Re: [gentoo-project] RFC: draft of Nitrokey survey questions re shipping, usage & satisfaction

[Andrew Savchenko <bircoph@gentoo.org>]

[-- Attachment #1: Type: text/plain, Size: 3266 bytes --]

On Sat, 13 Jul 2019 23:38:51 +0000 Robin H. Johnson wrote:
> Hi,
> 
> I'm trying to put together a survey about the Nitrokey units that the
> Foundation arranged for devs.
> 
> The rough goals:
> - measure shipping results [=> quantitative, at least one dev had their shipment returned]
> - measure usage [=> quantitative, was this a waste?]
> - measure satisfaction with nitrokey units [=> qualitative]
> 
> I'm planning on using Google Forms for this, because I'm familiar with
> that as a survey platform.
> 
> I'm not going to spin up an entire survey system just keep it entirely
> libre. I do plan on publishing the results of the survey, with some
> parts made anonymous/redacted.
> 
> The form will NOT require sign-in, but there will be a field for
> entering your developer name.
> 
> I would appreciate both public & private input, both about this as a
> survey, and meta-input about future surveys to measure success of
> particular programs.
> 
> Draft questions:
> ----------------
> 
> Setup:
> - Dev Username [textfield]
> 
> Shipping:
> - Did you order a nitrokey unit? boolean
> - When did you placed the order (optional) Y/M/D
> - When did you received the order (optional) Y/M/D
> - How many nitrokey units did you actually receive? [integer]
> - Did you have to pay any additional charges to receive the unit?
> - If so, how much did you pay? [numeric]
>   COMMENT: I want to be able to adjust this question to both per-country
>   cost-of-living and socioeconomic level of different developers within
>   a country. See the demographics at the end.
> - If so, what were the nature of the charges (e.g. customs) [freetext]
> - Additional: If you did not receive the order, or got more than one,
>   can you summarize what happened? [freetext] Please do not
>   self-identify in the text.
> 
> Usage:
> - Note: per-developer commit count will be extracted from Git

This count will give only a lower esfimate of what number of
signature are made for the Gentoo git. You also need to commit
number of git pushes, since we require them to be signed as well.

Another option is automatic rebase: this is how most commits to the
tree are done: git pull; do some job; repoman commit; git pull &&
git push — and most likely rebase will occur during git pull && git
push, so the number of signature with be doubled. Sometimes it will
be tripled, since I have had failures with git pulll && git push
when someone made commits in-between.

> - What percentage of your commits use the on-device key? (0..100% in 25% increments)
> - Did you use the units for non-commit signing or encryption? [boolean]
> - If so, how often? [many times a day, daily, weekly, monthly]

I think this list should be extended: now it assumes that keys are
used for either Gentoo git commits or non-commit signing or
encryption. But keys mays also be used or git signing in other
projects and for gpg-based authentification (auth subkey).

Also nirokey has other usage than gpg signing: it can be used as
TRNG, for pam auth, OTP storage, encrypted password safe and so on.
Such usage should be included to the survey as well and add the
"other" field for other cases.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]