[gentoo-project] Reconsidering github "noreply" emails in author/signed-off-by

[gentoo-project] Reconsidering github "noreply" emails in author/signed-off-by

[Sam James]

GitHub supports email addresses like <ID+username>@users.noreply.github.com for both git authorship
and Signed-off-by.

At the moment, we don't have a formal policy on this.

Prima facie, the email is unsuitable for use given you can't use it
to contact the person using it.

I'm told github, at least at the moment, _does_ forward emails sent to
the addresses, despite the "noreply" component, but I'm not sure they
guarantee this at all. This is entirely word-of-mouth which isn't
great.

I also think the email appears antisocial and defeats the purpose of a
GLEP 76 sign-off given it can't reliably be used to contact somebody.

LLVM is also discussing this at
https://discourse.llvm.org/t/hidden-emails-on-github-should-we-do-something-about-it/74223.

Should we ban the use of noreply emails in git authorship,
Signed-off-by, and in mask files etc?

thanks,
sam

Re: [gentoo-project] Reconsidering github "noreply" emails in author/signed-off-by

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1148 bytes --]

>>>>> On Thu, 19 Oct 2023, Sam James wrote:

> GitHub supports email addresses like
> <ID+username>@users.noreply.github.com for both git authorship and
> Signed-off-by.

> At the moment, we don't have a formal policy on this.

> Prima facie, the email is unsuitable for use given you can't use it
> to contact the person using it.

> I'm told github, at least at the moment, _does_ forward emails sent to
> the addresses, despite the "noreply" component, but I'm not sure they
> guarantee this at all. This is entirely word-of-mouth which isn't
> great.

> I also think the email appears antisocial and defeats the purpose of a
> GLEP 76 sign-off given it can't reliably be used to contact somebody.

> LLVM is also discussing this at
> https://discourse.llvm.org/t/hidden-emails-on-github-should-we-do-something-about-it/74223.

> Should we ban the use of noreply emails in git authorship,
> Signed-off-by, and in mask files etc?

GLEP 76 requires "a known identity as a natural person", which in
particular can be "an established online identity". IMHO this implies
that the person can be contacted by the address given in the sign-off.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 507 bytes --]

Re: [gentoo-project] Reconsidering github "noreply" emails in author/signed-off-by

[Arsen Arsenović]

[-- Attachment #1: Type: text/plain, Size: 499 bytes --]

Hi,

Ulrich Mueller <ulm@gentoo.org> writes:

> GLEP 76 requires "a known identity as a natural person", which in
> particular can be "an established online identity". IMHO this implies
> that the person can be contacted by the address given in the sign-off.

I agree with this interpretation (and am not in favor of noreply emails
given by GitHub).

I think a clarification sentence is sufficient next to the 'established
identity' rule.

Have a lovely night!
-- 
Arsen Arsenović

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 381 bytes --]

Re: [gentoo-project] Reconsidering github "noreply" emails in author/signed-off-by

[Andreas K. Huettel]

[-- Attachment #1: Type: text/plain, Size: 1180 bytes --]

Am Donnerstag, 19. Oktober 2023, 17:33:56 CEST schrieb Sam James:
> GitHub supports email addresses like <ID+username>@users.noreply.github.com for both git authorship
> and Signed-off-by.
> 
> At the moment, we don't have a formal policy on this.
> 
> Prima facie, the email is unsuitable for use given you can't use it
> to contact the person using it.
> 
> I'm told github, at least at the moment, _does_ forward emails sent to
> the addresses, despite the "noreply" component, but I'm not sure they
> guarantee this at all. This is entirely word-of-mouth which isn't
> great.
> 
> I also think the email appears antisocial and defeats the purpose of a
> GLEP 76 sign-off given it can't reliably be used to contact somebody.
> 
> LLVM is also discussing this at
> https://discourse.llvm.org/t/hidden-emails-on-github-should-we-do-something-about-it/74223.
> 
> Should we ban the use of noreply emails in git authorship,
> Signed-off-by, and in mask files etc?

Yes please.


-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer 
(council, comrel, toolchain, base-system, perl, libreoffice)
https://wiki.gentoo.org/wiki/User:Dilfridge

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Reconsidering github "noreply" emails in author/signed-off-by

[Viorel Munteanu]

On 10/19/23 18:33, Sam James wrote:
> GitHub supports email addresses like <ID+username>@users.noreply.github.com for both git authorship
> and Signed-off-by.
>
> At the moment, we don't have a formal policy on this.
>
> Prima facie, the email is unsuitable for use given you can't use it
> to contact the person using it.
>
> I'm told github, at least at the moment, _does_ forward emails sent to
> the addresses, despite the "noreply" component, but I'm not sure they
> guarantee this at all. This is entirely word-of-mouth which isn't
> great.
>
> I also think the email appears antisocial and defeats the purpose of a
> GLEP 76 sign-off given it can't reliably be used to contact somebody.
>
> LLVM is also discussing this at
> https://discourse.llvm.org/t/hidden-emails-on-github-should-we-do-something-about-it/74223.
>
> Should we ban the use of noreply emails in git authorship,
> Signed-off-by, and in mask files etc?
>
> thanks,
> sam
>
I also support this.  Having a link to add when asking for a different 
e-mail would help.

Thank you,

Viorel

Re: [gentoo-project] Reconsidering github "noreply" emails in author/signed-off-by

[Joonas Niilola]

[-- Attachment #1.1: Type: text/plain, Size: 1210 bytes --]

On 19.10.2023 18.33, Sam James wrote:
> GitHub supports email addresses like <ID+username>@users.noreply.github.com for both git authorship
> and Signed-off-by.
> 
> At the moment, we don't have a formal policy on this.
> 
> Prima facie, the email is unsuitable for use given you can't use it
> to contact the person using it.
> 
> I'm told github, at least at the moment, _does_ forward emails sent to
> the addresses, despite the "noreply" component, but I'm not sure they
> guarantee this at all. This is entirely word-of-mouth which isn't
> great.
> 
> I also think the email appears antisocial and defeats the purpose of a
> GLEP 76 sign-off given it can't reliably be used to contact somebody.
> 
> LLVM is also discussing this at
> https://discourse.llvm.org/t/hidden-emails-on-github-should-we-do-something-about-it/74223.
> 
> Should we ban the use of noreply emails in git authorship,
> Signed-off-by, and in mask files etc?
> 
> thanks,
> sam
> 

Hey,

Now instead of this you have an example of people initializing these
"1-off" mail addresses. I believe Github's noreply is a better way to
reach or identify someone than the 10minutemail alternative.

-- juippis

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Reconsidering github "noreply" emails in author/signed-off-by

[Sam James]

Joonas Niilola <juippis@gentoo.org> writes:

> [[PGP Signed Part:Undecided]]
> On 19.10.2023 18.33, Sam James wrote:
>> GitHub supports email addresses like <ID+username>@users.noreply.github.com for both git authorship
>> and Signed-off-by.
>> 
>> At the moment, we don't have a formal policy on this.
>> 
>> Prima facie, the email is unsuitable for use given you can't use it
>> to contact the person using it.
>> 
>> I'm told github, at least at the moment, _does_ forward emails sent to
>> the addresses, despite the "noreply" component, but I'm not sure they
>> guarantee this at all. This is entirely word-of-mouth which isn't
>> great.
>> 
>> I also think the email appears antisocial and defeats the purpose of a
>> GLEP 76 sign-off given it can't reliably be used to contact somebody.
>> 
>> LLVM is also discussing this at
>> https://discourse.llvm.org/t/hidden-emails-on-github-should-we-do-something-about-it/74223.
>> 
>> Should we ban the use of noreply emails in git authorship,
>> Signed-off-by, and in mask files etc?
>> 
>> thanks,
>> sam
>> 
>
> Hey,
>
> Now instead of this you have an example of people initializing these
> "1-off" mail addresses. I believe Github's noreply is a better way to
> reach or identify someone than the 10minutemail alternative.

Are you saying this is happening or hypothetically?

I'd say the same thing applies to any such 10minutemail things - we
shouldn't accept those either, at least not if it's a substantial
contribution.

And there's no guarantee that github's noreply will actually
forward stuff in the future either?

>
> -- juippis
>
> [[End of PGP Signed Part]]

Re: [gentoo-project] Reconsidering github "noreply" emails in author/signed-off-by

[Joonas Niilola]

[-- Attachment #1.1: Type: text/plain, Size: 1250 bytes --]

On 29.10.2023 10.59, Sam James wrote:
> 
> Are you saying this is happening or hypothetically?

Yes, we got our first example of someone being told
users.noreply.github.org isn't enough. I only see this getting worse in
the future, although not that we had too many of those e-mails before
this either.


> 
> I'd say the same thing applies to any such 10minutemail things - we
> shouldn't accept those either, at least not if it's a substantial
> contribution.

But I'm not aware of all these temporary mail addresses, do we start
looking up each domain?


> 
> And there's no guarantee that github's noreply will actually
> forward stuff in the future either?

There's no guarantee Github will be up in the future :) there's no
guarantee any e-mail address will be kept forever. E-mail providers
prune unused addresses, even GMail.

I'd also like to remind everyone about the significance of a
contribution. A copy-paste of an old ebuild doesn't even require a
sign-off, and I personally am really pushing it only for significant
code change contributions. Still I feel like we're complicating things
here on a larger scale.

https://devmanual.gentoo.org/general-concepts/copyright-policy/index.html

-- juippis

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Reconsidering github "noreply" emails in author/signed-off-by

[Sam James]

Joonas Niilola <juippis@gentoo.org> writes:

> [[PGP Signed Part:Undecided]]
> On 29.10.2023 10.59, Sam James wrote:
>> 
>> Are you saying this is happening or hypothetically?
>
> Yes, we got our first example of someone being told
> users.noreply.github.org isn't enough. I only see this getting worse in
> the future, although not that we had too many of those e-mails before
> this either.
>

And then they used a proper email for it...

>
>> 
>> I'd say the same thing applies to any such 10minutemail things - we
>> shouldn't accept those either, at least not if it's a substantial
>> contribution.
>
> But I'm not aware of all these temporary mail addresses, do we start
> looking up each domain?

Sure, look it up if you don't know. We're supposed to at least
see if their identity is established anyway.

>
>
>> 
>> And there's no guarantee that github's noreply will actually
>> forward stuff in the future either?
>
> There's no guarantee Github will be up in the future :) there's no
> guarantee any e-mail address will be kept forever. E-mail providers
> prune unused addresses, even GMail.
>

Yes, but this has "noreply" in it, and github aren't a mail provider.

> I'd also like to remind everyone about the significance of a
> contribution. A copy-paste of an old ebuild doesn't even require a
> sign-off, and I personally am really pushing it only for significant
> code change contributions. Still I feel like we're complicating things
> here on a larger scale.

The diagram on the devmanual page you linked makes clear you don't need
the signoff, so no need to worry there -- although again would really
want a proper email anyway given it's IMO antisocial not to.

>
> https://devmanual.gentoo.org/general-concepts/copyright-policy/index.html
>
> -- juippis
>
> [[End of PGP Signed Part]]

Re: [gentoo-project] Reconsidering github "noreply" emails in author/signed-off-by

[Joonas Niilola]

[-- Attachment #1.1: Type: text/plain, Size: 1032 bytes --]

On 29.10.2023 11.15, Sam James wrote:
> 
> Joonas Niilola <juippis@gentoo.org> writes:
> 
>> [[PGP Signed Part:Undecided]]
>> On 29.10.2023 10.59, Sam James wrote:
>>>
>>> Are you saying this is happening or hypothetically?
>>
>> Yes, we got our first example of someone being told
>> users.noreply.github.org isn't enough. I only see this getting worse in
>> the future, although not that we had too many of those e-mails before
>> this either.
>>
> 
> And then they used a proper email for it...
> 

"proper" that's going to be deleted or ever-ignored after this. Doubt
it's going to help contacting them later on any better if that was the
point.

We were talking about an "established identity". IMHO in some cases the
noreply address is better established on the web, than something you
create temporarily due to requirements between different projects. All
in all the worst outcome may be if these people stopped contributing,
but so far there's no data to confirm that's happening.

-- juippis


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]