Re: [gentoo-project] Date-of-birth in developer applications

[Kristian Fiskerstrand]

On 06/20/2018 12:52 PM, Rich Freeman wrote:
> On Wed, Jun 20, 2018 at 4:32 AM Michał Górny <mgorny@g.o> wrote:
>>
>> Please tell me, how many times did we have to disambiguate two
>> developers using the same name?  Even if we ever have to do that, do you
>> really think we'd use one's birthday all over the place?
>
> Even if we've had two people from the same location with the same
> name, WHY would we ever have to use their date of birth to identify
> them?  We already have their nicks which is what we use internally,
> and those are always unique.

One morbid example would be someone getting a stone in the back of their
head, at which point the nick will likely not help much... But the
underlying need is likely to arise more due to other circumstances for
needing to contact, say a retired dev needs to provide evidence in a
copyright case and we need to track them down to get said statement.

>
> And if we DID have to identify a specific individual legally, then why
> aren't we collecting government ID numbers, which actually do the job
> a LOT better than DOB?

Storing those would require much higher security than a simple DOB

>
> As far as I'm aware, under most privacy laws and policies I've seen,
> name+DOB is just as sensitive as a government ID number.  If
> collecting the latter makes you recoil in horror, then you should be
> just as concerned about DOB collection.

I'm not, but views of truestees might differ on that; we have reasons to
collect it, it is part of recruiting process known to developer, so the
legal matter wouldn't be on the collecting part but the storage part,
and here they differ quite a lot in practice (although it shouldn't as
even SSN is just a Primary Key in theory).


> Just ask put on the dev application a certification that they are
> legally allowed to sign agreements.  That depends on more than just
> age anyway.

The latter is an interesting point.

>
> Could somebody lie?  Sure, just as they can lie today about their DOB.

I'm not too concerned about misrepresentation, there are other ways to
pursue that, but at least there is an element of CYA.

>
> This is just reasonable care.  I don't think there is any expectation
> by anybody that we have a higher level of certainty that our
> developers are able to sign things (DCOs or otherwise - which are also
> just reasonable care, unless we intend to start doing in-depth reviews
> of every commit).
>
> If we did need a higher level of certainty, then just asking for DOB
> won't cut it.  We'd need to verify IDs, take at least some level of
> care that they aren't mentally incapacitated, and know the local age
> of being able to sign such agreements.

Indeed

>
> I think we need to take a step back and consider the threat model
> here.  What is the threat we need to protect against?  Is collecting
> DOB an effective but least-intrusive way of mitigating that threat?
>

This is always a good question, discussions are always helpful to
determine that.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3