05:21:22 Won't be able to make tomorrow's meeting. Update: we're squaring away final items for beta v3. The rebase onto master was massive and also exposed some issues we needed to solve. There is one remaining Mac specific issue causing failing tests in CI, and we're also looking to get all consensus changes included (including RandomX v2 into the v3). Beta v3 is very close 16:57:12 Meeting in a bit more than 1 hour 17:58:55 Heads up, my internet is very spotty, but I should be present 17:59:38 Ok 18:00:02 Meeting time. Hello! https://github.com/monero-project/meta/issues/1459 18:00:08 Hello 18:00:09 Howdy 18:00:18 Hi 18:00:27 Hey 18:01:32 Alright, on to the reports about last week. @jberman:monero.social can't attend, he left this before the meeting: 18:01:32 Update: we're squaring away final items for beta v3. The rebase onto master was massive and also exposed some issues we needed to solve. There is one remaining Mac specific issue causing failing tests in CI, and we're also looking to get all consensus changes included (including RandomX v2 into the v3). Beta v3 is very close 18:01:35 Will tobtoht and tevador be present today, or are they still out? 18:01:37 Hello 18:01:49 AFAICT fixed all the AI review comments I received (for 9464, 10232, 10233, 10819), now working on rebasing and fixing conflicts 18:02:14 @jeffro256:monero.social: Not sure. Are they expected to attend for something particular? 18:02:14 hi 18:02:22 Yeah this week we did the fcmp++-stage rebase, and I'm trying to debug a weird Mac-specific bug, probably has something to do with mx25519, but I'm not sure 18:02:42 Me: The Polyseed PR was merged :) 18:02:55 I'd like to discuss https://github.com/monero-project/monero/pull/11288 as it relates to merging a LGLP dependency 18:03:02 *LGPL 18:03:10 Me: did a bunch of reviews, LLM testing for various patches, worked on improving fuzz testing coverage for multisig code, attempted to learn some math-related stuff (yikes) 18:03:17 I see that Polyseed was merged. Good work rbrunner 18:03:29 tobtoht is not back to fully available yet 18:03:41 Thanks! 18:04:49 So I guess tobtoht was okay with a copyleft dependency then? 18:05:02 Nope, it was re-licensed to Apache 2.0 18:05:11 What is this dependency? 18:06:34 Ah I see 18:06:36 Polyseed 18:06:43 Used to be LGPL 18:07:11 Yup, that was a pleasant surprise 18:07:21 I ran a review of fcmp++-stage with latest OpenAI model, it found a couple things that appear serious but no inflation bug 18:07:41 I'd take that report if that's alright 18:07:59 yes I can send it to you on matrix 18:08:24 The whole code? Didn't this burn through tokens like crazy? 18:08:24 selsta: astra? 18:08:50 it was not a complete scan, it hits cyber warning quickly so I try to be careful with how I ask 18:08:58 yes 18:09:40 cyber warning? 18:10:01 This AI stuff asks for brand new talents and capabilities :) 18:10:08 On the side of devs 18:10:09 It's like the Bat-Signal /s 18:10:21 cyber warning means it stops as soon as it hits anything related to cybersecurity or something that sounds scary 18:10:38 isn't that the whole point of doing this? 18:10:40 so you basically have to be some "selected" person with whitelisted account to do proper audits 18:10:52 it still works but I would not call it complete 18:10:57 it triggers randomly 18:11:19 Splendid 18:11:50 ah okay. so it's like KYC for a bug report exchange ;) 18:11:53 selsta: aka only gov/cia or whatever can do proper audits to monero (I bet they already did) 18:12:26 Well, we still have paid competent humans to review the code, no? 18:12:36 Or better said audit 18:12:47 @jeffro256: still limited, anthropic does so but just with opus 5, not fable, who is much more capable 18:13:23 Humans are still in the race 18:14:37 thing is AI are capable to take a thing you think is fine/small and amplify it to a (big) vuln 18:15:24 I saw, with AI Polyseed PR reviews, that it's a pretty mixed bag. Sometimes you really don't know what do with some edge cases they come up with 18:15:25 jeffro256: sent everything to you, you can filter what is and what isn't interesting 18:15:45 okay will do 18:15:47 thanks 18:16:25 If you want to hunt down each and every last case we won't be able to finish larger PRs anymore ... 18:16:43 Problem is of course to see what is what 18:21:11 People seem to write longer comments ... 18:21:49 yeah though I'm talking about like actual audits of codebase here, where goal are exploits 18:22:50 it takes something you think is fine and creates the entire exploit chain 18:23:17 ofc this is limited with guardrails... 18:25:01 Didn't want to claim in any way that these are easy questions. But as I said, if you want to react to everything, you won't finish anything anymore. AI reviews will turn into something like a DOS attack. Just if you near completition, throw another one at the dev. 18:26:07 And well, Monero is running for over a decade now without AI code reviews, and damned few exploits. That's not nothing. 18:27:05 If you throw ai at it enough times, it starts coming up with unreachable or nonsense issues 18:27:28 I mean rnn with AI there are so many more CVEs everyday, just look at linux 18:27:40 its good as finding mistakes, but not gets real noisy after a couple rounds 18:28:04 But it* gets 18:28:04 Yeah, for Polyseed I do not do some things, fully on purpose, as part of a design decision. AIs may now forever moan about that because they don't get the change. 18:28:47 I wonder whether there is a good way to write such things into comments which then the AIs read and "understand" ... 18:29:15 I had an ai review of some of my work that claimed finding 1, then assumed finding 1 (wrong) would be fixed, and then pushed a finding 2 and 3 on the assumption that 1 would be changed to its suggestion 18:29:16 though there are repos out there that are genuinely vuln free as in AI says "no issues" 18:29:20 https://mrelay.p2pool.observer/m/matrix.org/sOqYfIhyIiElufPhzdNaxGDh.png (clipboard.png) 18:29:33 Keep in mind, we still have a quarter or so left of the year... 18:30:07 @jpk68:matrix.org: They added rust to the kernal in 2026 didnt they 🧠 /s 18:30:16 With that rate exploits will fill the known universe in 10 years :) 18:30:51 Anyway, interesting discussion, but is there still something important that belongs into this meeting proper? 18:30:53 @thomasbuilds:matrix.org: (randomx, mx25519) 18:30:57 in my testing 18:31:02 (jpk, thats a joke saying that rust is why there is more cves) 18:31:06 @rbrunner7: XKCD 605 ;) 18:31:20 @ofrnxmr: Yes, I know, lol 18:32:34 I think I can close the meeting proper while discussions continue. Thanks everybody for attending, read you again next week! 18:33:01 Thanks everyone 18:37:32 btw I'd like to bring back the question on drahtbot for monero repo? 18:38:46 nah I'm good, there's already way too many notifications on Github 18:39:32 If no human deems it worth their time to ping someone to rebase a PR, it's not worth making a bot to do the pinging and spamming everyone involved 18:41:34 all right also worth saying that the drahtbot is supposed to work based off ACK, Concept ACKs, NACK, etc 18:41:34 To be fair these are used somewhat but never consitently 18:41:52 The one feature i liekd about the bot, is that it knows when other open prs conflict 18:42:47 I agree but a bot just for this seems off 18:42:49 Thanks rbrunner 18:50:37 Thanks everyone 18:51:38 I think it would be good to use "ACK commit-hash" rather than GH approvals, though DrahtBot does seem a bit unneeded 18:56:04 draht bot would put that in stale ACK when commit changes, which is useful imo 18:56:50 It's just more stuff people have to worry about running, with very little benefit 18:57:12 wdym? 18:58:02 Someone has to set up DrahtBot, no? And I think most people here seem to not agree that it'd be helpful 18:58:40 yeah I understand what you meant now 19:01:54 @jeffro256:monero.social Looks like this links to the wrong PR: 19:01:54 https://github.com/monero-project/monero/pull/10965#issuecomment-5765754652 19:02:02 Should be #10964 instead, I think 19:07:58 wdym 10964 is merged 19:08:56 Are you sure? 19:09:23 oops my bad 19:09:36 I had that memory for some reason 21:15:58

I didnt make the meeting but wanted to chime in on the ai reviewing stuff since we (MAGIC) are doing a lot of it. 21:15:58

We have the “cyber” version of claude opus so it will create working exploits to prove vulns are reachable. (Very useful at ruling out false positives). This is what is running on the monero-review repo. 21:15:58

We can try to also get the “cyber” version for openai if needed.[... more lines follow, see https://mrelay.p2pool.observer/e/5dHK-qwLcF9FM0RD ] 21:16:32 IMO, it is very useful :)