Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Rich Freeman <rich0@gentoo.org>]

On Tue, Jul 2, 2019 at 12:24 AM desultory <desultory@gentoo.org> wrote:
>
> On 07/01/19 07:59, Rich Freeman wrote:
> > On Mon, Jul 1, 2019 at 1:02 AM desultory <desultory@gentoo.org> wrote:
> >>
> >> publishing PII purely on the basis of disciplinary
> >> considerations could be quite reasonably considered to be an outrageous
> >> overreach. There are reasons that "doxing" is generally considered to be
> >> rather reprehensible.
> >
> > It obviously is reprehensible.  However, nobody is suggesting
> > publishing PII for any reason, and I have no idea where this idea even
> > came from.
> >
> How, exactly, is a requirement to provide and publish "legal name as a
> natural person, i.e., the name that would appear in a government issued
> document" [GLEP76] not a requirement to publish persona data [PII]?

It isn't an issue if the person involved publishes itself and Gentoo
is merely the medium, IMO.

> > Furthermore, I do not think that Gentoo should be collecting PII under
> > conditions of confidentiality for any reason in the first place.  Nor
> > should we be doing any activities that require us to do so, such as
> > accepting money from people, or paying people.  IMO we do not have the
> > demonstrated ability to do this in a safe and compliant manner, and we
> > have a history of not performing legally-required activities in a
> > compliant manner.
> >
> Too late, Gentoo has multiple services which collect some form of PII
> (e.g. the EU considers an IP address to be, at least potentially, PII),
> and retain at least some of that data without publishing it.

I said that I don't think that it should be.  I never claimed that it wasn't.

> > For this reason, I think it would be a big mistake to allow people to
> > contribute under pseudonyms under the condition that they reveal their
> > real identities to some Gentoo body that would retain this information
> > in confidentiality.  That would expose Gentoo to a rather large number
> > of privacy laws in a large number of places, for IMO little gain.
> >
> So, under the mistaken premise that Gentoo does not collect or retain
> any form of PII you believe that Gentoo should not collect or retain any
> PII, correct?

I never said that Gentoo doesn't collect PII.  I said it shouldn't.
And it shouldn't.

> Knowing that Gentoo does indeed collect and retain some PII, does your
> opinion change?

No.  Obviously whatever PII we do collect needs to be properly
protected, just as we ought to be filing taxes and doing various other
things that we have trouble doing.

In both cases the problem can simply be avoided by structuring
ourselves in a manner that doesn't introduce the burden of compliance.

> LDAP, though most of that data is now published in some form it is still
> by and large a collection of PII.

We should not collect non-public PII in LDAP.  There is no harm in
allowing individuals to freely list their names/locations/etc if they
wish, but we shouldn't have anything in the database, other than
passwords or similar credentials, which isn't just published on the
website.  Hence there should be nothing to steal (well, other than
passwords, and those are useless after they are changed).

As I understand it we've already been pushing to eliminate much of the
PII from LDAP as it is - I'm curious as to what still remains that
would be of concern.  In particular I believe the birthdate field was
dropped some time ago.  Much of the rest gets published in the
directory/etc and so it isn't anything that isn't open to see.

> > None of this is intended as some kind of attack on Trustees/Infra/etc.
> > They're volunteers doing the best they can do without pay, and
> > generally trying to clean up after a long period of neglect.  It is
> > simply a fact that if you have nothing to steal, then it is impossible
> > to steal it, and no effort is required to protect it.
>
> Believing that you have nothing worth stealing is no defense against
> those who believe that you do and intend to take it.

I never claimed that we should shield ourselves with "belief."  I said
we shouldn't have anything to steal in the first place.

Sure, that won't stop people from trying.  It will definitely stop
them from succeeding.

-- 
Rich