needed. **\** What/ **\** ? **\** Link? **\** Learning the instance class **\** what what **\** Anyone apposed to creating member variables for router context and client context. **\** And giving them proper constructors **\** It was a todo to find out why they are this way currently **\** guzzi: please provide line number and file **\** pero: what's your question? **\** there is no question **\** guzzi: for the TODO **\** pero: there's a question mark. What is your point? **\** where is there a question mark **\** After "yesterday". **\** Looks like a typo for "". **\** this is ticket discussion isnt it - i was chiming in on something that was ostensibly assigned to me without my knowledge **\** anonimal: pigeons said he got a server for #46, but waiting for access to move over files **\** pero: nothing was assigned to you **\** ajs: ok thanks **\** alright well i guess there's nothing to do then **\** Instance.cc **\** Initialize function **\** First comment inside **\** Sorry github mobile has no li e numbers **\** Line **\ {-fluffypony}** ok maybe this discussion should happen later when you're at a computer, guzzi **\** Good idea. **\ {-pigeons}** i'm gonna confirm some things from ya'll in a few, fqdn and git repo to pull from **\** Anything else on 4.? **\** I will comment in the pr later **\** guzzi: I know what you're talking about and see what you want, let's talk more later **\** Cool **\** 5. Any additional meeting items **\** No additional items from me afaict **\** One last question : an external app that wants to use kovri (like monero GUI), should it includes only the libs ? or it can include things from src/app ? **\** Nothing from app. I see no reason for it to include anything from app. **\** Which means we get things out of app that we need elsewhere. I wrote TODO's. **\** Perfect. thx **\** Anything else on 5.? **\** not for me **\** k **\** 30 seconds... **\** 6. Confirm next meeting date/time **\ {-fluffypony}** 2 weeks (tm) **\** 18:00 UTC two weeks from today as usual? **\** Ok **\ {-fluffypony}** April 9th **\** Thanks everyone