Re: [gentoo-project] [RFC] GLEP 76: Copyright Policy [v4]

[Rich Freeman]

On Thu, Sep 27, 2018 at 9:52 AM NP-Hardass <NP-Hardass@g.o> wrote:
>
> But that's really besides the point... The current status quo (as is the
> case with me) is that a committer may be pseudonymous under the
> condition that the Foundation have that individual's name in the event
> of a copyright issue. So, I still don't understand how forcing everyone
> to publicly use a real name achieves something that we aren't currently
> achieving...  Is that incorrect?

Interesting point.

If we were going to go down this road I'd still suggest that the
Foundation have a policy on when the real names of contributors can be
disclosed, either privately or publicly.  If we were to use the
defense that we have a statement from a contributor that they checked
the copyright and it was ok, the first question somebody will respond
with is, "who?"  An answer of "we know who it is but can't tell
anybody, even a court" probably isn't going to work.

I think there are other arguments to be made against anonymity.
You're hardly a list troll, but anonymity can breed this sort of
thing.  From a strictly copyright standpoint I don't see why the
identity of contributors needs to be publicly disclosed, as long as it
can be disclosed where legally necessary.  Of course, if that is a
court then depending on the jurisdiction it may become public anyway.
Also, if we were going to go down this route then we also need to have
better archives of such things, as trying to dig up some trustee email
from 10 years ago is not the right solution.  A secured repository of
identities/etc would be better (the Foundation already has a place to
store stuff like bank account details).

Another practical argument against anonymity.  If everybody agrees
everything is public, then we don't have any personal information we
need to protect under various privacy laws.  As soon as we agree to
keep some info private, then we potentially have obligations under
such laws.  Also, legally the Foundation is a US organization - so I'm
not sure if things like the US-EU Safe Harbor provisions start to
apply if we want to collect this sort of info from EU citizens.  It is
just a can of worms you can avoid simply by not hanging onto this kind
of information.  I believe that many of these privacy protections
cannot be simply waived - we can't get some EU citizen to agree that
they don't apply to us.  If the laws apply then we need to follow
them.  Now, we're obviously not a big fish, so enforcement may never
happen.  Maybe compliance isn't burdensome - I only know enough about
such things to know that I'd want to know more before going down that
road...

-- 
Rich