Re: [gentoo-project] call for agenda items -- council meeting 2019-04-14

[Michał Górny]

On Tue, 2019-04-09 at 21:13 +0000, Gokturk Yuksek wrote:
> > To your second question, you could, but I think that would be wrong and if
> > I found out I'd probably talk to you about it and if it continued, I'd
> > probably take some kind of remedial action. The intent is to have a
> > reasonable suspicion of fraud or wrongdoing, not to do just do it willy
> > nilly.
> >
> > That being said I don't intend to forge a policy that is bullet-proof. If I
> > cannot trust fellow project members to act well, they might as well just
> > leave the project now. If project members are looking for "a list of rules
> > to follow" my only rules are "don't be an ass" and if you are told you are
> > being an ass, maybe listen and take that advice as opposed to objecting.
> >
>
> My point about the guidelines is for the concern on the receiving party.
> I suspect there may be situations where saying "I'm not convinced that
> this is a real name of a person. Would you please provide me a proof of
> ID?" is perceived offensive. Guidelines published by the Foundation help
> developers justify their stance and ease people into compliance, I think.
>
> > > > > Additional problem is personal data collection, it is
> > > > > restricted or heavily regulated in many countries. One can't just
> > > > > demand to show an ID via electronic means without following
> > > > > complicated data protection procedures which are likely to be
> > > > > incompatible between jurisdictions.
> > > >
> > > > Do you have any proof of that, or are you just basing your comments
> > > > on the common concept of misunderstanding GDPR and extending it to match
> > > > your private interest?
> > > >
> > >
> > > At the very least, insecure transportation and storage of legal
> > > documents has a potential to lead to identity theft, which makes it a
> > > legal liability in and of itself. I don't think we should be dismissive
> > > on this point.
> > >
> >
> > I don't believe any policies require collecting personal data currently.
> >
>
> If I have suspicions about a contributor's identity, would you advise me
> on a method of validation that doesn't require the electronic transfer
> of a government approved identification?

My suggestion would be to use the solution that's been there for years
-- OpenPGP web of trust.  Establish a path of trust and/or keysign with
the person in question.  This naturally involves verifying one's ID,
and reduces the risk of stealing personal data to the minimum.

> > The Foundation has always carried legal risk. Only recently have we
> > (through the awesome work of ulm@ and others) had a policy to help mitigate
> > it. These contributors have not 'suddenly become a legal risk' but instead
> > the community (council and foundation combined) have adopted a more
> > risk-averse stance by adopting GLEP-76 and that results in some
> > contributors being unable to contribute. I'm not sure what else needs to be
> > explained.
> >
> >
>
> To the best of my knowledge, the Foundation has a long established
> practice of allowing developers to use pseudonyms on the condition that
> they reveal their legal identity to the Foundation for legal protection.
> Was the exclusion of developers with pseudonyms as per GLEP76 a result
> of a conclusion that the Foundation being informed about developers
> legal identity wrt copyright infringement carries more risk compared to
> their total exclusion from development?

Did you read the Linux policy?  It is clear: the problem's not
Foundation knowing, it's *community* knowing.  Foundation is just
a temporary opaque body that's going to be dissolved one day.  Code's
going to live much longer, and it needs to be sustainable without having
to refer to secret records of the Foundation.

> > If you want to make a point that Gentoo leadership is bad at making
> > opposing feelings heard, well I'd probably agree with you (this thread is
> > one such example.) If you want to make some kind of point that "having an
> > opinion heard means we change the policy to suit that opinion" then I think
> > we just disagree on that point. Don't make it out like we made the decision
> > without thinking of anonymous / pseudonymous contributors; numerous
> > discussions were had about them and we could not find a way to include them
> > in the policy.
> >
> > That doesn't mean we didn't hear their thoughts and objections though.
> >
> Perhaps the people I talked to didn't find the right people to talk to
> before me. I'm not trying to paint the leadership as ignorant or bad. I
> understand that this is all volunteer work first and foremost. I wasn't
> implying to enact a change in the policy on the basis that people's
> opinions haven't been sufficiently heard.
>

Perhaps the person you talked to don't 'take no for an answer'.
If the policy works for the majority of people, and there are only few
who disagree with it (no matter how much they try to exaggerate it),
and most of those few so far have failed to provide a really good
argument why they can't do it, then I'm sorry but that's just how things
work.

I'm certainly against changing the policy on arguments like 'but I want
to brand myself as X' or 'but you can't prove people are using fake
identities'.  If you really want to push for the latter, I wouldn't mind
making some form of identity verification obligatory for everyone. 
However, I doubt that's the result you want.

-- 
Best regards,
Michał Górny