Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[desultory <desultory@gentoo.org>]

On 07/03/19 07:13, Rich Freeman wrote:
> On Wed, Jul 3, 2019 at 12:31 AM desultory <desultory@gentoo.org> wrote:
>>
>> You based your argument on your preference, as opposed to reality.
> 
> This entire thread is about preference.  The reality is that you need
> to use your real name to contribute to Gentoo right now.  You would
> prefer that it be otherwise.  There is no harm in expressing that.
> 
That "reality" is, once again, not real. Sure, there is the (practically
unverifiable) requirement for signing off commits, but that is hardly
the only way to contribute to Gentoo right now.

>> Accepting and providing payments are fairly basic operations
>> for legal entities to engage in, even if the foundation were to be
>> dissolved there would still be financial transactions apropos Gentoo.
> 
> If we were operating under an umbrella org, Gentoo would not be
> legally responsible for these activities.
> 
> Also, I believe that these activities should STILL be minimized,
> ideally towards zero.  Physical servers and bank accounts are
> vulnerabilities that can be disrupted.  The less you depend on them,
> the more resilient you are.
> 
Again, I ask: how?

> If Gentoo were nothing more than a git repo it would be almost
> impossible to disrupt its operations as these are trivially
> replicated.  If the services it did run were entirely open they would
> be trivially mirrored (I mean open everything - not just the upstream
> code, but all our configs/etc - obviously short of the credentials).
> 
If Gentoo were nothing more than a git repo it would be almost useless.
No bug tracking, no integrated communications channels beyond various
forms of repo abuse, no user support, no mailing lists, no bespoke
package manager, no non-trivial analogs of e.g. eselect, not even
documentation outside of a git repo. On the plus side, there would
likely be next to no pesky users either.

> Yes, I'm obviously speaking aspirationally, but the principle is still
> valid.  IMO FOSS solutions for replacing some of the infra-heavy
> existing solutions like bugzilla are lacking, so this could be a long
> road.  However, anytime we deploy something new we should be asking
> whether any Gentoo user can trivially replicate the entire service
> based on our documentation and published data (ideally with a few
> lines), ideally including even authentication (no reason a Gentoo
> credential shouldn't work on a non-Gentoo site in a world where
> federation is common).  If the answer is no, then we're creating a
> dependency on some black box that could be taken away from us.
> 
As with most principles, what validity it has only extends to a point
and that point s far and away exceeded by what could loosely be termed
your proposals (given that there are no details beyond handwaving away
all practical considerations). By your argument, virtually everything
hosted on Gentoo controlled infra is a liability, not just bugzilla, but
the mailing lists (especially -core), developer mail in general, the
forums, the wiki, even your reductive case of gentoo.git would bear some
"black box".

>> In that case, you are advocating for having no: passwords, password
>> hashes, private e-mail (including security related correspondence), no
>> encryption keys, no signing keys, no pre-release code, no closed source
>> code, no code not meant for release for any reason at all, no
>> confidential data at all, and probably other things that I neglected to
>> list.
> 
> None of those are really PII.  However, we should certainly be
> minimizing our dependence on all of these.  We should depend on actual
> PII even less, and I'm skeptical that we need to retain this at all if
> we stop operating a legal entity.
> 
Having "nothing to steal" means having nothing that other people value,
not just not having one specific class of things other people might value.

Bearing in mind that none of the things I listed are at all specific to
the foundation; how, exactly, would not having a legal entity (good luck
with enforcing  and defending licensing and the use of marks, among
other things) remove the need to have any of the things I listed? Any
given one, your choice, how would an existing need for it go away
without a legal entity?

> I'm not saying that we'll ever reach zero, but anytime we can
> accomplish our goals without resorting to using the laundry list of
> stuff you just provided, we should.
> 
While having preferences for lighter and more open systems is, to an
extent, something toward which one can work, the degree of purity
testing that you are implying is a virtually guaranteed path to extinction.