ChanServ changed the topic of #freedesktop to: https://www.freedesktop.org infrastructure and online services || for questions about freedesktop.org projects, please see each project's contact || for discussions about specifications, please use https://gitlab.freedesktop.org/xdg or xdg@lists.freedesktop.org
alanc has quit [Remote host closed the connection]
Traneptora has joined #freedesktop
alanc has joined #freedesktop
brodie_ has quit [Remote host closed the connection]
olivial has quit [Remote host closed the connection]
olivial has joined #freedesktop
dan_ has joined #freedesktop
dan_ has quit []
snetry has joined #freedesktop
sentry has quit [Ping timeout: 480 seconds]
fantom has quit [Ping timeout: 480 seconds]
<xe>
i have found a workaround, GNOME is contacting GitLab security
fantom has joined #freedesktop
Zathras_11 has joined #freedesktop
Zathras has quit [Ping timeout: 480 seconds]
atticf has quit [Ping timeout: 480 seconds]
i-garrison has quit []
atticf has joined #freedesktop
Haven0320 has joined #freedesktop
i-garrison has joined #freedesktop
alarumbe has quit []
AbleBacon has quit [Quit: I am like MacArthur; I shall return.]
swatish2 has joined #freedesktop
<bentiss>
deploying the wokaround on our gitlab instance (though not entirely sure it'll solve 100% of the cases)
<bentiss>
keeping the banner a little bit longer, even if the attack stopped a while ago
sima has joined #freedesktop
fantom has quit [Ping timeout: 480 seconds]
<mupuf>
bentiss: thanks a lot for your continued efforts... and sorry you had to go through that alone :s
<bentiss>
mupuf: no worries, and I wasn't alone, a few people were around helping and cheering (and big thanks to Xe for spotting the issue in the end)
tzimmermann has joined #freedesktop
fantom has joined #freedesktop
<mupuf>
<3
MrCooper_ has joined #freedesktop
krei-se- has quit [Ping timeout: 480 seconds]
swatish2 has quit [Ping timeout: 480 seconds]
MrCooper has quit [Ping timeout: 480 seconds]
swatish2 has joined #freedesktop
cascardo_ has joined #freedesktop
cascardo has quit [Ping timeout: 480 seconds]
cadubentzen1509[m] is now known as cadubentzensick[m]
ximion has quit [Remote host closed the connection]
MrCooper_ is now known as MrCooper
mvlad has joined #freedesktop
pjakobsson has quit [Remote host closed the connection]
pjakobsson has joined #freedesktop
a-l-e- has joined #freedesktop
a-l-e has quit [Ping timeout: 480 seconds]
swatish21 has joined #freedesktop
swatish2 has quit [Ping timeout: 480 seconds]
<daniels>
bentiss, xe: thankyou both <3 we don't deserve you
<f_>
01:30 <orowith2os[m]> pmos is too... let me rack my brain and try to see what else is out there.
<f_>
01:30 <orowith2os[m]> (pmos is fine, to clarify.)
<f_>
pmOS's instance is all handled by osuosl, not us
<f_>
but I haven't noticed any slowdowns lately.
swatish21 is now known as swatish2
<bentiss>
\o/ my countermeasure worked: at 10AM I see 2 attempts of exploiting the vulnerability which where not followed by the storm of DoS :)
<f_>
What vuln?
<karolherbst>
TBA
* f_
trying to make sense of the backlog while being half-asleep
jsa1 has joined #freedesktop
<f_>
nasty
<xe>
daniels: i care!
<dabrain34[m]>
hey, has it been considered to have a subscription to an AI agent such as claude or codex in FDO org to provide feedback to MR in term of code review ? It would be very usefull to have a sort of a report telling the developper that this MR is good but misses this and that as suggestions from the AI agent.
<xe>
dabrain34[m]: as someone that is an expert in generative AI, have you heard of alarm fatigue?
<karolherbst>
no project maintainer seems interested so far
<dabrain34[m]>
what do you mean by alarm fatigue ?
<emersion>
notwithstanding other issues with LLMs, i think maintainers would take more time baby-sitting the LLM than anything else
<karolherbst>
Also, not sure if asking a community that gets hammered and DDOSed by AI crawlers is the best place to ask such questions
<xe>
emersion: at work we use such a langle mangle review bot and it has fantastically strange issues that are near impossible to debug lol
<karolherbst>
but are those real issues 🙃
<xe>
karolherbst: for one it gets really inconsistent feedback on the word "colour"
<Venemo>
nice work, bentiss
<Venemo>
what was the solution after all?
<pq>
xe, as some having tried to learn about color management from the past several years, I am not surprised.
<pq>
*someone
<pq>
*for
swatish2 has quit [Ping timeout: 480 seconds]
<dabrain34[m]>
<karolherbst> "Also, not sure if asking a..." <- yes I agree but we should also take advantage of it if it can be useful. I appreciate that my question opened a debate on that
<xe>
Venemo: we're keeping details private until vendors can react and patch
<dabrain34[m]>
<xe> "dabrain34: https://en.wikipedia..." <- we can see that as a linter without consequences
<Venemo>
xe: okay
<Venemo>
I'm just curious
<xe>
either way, i think it will be a rough sell here dabrain34[m]
<Venemo>
was it really coming from an AMD IP address?
<xe>
Venemo: i appreciate the enthusiasm, but this is a 0-day scenario lol
<xe>
some herrings have red scales
<Venemo>
aha
<Venemo>
alright, either way I'm just happy that I could come back to work on a functional gitlab. thanks!
<xe>
if you notice parts of gitlab broken, ping me in here or DM me so I can update documentation
<slomo>
dabrain34[m]: did you ever use such a tool before, e.g. on github? from what I saw so far it just generates immense amounts of noise, and if you're lucky there's one useful piece of information hidden in there for you to find and you probably would've found that faster by just reading the code changes instead. seems completely overrated at this
<slomo>
point and it seems more useful to spend resources and time on more useful things
<dabrain34[m]>
yes I'm using it on my personal compuer and I have to say that several time it spotted issues that was difficult to see reading a large code change. For me it is usefull locally, that's why I'm thinking about it at infra level
<dabrain34[m]>
s/compuer/computer/
<xe>
dabrain34[m]: it's gonna be a very hard sell though
<dabrain34[m]>
what do you mean ? sorry i dont understand the meaning of hard sell ...
<xe>
dabrain34[m]: "a hard sell" is an american english idiomatic expression that roughly means "this is not the target audience for such a thing"
<pq>
dabrain34[m], one is often blind to their own code mistakes, so in that way such experience does not seem surprising. However, I believe practically all projects have another person to review any change who would have spotted the same things. OTOH, if a change is difficult for a person to grap (too big, too complicated), then it would be better to split the change. Someone might trace the introduction of
<pq>
a bug back to the change later, and then they need to figure it out.
<pq>
*grasp
<karolherbst>
Also introducing bugs isn't really our concern, it's more maintainability than anything else
<dabrain34[m]>
Thanks for the clarification. AI is unavoidable in our society, so we should take advantage of it. We can resist and we should to scrappers which are killing our infra but we should not think that it does not exist. We can that as powerful linter
<dabrain34[m]>
I see that as informative but yes the information might overload us. That's why I'm opening the debate
<pq>
I think CI would be several orders of magnitude more efficient use of computing resources than LLMs for software development.
<dabrain34[m]>
github/bitbucket is already having this feature
<dabrain34[m]>
s/is/are/
<xe>
dabrain34[m]: i think that your passion and energy about this topic are better used elsewhere
<dabrain34[m]>
:)
vkareh has joined #freedesktop
guludo has joined #freedesktop
<dabrain34[m]>
* We can view that as
swatish2 has joined #freedesktop
cascardo_ is now known as cascardo
MCDead29Deadpool[m] has joined #freedesktop
<karolherbst>
oh also.. don't click on email links asking you to reset your gitlab password and all that jazz 🙃 I wouldn't be surprised if we'd see more targeted attempts
<xe>
now the way that AI can be useful dabrain34[m] is by using k-means clustering on incoming HTTP requests in order to find things that are common and things that are not
<daniels>
karolherbst: also, protect your account with U2F/FIDO/Solo/Yubikey
<karolherbst>
yeah, I have U2F everywhere
<karolherbst>
also a password manager helps :D
<karolherbst>
just mentioning the pasasword reset things, because others got attacked like that just recently on node
<pinchartl>
dabrain34[m]: acknowledging that LLMs exist doesn't mean they become the perfect solution for any job. not using them is perfectly fine
swatish2 has joined #freedesktop
<bentiss>
pinchartl: there are no reasons for git+ssh to be slow :/
* pinchartl
debugs
<pinchartl>
have you disabled IPv6 access to ssh ?
infernix has joined #freedesktop
<pinchartl>
debug1: Connecting to ssh.gitlab.freedesktop.org [2a01:4f8:c01e:f47::1] port 22.
<pinchartl>
debug1: connect to address 2a01:4f8:c01e:f47::1 port 22: Connection timed out
<pinchartl>
debug1: Connecting to ssh.gitlab.freedesktop.org [138.199.132.39] port 22.
<pinchartl>
debug1: Connection established.
<dabrain34[m]>
<pinchartl> "dabrain34: acknowledging that..." <- I dont mean its a perfect solution but another tool we can use to get better code quality
<pinchartl>
I see way more downsides than upsides at this point
<pinchartl>
(mostly looking at it from a kernel point of view)
<dabrain34[m]>
OOC what are the downsides at kernel point of view ?
<pinchartl>
increasing the work load on maintainers, as explained above
swatish2 has quit [Ping timeout: 480 seconds]
<bentiss>
pinchartl: debug1: Connecting to ssh.gitlab.freedesktop.org [2a01:4f8:c01e:f47::1] port 22. -> looks like it must be coming from your Ipv6 configuration, it works here
<bentiss>
debug1: Connection established.
<pinchartl>
now it works for me too
<pinchartl>
who changed something ? :-)
<zmike>
valentine: okay I'm gonna try to get to the bottom of this cml thing today
<zmike>
but it's gonna take a lot of ci roundtripping
ximion has joined #freedesktop
<valentine>
looking forward to your fix
<zmike>
hopefully there is a fix
<xe>
zmike: you know the best practice for CI roundtripping right?
<xe>
you start with the commit "fix?" and every time you add more question marks
<zmike>
🤔
<xe>
the fun part is that people end up noticing this
<xe>
and one time at a previous job someone sent me a screenshot of that in a slack dm and said "are you okay?"
<xe>
and i replied "am I?"
<xe>
it was one of those glorious errors that only happens off my laptop too :DDD
kode545 has joined #freedesktop
kode54 has quit [Read error: Connection reset by peer]
<Ford_Prefect>
(and I see they have fastly DNS entries, while other fd.o things no longer do)
haaninjo has joined #freedesktop
<bentiss>
Ford_Prefect: {"correlation_id":"0ba22cfd9cce219e06db87ae3742f448","error":"zip: not a valid zip file","host":"docs.pipewire.org","level":"error","msg":"vfs.Root","path":"/page_module_echo_cancel.html","time":"2025-09-15T15:11:08Z"} -> I have a feeling the doc was regenrated somehow while we were down yesterday and is now messed up
<bentiss>
so I guess a restart of the pipeline that uploads it should fix it
<Ford_Prefect>
Ah, let me see if I can retrigger that job
<bentiss>
and FWIW, all pages websites are supposed to be using fastly because we get caching for those static websites