[FFmpeg-devel] Mailing List Delay

[Michael Niedermayer]

On Wed, Aug 04, 2021 at 04:17:53PM +0100, Derek Buitenhuis wrote:
> On 8/3/2021 11:59 PM, Michael Niedermayer wrote:
> > somehow this reads a bit offensive to me, iam not sure its meant to
> 
> It's not meant as an attack towards you pesonally, but rather to point out
> the absurdity of the situation:

ill try to reply to as much as i have time ATM
brevety is due to lack of time not lack of will to write a nicer reply


> 
> * There is no public documentation on:
>     * Who owns the physical infra.

its all donated one way or another IIRC, 
I am a bit hesitant to post a names who provide the servers in public
for the main server i think its all on the mailing list. Our fate
machiene is seperate and provided and payed for by a FFmpeg developer
Theres also a server hosting backups, that reminds me that the backups
should be tested. That requirres a volunteer probably


>     * Where it is located or who hosts it.

traceroute ffmpeg.org points to telepoint.bg


>     * Who has admin access and how to contact them.

project server line in MAINTAINERS file, not everyone is active but even inactive
ones can help in an emergency potentially


>     * Any way to audit admin access.

What do you mean by "audit admin access" ?


>     * Who to contact in case of issues.

root at ffmpeg.org and if that doesnt work the people listed in MAINTAINERS
directly via mail or IRC or if you know phone# and its critical SMS


> 
> * There is no monitoring of infra at all. Stuff does down for hours and it
>   doensn't get fixed until somene figures out who to poke so they can manually
>   fix it.

Its a open source project, setup some monitoring and make it tell admins


> 
> * There is no auto-restat after crashes.

thats not true. Many daemons do auto restart, some do not because thats how
their defaults are. There are security implications with auto restarting and
for the case where it happened (a out of memory issue) auto restart would not
have solved it


> 
> * Nobody is forthcoming with logs to help debug the issue, if there even are
>   logs, and if we even know who has access. See point one. We are totally reliant
>   on what the admin thinks it may be.

I posted some logs now. And yes i avoid posting logs because it provides alot
of details about the servers configuration. Such details can be useful to an
attacker. Also there can be privacy issues with posting logs

All this said, the truth with open source projects probably is as long as
it works well enough noone volunteers to help. 
ALso we seem to fail in quickly informing all the admins on an issue
maybe we should setup a mail alias / forwarding thingy elsewhere than
ffmpeg.org so the admins can be reached when the server is down

Thanks

[...]

-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Avoid a single point of failure, be that a person or equipment.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
URL: <https://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20210805/efe04ad1/attachment.sig>