Re: [gentoo-project] [RFC] GLEP 76: Copyright Policy [v4]

[desultory]

On 09/27/18 10:13, Rich Freeman wrote:
> On Thu, Sep 27, 2018 at 9:52 AM NP-Hardass <NP-Hardass@g.o> wrote:
>>
>> But that's really besides the point... The current status quo (as is the
>> case with me) is that a committer may be pseudonymous under the
>> condition that the Foundation have that individual's name in the event
>> of a copyright issue. So, I still don't understand how forcing everyone
>> to publicly use a real name achieves something that we aren't currently
>> achieving...  Is that incorrect?
>
> Interesting point.
>
> If we were going to go down this road I'd still suggest that the
> Foundation have a policy on when the real names of contributors can be
> disclosed, either privately or publicly.  If we were to use the
> defense that we have a statement from a contributor that they checked
> the copyright and it was ok, the first question somebody will respond
> with is, "who?"  An answer of "we know who it is but can't tell
> anybody, even a court" probably isn't going to work.
>
> I think there are other arguments to be made against anonymity.
> You're hardly a list troll, but anonymity can breed this sort of
> thing.  From a strictly copyright standpoint I don't see why the
> identity of contributors needs to be publicly disclosed, as long as it
> can be disclosed where legally necessary.  Of course, if that is a
> court then depending on the jurisdiction it may become public anyway.
> Also, if we were going to go down this route then we also need to have
> better archives of such things, as trying to dig up some trustee email
> from 10 years ago is not the right solution.  A secured repository of
> identities/etc would be better (the Foundation already has a place to
> store stuff like bank account details).
>
> Another practical argument against anonymity.  If everybody agrees
> everything is public, then we don't have any personal information we
> need to protect under various privacy laws.  As soon as we agree to
> keep some info private, then we potentially have obligations under
> such laws.  Also, legally the Foundation is a US organization - so I'm
> not sure if things like the US-EU Safe Harbor provisions start to
> apply if we want to collect this sort of info from EU citizens.  It is
> just a can of worms you can avoid simply by not hanging onto this kind
> of information.  I believe that many of these privacy protections
> cannot be simply waived - we can't get some EU citizen to agree that
> they don't apply to us.  If the laws apply then we need to follow
> them.  Now, we're obviously not a big fish, so enforcement may never
> happen.  Maybe compliance isn't burdensome - I only know enough about
> such things to know that I'd want to know more before going down that
> road...
>

We should just publish all e-mail addresses (including those explicitly
marked to not publish), all private messages, and all IP adresses of
every forum, wiki, github, telegram, slack, discord, zulip, facebook,
google+, twitter, and reddit user that any Gentoo account has access to,
and a full archive of the -core list (which is expressly not public),
and all information stored in Gentoo's LDAP, and private wikis, and all
mailing list subscribers who have not actually posted to the list(s) to
which they are subscribed because... you think that it might be more
convenient for you? Are you sure that is a road that you want to go
down? Because that seems, to put it gently, completely insane.

Before you plead strawman, consider that your claim is that retaining
any private information is too problematic. Gentoo already retains
private information, where and as it is useful. Gentoo is not likely to
stop retaining such information to at least some extent, given that some
of it is necessary for fairly basic functions. Gentoo is not well served
by pointless double standards, not that anyone is.

Actively dissuading developers who would, for whatever reason, prefer to
use an identifier that is not their legal name seems counterproductive
given the apparent constant search for additional contributors.