Re: [gentoo-project] call for agenda items -- council meeting 2019-04-14

[Alec Warner]

On Wed, Apr 3, 2019 at 2:44 PM Michał Górny <mgorny@g.o> wrote:

> On Wed, 2019-04-03 at 17:43 +0300, Andrew Savchenko wrote:
> > Why? We have no way to verify that provided names are valid or that
> > provided ID's are valid. At least in my jurisdiction such
> > information collected can't be used for legal action or protection
> > without following established government-assisted verification
> > procedure. In other jurisdictions similar problems may and will
> > arise.
>
> 'Perfect is the enemy of good'.  Claiming that you can't be 100% sure
> that someone's giving his real name doesn't imply that everyone is using
> fake names.  Or that it makes no sense to use them.
>
> > Additional problem is personal data collection, it is
> > restricted or heavily regulated in many countries. One can't just
> > demand to show an ID via electronic means without following
> > complicated data protection procedures which are likely to be
> > incompatible between jurisdictions.
>
> Do you have any proof of that, or are you just basing your comments
> on the common concept of misunderstanding GDPR and extending it to match
> your private interest?
>
> > So the real name requirement gives us no real protection from
> > possible cases, but creates real and serious problems by kicking
> > active developers and contributors from further contributions.
> > NP-Hardass is not the only one.
>
> Do you have any proof of that?  As far as I'm concerned, we're pretty
> clear that NP-Hardass can't contribute to Gentoo, and that his previous
> contributions shouldn't have been accepted in the first place (and why
> Trustees agreed to them is another problem).  Are you going to take
> legal and financial responsibility if his employer claims copyright to
> his contributions?  And if you say yes, are you going to really take it
> or go with the forementioned attitude that we can't legally force you
> to?
>

Under the current policy we do not accept contributions from contributors
whose names we believe are not real identities. The current policy says
nothing about previous contributions; almost everyone who contributed to
Gentoo over the past 20 years did so without signing anything, without
identity verification, and with no DCO. Those commits were accepted and
continue to be accepted until we decide otherwise. I don't like the way you
construe the previous work of hundreds of people who contributed to the
project; I find the idea that we should never have accepted these
contributions to be pretty offensive.

You are free to blame the organization for having bad policies (and you do
and I'm the board President and I will 1000% take the blame) but don't for
a minute blame people who are just trying to contribute and following the
policies that the project had at the time. As you wrote above "perfect is
the enemy of the good" and if we rejected the previous 20 years of work
we'd have basically nothing, so we accept that risk as a cost of continuing
to exist as a Foundation. No business operates with zero risk.


>
> > I invited some gifted people with
> > high quality out-of-tree work to become contributors or developers,
> > but due to hostile attitude towards anonymous contributors they
> > can't join. And people want to stay anonymous for good reasons,
> > because they are engaged with privacy oriented development.
>

> This is a very vague statement that sounds like serious overstatement
> with no proof, aimed purely to force emotional reaction to support your
> proposal.  If you really want to propose something meaningful, I'd
> really appreciate if you used real evidence to support it rather than
> vague claims.
>

> > We are loosing real people, real contributions and real community.
> > What for? For solving imaginary problems with inappropriate tools.
> >
>
> Thank you for telling us that copyright is an imaginary problem.
>

Your words are like knives, and this leads to a perception of antagonism.

1) The policies of the project currently prioritize a knowledge of where
commits come from in order to eventually reduce liability risk for the
project.
2) I firmly do not believe the project has anything against anonymous /
pseudonymous contributors (nor should it; if you think it does I'm happy to
amend bylaws, GLEPs, and any other charter documents to state that we have
nothing against that type of contribution.)
3) The current policy makes it difficult to contribute in this way; because
we have this trade-off we have made where we want to know where commits
come from for legal reasons.)

Its OK to say "Hi X, we cannot accept your anonymous / pseudonymous
contribution because of this policy, and we made this policy to solve a
problem of copyright liability for the organization."
I don't think its OK to say "Hi X, its completely unreasonable to want to
contribute to Gentoo in an Anonymous or Pseudonymous manner; please file
your identity papers to me immediately!"

My reading is your comments are closer to the latter than the former; I'm
just not sure why that is.

I think its perfectly sane to ask "how can we build an organization where
we can accept pseudonymous contributions and contain our liability for code
from unverified contributors?" and have people interested in that write up
and vet proposals. I get that its a complex and difficult problem area;
maybe none of the proposals will work! but that doesn't meant we shouldn't
try to do it.


>
> --
> Best regards,
> Michał Górny
>
>