Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Andrew Savchenko <bircoph@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 4311 bytes --]

Hi all!

On Sat, 15 Jun 2019 12:49:33 +0300 Andrew Savchenko wrote:
> On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
> > Hi all!
> > 
> > Last year we had a good initiative: it addition to (or even instead
> > of) manifests nominees were asked questions by voters. So let's
> > continue this year.
> > 
> > I propose to have one question per thread spawned by this e-mail to
> > keep discussion focused. If you have multiple questions, please
> > start multiple threads. If your question was already asked, please
> > join a thread.
> > 
> > I'll ask my questions in subsequent e-mails.
> 
> In my opinion GLEP 76 is the most controversial decision made by
> running council. While it fixed some long standing issues like
> copyright headers and proper acknowledgement of out of the tree
> contributors, it created grave problems: now some long-time
> contributors and even developer are seriously discriminated because
> they want to keep their privacy.
> 
> What is your opinion on this problem?
> Should GLEP 76 be left as is?
> Should GLEP 76 be cancelled?
> Should GLEP 76 be improved and how?

Since I've accepted the nomination, it's my turn to answer as well.

I'll tell you frankly that GLEP 76 was the main motivation for me
to accept the nomination. I consider it — in the way it exists now —
harmful and in need to be fixed. This is how free software works:
if something is broken and nobody repairs it, go and fix it
yourself.

What is wrong with GLEP 76? It kicks some active contributors and
rejects some of new ones. No, it is not just one developer
affected as someone may assume. We have external contributors
kicked out, we have at least one high quality maintainer who worked
on quizzes, but this work was stopped due to hostility to and
further ban on anonymous contributions.

I believe that for free software development privacy concern is of
paramount importance, especially when we are dealing with security
or privacy oriented software.

One may argue that ban on anonymous contributions was to protect
Gentoo from possible copyright claims in the future. But does it
really gives us such protection? In my opinion NO, because:

1. GLEP 76 was prepared without legal expertise from experts in
this field. (At least such expertise was not published.) Hereby we
have no evidence that it will work if real case will be opened.

2. No law or legal precedent was provided to prove that GLEP 76
will be useful in alleged case or that we have a legal requirement
to put such restrictive demand on our contributors.

3. We objectively have no means to verify developer's credentials.
Current approach is based on realistic-like approach: if someone
names themselve "John Doe" we accept it, if someone names as
"qwerty123" we do not recognize this as an ID. But we have no means
to verify that "John Doe" is real (natural) name. Even GnuPG Web of
Trust doesn't provide such means, because what it really provides
is a link between a person and their GnuPG key, as we're not
authorized legal entities empowered and fully informed to verify
validity of IDs present during GnuPG signing.

So in my opinion current state of affairs is not acceptable and
must be amended. What I propose to do:

1. To mitigate current crisis we should allow developers to commit
under any unique non-offensive id (text string) as long as the
trustees know how it maps to a real name.

The rationale is that the trustees are the legal body to handle all
legal issues of Gentoo, so even if we agree that real names are
mandatory, there is no practical legal need for anyone outside of
trustees to know them. This way we can include people who agree to
keep their privacy from anyone except trustees and in the same way
this will keep the legal effect of GLEP 76 intact.

2. Work together with trustees and possibly some external expertise
(both legal and risk assessment) to clarify if we are really
expected to check all these data and search for a way to accept
private contributions.

My goal is to help Gentoo to be open and inclusive society and not
some bureaucratic club fighting ghosts (I *don't* claim it is that
way now, but there are some alarming tendencies...).

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]