Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Andrew Savchenko <bircoph@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 4291 bytes --]

Hi all!

On Tue, 25 Jun 2019 08:15:07 +0200 Michał Górny wrote:
> On Tue, 2019-06-25 at 01:18 +0300, Andrew Savchenko wrote:
[...]
> > Since I've accepted the nomination, it's my turn to answer as well.
> > 
> > I'll tell you frankly that GLEP 76 was the main motivation for me
> > to accept the nomination. I consider it — in the way it exists now —
> > harmful and in need to be fixed. This is how free software works:
> > if something is broken and nobody repairs it, go and fix it
> > yourself.
> > 
> > What is wrong with GLEP 76? It kicks some active contributors and
> > rejects some of new ones. No, it is not just one developer
> > affected as someone may assume. We have external contributors
> > kicked out, we have at least one high quality maintainer who worked
> > on quizzes, but this work was stopped due to hostility to and
> > further ban on anonymous contributions.
> > 
> > I believe that for free software development privacy concern is of
> > paramount importance, especially when we are dealing with security
> > or privacy oriented software.
> > 
> > One may argue that ban on anonymous contributions was to protect
> > Gentoo from possible copyright claims in the future. But does it
> > really gives us such protection? In my opinion NO, because:
> > 
> > 1. GLEP 76 was prepared without legal expertise from experts in
> > this field. (At least such expertise was not published.) Hereby we
> > have no evidence that it will work if real case will be opened.
> > 
> > 2. No law or legal precedent was provided to prove that GLEP 76
> > will be useful in alleged case or that we have a legal requirement
> > to put such restrictive demand on our contributors.
> 
> What 'legal expertise', 'law' or 'legal precedent' do you have to say
> otherwise?  It's easy to blame others when all you have is your private
> opinion.

This is not blaming, this not how the law works: everything which
is not denied is allowed, everything which is not required is not
mandatory. Of course this applies to full set of laws: from federal
to local level and legal precendents.

So, at least for my knowledge, Gentoo Foundation is not forbidden
by the law to require real name signatures, but is neither obliged
to do so.

> > 3. We objectively have no means to verify developer's credentials.
> > Current approach is based on realistic-like approach: if someone
> > names themselve "John Doe" we accept it, if someone names as
> > "qwerty123" we do not recognize this as an ID. But we have no means
> > to verify that "John Doe" is real (natural) name. Even GnuPG Web of
> > Trust doesn't provide such means, because what it really provides
> > is a link between a person and their GnuPG key, as we're not
> > authorized legal entities empowered and fully informed to verify
> > validity of IDs present during GnuPG signing.
> > 
> > So in my opinion current state of affairs is not acceptable and
> > must be amended. What I propose to do:
> > 
> > 1. To mitigate current crisis we should allow developers to commit
> > under any unique non-offensive id (text string) as long as the
> > trustees know how it maps to a real name.
> > 
> > The rationale is that the trustees are the legal body to handle all
> > legal issues of Gentoo, so even if we agree that real names are
> > mandatory, there is no practical legal need for anyone outside of
> > trustees to know them. This way we can include people who agree to
> > keep their privacy from anyone except trustees and in the same way
> > this will keep the legal effect of GLEP 76 intact.
> > 
> 
> How are Trustees supposed to know whether the 'real name' is actually a
> real natural name?  You just said it is apparently impossible to verify.

Please read carefully my original e-mail and do not twist my words.

I never stated that the trustees will know better, I stated that
their knowledge of what we assume to be real names will be
sufficient and there is no need for all developers to know them.
This is because the trustees are responsible for legal issues of
Gentoo.

With such approach we lose nothing, but gain something valuable: we
may and will accept more people and more contributions.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]