Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Rich Freeman <rich0@gentoo.org>]

On Mon, Jul 1, 2019 at 1:02 AM desultory <desultory@gentoo.org> wrote:
>
> publishing PII purely on the basis of disciplinary
> considerations could be quite reasonably considered to be an outrageous
> overreach. There are reasons that "doxing" is generally considered to be
> rather reprehensible.

It obviously is reprehensible.  However, nobody is suggesting
publishing PII for any reason, and I have no idea where this idea even
came from.

For the sake of clarity, I do not believe that Gentoo should publish
PII collected confidentially for any reason.

Furthermore, I do not think that Gentoo should be collecting PII under
conditions of confidentiality for any reason in the first place.  Nor
should we be doing any activities that require us to do so, such as
accepting money from people, or paying people.  IMO we do not have the
demonstrated ability to do this in a safe and compliant manner, and we
have a history of not performing legally-required activities in a
compliant manner.

For this reason, I think it would be a big mistake to allow people to
contribute under pseudonyms under the condition that they reveal their
real identities to some Gentoo body that would retain this information
in confidentiality.  That would expose Gentoo to a rather large number
of privacy laws in a large number of places, for IMO little gain.

None of this is a risk with GLEP 76 as it currently stands.  People
who wish to contribute code to Gentoo must divulge their names.  They
can choose to do this, or not, and if they choose not to, then their
contributions will not be accepted.  If they do, then Gentoo doesn't
have any private information they have to safeguard, because it has
been made public by the person it pertains to.  There is no database
of PII that we have to make accessible to people we already barely
know scattered around the world, but protect from exposure via hacking
attacks/etc.

None of this is intended as some kind of attack on Trustees/Infra/etc.
They're volunteers doing the best they can do without pay, and
generally trying to clean up after a long period of neglect.  It is
simply a fact that if you have nothing to steal, then it is impossible
to steal it, and no effort is required to protect it.

-- 
Rich