Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[desultory]

On 07/02/19 07:57, Rich Freeman wrote:
> On Tue, Jul 2, 2019 at 12:24 AM desultory <desultory@g.o> wrote:
>>
>> On 07/01/19 07:59, Rich Freeman wrote:
>>> On Mon, Jul 1, 2019 at 1:02 AM desultory <desultory@g.o> wrote:
>>>>
>>>> publishing PII purely on the basis of disciplinary
>>>> considerations could be quite reasonably considered to be an outrageous
>>>> overreach. There are reasons that "doxing" is generally considered to be
>>>> rather reprehensible.
>>>
>>> It obviously is reprehensible.  However, nobody is suggesting
>>> publishing PII for any reason, and I have no idea where this idea even
>>> came from.
>>>
>> How, exactly, is a requirement to provide and publish "legal name as a
>> natural person, i.e., the name that would appear in a government issued
>> document" [GLEP76] not a requirement to publish persona data [PII]?
>
> It isn't an issue if the person involved publishes itself and Gentoo
> is merely the medium, IMO.
>
In effect, so long as you can get some people to do it, the rest don't
matter. Is that really such a good stance for an organization which is
chronically in search of additional volunteers?

>>> Furthermore, I do not think that Gentoo should be collecting PII under
>>> conditions of confidentiality for any reason in the first place.  Nor
>>> should we be doing any activities that require us to do so, such as
>>> accepting money from people, or paying people.  IMO we do not have the
>>> demonstrated ability to do this in a safe and compliant manner, and we
>>> have a history of not performing legally-required activities in a
>>> compliant manner.
>>>
>> Too late, Gentoo has multiple services which collect some form of PII
>> (e.g. the EU considers an IP address to be, at least potentially, PII),
>> and retain at least some of that data without publishing it.
>
> I said that I don't think that it should be.  I never claimed that it wasn't.
>
You based your argument on your preference, as opposed to reality. The
reality is that it does, and that there is no practical way to avoid it
entirely. Accepting and providing payments are fairly basic operations
for legal entities to engage in, even if the foundation were to be
dissolved there would still be financial transactions apropos Gentoo.
Not to mention that accepting and providing payments are hardly the only
areas in which PII is exchanged and/or retained. Having a preference
does not change reality; treating that preference as reality when it is
counter to reality is, at best, unproductive.

>>> For this reason, I think it would be a big mistake to allow people to
>>> contribute under pseudonyms under the condition that they reveal their
>>> real identities to some Gentoo body that would retain this information
>>> in confidentiality.  That would expose Gentoo to a rather large number
>>> of privacy laws in a large number of places, for IMO little gain.
>>>
>> So, under the mistaken premise that Gentoo does not collect or retain
>> any form of PII you believe that Gentoo should not collect or retain any
>> PII, correct?
>
> I never said that Gentoo doesn't collect PII.  I said it shouldn't.
> And it shouldn't.
>
How, exactly, would this work in practice?

>> Knowing that Gentoo does indeed collect and retain some PII, does your
>> opinion change?
>
> No.  Obviously whatever PII we do collect needs to be properly
> protected, just as we ought to be filing taxes and doing various other
> things that we have trouble doing.
>
Are you deliberately implying that Gentoo has systemic problems with
maintaining user confidentiality where required? If so, why?

> In both cases the problem can simply be avoided by structuring
> ourselves in a manner that doesn't introduce the burden of compliance.
>
Again, you claim that it is a simple matter to restructure services to
avoid any retention of PII or the need to comply with regulations
regarding PII, and again, I ask you to detail your simple plan. Or at
least license the patents to allow Gentoo services to use them.

>> LDAP, though most of that data is now published in some form it is still
>> by and large a collection of PII.
>
> We should not collect non-public PII in LDAP.  There is no harm in
> allowing individuals to freely list their names/locations/etc if they
> wish, but we shouldn't have anything in the database, other than
> passwords or similar credentials, which isn't just published on the
> website.  Hence there should be nothing to steal (well, other than
> passwords, and those are useless after they are changed).
>
Again, you state your preferences as though they take precedence over
reality, while handwaving away any practical considerations, this is not
productive.

Passwords are often considered high value targets for data theft, even
if they "are useless after they are changed". You are familiar with the
common practice of password reuse, aren't you? It is highly deprecated,
and with good reason, but still quite common.

> As I understand it we've already been pushing to eliminate much of the
> PII from LDAP as it is - I'm curious as to what still remains that
> would be of concern.  In particular I believe the birthdate field was
> dropped some time ago.  Much of the rest gets published in the
> directory/etc and so it isn't anything that isn't open to see.
>
As I noted, and you even included in your quotation, most of the data is
public but not all. Given that this is a public mailing list, I will
leave my description of what unpublished PII is present on LDAP as:
things which are not typically high value for theft, but still
technically PII.

>>> None of this is intended as some kind of attack on Trustees/Infra/etc.
>>> They're volunteers doing the best they can do without pay, and
>>> generally trying to clean up after a long period of neglect.  It is
>>> simply a fact that if you have nothing to steal, then it is impossible
>>> to steal it, and no effort is required to protect it.
>>
>> Believing that you have nothing worth stealing is no defense against
>> those who believe that you do and intend to take it.
>
> I never claimed that we should shield ourselves with "belief."  I said
> we shouldn't have anything to steal in the first place.
>
In that case, you are advocating for having no: passwords, password
hashes, private e-mail (including security related correspondence), no
encryption keys, no signing keys, no pre-release code, no closed source
code, no code not meant for release for any reason at all, no
confidential data at all, and probably other things that I neglected to
list. In short, there would need to be an abolition of all services
which were at all secured just to start with complying with your
preferences. Dissolving Gentoo as a functional entity to satisfy your
preferences with regard to the state of Gentoo seems like it would be
rather counterproductive.

> Sure, that won't stop people from trying.  It will definitely stop
> them from succeeding.
>
While we can both agree that you cannot steal something which does not
exist, you also cannot use it. By your rationale, I appear to be under
the grossly mistaken impression that we are here to make something
useful and make that available to ourselves and others to use by means
of maintaining basic infrastructure by which it is maintained and
supported in addition to the maintenance of the thing itself. Pardon me
while I retain, and even attempt to spread, my delusions.