Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Michał Górny]

On Tue, 2019-06-25 at 01:18 +0300, Andrew Savchenko wrote:
> Hi all!
>
> On Sat, 15 Jun 2019 12:49:33 +0300 Andrew Savchenko wrote:
> > On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
> > > Hi all!
> > >
> > > Last year we had a good initiative: it addition to (or even instead
> > > of) manifests nominees were asked questions by voters. So let's
> > > continue this year.
> > >
> > > I propose to have one question per thread spawned by this e-mail to
> > > keep discussion focused. If you have multiple questions, please
> > > start multiple threads. If your question was already asked, please
> > > join a thread.
> > >
> > > I'll ask my questions in subsequent e-mails.
> >
> > In my opinion GLEP 76 is the most controversial decision made by
> > running council. While it fixed some long standing issues like
> > copyright headers and proper acknowledgement of out of the tree
> > contributors, it created grave problems: now some long-time
> > contributors and even developer are seriously discriminated because
> > they want to keep their privacy.
> >
> > What is your opinion on this problem?
> > Should GLEP 76 be left as is?
> > Should GLEP 76 be cancelled?
> > Should GLEP 76 be improved and how?
>
> Since I've accepted the nomination, it's my turn to answer as well.
>
> I'll tell you frankly that GLEP 76 was the main motivation for me
> to accept the nomination. I consider it — in the way it exists now —
> harmful and in need to be fixed. This is how free software works:
> if something is broken and nobody repairs it, go and fix it
> yourself.
>
> What is wrong with GLEP 76? It kicks some active contributors and
> rejects some of new ones. No, it is not just one developer
> affected as someone may assume. We have external contributors
> kicked out, we have at least one high quality maintainer who worked
> on quizzes, but this work was stopped due to hostility to and
> further ban on anonymous contributions.
>
> I believe that for free software development privacy concern is of
> paramount importance, especially when we are dealing with security
> or privacy oriented software.
>
> One may argue that ban on anonymous contributions was to protect
> Gentoo from possible copyright claims in the future. But does it
> really gives us such protection? In my opinion NO, because:
>
> 1. GLEP 76 was prepared without legal expertise from experts in
> this field. (At least such expertise was not published.) Hereby we
> have no evidence that it will work if real case will be opened.
>
> 2. No law or legal precedent was provided to prove that GLEP 76
> will be useful in alleged case or that we have a legal requirement
> to put such restrictive demand on our contributors.

What 'legal expertise', 'law' or 'legal precedent' do you have to say
otherwise?  It's easy to blame others when all you have is your private
opinion.

>
> 3. We objectively have no means to verify developer's credentials.
> Current approach is based on realistic-like approach: if someone
> names themselve "John Doe" we accept it, if someone names as
> "qwerty123" we do not recognize this as an ID. But we have no means
> to verify that "John Doe" is real (natural) name. Even GnuPG Web of
> Trust doesn't provide such means, because what it really provides
> is a link between a person and their GnuPG key, as we're not
> authorized legal entities empowered and fully informed to verify
> validity of IDs present during GnuPG signing.
>
> So in my opinion current state of affairs is not acceptable and
> must be amended. What I propose to do:
>
> 1. To mitigate current crisis we should allow developers to commit
> under any unique non-offensive id (text string) as long as the
> trustees know how it maps to a real name.
>
> The rationale is that the trustees are the legal body to handle all
> legal issues of Gentoo, so even if we agree that real names are
> mandatory, there is no practical legal need for anyone outside of
> trustees to know them. This way we can include people who agree to
> keep their privacy from anyone except trustees and in the same way
> this will keep the legal effect of GLEP 76 intact.
>

How are Trustees supposed to know whether the 'real name' is actually a
real natural name?  You just said it is apparently impossible to verify.


-- 
Best regards,
Michał Górny