Re: [gentoo-project] call for agenda items -- council meeting 2019-04-14

[Michał Górny]

On Wed, 2019-04-03 at 18:35 -0400, Alec Warner wrote:
> On Wed, Apr 3, 2019 at 2:44 PM Michał Górny <mgorny@g.o> wrote:
>
> > On Wed, 2019-04-03 at 17:43 +0300, Andrew Savchenko wrote:
> > > Why? We have no way to verify that provided names are valid or that
> > > provided ID's are valid. At least in my jurisdiction such
> > > information collected can't be used for legal action or protection
> > > without following established government-assisted verification
> > > procedure. In other jurisdictions similar problems may and will
> > > arise.
> >
> > 'Perfect is the enemy of good'.  Claiming that you can't be 100% sure
> > that someone's giving his real name doesn't imply that everyone is using
> > fake names.  Or that it makes no sense to use them.
> >
> > > Additional problem is personal data collection, it is
> > > restricted or heavily regulated in many countries. One can't just
> > > demand to show an ID via electronic means without following
> > > complicated data protection procedures which are likely to be
> > > incompatible between jurisdictions.
> >
> > Do you have any proof of that, or are you just basing your comments
> > on the common concept of misunderstanding GDPR and extending it to match
> > your private interest?
> >
> > > So the real name requirement gives us no real protection from
> > > possible cases, but creates real and serious problems by kicking
> > > active developers and contributors from further contributions.
> > > NP-Hardass is not the only one.
> >
> > Do you have any proof of that?  As far as I'm concerned, we're pretty
> > clear that NP-Hardass can't contribute to Gentoo, and that his previous
> > contributions shouldn't have been accepted in the first place (and why
> > Trustees agreed to them is another problem).  Are you going to take
> > legal and financial responsibility if his employer claims copyright to
> > his contributions?  And if you say yes, are you going to really take it
> > or go with the forementioned attitude that we can't legally force you
> > to?
> >
>
> Under the current policy we do not accept contributions from contributors
> whose names we believe are not real identities. The current policy says
> nothing about previous contributions; almost everyone who contributed to
> Gentoo over the past 20 years did so without signing anything, without
> identity verification, and with no DCO. Those commits were accepted and
> continue to be accepted until we decide otherwise. I don't like the way you
> construe the previous work of hundreds of people who contributed to the
> project; I find the idea that we should never have accepted these
> contributions to be pretty offensive.
>
> You are free to blame the organization for having bad policies (and you do
> and I'm the board President and I will 1000% take the blame) but don't for
> a minute blame people who are just trying to contribute and following the
> policies that the project had at the time. As you wrote above "perfect is
> the enemy of the good" and if we rejected the previous 20 years of work
> we'd have basically nothing, so we accept that risk as a cost of continuing
> to exist as a Foundation. No business operates with zero risk.

I'm sorry.  I don't know what exact knowledge people who made those
decisions had.  I'm just saying that if you know that someone is hiding
his contributions to Gentoo from his employer, and if you know that
employers often claim copyright to all work their employees do... you
get the picture, right?

And no, I'm not saying people will sue the hell out of us, take all our
money, arrest all developers they can.  What I'm really worried about is
that if they claim copyright to those contributions, we will have to
spend a lot of work finding all his contributions and replacing them
with unencumbered code.  And it will be especially hard to prove we
aren't copying that copyrighted code given that ebuilds are very uniform
by nature.

> > > I invited some gifted people with
> > > high quality out-of-tree work to become contributors or developers,
> > > but due to hostile attitude towards anonymous contributors they
> > > can't join. And people want to stay anonymous for good reasons,
> > > because they are engaged with privacy oriented development.
> > This is a very vague statement that sounds like serious overstatement
> > with no proof, aimed purely to force emotional reaction to support your
> > proposal.  If you really want to propose something meaningful, I'd
> > really appreciate if you used real evidence to support it rather than
> > vague claims.
> >
> > > We are loosing real people, real contributions and real community.
> > > What for? For solving imaginary problems with inappropriate tools.
> > >
> >
> > Thank you for telling us that copyright is an imaginary problem.
> >
>
> Your words are like knives, and this leads to a perception of antagonism.

...and accusing Council of 'solving imaginary problems' is not?  As far
as I'm concerned, that's a *very antagonistic* statement, and seriously
undermining Council's professionality.

> 1) The policies of the project currently prioritize a knowledge of where
> commits come from in order to eventually reduce liability risk for the
> project.
> 2) I firmly do not believe the project has anything against anonymous /
> pseudonymous contributors (nor should it; if you think it does I'm happy to
> amend bylaws, GLEPs, and any other charter documents to state that we have
> nothing against that type of contribution.)
> 3) The current policy makes it difficult to contribute in this way; because
> we have this trade-off we have made where we want to know where commits
> come from for legal reasons.)
>
> Its OK to say "Hi X, we cannot accept your anonymous / pseudonymous
> contribution because of this policy, and we made this policy to solve a
> problem of copyright liability for the organization."
> I don't think its OK to say "Hi X, its completely unreasonable to want to
> contribute to Gentoo in an Anonymous or Pseudonymous manner; please file
> your identity papers to me immediately!"
>
> My reading is your comments are closer to the latter than the former; I'm
> just not sure why that is.
>
> I think its perfectly sane to ask "how can we build an organization where
> we can accept pseudonymous contributions and contain our liability for code
> from unverified contributors?" and have people interested in that write up
> and vet proposals. I get that its a complex and difficult problem area;
> maybe none of the proposals will work! but that doesn't meant we shouldn't
> try to do it.

This seems to entirely miss the point taken from Linux policy, and focus
on the 'Gentoo is Foundation' model.  It's not.  Gentoo is distributed
to all our users, and all our users need to be able to verify that
the code comes from contributors who are actually allowed to contribute.
They can't really hit 'Foundation has this data somewhere in secret'
wall.  If not anything else, this makes the project non-transparent,
and raises serious doubts whether users can actually trust it.

-- 
Best regards,
Michał Górny