2020-05-05 heroes meeting [19:56:27] good evening [19:57:45] HI [19:59:47] Hi [19:59:53] good morning [20:01:14] good afternoon [20:01:35] hi everybody, and welcome to the heroes meeting! [20:01:48] kl_eisbaer: fwiw, if this keeps happening, I *will* make a JeOS image [20:01:55] two questions in parallel: [20:02:01] I know how to since I maintain kiwi in fedora ;) [20:02:03] - who is here for the meeting and [20:02:13] - does someone from the community have questions? [20:02:17] me [20:02:19] Me [20:02:24] Me [20:02:27] I'm here! :) [20:03:08] hello everybody. [20:03:13] hello? [20:04:44] is that a community question? :P [20:05:04] HI [20:05:17] hi [20:05:32] lcp: it seems to become a tradition that we don't have community questions - but I'd love to be proven wrong ;-) [20:05:52] actually yes [20:05:54] I can ask community questions if you want [20:05:56] you did have community questions when I was the community [20:05:59] I am not a hero :P [20:06:18] Hi! [20:06:21] who are you, Redtigra? I'm unfamiliar with your nick [20:06:30] though I can guess who gp_ is :D [20:06:44] gp -> great person? :-) [20:06:49] indeed [20:06:50] I am a (relatively) new team lead of Engineering Infra SUSE [20:06:53] all these new people though :) [20:07:22] jdsn's and mcaj's boss, if they don't mind. very young hero embrion :) [20:07:30] glad to meet you all [20:07:53] glad to have you all here ;-) [20:07:57] hello, nice to meet you :) [20:08:02] and my boss :-) [20:08:10] it's always nice to meet SUSE folks :D [20:08:38] yes, bmwiedermann's too :) [20:09:03] I would be better to meet F2F on openSUSE conference but that not going to happen this year... [20:09:11] cboltz: let's get through the topics, because I feel we have a big one at the end [20:09:19] right [20:09:37] let's do a *quick* round of status reports - and then focus on the account system [20:09:47] so - does someone have a status report? [20:09:50] cboltz: I've also got one (though not exactly a community questions). :-) Happy to have that at the end. [20:10:19] I had report. [20:10:35] go ahead ;-) [20:10:55] Last weeks, We already migrate new progress. I hope get less complaint and bug. [20:11:21] if you have found any error, please update this ticket: https://progress.opensuse.org/issues/65456 [20:11:32] some last issue have been solved. [20:11:40] that from me. [20:12:00] If here any I can help, something with container. I will be glad to help [20:12:10] :D [20:12:38] next. [20:12:59] tuanpembual: thanks for new progress, it looks great :) [20:13:03] for the new freeipa, and the rest of the stuff, it was deployed and followed by the very popular announcement on the mailing list [20:13:22] and matrix + riot are setup for when we have saml and/or oidc to connect to it [20:13:32] thanks King_InuYasha [20:13:37] 🔥 [20:14:08] that's it for me :P [20:14:32] I've been working with lcp on some bug squashing with ipsilon (id.i.o.o / f-s.i.o.o) [20:14:51] things are in (mostly) good shape, and once we go into production, I'll cut the 3.0.0 release officially based on that [20:15:36] I'm in touch with rhbz devs, and they're going to be releasing rhbz source in the coming days [20:15:50] from there, we can look to adapt for susebz to shift to saml2 auth [20:16:40] fedora-aaa and lcp and I are in touch now and actively collaborating on features and configuration details [20:16:46] quite a surprising announcement, not expected that this week [20:17:03] I was pretty pleased too :) [20:18:06] working on some stuff in pagure for the upcoming code.i.o.o and dist.i.o.o instances, we'll see how that goes [20:18:43] oh, and working with lcp on freeipa porting to opensuse... good progress is made, perhaps we'll have it in a year :) [20:18:48] that's it for me :) [20:19:12] I moved www.o.o from Provo to Nuremberg ~2 weeks ago, and besides /searchPage/ (which I wasn't aware of, and hot-fixed) everything went smooth :-) (no serious 404s in the error_log) [20:19:40] Note that www.o.o/openid/ is still proxied to the server in Provo - that's something we'll need to change [20:20:03] cboltz: lcp and I are working on a replacement for that, it's... ugly :( [20:20:16] cboltz: I am working on openid setup for our new bugzilla-ldap [20:20:37] King_InuYasha: sounds interesting[tm]... [20:20:45] s/bugzilla-ldap/community-accounts/ :) [20:21:10] * jdsn is just trying to get rid of the term "bugzilla account" :) [20:21:15] haha [20:21:27] still better than "Novell account" ;-) [20:21:38] well, yes, but we can do better :) [20:21:41] I still have my email saying welcome to your novell account :P [20:21:50] lol [20:21:50] * adrianS would name jdsn's "community-accounts" instead "developer accounts" since they are used for all development topics, inside and outside of suse ... [20:22:02] and partners [20:22:07] did you mean Micro Focus/NetIQ/Novell/SUSE/openSUSE accounts? :P [20:22:07] >_> [20:22:16] >_< [20:22:37] yep, still the same database, just migrated now [20:22:41] adrianS: and probably also bugreporters and forum users, so not only developers ;-) [20:22:51] and wiki people too :) [20:22:58] did we shift to that topic already? [20:23:04] bugreporters for sure ... not sure if forum and wiki will use it? [20:23:05] well, and also future chat infra, and meet.o.o etc [20:23:18] or using independ account database? [20:23:21] and code/dist too [20:23:31] jdsn: depends - does someone have a status report _not_ related to accounts? [20:23:41] if yes, please speak up *now* ;-) [20:23:48] adrianS: Per said he was trying. [20:24:27] oh yeah, we have auth setup on forums [20:24:34] forgot about that :P [20:24:49] robin_listas: you mean trying to use a login proxy? [20:25:02] lcp: that was the *first* thing we did :P [20:25:05] for forums? [20:25:17] kinda important, since that allows us to move forums from provo at last [20:25:25] yup [20:25:59] I would have some status reports - but I guess everyone wants to focus on IDM. So fine with me (less to type ;-) [20:26:16] kl_eisbaer: well, if you have stuff to tell us, please do so :D [20:26:27] I will just send my reports to the mailing list, I guess that's easier. [20:26:42] also an option, whatever you prefer ;-) [20:26:56] King_InuYasha: well: the current Fedora installer seems not to like my static IP configuration :-/ [20:26:59] adrianS: He said "we expect to hook the forums into the above too (Nuernberg datacenter) [20:27:12] kl_eisbaer: :( [20:27:15] cboltz: I prefer to go to bed early ;-) -> Email [20:27:32] ok, then I'm looking forward for your mail(s) ;-) [20:27:41] King_InuYasha: I will try again, but IMHO I did nothing different than the last time. I'll keep you updated once the machine is available [20:27:55] kl_eisbaer: if f32 isn't working, f31 is fine [20:27:57] we can upgrade after [20:28:04] robin_listas: and he is still trying or give up? or needs some help? [20:28:09] King_InuYasha: I'm down to 31 already :-/ [20:28:12] oh dear [20:28:27] kl_eisbaer: it didn't work with f32 I take it? [20:28:32] I guess I will trash the qemu config and start from scratch - something seems fishy [20:28:37] yeah, that's odd [20:28:39] Dunno. YOu will have to ask him. That was this morning when he said this. [20:28:43] if you need help, let me know later :) [20:28:52] I'll do my best to assist [20:31:44] cboltz: ? IDM ? [20:31:46] given the silence for > a minute, let's officially switch the topic to the account system [20:31:57] yes ;-) [20:32:01] IDM/IDP: then maybe I can start and quickly share what we did the last days/weeks: [20:32:05] here we go [20:32:08] https://jdsn.de/ucs-setup-simplified.png [20:32:18] we were setting up the Univention servers and then making sure we can bring all our data home into the NUE data center [20:32:25] so we had to make sure that all this is setup for the Bugzilla move on the coming weekend [20:32:29] thats what kept us busy days 'and nights' ... [20:32:41] for many services this will mean just a small config change [20:32:57] but as the schedules are no longer that tight as they were until yesterday, we have now time to spread the switch of services using that authentication backend step by step [20:33:57] alright, I am actually very curious about your current system first and foremost [20:33:59] the diagram is very simplified, it should just show that we remove any dependency from MF and Novell-Servers and other datacenters [20:35:11] so basically (and even more simplified) s/Novell account/SUSE account/ ? [20:35:30] I assume your new system is email based and not username based, how does username mapping work to the existing services [20:36:04] bugzilla is email-based, all other systems afaik are uid based [20:36:08] I assume based on the lack of username entry in the register and login fields on suse.com ;) [20:36:23] it is the same data as until now, except for the password. [20:36:26] well, obs is username based at the moment [20:36:30] we do not map, we use the same data [20:37:07] it looks like scc is moving to email based (which makes me happy) [20:37:24] * King_InuYasha is still annoyed that his suse account is ngompa when it's for his partner-related work [20:37:53] scc is using Okta, but this is out of scope for development work and IMHO also for opensuse cost wise .... [20:38:02] thank goodness [20:38:11] I don't want to deal with Okta more than I already have to [20:39:44] btw, we will switch first internal services tomorrow to the new system of jdsn to see how it works in real life [20:40:08] wait, what? [20:40:10] why? [20:40:21] fingers cross [20:40:28] also, what are "internal services"? [20:40:39] SUSE-internal [20:40:48] our internal Build-Service e.g. [20:40:52] ah okay [20:40:53] does that include switching over internal openQA? :D [20:41:18] not tomorrow :) [20:41:40] I see, I see [20:42:18] jdsn: how much has the timeline been loosened? [20:42:20] alright, so I would like to know what the goals are for switching over openSUSE stuff [20:42:48] the migration phase "can" happen until end of June [20:42:54] but that is a very hard stop [20:43:09] we want to move as much services as possible in the next 2 weeks [20:43:16] we = SUSE internal [20:43:20] sorry [20:43:47] I'll answer about timeline [20:43:49] and I would recommend to also move the openSUSE services rather early because there is one good reason: [20:43:53] And I would like to move build.opensuse.org also asap to avoid that we run into problems due to different new accounts ... [20:44:10] (same login name, but different user) [20:44:27] it came out, that auth backend is required to be cut off till May 18th for Bugzilla only [20:44:30] people who do not have a valid email address set in their account (and wont change it because they would loose access to their bugzilla entries) will have to migrate their account [20:44:37] adrianS: sounds unlikely - account creation is currently broken :-/ [20:44:51] that's Bugzilla cut over requirement, not the whole auth. [20:44:55] this migration works with the old AccessManager still in place and with your old credentials - and this without a password reset mail [20:44:57] cboltz: well, that is good from this POV :) [20:45:11] after end June we can only offer password reset mails [20:45:27] Redtigra, jdsn: so lcp and I have been mostly operating under the assumption that everything needs to cut over in two weeks [20:46:01] as Daniel said, we'd like to complete migration as earlier as possible to a) avoid two accounts and b) to have some time in case things go wrong at some place/moment [20:46:09] adrianS: that's the only positive thing about the broken account creation... [20:46:19] cboltz: I agree [20:46:20] King_InuYasha: so were we until yesterday :) [20:46:28] think how well I slept last night [20:46:29] King_InuYasha, so did we :D [20:46:32] :) [20:47:01] so, on our side (oS Heroes), lcp and I had been working on decoupling from Novell accounts since late 2018 [20:47:31] in January, we started working with the Fedora AAA folks to enumerate our requirements and mesh them into their solution that they were developing to replace FAS [20:47:39] (FAS is Fedora Account System, their legacy platform) [20:47:45] and there were 2 reasons, foundation and infra independence [20:48:01] and we grew some more reasons along the way [20:48:38] I see the point - and - I even support it [20:48:41] in February, we enumerated the list of applications we needed to handle for accounts, and in March started working on that effort [20:49:00] on the other hand SUSE is providing services to their communities and employees and customers [20:49:07] the original plan was to split the accounts slowly and cut over by the openSUSE Conference this year [20:49:17] as you might know, heroes internally use freeipa for various parts of IPA management, and we wouldn't like to part ways with that, for now at least [20:49:20] and these are certified, so SUSE must be in control of this idetity system [20:49:43] this requirement does not apply in the openSUSE case, based on the conversation I've had with gp_ [20:49:45] but we can offer to oS to make use of it as oS did until now [20:50:38] so I'm confused why this point was brought up [20:51:02] because outside of bugzilla (which needs special handling anyway), nobody in the community side sees or controls SUSE-internal stuff [20:51:09] only the other way around [20:51:27] well, if you can control the identity, you can become everyone and see all content [20:51:34] hopefully [20:51:40] what makes SUSE more special than openSUSE? [20:51:48] that also not true for Jira/Confluence [20:51:53] which we cannot use [20:52:02] nobody in the community can use or access those systems [20:52:02] a Common Criteria Certification [20:52:04] the certification requires that only written down people can control the identity system who are employees [20:52:15] openSUSE uses neither Jira nor Confluence tho [20:52:25] lcp: but the same account DB is used for both [20:52:31] we don't care about those [20:52:32] community is bigger than oS :) [20:52:37] King_InuYasha: you can not become another identity if you are root on the IDM server? [20:52:51] adrianS: not easily, no [20:53:08] King_InuYasha: that is a few ldapmodify :P [20:53:10] it's possible, of course, but the architecture does not make that simple to do [20:53:30] adrianS: why should oS applications trust SUSE IdM in the same manner? [20:53:39] something like "we don't care about those" makes it harder to consolidate [20:53:49] King_InuYasha: that is a valid question [20:53:54] right [20:53:55] from a user (or customer) perspective it would mean yet another login [20:54:06] but we would have to split that stuff either way, due to foundation stuff [20:54:09] however, if we decide for a split, it means we also need to split bugzilla and some OBS content [20:54:24] basically we would work more seperate and less together [20:54:39] jdsn: my experience in Fedora ecosystem has shown that it works quite well with FAS and RH/Customer and RH/Employee being separate [20:54:54] IMHO the opposite should be the goal .... as we see with the "open SUSE bugs" discussion [20:55:36] then the question becomes, should we unite under SUSE? or under openSUSE? [20:55:51] thats also my take, and also the goal of the closing the leap gap project [20:55:54] my feeling is that we should unite under openSUSE, and federate SUSE into openSUSE [20:55:56] we would need seperate instance and write some additional code to be able to connect accounts [20:56:04] all doable, but not cheap [20:56:11] adrianS: lcp and I have already been thinking about it and working on it [20:56:28] we knew going in that we'd have to solve this, and we assumed that this is something we need to do [20:57:12] you mean connecting accounts, not building up new bugzilla and OBS servers, right? [20:57:14] yes [20:57:31] I maintain enough OBS servers :) [20:58:22] the openSUSE accounts system that lcp and I have been working on basically non-stop for two months is very extensible [20:58:40] and our goal is that SUSE Linux 16 platform will let use switch fully over to openSUSE Leap 16 for the infra [20:58:53] we will aggressively switch things over to openSUSE Leap as it becomes technically feasible [20:59:35] we are using Fedora servers for now to speed up deployment, and it helps with working with our friends in Fedora on this [21:00:53] adrianS, jdsn: this work is also how I've made the biggest push to get Red Hat to release the sources for Red Hat Bugzilla [21:01:01] I vote for fewer accounts not more. [21:01:16] which includes their multi-auth module for Bugzilla [21:01:20] I think we can have such a discussion at a given time, the topic now should be to plan for the switch of the openSUSE services to Univention - because the timer is ticking [21:01:21] using SAML 2 [21:01:41] me too, that's why heroes accounts would be merged with this systems so we would have total of the same number of accounts [21:01:55] not more [21:01:56] nothing prevents us from separating after the Univention system is live [21:02:44] and with less dependecies now it should be even easier technically [21:02:47] lcp: for everyone who works for suse it means more accounts not less. [21:02:52] you should really see both sides [21:02:58] yes, I do think we should do it after, however I can already hear adrianS complaining about this :P [21:03:11] we can target sso.opensuse.org to the univention server [21:03:11] me to :) [21:03:22] I even see pros and cons for both sides [21:03:26] that way applications don't have to be aware once we switch the backends [21:03:30] so even I am split :) [21:03:52] as someone who is both a suse partner/customer and opensuse contributor, I *really* prefer those two being split [21:04:18] well then, maybe get OBS to support more protocols, so we can have multiple openid connect providers there [21:04:20] again: I see this as topic for later [21:04:21] but I recognize others care otherwise [21:04:21] King_InuYasha: and I would even prefer to have just 1 account for all suse stuff [21:04:25] *really* [21:04:34] omniauth would support this [21:04:34] the new schedule gives us more time, but lets not waste it now [21:04:49] jdsn: how far along are you on the data import for openSUSE data? [21:04:59] lcp: again, it is not about the protocols in first place, that is really a detail. It is about the trust of the content [21:05:05] King_InuYasha: its done :) [21:05:16] if you can bridge the ldap endpoint into heroes servers, we can make sso.os.o talk to it and provide saml2, oidc, and openid [21:05:24] and given that one can become root on many systems via OBS I am indeed really conservative, I admit [21:05:39] but it is not my decision at the end of the day [21:05:47] Univention already offers saml [21:05:51] but I want to make sure that all sides understand what they are doing ... [21:05:53] and openid connect [21:06:04] jdsn: but not plain openid [21:06:13] I get it, I get [21:06:14] and I think connecting to our endpoint will result in fewer app changes [21:06:19] correct, thats what Bernhard is working on ;) [21:06:24] but given the certifications, it *will* mean we need to build up new OBS and bugzilla instances [21:06:36] King_InuYasha: ok, also good point [21:06:38] at least as long as SUSE says that these certifications are important [21:06:50] jdsn: and if you want, you can deploy ipsilon internally for suse openid [21:07:01] it's free software: https://pagure.io/ipsilon [21:07:05] adrianS: I wonder where in OBS there is anything hidden tbh [21:07:06] no we dont [21:07:19] lcp: for security updates under embargo [21:07:34] oh, really? [21:07:35] and we would need to rethink some syncing stuff IMHO [21:07:51] yes, all can be done, but it has consequences [21:07:56] jdsn: I'm also packaging it for openSUSE, though some small work needs to be done to fix the configs and such [21:07:59] I can guarantee that kind of assurances/certifications will remain relevant for a long time. [21:08:00] and means work :) [21:08:12] hm, that does make sense, I was always thinking this is done in IBS instead [21:08:26] I assumed this work was done in IBS as well [21:08:37] King_InuYasha: not if the target is opensuse [21:08:43] at work, I tended to use the cross-system copypac to push out publicly [21:08:44] lcp: well, would be an option to do it only in IBS and not include community maintainers anymore [21:08:55] but IMHO not wanted [21:09:12] adrianS: if you're involving community maintainers already, what's the net-change on the situation? [21:09:16] well, Leap stuff is synced from SLE, so how does that collaboration work [21:09:27] King_InuYasha: it is only on topic and it is documented [21:09:39] it is not that multiple people can see *everything* [21:09:39] lcp: not all of it. [21:09:58] same for bugzilla [21:10:05] that's true, but this seems like the goal of jump :P [21:10:11] that are not my rules, just like common criteria is designed ... [21:10:23] but we need to ensure to follow the rules ... with blood [21:10:49] consequences of a violation are not really nice ... [21:11:07] I know :( [21:11:16] I've had to follow those rules before [21:11:31] personally I thought all your freeipa+ipsilon work was just for heroes stuff not for all of opensuse TBH [21:11:31] I know what they are and how to deal with many of them [21:12:11] i mean did you ask what the suse plans are before starting what with the work? [21:12:13] darix: some of it, yeah [21:12:22] darix: we *did* [21:12:25] aha [21:12:26] for almost a year [21:12:38] nobody ever responded to any inquiry by us [21:12:45] who did you ask?:) [21:13:00] jdsn: :D [21:13:27] we have tried *very* hard to consider everything when we started this work _last year_ after oSC [21:13:53] just curious you never spoke to me about it after osc :) [21:14:10] lcp: that was not "for years" ;) I am in the team since last October :) [21:14:15] I should have asked during oSC >:D [21:14:25] * adrianS whished he knew that so many people would join FreeIPA work that would have maybe changed the decision last year, since we evaluated it as well ... [21:14:27] I forgot tho, and had to run do a talk anyway [21:14:40] adrianS: freeipa suse platform was merged in [21:14:40] and yes, I meanwhile found your mail - it was directed to me alone :( [21:14:41] jdsn: no, we asked you recently, yeah [21:15:03] adrianS: thanks principally to lcp (with me helping a bit) we now have scaffolding in freeipa [21:15:13] King_InuYasha: it is not SLE maintained since we don't have enough maintainer power internal [21:15:19] I worked on getting it ready [21:15:20] yeah, yeah [21:15:26] and it is getting backported to the next freeipa 4.8 release and obviously 4.9 [21:15:27] As a general recommendation: Don't run into timeouts, find alternate comms (means of comms or contacts). [21:15:31] so we just had the chance to employ new people for it or to buy in support [21:15:41] freeipa actually was rejected in the internal evaluation [21:15:46] adrianS: ^ [21:15:54] for technical reasons [21:16:00] well, not technical rejected, it was a support topic in first place [21:16:14] so we actually looked at it [21:16:19] gp_: actually, we didn't really know who to contact either [21:16:32] lcp: in doubt the board [21:16:40] we definitely talked to the board [21:16:42] they knew [21:16:43] we really only got jdsn after kl_eisbaer pointed at them [21:16:56] * adrianS did spoke also with the old board about IDM system last year just for the record ;) [21:18:02] clearly I should have asked rb about it too >:D [21:18:04] but frankly, in the current situation, I would like to stay away for the past anlyses and like to find what we do now to rescue the situation in first place [21:18:32] lcp: I've been handling a load of (MF) IT related escalations the last seven months, cboltz felt some pity for me. That one did not come up as one. [21:18:33] afterwards one can do a better critic with some distance .... [21:18:59] Yeah, and it's not I am asking for more escalations. :) [21:19:00] lcp: and sorry again, that question hit when I was too busy because we were under high pressure - I still have hundreds of unread mails ;) [21:19:20] at least concretely, what we can do is set up an sso.opensuse.org instance talking to UCS [21:19:36] and move all the apps on openSUSE side to sso.opensuse.org [21:19:38] yeah, I still have the virtue of being able to respond to my emails in under 10 seconds :P [21:19:52] lcp: we can hire you. would make that problem go away ;) [21:19:58] * King_InuYasha has almost 100 folders and filters so that he can respond quickly [21:19:58] lucky you ;) [21:20:04] jdsn: bmwiedemann: when do you think you can have sso.opensuse.org running with ucs? [21:20:21] I also filter, I did not even count the unread in the folders ;) [21:20:23] I will count that as the second time I was asked to work for SUSE darix even if it was a joke :P [21:20:41] * King_InuYasha is actually amazed lcp doesn't work for SUSE at this point [21:20:55] tbh: we need to focus on the internal services next week [21:20:56] But let's take Redtigra up on her offer last week and/or use me (in case it is needed - no hurt feelings if not ;-). [21:21:02] somewhen after bugzilla and OBS switch? [21:21:11] but after that we can find out whats needed to make it happen [21:21:24] bmwiedemann: moving the vhost to you is relatively easy [21:21:33] we wouldn't move the vhost [21:21:39] there'd be no point [21:22:10] it would need access to our DMZ though [21:22:22] jdsn: yeah, that's the tricky bit [21:22:30] or it could be routed externally [21:22:39] King_InuYasha: what would run on sso.opensuse.org ? [21:22:43] ipsilon [21:23:01] ipsilon is not strictly tied to freeipa [21:23:11] ic [21:23:12] it's _easiest_ with it, but it can work with generic ldap and krb5 [21:23:15] King_InuYasha: last year you told me that ipsilon requires freeipa [21:23:36] that's before puiterwijk told me how to do it without freeipa [21:23:56] and that would allow us to actually set up our own applications instead of having to ask you for it :P [21:23:56] it's much more annoying and manual, and some features go away, but it works [21:24:28] King_InuYasha: JFYI: UCS comes with konnect ( https://github.com/Kopano-dev/konnect ) so it could do openid too [21:24:33] problem would be (maybe) that this vhost would need to be under exclusive control of eng-infra team [21:24:44] konnect does not do openid [21:24:45] because you could sniff passwords there, right? [21:24:57] adrianS: not with https [21:25:03] King_InuYasha: you could in the app. [21:25:04] :) [21:25:17] yes [21:25:24] and UCS has saml [21:25:36] yes it is openid connect. to be exact. [21:25:38] darix: you better not be suggesting we make all the contributors for all the third party apps made by _not us_ to port away from regular openid? [21:25:46] openid connect != openid [21:25:54] completely different protocol [21:26:00] i am aware [21:26:06] and UCS could have all that you contribute to it, they are developing it openly on github.com and very welcome PRs [21:26:13] that is understood, bmwiedemann is therefore working on openid (not connect) [21:26:43] jdsn: I am one of the maintainers for ipsilon itself upstream, why would I also do that?! [21:27:11] why shouldn't you? [21:27:16] I don't have time :) [21:27:21] if ipsilon does openid, we might also be able to use that. [21:27:35] it definitely does, most fedora apps are openid [21:27:46]