<jberman> Won't be able to make tomorrow's meeting. Update: we're squaring away final items for beta v3. The rebase onto master was massive and also exposed some issues we needed to solve. There is one remaining Mac specific issue causing failing tests in CI, and we're also looking to get all consensus changes included (including RandomX v2 into the v3). Beta v3 is very close

<rbrunner7> Meeting in a bit more than 1 hour

<jeffro256> Heads up, my internet is very spotty, but I should be present

<rbrunner7> Ok

<rbrunner7> Meeting time. Hello! monero-project/meta #1459

<jpk68:matrix.org> Hello

<jeffro256> Howdy

<vtnerd> Hi

<sneedlewoods_xmr:matrix.org> Hey

<rbrunner7> Alright, on to the reports about last week. @jberman:monero.social can't attend, he left this before the meeting:

<rbrunner7> Update: we're squaring away final items for beta v3. The rebase onto master was massive and also exposed some issues we needed to solve. There is one remaining Mac specific issue causing failing tests in CI, and we're also looking to get all consensus changes included (including RandomX v2 into the v3). Beta v3 is very close

<jeffro256> Will tobtoht and tevador be present today, or are they still out?

<sgp_> Hello

<sneedlewoods_xmr:matrix.org> AFAICT fixed all the AI review comments I received (for 9464, 10232, 10233, 10819), now working on rebasing and fixing conflicts

<rbrunner7> @jeffro256:monero.social: Not sure. Are they expected to attend for something particular?

hi

<jeffro256> Yeah this week we did the fcmp++-stage rebase, and I'm trying to debug a weird Mac-specific bug, probably has something to do with mx25519, but I'm not sure

<rbrunner7> Me: The Polyseed PR was merged :)

<jeffro256> I'd like to discuss monero-project/monero #11288 as it relates to merging a LGLP dependency

<jeffro256> *LGPL

<jpk68:matrix.org> Me: did a bunch of reviews, LLM testing for various patches, worked on improving fuzz testing coverage for multisig code, attempted to learn some math-related stuff (yikes)

<jeffro256> I see that Polyseed was merged. Good work rbrunner

tobtoht is not back to fully available yet

<rbrunner7> Thanks!

<jeffro256> So I guess tobtoht was okay with a copyleft dependency then?

<jpk68:matrix.org> Nope, it was re-licensed to Apache 2.0

<rbrunner7> What is this dependency?

<jeffro256> Ah I see

<jeffro256> Polyseed

<jeffro256> Used to be LGPL

<rbrunner7> Yup, that was a pleasant surprise

I ran a review of fcmp++-stage with latest OpenAI model, it found a couple things that appear serious but no inflation bug

<jeffro256> I'd take that report if that's alright

yes I can send it to you on matrix

<rbrunner7> The whole code? Didn't this burn through tokens like crazy?

<thomasbuilds:matrix.org> selsta: astra?

it was not a complete scan, it hits cyber warning quickly so I try to be careful with how I ask

yes

<jeffro256> cyber warning?

<rbrunner7> This AI stuff asks for brand new talents and capabilities :)

<rbrunner7> On the side of devs

<jpk68:matrix.org> It's like the Bat-Signal /s

cyber warning means it stops as soon as it hits anything related to cybersecurity or something that sounds scary

<jeffro256> isn't that the whole point of doing this?

so you basically have to be some "selected" person with whitelisted account to do proper audits

it still works but I would not call it complete

it triggers randomly

<rbrunner7> Splendid

<jeffro256> ah okay. so it's like KYC for a bug report exchange ;)

<thomasbuilds:matrix.org> selsta: aka only gov/cia or whatever can do proper audits to monero (I bet they already did)

<rbrunner7> Well, we still have paid competent humans to review the code, no?

<rbrunner7> Or better said audit

<thomasbuilds:matrix.org> @jeffro256: still limited, anthropic does so but just with opus 5, not fable, who is much more capable

<rbrunner7> Humans are still in the race

<thomasbuilds:matrix.org> thing is AI are capable to take a thing you think is fine/small and amplify it to a (big) vuln

<rbrunner7> I saw, with AI Polyseed PR reviews, that it's a pretty mixed bag. Sometimes you really don't know what do with some edge cases they come up with

jeffro256: sent everything to you, you can filter what is and what isn't interesting

<jeffro256> okay will do

<jeffro256> thanks

<rbrunner7> If you want to hunt down each and every last case we won't be able to finish larger PRs anymore ...

<rbrunner7> Problem is of course to see what is what

<rbrunner7> People seem to write longer comments ...

<thomasbuilds:matrix.org> yeah though I'm talking about like actual audits of codebase here, where goal are exploits

<thomasbuilds:matrix.org> it takes something you think is fine and creates the entire exploit chain

<thomasbuilds:matrix.org> ofc this is limited with guardrails...

<rbrunner7> Didn't want to claim in any way that these are easy questions. But as I said, if you want to react to everything, you won't finish anything anymore. AI reviews will turn into something like a DOS attack. Just if you near completition, throw another one at the dev.

<rbrunner7> And well, Monero is running for over a decade now without AI code reviews, and damned few exploits. That's not nothing.

<ofrnxmr> If you throw ai at it enough times, it starts coming up with unreachable or nonsense issues

<thomasbuilds:matrix.org> I mean rnn with AI there are so many more CVEs everyday, just look at linux

<ofrnxmr> its good as finding mistakes, but not gets real noisy after a couple rounds

<ofrnxmr> But it* gets

<rbrunner7> Yeah, for Polyseed I do not do some things, fully on purpose, as part of a design decision. AIs may now forever moan about that because they don't get the change.

<rbrunner7> I wonder whether there is a good way to write such things into comments which then the AIs read and "understand" ...

<ofrnxmr> I had an ai review of some of my work that claimed finding 1, then assumed finding 1 (wrong) would be fixed, and then pushed a finding 2 and 3 on the assumption that 1 would be changed to its suggestion

<thomasbuilds:matrix.org> though there are repos out there that are genuinely vuln free as in AI says "no issues"

<jpk68:matrix.org> mrelay.p2pool.observer/m/matrix.org/sOqYfIhyIiElufPhzdNaxGDh.png (clipboard.png)

<jpk68:matrix.org> Keep in mind, we still have a quarter or so left of the year...

<ofrnxmr> @jpk68:matrix.org: They added rust to the kernal in 2026 didnt they 🧠 /s

<rbrunner7> With that rate exploits will fill the known universe in 10 years :)

<rbrunner7> Anyway, interesting discussion, but is there still something important that belongs into this meeting proper?

<thomasbuilds:matrix.org> @thomasbuilds:matrix.org: (randomx, mx25519)

<thomasbuilds:matrix.org> in my testing

<ofrnxmr> (jpk, thats a joke saying that rust is why there is more cves)

<jpk68:matrix.org> @rbrunner7: XKCD 605 ;)

<jpk68:matrix.org> @ofrnxmr: Yes, I know, lol

<rbrunner7> I think I can close the meeting proper while discussions continue. Thanks everybody for attending, read you again next week!

<sneedlewoods_xmr:matrix.org> Thanks everyone

<thomasbuilds:matrix.org> btw I'd like to bring back the question on drahtbot for monero repo?

<jeffro256> nah I'm good, there's already way too many notifications on Github

<jeffro256> If no human deems it worth their time to ping someone to rebase a PR, it's not worth making a bot to do the pinging and spamming everyone involved

<thomasbuilds:matrix.org> all right also worth saying that the drahtbot is supposed to work based off ACK, Concept ACKs, NACK, etc

<thomasbuilds:matrix.org> To be fair these are used somewhat but never consitently

<ofrnxmr> The one feature i liekd about the bot, is that it knows when other open prs conflict

<thomasbuilds:matrix.org> I agree but a bot just for this seems off

<ofrnxmr> Thanks rbrunner

<jeffro256> Thanks everyone

<jpk68:matrix.org> I think it would be good to use "ACK commit-hash" rather than GH approvals, though DrahtBot does seem a bit unneeded

<thomasbuilds:matrix.org> draht bot would put that in stale ACK when commit changes, which is useful imo

<jpk68:matrix.org> It's just more stuff people have to worry about running, with very little benefit

<thomasbuilds:matrix.org> wdym?

<jpk68:matrix.org> Someone has to set up DrahtBot, no? And I think most people here seem to not agree that it'd be helpful

<thomasbuilds:matrix.org> yeah I understand what you meant now

<jpk68:matrix.org> @jeffro256:monero.social Looks like this links to the wrong PR:

<jpk68:matrix.org> monero-project/monero #10965#issuecomment-5765754652

<jpk68:matrix.org> Should be #10964 instead, I think

<thomasbuilds:matrix.org> wdym 10964 is merged

<jpk68:matrix.org> Are you sure?

<thomasbuilds:matrix.org> oops my bad

<thomasbuilds:matrix.org> I had that memory for some reason

<ack-j:matrix.org> I didnt make the meeting but wanted to chime in on the ai reviewing stuff since we (MAGIC) are doing a lot of it.

<ack-j:matrix.org> We have the “cyber” version of claude opus so it will create working exploits to prove vulns are reachable. (Very useful at ruling out false positives). This is what is running on the monero-review repo.

<ack-j:matrix.org> We can try to also get the “cyber” version for openai if needed.[... more lines follow, see mrelay.p2pool.observer/e/5dHK-qwLcF9FM0RD ]

<jpk68:matrix.org> IMO, it is very useful :)