Re: [gentoo-project] Comrel Improvements: Expectations of Privacy

[Daniel Campbell]

On 10/01/2016 09:53 PM, Raymond Jennings wrote:
>
>
> On Sat, Oct 1, 2016 at 9:13 PM, Daniel Campbell <zlg@g.o> wrote:
>> On 09/30/2016 05:59 PM, Rich Freeman wrote:
>>>  [snip]
>>>
>>>  1.  When information is turned over to comrel who does it get shared
>>>  with, and under what circumstances?
>>
>> That information should be kept mainly to the comrel member(s) who were
>> reported to. Should the issue become more serious, share it with the
>> rest of comrel according to case needs (one member having a friendship
>> with a given developer, or a professional background in community
>> management, etc).
>>
>>>  2.  Do any members of the community have an obligation to report?  Can
>>>  members of comrel/trustees/officers/council/etc be told information in
>>>  private without it being shared back with comrel for the official
>>>  record?
>>
>> An obligation to report will result in more reporting, some of which
>> will end up being within CoC limits or merely a misunderstanding.
>> Encouragement might not be a bad idea, but forcing them to is just an
>> easy way to make ComRel busy; I'm sure they're just as understaffed as
>> the rest of Gentoo, however.
>
>>>  3. Specifically, what information gets shared with people named in a
>>>  dispute of some kind?
>>
>> It depends on the type of dispute. If it's happenstance in a public
>> medium such as the forums, bugzilla, or the ML, then the antagonists and
>> their actions are known and can be shared freely.
>>
>> In short I think the privacy level of a dispute should never become
>> lower than the occurrence of the "crime". So if it was in PMs on IRC, it
>> now concerns the ComRel member who was contacted, Party A, and Party B.
>> It should only expand when one ComRel member isn't enough.
>>
>> Impactful changes to Gentoo staffing are deserving of mention, but in
>> general terms, like "Foobar project no longer has a lead, election
>> scheduled for..."
>>
>>>  4. Under what circumstances will information be shared with a
>>>  government authority/etc?
>>
>> It's not written anywhere, but I think we owe it to our developers to
>> keep private information private. Without a sufficient reasoning and/or
>> legal force, imo Gentoo should not comply without overwhelming evidence
>> or legitimate legal threat to its incorporation status. We should treat
>> private and internal information like it's valuable and important,
>> because it is. If developers can't share information with the Foundation
>> and/or other developers and expect it to remain at least somewhat safe,
>> then it may lower morale within the Project.
>
> Would we assume that the foundation would be hiring counsel or otherwise
> opposing such legal threats in court?  If the foundation gets a subpoena
> or served with a search warrant, how much effort should the foundation
> put into fighting it?
>
That's a good question with a possibly-messy answer. It depends; if we
already have a lawyer on retainer or otherwise would go to bat for us
and has an understanding of such law, then sure, hire counsel. But
anything impacting the finances imo should go past the Foundation and
the treasurer first. If we lack budgeting, then depending on how bad
this request is we may ask for people to pitch in or something. I doubt
anything like that would happen, however, so the most likely case is
subpoena for logs connected to a given IP address. If they have a search
warrant, well, not much you can do about that then, huh?

I'm not a lawyer, however, and don't know the safest approach that also
protects the Foundation's members. I just don't believe in handing
things over when they're asked for without a damn good reason.
>>>  5. Do subjects of comrel action generally have a "right to face their
>>>  accuser?"
>>
>> If the action is impacting their developer status or public/internal
>> image, I believe the accuser should be willing to attach their name to
>> their accusations.
>
> +1 to this.
>
> Furthermore I believe in principle that if you aren't willing to put
> your ass on the line to back your accusation, then your testimony is
> worthless.  People are put under oath in court for a reason, and there
> are penalties for perjury.
I agree up to the "penalty for perjury" part. On one hand, there should
be something that prevents people from making stuff up and generally
just killing peoples' time, but on the other, punishing someone for it
could result in them leaving the Foundation, possibly taking down
important things (forums, deliberately misconfigured mailserver, etc)
beforehand.

There needs to be a balance. Maybe once comrel and/or the Council have
decided a matter is important, the push rights of all involved parties
is suspended to prevent in-fighting. Could be a stupid idea, I dunno.
>
>>>  6. What should be communicated about comrel actions, both proactively
>>>  and when people inquire about them?
>>
>> Proactive announcements only necessary when they impact the functioning
>> of Gentoo and have reason to be made public. Inquiries are a little
>> trickier, as we should strive for transparency internally, but keep
>> sensitive things from the general public.
>>
>>>  I think there are a number of pros and cons to any approach we take,
>>>  and it is possible for reasonable people to hold a different opinion
>>>  on this topic.
>>>
>>>  [snip]
>>>
>>>  So, whether you think this is great or the worst drivel you've ever
>>>  read, please do speak up...
>>>
>>>  --
>>>  Rich
>>>
>>>
>> I was wondering who would get around to writing something like this up
>> ever since that conversation about it a while back. :)
>>
>> --
>> Daniel Campbell - Gentoo Developer
>> OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net
>> fpr: AE03 9064 AE00 053C 270C  1DE4 6F7A 9091 1EA0 55D6
>
> I'd also like to note for the record that the last known version of the
> developer quiz features a question about devrel (now comrel, +todo
> update it), so whoever wrote the quiz obviously feels that a good
> grounding in comrel procedures.
>
> I would very much like this noted for the record, and in addition to
> keeping the quiz updated with whatever happens in this discussion, I'd
> also like the current devmanual policy (cited in the quiz as a
> reference) involved as a subject in this discussion...does that make sense?
What devmanual policy are you referring to?
>
> We kinda do have documentation already, that is at the least being cited
> as a reference in the developer quiz...which I'm presently polishing my
> answers to in the wake of my pending recruitment.
>
>
Good luck on your journey to join us. :)

-- 
Daniel Campbell - Gentoo Developer
OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net
fpr: AE03 9064 AE00 053C 270C  1DE4 6F7A 9091 1EA0 55D6