1 |
Rich Freeman posted on Thu, 20 Dec 2012 22:33:55 -0500 as excerpted: |
2 |
|
3 |
> On Thu, Dec 20, 2012 at 10:21 PM, Doug Goldstein <cardoe@g.o> |
4 |
> wrote: |
5 |
>> I could MAYBE understand it if they're consuming some valuable resource |
6 |
>> that we need to free up by retiring them. But instead they get a |
7 |
>> nasty-gram about their impending retirement and decide if that's how |
8 |
>> they are to be treated that they can be retired. |
9 |
> |
10 |
> Could anybody post the text of one of these "nasty grams?" |
11 |
> |
12 |
> I can understand the sense in just checking in to make sure a developer |
13 |
> still is interested in Gentoo and wants to retain cvs access. However, |
14 |
> I think the bar for keeping access should be kept low - they shouldn't |
15 |
> be forced to go find some trivial change to make just to get their name |
16 |
> in the logs. |
17 |
> |
18 |
> Sure, sometimes real life gets busy, but if a dev still runs Gentoo and |
19 |
> has interest they're fairly likely to return when life settles down. |
20 |
|
21 |
Obviously I can't post the text of one of these "nasty grams", but I was |
22 |
around when the idea was first discussed and then implemented, by |
23 |
undertakers and infra, with the blessing of either council or whatever it |
24 |
was that came before (I was young in gentoo back then and didn't have a |
25 |
clear understanding of how it all worked, but when I started, drobbins |
26 |
was still around, but in the process of setting up the foundation and etc |
27 |
so he could leave gentoo in good shape when he did retire, and IIRC/ |
28 |
AFAIK, he had turned things over to some sort of interrim executive |
29 |
committee... and I don't recall whether the events here predated what we |
30 |
call council today, or not). |
31 |
|
32 |
You're essentially correct, Rich. IIRC (and all this based on my |
33 |
possibly inaccurate understanding), at least one of the initial triggers |
34 |
was infra's concern, I believe after some other distro had a headline |
35 |
breakin when an inactive dev had their system penetrated and their |
36 |
credentials stolen, that the at-the-time-something like 500+ devs on the |
37 |
rolls, with something under 300 having any CVS or list activity at all |
38 |
within the last six months or some such (so about half were even |
39 |
minimally "active", this was of course before overlays became in any way |
40 |
widespread or more than personal overlays, tho some devs did make theirs |
41 |
publicly available), wasn't healthy, and was taking too much risk, due to |
42 |
the number of still active but potentially abandoned credentials out |
43 |
there, possibly free for the taking, with the credentialed no longer |
44 |
active, so they'd not even notice the activity in their name, that they |
45 |
hadn't done! |
46 |
|
47 |
The other primary concern was QA related, all those effectively abandoned |
48 |
packages could now be put up for adoption by new maintainers or for |
49 |
maintainer-needed or treecleaning, as appropriate based on open bug |
50 |
count, etc. |
51 |
|
52 |
As it was originally setup, the idea was that anybody without an away |
53 |
file explaining the situation, that hadn't had sufficient activity (CVS |
54 |
or list, I believe two commits or posts was to be considered sufficiently |
55 |
active) for at least (I believe) 90 days, would get an inquiry note from |
56 |
undertakers. That level of the process was supposed to be mostly |
57 |
scripted, a script was to be run periodically that would check for away |
58 |
files, cvs commits, and list posts, and would generate a list of inactive |
59 |
devs and the notices automatically, altho I THINK actually SENDING the |
60 |
notices might have required undertaker action, in which case the human |
61 |
doing that was supposed to review them for sanity. |
62 |
|
63 |
The idea was *NOT* that it would be a "nastygram", simply a note of |
64 |
concern, asking what was going on and if the dev was still interested in |
65 |
gentoo, or if they wanted to retire. Again, the primary interest, as |
66 |
best I know, was security. All those potentially unsupervised access |
67 |
credentials laying around for the taking, should someone get access to |
68 |
the inactive dev's computers, etc. |
69 |
|
70 |
If they were still interested, at the first level (which was IIRC 90 |
71 |
days), all they had to do was reply, saying so. *ONLY*, and this was a |
72 |
point that everyone took pains to ensure was specifically made, if people |
73 |
didn't reply (or replied that they were no longer interested in gentoo), |
74 |
were they ultimately retired. |
75 |
|
76 |
** It's also worth pointing out that a simple away file listing something |
77 |
reasonable (that wasn't itself expired by this much time, but that bit |
78 |
wasn't automated, the automated script simply checked for an away file, |
79 |
period) would immediately shut down the process. |
80 |
|
81 |
I believe there was a second level that actually triggered the beginning |
82 |
of the undertaker process, at the 180 day (probably plus 30 days to give |
83 |
a last chance for a reply, which would have made it 210 days total, but |
84 |
I'm not positive on that). By this point, the thinking went, a dev |
85 |
really SHOULD have had at LEAST the time to setup an away file, or simply |
86 |
reply with an explanation so they could be entered in an ignore list, if |
87 |
they weren't already active once again. |
88 |
|
89 |
But, the argument went, anybody that couldn't post AT LEAST two messages |
90 |
or do two commits in six months (I believe the magic number was two)... |
91 |
arguably was likely not following gentoo closely enough any more to be |
92 |
sure their commits, if they DID make any, weren't more of a danger to the |
93 |
now moved on tree than a help, in any case. |
94 |
|
95 |
AFAIK the policy was a bit controversial even then, but nobody could |
96 |
really refute the argument, particularly given the other distros breakins |
97 |
in the headlines due to the exploitation of still-active credentials for |
98 |
year-inactive devs. |
99 |
|
100 |
And IIRC it DID allow gentoo to bring its headcount down to something a |
101 |
bit more in line with the active dev count. Plus, with the retirement of |
102 |
those devs, the packages they maintained that had been effectively |
103 |
abandoned, were now actually announced for adoption and if there were no |
104 |
takers, they were marked maintainer-needed and/or tree-cleaned as |
105 |
appropriate. That in turn helped clean up the tree rather noticeably in |
106 |
the initial six to eight months after the policy went into effect, as |
107 |
well. |
108 |
|
109 |
Meanwhile, it didn't hurt activity measurably at all. Because if people |
110 |
WERE still interested, they could easily show it, by simply replying and/ |
111 |
or setting an appropriate away, or by taking the encouragement to up |
112 |
their activity level just a bit. |
113 |
|
114 |
But, as I said, that was well before overlays.gentoo.org and layman. |
115 |
Even if the original policy is still considered sound in general, it |
116 |
should arguably be updated (along with the scripts that do the checks) to |
117 |
include at least the main project overlays. OTOH, an argument could |
118 |
equally be made that those aren't actual contributions to THE GENTOO |
119 |
TREE, and that in many/most cases, gentoo developer credentials aren't |
120 |
actually necessary for the main project overlays, in any case, so if |
121 |
that's where a dev's activity is, and they can't make at least the |
122 |
minimum main tree commits OR list posts, then the original argument still |
123 |
applies. |
124 |
|
125 |
So the overlays policy could be debated either way, but it DOES need to |
126 |
be discussed, and the general inactivity retirement policy should be |
127 |
updated to reflect the actual decision, whatever it may be. |
128 |
|
129 |
And... perhaps that policy in general needs a reexamination. |
130 |
|
131 |
Regardless, it's possible that the "nastygrams" aren't worded |
132 |
particularly well, and that they could be worded better, even if the |
133 |
policy is retained. However, that's hard to say, without a hard example |
134 |
of such a "nastygram" posted. |
135 |
|
136 |
-- |
137 |
Duncan - List replies preferred. No HTML msgs. |
138 |
"Every nonfree program has a lord, a master -- |
139 |
and if you use the program, he is your master." Richard Stallman |