Re: [gentoo-project] Comrel Improvements: Expectations of Privacy

[Raymond Jennings]

On Sat, Oct 1, 2016 at 10:20 PM, Daniel Campbell <zlg@g.o> wrote:
> On 10/01/2016 09:53 PM, Raymond Jennings wrote:
>>
>>
>>  On Sat, Oct 1, 2016 at 9:13 PM, Daniel Campbell <zlg@g.o>
>> wrote:
>>>  On 09/30/2016 05:59 PM, Rich Freeman wrote:
>>>>   [snip]
>>>>
>>>>   1.  When information is turned over to comrel who does it get
>>>> shared
>>>>   with, and under what circumstances?
>>>
>>>  That information should be kept mainly to the comrel member(s) who
>>> were
>>>  reported to. Should the issue become more serious, share it with
>>> the
>>>  rest of comrel according to case needs (one member having a
>>> friendship
>>>  with a given developer, or a professional background in community
>>>  management, etc).
>>>
>>>>   2.  Do any members of the community have an obligation to
>>>> report?  Can
>>>>   members of comrel/trustees/officers/council/etc be told
>>>> information in
>>>>   private without it being shared back with comrel for the official
>>>>   record?
>>>
>>>  An obligation to report will result in more reporting, some of
>>> which
>>>  will end up being within CoC limits or merely a misunderstanding.
>>>  Encouragement might not be a bad idea, but forcing them to is just
>>> an
>>>  easy way to make ComRel busy; I'm sure they're just as
>>> understaffed as
>>>  the rest of Gentoo, however.
>>
>>>>   3. Specifically, what information gets shared with people named
>>>> in a
>>>>   dispute of some kind?
>>>
>>>  It depends on the type of dispute. If it's happenstance in a public
>>>  medium such as the forums, bugzilla, or the ML, then the
>>> antagonists and
>>>  their actions are known and can be shared freely.
>>>
>>>  In short I think the privacy level of a dispute should never become
>>>  lower than the occurrence of the "crime". So if it was in PMs on
>>> IRC, it
>>>  now concerns the ComRel member who was contacted, Party A, and
>>> Party B.
>>>  It should only expand when one ComRel member isn't enough.
>>>
>>>  Impactful changes to Gentoo staffing are deserving of mention, but
>>> in
>>>  general terms, like "Foobar project no longer has a lead, election
>>>  scheduled for..."
>>>
>>>>   4. Under what circumstances will information be shared with a
>>>>   government authority/etc?
>>>
>>>  It's not written anywhere, but I think we owe it to our developers
>>> to
>>>  keep private information private. Without a sufficient reasoning
>>> and/or
>>>  legal force, imo Gentoo should not comply without overwhelming
>>> evidence
>>>  or legitimate legal threat to its incorporation status. We should
>>> treat
>>>  private and internal information like it's valuable and important,
>>>  because it is. If developers can't share information with the
>>> Foundation
>>>  and/or other developers and expect it to remain at least somewhat
>>> safe,
>>>  then it may lower morale within the Project.
>>
>>  Would we assume that the foundation would be hiring counsel or
>> otherwise
>>  opposing such legal threats in court?  If the foundation gets a
>> subpoena
>>  or served with a search warrant, how much effort should the
>> foundation
>>  put into fighting it?
>>
> That's a good question with a possibly-messy answer. It depends; if we
> already have a lawyer on retainer or otherwise would go to bat for us
> and has an understanding of such law, then sure, hire counsel. But
> anything impacting the finances imo should go past the Foundation and
> the treasurer first. If we lack budgeting, then depending on how bad
> this request is we may ask for people to pitch in or something. I
> doubt
> anything like that would happen, however, so the most likely case is
> subpoena for logs connected to a given IP address. If they have a
> search
> warrant, well, not much you can do about that then, huh?
>
> I'm not a lawyer, however, and don't know the safest approach that
> also
> protects the Foundation's members. I just don't believe in handing
> things over when they're asked for without a damn good reason.
>>>>   5. Do subjects of comrel action generally have a "right to face
>>>> their
>>>>   accuser?"
>>>
>>>  If the action is impacting their developer status or
>>> public/internal
>>>  image, I believe the accuser should be willing to attach their
>>> name to
>>>  their accusations.
>>
>>  +1 to this.
>>
>>  Furthermore I believe in principle that if you aren't willing to put
>>  your ass on the line to back your accusation, then your testimony is
>>  worthless.  People are put under oath in court for a reason, and
>> there
>>  are penalties for perjury.
> I agree up to the "penalty for perjury" part. On one hand, there
> should
> be something that prevents people from making stuff up and generally
> just killing peoples' time, but on the other, punishing someone for it
> could result in them leaving the Foundation, possibly taking down
> important things (forums, deliberately misconfigured mailserver, etc)
> beforehand.
>
> There needs to be a balance. Maybe once comrel and/or the Council have
> decided a matter is important, the push rights of all involved parties
> is suspended to prevent in-fighting. Could be a stupid idea, I dunno.
>>
>>>>   6. What should be communicated about comrel actions, both
>>>> proactively
>>>>   and when people inquire about them?
>>>
>>>  Proactive announcements only necessary when they impact the
>>> functioning
>>>  of Gentoo and have reason to be made public. Inquiries are a little
>>>  trickier, as we should strive for transparency internally, but keep
>>>  sensitive things from the general public.
>>>
>>>>   I think there are a number of pros and cons to any approach we
>>>> take,
>>>>   and it is possible for reasonable people to hold a different
>>>> opinion
>>>>   on this topic.
>>>>
>>>>   [snip]
>>>>
>>>>   So, whether you think this is great or the worst drivel you've
>>>> ever
>>>>   read, please do speak up...
>>>>
>>>>   --
>>>>   Rich
>>>>
>>>>
>>>  I was wondering who would get around to writing something like
>>> this up
>>>  ever since that conversation about it a while back. :)
>>>
>>>  --
>>>  Daniel Campbell - Gentoo Developer
>>>  OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net
>>>  fpr: AE03 9064 AE00 053C 270C  1DE4 6F7A 9091 1EA0 55D6
>>
>>  I'd also like to note for the record that the last known version of
>> the
>>  developer quiz features a question about devrel (now comrel, +todo
>>  update it), so whoever wrote the quiz obviously feels that a good
>>  grounding in comrel procedures.
>>
>>  I would very much like this noted for the record, and in addition to
>>  keeping the quiz updated with whatever happens in this discussion,
>> I'd
>>  also like the current devmanual policy (cited in the quiz as a
>>  reference) involved as a subject in this discussion...does that
>> make sense?
> What devmanual policy are you referring to?

The one saying that you should follow this sequence:

1.  Resolve informally

2.  Consult project lead

3.  Go to devrel (now comrel) only if you can't resolve it.

Go directly to step 3 if the misconduct is intentional or habitual.

I was told by a past mentor that "comrel doesn't want to get dragged 
into every catfight"

If you need a direct citation of the devmanual section I can do some 
digging.

>>
>>  We kinda do have documentation already, that is at the least being
>> cited
>>  as a reference in the developer quiz...which I'm presently
>> polishing my
>>  answers to in the wake of my pending recruitment.
>>
>>
> Good luck on your journey to join us. :)
>
> --
> Daniel Campbell - Gentoo Developer
> OpenPGP Key: 0x1EA055D6 @ hkp://keys.gnupg.net
> fpr: AE03 9064 AE00 053C 270C  1DE4 6F7A 9091 1EA0 55D6
>