Re: [gentoo-project] call for agenda items -- council meeting 2019-04-14

[Gokturk Yuksek]

Hi,

Alec Warner:
> On Wed, Apr 3, 2019 at 10:04 AM NP-Hardass <NP-Hardass@g.o> wrote:
>
>> On 4/3/19 8:43 AM, Alec Warner wrote:
>>>
>>>
>>> On Wed, Apr 3, 2019 at 7:31 AM NP-Hardass <NP-Hardass@g.o
>>> <mailto:NP-Hardass@g.o>> wrote:
>>>
>>>     On 3/31/19 11:20 PM, William Hubbs wrote:
>>>     > Hi all,
>>>     >
>>>     > two weeks from today (2019-04-14) the Gentoo Council will meet at
>>>     > 19:00 UTC in the #gentoo-council channel on freenode.
>>>     >
>>>     > Please reply to this message with any items you would like us to
>>>     put on
>>>     > the agenda to discuss or vote on.
>>>     >
>>>     > Thanks much,
>>>     >
>>>     > William
>>>     >
>>>
>>>     I'd like the council to discuss the issue and general trend of
>> actions
>>>     (particularly recent) to restrict the ability of developers to
>>>     contribute to Gentoo.  In my view, efforts are being made to make
>>>     contributions as users substantially easier, while efforts are being
>>>     made to make being a developer substantially harder.  The months of
>>>     studying, quiz taking, and interviews set a bar that should make
>>>     contributions from those individuals that become developers easier
>> than
>>>     the average user, not more difficult.
>>>
>>>
>>> This is a pretty vague statement, are there particular things you want
>>> the council to review; or just the 'general trend'?
>>> I'm not aware of any recent changes to the developer onboarding process.
>>>
>>> -A
>>>
>>>
>>>
>>>     --
>>>     NP-Hardass
>>>
>>
>> Not just the onboarding, but the retention too.  General trend is what
>> I'm proposing should be discussed publicly during the meeting.
>>
>> Three points:
>>
>> At present time, everyone needs a "Real Name" to contribute.  A user,
>> with a new email address, can allege to be "Foo Bar" and contribute
>> without impediment, but, as recent proposals would have it, developers
>> would need to show proof of ID over video call to become part of the web
>> of trust for committing.  That effectively allows any user to remain
>> anonymous by using a false name, obviating a huge portion of the alleged
>> benefit to requiring names in the first place. So, developers can be
>> held to such a high standard that they can either no longer contribute,
>> while we trim eligible pool of new developers and compare that to the
>> ease with which any "named" contributor on github or bugzilla can do as
>> they please.
>>
>
> I think it is reasonable to try to pursue a more inclusive policy where
> identity is more flexible (as I discussed in a different message on this
> thread), but keep in mind the Council (and really a few key members) spent
> over a year working on the policy we have; so I'm not certain its a trivial
> change. You are free to dislike the policy we have and you are free to
> suggest we pursue a more inclusive policy, but at least here as a trustee
> who voted for it we made a deliberate choice here and barring some middle
> ground where we somehow understand that contributions to Gentoo are done in
> a low-risk way, we will continue to reject commits from obvious
> contributors.
>
> What I refuse to engage in is an incessant debate about the policy we have;
> please accept that we made it in good faith to reduce legal risk for the
> project and, if an alternative is presented that keeps risk low while
> accepting a broader set of contributions we will consider it in the same
> good faith.
>
> -A
>

I don't doubt people's good faith in proposing this policy and I'm sure
it's done with the best interest in mind. I apologize for not doing the
homework for the following question: did the Foundation pay for any kind
of legal counsel on this matter? I think one thing most of us struggle
with is that we are not lawyers. It would help to put people's mind at
ease if the Foundation consulted a lawyer that clearly explained:

- What exactly is the legal liability being addressed here?
- Have there been any precedent cases of copyright infringement
(constrained to the context of copyrighted ebuilds, or code of similar
nature) to make this a more realistic threat for the Foundation?
- In the case of a potential court case, how is the liability
distributed among involved parties? Would we be legally required to
track down the contributor (whose identity we may or may not have
confirmed yet)?

The reason why I'm suggesting this is because I've talked to a friend of
mine, who is a software patent lawyer, about the DCO and GLEP. Their
first impression was that the DCO itself has no clause for requiring a
legal name, so signing it with a fake name may not violate the DCO
itself. So the (informal) conclusion is that as long as nobody sues you
for copyright infringement, there is no legal problem with using a fake
name to sign the DCO. I know it sounds very obvious but the point is
that legal people have a better grip of the situation than we do, and
the community is more likely to take their word and justification for it.

>
>> We currently have a RFC, just posted two days ago, for developers to be
>> regularly tested to maintain commit status.  Again, if the developer
>> feels like it, maybe it is easier for him/her to just become a plain old
>> user and submit patches, waiting on the (as I see it, dwindling,) amount
>> of active other developers ready to commit instead.
>>
>> Totally anecdotal, I've seen developers that have fairly decent QA on
>> their own commits merge PRs from users without full review and
>> introducing a whole host of issues because code from users isn't always
>> vetted as thoroughly as ones own work.  So, I'd argue, the QA standards
>> of being a dev don't quite apply to you as stringently once you
>> downgrade to being a user...
>>
>> At the end of the day, holding developers to higher standards than users
>> is a given, but it shouldn't be more onerous to be a developer than to
>> be a user contributing.
>>
>> --
>> NP-Hardass
>>
>>