[gentoo-project] Questions for Gentoo Council nominees

[gentoo-project] Questions for Gentoo Council nominees

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 469 bytes --]

Hi all!

Last year we had a good initiative: it addition to (or even instead
of) manifests nominees were asked questions by voters. So let's
continue this year.

I propose to have one question per thread spawned by this e-mail to
keep discussion focused. If you have multiple questions, please
start multiple threads. If your question was already asked, please
join a thread.

I'll ask my questions in subsequent e-mails.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

[gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1053 bytes --]

On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
> Hi all!
> 
> Last year we had a good initiative: it addition to (or even instead
> of) manifests nominees were asked questions by voters. So let's
> continue this year.
> 
> I propose to have one question per thread spawned by this e-mail to
> keep discussion focused. If you have multiple questions, please
> start multiple threads. If your question was already asked, please
> join a thread.
> 
> I'll ask my questions in subsequent e-mails.

In my opinion GLEP 76 is the most controversial decision made by
running council. While it fixed some long standing issues like
copyright headers and proper acknowledgement of out of the tree
contributors, it created grave problems: now some long-time
contributors and even developer are seriously discriminated because
they want to keep their privacy.

What is your opinion on this problem?
Should GLEP 76 be left as is?
Should GLEP 76 be cancelled?
Should GLEP 76 be improved and how?

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

[gentoo-project] Questions for Gentoo Council nominees: Power balance

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1449 bytes --]

On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
> Hi all!
> 
> Last year we had a good initiative: it addition to (or even instead
> of) manifests nominees were asked questions by voters. So let's
> continue this year.
> 
> I propose to have one question per thread spawned by this e-mail to
> keep discussion focused. If you have multiple questions, please
> start multiple threads. If your question was already asked, please
> join a thread.
> 
> I'll ask my questions in subsequent e-mails.

Gentoo power balance was carefully crafted over the years. However
during last year that balance was disrupted:

1. The same person can now be in the Gentoo Council and the Trustees
board.
2. QA can now bypass Comrel on bans.

What is your opinion on this?
Should this balance be left as is?
If it should be tuned, then how?

I'm worried about that some people or teams may gain too much power
and misuse it.

One possible solution will be to limit number of teams or roles a
single person may participate, but this may result in some teams
outnumbered since many have lack of manpower problem.

A better solution may be "single person => single vote" rule, so
everyone is free to participate where and how they want, but in a
case when multiple teams are involved in processing an issue a
single person may vote only once and it is up to them to choose
using what role.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 667 bytes --]

>>>>> On Sat, 15 Jun 2019, Andrew Savchenko wrote:

> In my opinion GLEP 76 is the most controversial decision made by
> running council. While it fixed some long standing issues like
> copyright headers and proper acknowledgement of out of the tree
> contributors, it created grave problems: now some long-time
> contributors and even developer are seriously discriminated because
> they want to keep their privacy.

> What is your opinion on this problem?
> Should GLEP 76 be left as is?
> Should GLEP 76 be cancelled?
> Should GLEP 76 be improved and how?

I believe that I've made my opinion on these matters clear, in the
discussions leading to GLEP 76.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

[gentoo-project] Questions for Gentoo Council nominees: Bringing new people

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1276 bytes --]

On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
> Hi all!
> 
> Last year we had a good initiative: it addition to (or even instead
> of) manifests nominees were asked questions by voters. So let's
> continue this year.
> 
> I propose to have one question per thread spawned by this e-mail to
> keep discussion focused. If you have multiple questions, please
> start multiple threads. If your question was already asked, please
> join a thread.
> 
> I'll ask my questions in subsequent e-mails.

As almost any FOSS project Gentoo suffers from lack of manpower in
various areas. While there are technical ways to amend this like
automation improvements I'd like to focus on bringing new people.

Life changes, some developers eventually quit; number of packages
is growing (not only in Gentoo, but world-wide), their complexity
grows. All this requires new developers.

How do you propose to bring new people to our team? What as the
Council member you can do?
What do you think on current entrance threshold?
What about contributions by non-developers? Should we focus on e.g.
encouraging proxied maintainers to become developers or should we
grow out of the tree contributions without git tree access?

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Power balance

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 757 bytes --]

>>>>> On Sat, 15 Jun 2019, Andrew Savchenko wrote:

> Gentoo power balance was carefully crafted over the years. However
> during last year that balance was disrupted:

> 1. The same person can now be in the Gentoo Council and the Trustees
> board.

Ultimately, the electorate is going to decide if that will actually
happen. Personally, I wouldn't vote for the same person in both Council
and Trustee elections.

> 2. QA can now bypass Comrel on bans.

Yeah, and I had a part in mitigating it by limiting the duration of such
bans to 14 days, instead of 30 days as originally proposed. (Which I was
heavily criticised for and accused of being "childish" in another mail
sent to -project earlier today. I guess it's impossible to please
everybody.)

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 461 bytes --]

On 6/15/19 11:49 AM, Andrew Savchenko wrote:
> What is your opinion on this problem?
> Should GLEP 76 be left as is?
> Should GLEP 76 be cancelled?
> Should GLEP 76 be improved and how?

As I voted on it my opinion is a matter of public record. It is a
necessary improvement and needs to remain as it is.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Bringing new people

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 1436 bytes --]

On 6/15/19 12:24 PM, Andrew Savchenko wrote:
> How do you propose to bring new people to our team? What as the
> Council member you can do?

Ensure Gentoo is a distro taken serious, which is a multi-step matter;
(i) by having a good reputation for good technical solutions of (a) the
distro itself; and (b) amongst upstream developers by ensuring patches
etc are contributed; and (ii) a professional behavior so it is taken
serious by others; and (iii) it is definitely needed to become more
active at (a) various conferences, both with stands to promote gentoo,
(b) but also participations in various LUGs and other venues.

> What do you think on current entrance threshold?

It is definitely not difficult to become a developer if you're
devoted/interested in doing so, if anything it is a bit too low, but
that can be a good thing if balanced with proper mentoring to bring
people in.

> What about contributions by non-developers? Should we focus on e.g.
> encouraging proxied maintainers to become developers or should we
> grow out of the tree contributions without git tree access?

Depends on type of package, for core packages, unless the proxied
maintainer are also upstream developers etc we likely want to maintian
control within gentoo developers.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Bringing new people

[Andreas K. Huettel]

[-- Attachment #1: Type: text/plain, Size: 891 bytes --]

Am Samstag, 15. Juni 2019, 12:24:15 CEST schrieb Andrew Savchenko:
> 
> How do you propose to bring new people to our team? What as the
> Council member you can do?

Focus less on pointless mailing list discussions and more on improving gentoo.

> What do you think on current entrance threshold?

Technical knowledge is necessary. 

The entrance threshold is to a large extent a matter of perception. If you 
know what you are doing (and someone from recruiters has time= you can in 
principle go through the entire recruitment procedure within 48h.

> What about contributions by non-developers? Should we focus on e.g.
> encouraging proxied maintainers to become developers

Yes. People should take responsibility for their own contributions.


-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Power balance

[Andreas K. Huettel]

[-- Attachment #1: Type: text/plain, Size: 534 bytes --]

> 
> Gentoo power balance was carefully crafted over the years. However
> during last year that balance was disrupted:
> 
[...]
> 2. QA can now bypass Comrel on bans.
> 

That is not a change of policy, but a clarification of how it was intended in 
a previous council decision (years ago).

Even if nobody believes me, this is how things would have been handled during 
my tenure as comrel lead.

-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Power balance

[Mikle Kolyada]

[-- Attachment #1.1: Type: text/plain, Size: 682 bytes --]


On 15.06.2019 13:00, Andrew Savchenko wrote:

[...]

> 1. The same person can now be in the Gentoo Council and the Trustees
> board.
> 2. QA can now bypass Comrel on bans.
>
> What is your opinion on this?
> Should this balance be left as is?
> If it should be tuned, then how?
>

1. Personally I would not vote for the same person being council and
trustees member at the same time.

2. QA has already had the right of bypassing ComRel on bans once QA lead
requested it from infra directly.

Now we have clear policy about it which helps people avoiding confusion,
no implicit actions anymore therefore this is less questionable now than
it was before.



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Power balance

[Roy Bamford]

[-- Attachment #1: Type: text/plain, Size: 2295 bytes --]

On 2019.06.15 11:00, Andrew Savchenko wrote:
> On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
> > Hi all!
> > 
> > Last year we had a good initiative: it addition to (or even instead
> > of) manifests nominees were asked questions by voters. So let's
> > continue this year.
> > 
> > I propose to have one question per thread spawned by this e-mail to
> > keep discussion focused. If you have multiple questions, please
> > start multiple threads. If your question was already asked, please
> > join a thread.
> > 
> > I'll ask my questions in subsequent e-mails.
> 
> Gentoo power balance was carefully crafted over the years. However
> during last year that balance was disrupted:

[snip]

I don't that is correct but it may not matter to the rest of the discussion.

When drobbins left in 2004, the Foundation was formed to take over the 
assets of Gentoo Technologies Inc., which had owned Gentoos assets
while drobbins was BDFL.

At that time the TLPL, without the BDFL continued to look after the 
technical issues. For whatever reasons, the TLPL became ineffective
and the council was formed to address that.

I don't have any data to suggest that the Foundation endorsed the 
councils terms of reference or otherwise.   

The point is, the Gentoo power balance just happened as a series of
responses to local problems at the time. 

> 1. The same person can now be in the Gentoo Council and the Trustees
> board.

Its not new. drobbins was both BDFL (TLPL Manager) and one of the
directors of Gentoo Technologies Inc.

When the Foundation bylaws were adopted in 2008, the thinking was 
that the council would put forward project ideas that needed to be funded 
and separation of duties requires that those that want to spend the money 
should be a separate group from those that approve it.

Its never been an issue since to my knowledge, council as a body, have 
never requested funding for anything.

It would still be a bad thing if the trustees was a subset of the council.
The two roles require different skill sets, so I don't think overlap is either
useful or desirable. 

> Best regards,
> Andrew Savchenko
> 

-- 
Regards,

Roy Bamford
(Neddyseagoon) a member of
elections
gentoo-ops
forum-mods
arm64

[-- Attachment #2: Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo as hobbyist distro

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 916 bytes --]

On Sat, 2019-06-15 at 12:42 +0300, Andrew Savchenko wrote:
> Last year we had a good initiative: it addition to (or even instead
> of) manifests nominees were asked questions by voters. So let's
> continue this year.
> 
> I propose to have one question per thread spawned by this e-mail to
> keep discussion focused. If you have multiple questions, please
> start multiple threads. If your question was already asked, please
> join a thread.
> 

Some developers were recently complaining that we're turning Gentoo into
a hobbyist distro and that's apparently bad.

Do you think Gentoo should allow for experimental and unstable features,
and possibly breaking changes that make Gentoo more interesting for
hobbyists?  Or should we block breaking changes and become more
conservative for users who prefer stable distribution with minimal
maintenance burden?

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Bringing new people

[Mikle Kolyada]

[-- Attachment #1.1: Type: text/plain, Size: 2392 bytes --]


On 15.06.2019 13:24, Andrew Savchenko wrote:
> On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
>> Hi all!
>>
>> Last year we had a good initiative: it addition to (or even instead
>> of) manifests nominees were asked questions by voters. So let's
>> continue this year.
>>
>> I propose to have one question per thread spawned by this e-mail to
>> keep discussion focused. If you have multiple questions, please
>> start multiple threads. If your question was already asked, please
>> join a thread.
>>
>> I'll ask my questions in subsequent e-mails.
> As almost any FOSS project Gentoo suffers from lack of manpower in
> various areas. While there are technical ways to amend this like
> automation improvements I'd like to focus on bringing new people.
>
> Life changes, some developers eventually quit; number of packages
> is growing (not only in Gentoo, but world-wide), their complexity
> grows. All this requires new developers.
>
> How do you propose to bring new people to our team? What as the
> Council member you can do?

This does not depend on council directly, but I think we must improve
existing polices and procedures, some people who I would like to see
amongst devs tell me that they are literally afraid to start the process
because we have lots of things to learn and some of them are poorly
described. I also think that publicity is a must
(conferences/talks/etc), this usually helps new people to get their
questions answered therefore they are more interested to be involved.

> What do you think on current entrance threshold?
The threshold corresponds 1:1 to the current situation in the distro (I
mean polices demands and general developers qualification), generally
this is not really difficult to become a developer, especially if you
have a good mentor (as a recruiter I can firmly claim that the good
mentor is the 60% of success), enthusiasm and free time.


> What about contributions by non-developers? Should we focus on e.g.
> encouraging proxied maintainers to become developers or should we
> grow out of the tree contributions without git tree access

I'd say being a proxied maintainer is more time consuming deal than the
whole process of becoming a developer.

Also once you became a dev you have much more freedom to help the
distro, so yes.

>
> Best regards,
> Andrew Savchenko


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo as hobbyist distro

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 715 bytes --]

On 6/16/19 8:09 PM, Michał Górny wrote:
> Do you think Gentoo should allow for experimental and unstable features,
> and possibly breaking changes that make Gentoo more interesting for
> hobbyists?  Or should we block breaking changes and become more
> conservative for users who prefer stable distribution with minimal
> maintenance burden?

The upgrade paths within a profile should certainly be non-breaking,
whereby breaking changes and changes that require manual interaction
beyond normal needs to await for a specific profile change on the system.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 1474 bytes --]

On 2019-06-15 11:49, Andrew Savchenko wrote:
> What is your opinion on this problem?
> Should GLEP 76 be left as is?
> Should GLEP 76 be cancelled?
> Should GLEP 76 be improved and how?

I don't see GLEP 76 being cancelled. I personally do *not* share your
privacy concerns and really believe that this was a necessary, long
overdue, change.

But my opinion doesn't matter. What I want to say: My opinion has the
same value as your opinion or the opinion of any other developer.

And from that POV, you have to acknowledge that nobody really raised
such a concern. The truth is, only 1 active developer is really affected
by this change (at least just one developer expressed problems and
stopped contributing since then). But this wasn't a council-only
decision. When this was discussed on mailing list, everyone should have
known the consequences. In other words: Most people in Gentoo agreed
that we have to address copyright and we don't do anything crazy in
comparison to Fedora/Redhat, Arch Linux or Debian. Wrong?

If you or anyone else have an idea how GLEP 76 could be improved please
share! That's not special about GLEP 76, that's valid for anything in
Gentoo. We all are Gentoo. And if there's a problem which could be
solved or something which could be improved, raise your voice so we can
become better -- together.


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Power balance

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 1298 bytes --]

Hi,

On 2019-06-15 12:00, Andrew Savchenko wrote:
> Gentoo power balance was carefully crafted over the years. However
> during last year that balance was disrupted:
> 
> 1. The same person can now be in the Gentoo Council and the Trustees
> board.
> 2. QA can now bypass Comrel on bans.
> 
> What is your opinion on this?
> Should this balance be left as is?
> If it should be tuned, then how?
> 
> I'm worried about that some people or teams may gain too much power
> and misuse it.

I fully share your concerns. Please read what I wrote before council
voted on that topic
https://archives.gentoo.org/gentoo-project/message/ba028e0ca53f6f55cf04f52645b52cee
and during that meeting and today in
https://archives.gentoo.org/gentoo-project/message/a3b6bf6b96d2703ea71ec3e0fdc4889b.

But even if some of us are disagreeing and concerned, for now we have to
accept and respect that this motion passed. That's part of any
democratic process.

May I ask you if you know GLEP 77 (Gentoo General Resolution)? With such
a 'rescue tool' in place we all should be a little bit more relaxed and
have some faith in each other, even if we disagree on some topics.


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Bringing new people

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 1968 bytes --]

On 2019-06-15 12:24, Andrew Savchenko wrote:
> As almost any FOSS project Gentoo suffers from lack of manpower in
> various areas. While there are technical ways to amend this like
> automation improvements I'd like to focus on bringing new people.
> 
> Life changes, some developers eventually quit; number of packages
> is growing (not only in Gentoo, but world-wide), their complexity
> grows. All this requires new developers.
> 
> How do you propose to bring new people to our team? What as the
> Council member you can do?
> What do you think on current entrance threshold?
> What about contributions by non-developers? Should we focus on e.g.
> encouraging proxied maintainers to become developers or should we
> grow out of the tree contributions without git tree access?

I want to quote from my previous Manifest:

> Lack of manpower is always a problem. But I don't think it is the
> council's job to change this. Job is maybe the wrong word but if you
> would hope for a new council which will create a PR campaign for Gentoo
> then please don't vote for me. Like I don't think that any government in
> this world can create jobs on their own, I don’t believe that a single
> committee in Gentoo alone can lead to interested persons becoming
> developers.
> For me, it is the project itself which must be interesting enough. But a
> closed or toxic community would scare away anyone interested in the
> project. However, it is not the council's job to make sure these
> requirements are met. It is the responsibility of every single member of
> the Gentoo community to keep this project interesting and make sure that
> people want to join and stay in the community. So it is the community
> which must define and live the rules. And the council will only act only
> by majority decision of the community.


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo as hobbyist distro

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 1547 bytes --]

Hi,

On 2019-06-16 20:09, Michał Górny wrote:
> Some developers were recently complaining that we're turning Gentoo into
> a hobbyist distro and that's apparently bad.
> 
> Do you think Gentoo should allow for experimental and unstable features,
> and possibly breaking changes that make Gentoo more interesting for
> hobbyists?  Or should we block breaking changes and become more
> conservative for users who prefer stable distribution with minimal
> maintenance burden?

I am not sure if I fully get the point.

Gentoo should never break. If we know something doesn't work yet, it
shouldn't reach users (i.e. the breaking change should be masked, opt-in
only...).

If this is about 17.1 profile: Sure, at some point, when things are
stable and working as intended so that they are ready for most users,
they could still 'break' things and require user interaction (like a
migration).
Saying "we never do something like that" would be wrong from my P.O.V.
because this would block any possible improvement in general.

The important thing is that we as Gentoo agree on that change. I.e. no
single person/project should be allowed to force such a change. If a
single person/project want to introduce a breaking change, change must
be proposed, explained and discussed. If this change will make sense for
most Gentoo developers, we will find ways to make that change like in
the past -- together.


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Power balance

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 1038 bytes --]

On 6/15/19 12:00 PM, Andrew Savchenko wrote:

> 
> Gentoo power balance was carefully crafted over the years. However
> during last year that balance was disrupted:
> 
> 1. The same person can now be in the Gentoo Council and the Trustees
> board.

This isn't unprecedented, and ultimately it likely isn't a big concern.

> 2. QA can now bypass Comrel on bans.

This is more a formality than anything else, and since it is only for
short term matters, the clarifications are likely a good thing.

> 
> A better solution may be "single person => single vote" rule, so
> everyone is free to participate where and how they want, but in a
> case when multiple teams are involved in processing an issue a
> single person may vote only once and it is up to them to choose
> using what role.
> 

As long as there is no conflict of interest this seems counter-intuitive.


-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 708 bytes --]

On Sat, Jun 15, 2019 at 12:49:33PM +0300, Andrew Savchenko wrote:
> In my opinion GLEP 76 is the most controversial decision made by
> running council. While it fixed some long standing issues like
> copyright headers and proper acknowledgement of out of the tree
> contributors, it created grave problems: now some long-time
> contributors and even developer are seriously discriminated because
> they want to keep their privacy.
 
 I only know of one developer who this affected, so I don't see it as
 that big of an issue.

 Personally, I'm fine with the real name requirement for sign-offs;. The
 Linux kernel requires real names, and I believe many open source
 projects do.

 William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Power balance

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1251 bytes --]

On Sat, Jun 15, 2019 at 01:00:33PM +0300, Andrew Savchenko wrote:
> Gentoo power balance was carefully crafted over the years. However
> during last year that balance was disrupted:
> 
> 1. The same person can now be in the Gentoo Council and the Trustees
> board.

I personally wouldn't vote for that, but you are right, they can.

> 2. QA can now bypass Comrel on bans.

I was on the council when this first came up. I had several discussions
with the comrel lead at the time and comrel did not want to be involved
in the process of qa temporarily suspending commit privileges.

> What is your opinion on this?
> Should this balance be left as is?
> If it should be tuned, then how?
> 
> I'm worried about that some people or teams may gain too much power
> and misuse it.
 
 I'm not as concerned about the trustees/council as I am about other
 teams.
 For example, it is possible right now for someone to serve on qa,
 comrel and the council at the same time.

 I have voiced my concerns about this in the past, but there are a
 number of people in the distro who don't see this as a problem, so
 nothing happened.

I do plan to bring up a glep 39 change again for this issue and we'll
see what happens.

William

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Luca Barbato]

On 18/06/2019 16:12, William Hubbs wrote:
> On Sat, Jun 15, 2019 at 12:49:33PM +0300, Andrew Savchenko wrote:
>> In my opinion GLEP 76 is the most controversial decision made by
>> running council. While it fixed some long standing issues like
>> copyright headers and proper acknowledgement of out of the tree
>> contributors, it created grave problems: now some long-time
>> contributors and even developer are seriously discriminated because
>> they want to keep their privacy.
>   
>   I only know of one developer who this affected, so I don't see it as
>   that big of an issue.

Well all the developers are affected by the extra steps needed to push.

lu

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 895 bytes --]

On Tue, Jun 18, 2019 at 05:43:17PM +0200, Luca Barbato wrote:
> On 18/06/2019 16:12, William Hubbs wrote:
> > On Sat, Jun 15, 2019 at 12:49:33PM +0300, Andrew Savchenko wrote:
> >> In my opinion GLEP 76 is the most controversial decision made by
> >> running council. While it fixed some long standing issues like
> >> copyright headers and proper acknowledgement of out of the tree
> >> contributors, it created grave problems: now some long-time
> >> contributors and even developer are seriously discriminated because
> >> they want to keep their privacy.
> >   
> >   I only know of one developer who this affected, so I don't see it as
> >   that big of an issue.
> 
> Well all the developers are affected by the extra steps needed to push.

I'm not sure what extra steps you are referring to, I just answered this
in regard to the pseudonym issue.

Thanks,

William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Bringing new people

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1288 bytes --]

On Sat, Jun 15, 2019 at 01:24:15PM +0300, Andrew Savchenko wrote:
> As almost any FOSS project Gentoo suffers from lack of manpower in
> various areas. While there are technical ways to amend this like
> automation improvements I'd like to focus on bringing new people.

I would like both. Automation is a good thing, but we need new people
also.

> How do you propose to bring new people to our team? What as the
> Council member you can do?

In my opinion, this falls on all of us.  I think we need to work on
making the community more welcoming, and that will take effort by everyone.

> What do you think on current entrance threshold?

Since I don't know what the entrance threshold for other distros is
like, I don't feel really prepared to comment on ours.

I do know we have people who are proxiied maintainers and who chose to stay
proxied. I'll comment more on this below.

> What about contributions by non-developers? Should we focus on e.g.
> encouraging proxied maintainers to become developers or should we
> grow out of the tree contributions without git tree access?

Yes, I would like to see the distro focus on bringing in more
developers. Proxy-maint is a good thing, but I would rather see
proxy-maint set up as a way to move people toward being developers.
William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo as hobbyist distro

[Mikle Kolyada]

[-- Attachment #1.1: Type: text/plain, Size: 1548 bytes --]


On 16.06.2019 21:09, Michał Górny wrote:
> On Sat, 2019-06-15 at 12:42 +0300, Andrew Savchenko wrote:
>> Last year we had a good initiative: it addition to (or even instead
>> of) manifests nominees were asked questions by voters. So let's
>> continue this year.
>>
>> I propose to have one question per thread spawned by this e-mail to
>> keep discussion focused. If you have multiple questions, please
>> start multiple threads. If your question was already asked, please
>> join a thread.
>>
> Some developers were recently complaining that we're turning Gentoo into
> a hobbyist distro and that's apparently bad.
>
> Do you think Gentoo should allow for experimental and unstable features,
> and possibly breaking changes that make Gentoo more interesting for
> hobbyists?  Or should we block breaking changes and become more
> conservative for users who prefer stable distribution with minimal
> maintenance burden?
>
We must keep gentoo as stable as possible taking care of our production
users, I can speak of myself here, I am currently maintaining
computation clusters with > 1k units (all are under gentoo), and I would
not happy to see my cluster somehow affected by unstable features in the
mainline (neither would others I believe).

Still gentoo is the only meta distribution with freedom of choice, that
says we can really implement bleeding edge solutions with a separate
profile and something like "I_KNOW_WHAT_I_AM_DOING=1" variable set in
the make.conf, the only question of implementation.



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo as hobbyist distro

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 1780 bytes --]

On Sun, Jun 16, 2019 at 08:09:38PM +0200, Michał Górny wrote:
> On Sat, 2019-06-15 at 12:42 +0300, Andrew Savchenko wrote:
> Some developers were recently complaining that we're turning Gentoo into
> a hobbyist distro and that's apparently bad.
> 
> Do you think Gentoo should allow for experimental and unstable features,
> and possibly breaking changes that make Gentoo more interesting for
> hobbyists?  Or should we block breaking changes and become more
> conservative for users who prefer stable distribution with minimal
> maintenance burden?

This is sort of vague, but I do have a couple of thoughts on the matter.

I have heard of production users deciding to use full ~ keywords, e.g.
ACCEPT_KEYWORDS="~amd64"
This has never been a good idea, production users should be using the
opposite, because ~ packages will have breakages from time to time.

I don't know how it is now, but I know that keeping the stable tree
relevant has been a big issue for us in the past for a number of
reasons, and I still think we should improve that.

Never breaking backward compatibility is not possible. The best we can do
is provide a smooth transition forward for users. Unfortunately,
sometimes, manual intervention must happen. For example, the migration
to the 17.1 profiles had no other option.

At the package level, backward compatibility depends a lot on what
upstreams do. It is up to the individual package maintainers to make
sure that upgrades happen as smoothly as possible -- automatically where
possible, but if this is not possible, upgrading instructions should be
available to the user some way.

Other than that, I'm not sure how to answer this. I would be open to a
discussion to try to figure it out.

Thanks,

William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo as hobbyist distro

[William Hubbs]

[-- Attachment #1: Type: text/plain, Size: 956 bytes --]

On Wed, Jun 19, 2019 at 09:24:10AM +0300, Mikle Kolyada wrote:
> We must keep gentoo as stable as possible taking care of our production
> users, I can speak of myself here, I am currently maintaining
> computation clusters with > 1k units (all are under gentoo), and I would
> not happy to see my cluster somehow affected by unstable features in the
> mainline (neither would others I believe).
> 
> Still gentoo is the only meta distribution with freedom of choice, that
> says we can really implement bleeding edge solutions with a separate
> profile and something like "I_KNOW_WHAT_I_AM_DOING=1" variable set in
> the make.conf, the only question of implementation.

As I said in my last message on this thread, the stable tree is supposed
to be for that, so if your cluster is using fully stable packages I
would be concerned about this.

Is that what you are doing, or are you using ~ keywords for any of the
packages?

William


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo as hobbyist distro

[Andreas K. Huettel]

[-- Attachment #1: Type: text/plain, Size: 2281 bytes --]

Am Sonntag, 16. Juni 2019, 20:09:38 CEST schrieb Michał Górny:
> 
> Some developers were recently complaining that we're turning Gentoo into
> a hobbyist distro and that's apparently bad.
> 
> Do you think Gentoo should allow for experimental and unstable features,
> and possibly breaking changes that make Gentoo more interesting for
> hobbyists?  Or should we block breaking changes and become more
> conservative for users who prefer stable distribution with minimal
> maintenance burden?

We're torn between extremes here, and I think nothing we do will make 
*everyone* happy. That said, we do have the duality stable/~arch, and that 
should already answer a large part of that question. In an ideal world, stable 
should be rock-solid and production worthy, and ~arch should be bleeding edge 
with occasional bugs and compile failures that come with that.

Where that doesnt work (say, profiles) ...

Let's start with the following assumption: Our main objective should be that 
Gentoo has a vivid, productive, and growing developer community. (If you think 
that doesnt sound right, you can try replacing "developer" with "productive 
contributor".)

Developers exist in two overlapping types, broadly speaking:
1) hobbyists who do something because it's interesting and cool
2) employees who are paid to do something because it's useful

So, we need to find a compromise between these two, with weight on the group 
that contributes to Gentoo most.

Right now my personal feeling is that we're trying to set long deprecation 
times when something is going away, and that nevertheless migration to, say, a 
new profile tends to only *start* when we threaten that the deprecation time 
will be over soon and the old one will go away.

We can't be stuck at the same level forever. Occasionally we will have to 
change something that requires manual intervention. Hey, if you have a big 
server farm, that's what all these horrible automation tools (puppet, rex, 
...) are good for. I think. Let's do it carefully, announce it, announce 
deprecation times, and give people time to do it. And then move on.


-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

[gentoo-project] Questions for Gentoo Council nominees: your achievements

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 590 bytes --]

On Sat, 2019-06-15 at 12:42 +0300, Andrew Savchenko wrote:
> I propose to have one question per thread spawned by this e-mail to
> keep discussion focused. If you have multiple questions, please
> start multiple threads. If your question was already asked, please
> join a thread.
> 

I'd like to ask all nominees a very simple open question: what have you
done to improve Gentoo in the last year?  Please focus on noticeable
achievements and successes, rather than general things like 'I've copied
few hundred ebuilds to newer versions'.

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo as hobbyist distro

[Mikle Kolyada]

[-- Attachment #1.1: Type: text/plain, Size: 1522 bytes --]


On 19.06.2019 18:45, William Hubbs wrote:
> On Wed, Jun 19, 2019 at 09:24:10AM +0300, Mikle Kolyada wrote:
>> We must keep gentoo as stable as possible taking care of our production
>> users, I can speak of myself here, I am currently maintaining
>> computation clusters with > 1k units (all are under gentoo), and I would
>> not happy to see my cluster somehow affected by unstable features in the
>> mainline (neither would others I believe).
>>
>> Still gentoo is the only meta distribution with freedom of choice, that
>> says we can really implement bleeding edge solutions with a separate
>> profile and something like "I_KNOW_WHAT_I_AM_DOING=1" variable set in
>> the make.conf, the only question of implementation.
> As I said in my last message on this thread, the stable tree is supposed
> to be for that, so if your cluster is using fully stable packages I
> would be concerned about this.
The question implied nothing about stability of the existing tree, so I
decided to emphasize (just in case) that stable state should be kept
whatever we do. Some people just get paid for gentoo at work, that is
where I was concerned.


>
> Is that what you are doing, or are you using ~ keywords for any of the
> packages?

Some gentoo packages I use simply do not have stable keywords, that is
where I am using testing ones sometimes.

Normally, as a member of (almost) all arch teams I push testing packages
ahead and mark them stable once I am sure there is no bugs.


>
> Willia


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: your achievements

[Kristian Fiskerstrand]

On 6/21/19 3:21 PM, Michał Górny wrote:
> I'd like to ask all nominees a very simple open question: what have you
> done to improve Gentoo in the last year?  Please focus on noticeable
> achievements and successes, rather than general things like 'I've copied
> few hundred ebuilds to newer versions'.
tl;dr; I provide a professional face to Gentoo, it being FOSDEM stand,
or other operations, of which I'm mainly focused on security related
ones (Gentoo is providing statistics for the openwall distros list and
are in general dialogue with gpg upstream).

Sure, I'm involved in a lot of the grunt-work of licensing, security
etc, but who cares; what I'm most proud of personally is bringing people
into being interested in Gentoo through PR.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3

Re: [gentoo-project] Questions for Gentoo Council nominees: your achievements

[Georgy Yakovlev]

[-- Attachment #1: Type: text/plain, Size: 2397 bytes --]

On Friday, June 21, 2019 6:21:00 AM PDT Michał Górny wrote:
> On Sat, 2019-06-15 at 12:42 +0300, Andrew Savchenko wrote:
> > I propose to have one question per thread spawned by this e-mail to
> > keep discussion focused. If you have multiple questions, please
> > start multiple threads. If your question was already asked, please
> > join a thread.
> 
> I'd like to ask all nominees a very simple open question: what have you
> done to improve Gentoo in the last year?  Please focus on noticeable
> achievements and successes, rather than general things like 'I've copied
> few hundred ebuilds to newer versions'.
Hi, 

Some notable things I've done last year (and I've been a developer roughly 
same amount of time)
Not sure if those considered achievements, they are for me.

- Taken over all jvm/jdk/jre maintenance in gentoo over from chewi (with 
exception to oracle proprietary variants)
It involves, for example, building icedtea tarballs for amd64,arm,arm64,ppc64, 
ppc64le so users can bootstrap their own from-source jvm.
And since cross-compiling jvm is not so great idea I have to do it on native 
machines as qemu does not always work for that.
Also continued chewi's work on openjdk, added openjdk8, different JRE and 
notably openjfx, which was deemed unpackageable.

I'm not involved in any java library/package maintenance, this area is still 
in a very bad state unfortunately and the modern java toolset is very portage-
unfriendly.

But at least we still have working icedtea/openjdk for a lot of arches and 
will soon have full jdk+jfx alternative to oracle-jdk.


- taken over zfs maintenance. ebuilds were not in a very good state due to 
various reasons, now it's much better, updates are in time and bugs are 
handled.
Gentoo always was a first-class distro in ZoL world (thanks to ryao) and it 
still is.


- I've been maintaining a lot of rust related thing lately, not a lot was done 
in this area but situation is improving and there are plans on adding cross-
compilation support to rust and maybe improve situation with crate bundling.


- Attended SCALE17x conference, brought some arm devices to attract people to 
gentoo booth. Next time I'm going to come a bit more prepared as this year our 
stand was very bare-bones.


- I got to mentor someone, we'll increase our headcount soon =)

Regards, Georgy.

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: your achievements

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 970 bytes --]

>>>>> On Fri, 21 Jun 2019, Michał Górny wrote:

> I'd like to ask all nominees a very simple open question: what have
> you done to improve Gentoo in the last year? Please focus on
> noticeable achievements and successes, rather than general things
> like 'I've copied few hundred ebuilds to newer versions'.

Don't play down the value of ebuild development. It is important
progress, even (and especially!) if it is proceeding smoothly, so that
it won't be much noticed.

But to answer your question: Last year was somewhat exceptional for me,
because I focused mainly on non-technical issues.

- Copyright policy, GLEP 76
- New @FREE default for ACCEPT_LICENSE (and sorting out licenses of
  stages, install media, and kernel/firmware, which was most of the work)
- New locations /var/db/repos/gentoo and friends

I leave it for the reader to decide how large my part in either of them
was, and if they should be counted as successes.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: your achievements

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 765 bytes --]

On Sat, 2019-06-22 at 08:44 +0200, Ulrich Mueller wrote:
> > > > > > On Fri, 21 Jun 2019, Michał Górny wrote:
> > I'd like to ask all nominees a very simple open question: what have
> > you done to improve Gentoo in the last year? Please focus on
> > noticeable achievements and successes, rather than general things
> > like 'I've copied few hundred ebuilds to newer versions'.
> 
> Don't play down the value of ebuild development. It is important
> progress, even (and especially!) if it is proceeding smoothly, so that
> it won't be much noticed.
> 

I'm not.  I'm playing down the value of bumping packages via dumbly
copying ebuild files and not bothering to verify if anything changed
in the distfile.

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: your achievements

[Mikle Kolyada]

[-- Attachment #1.1: Type: text/plain, Size: 1756 bytes --]


On 21.06.2019 16:21, Michał Górny wrote:
> On Sat, 2019-06-15 at 12:42 +0300, Andrew Savchenko wrote:
>> I propose to have one question per thread spawned by this e-mail to
>> keep discussion focused. If you have multiple questions, please
>> start multiple threads. If your question was already asked, please
>> join a thread.
>>
> I'd like to ask all nominees a very simple open question: what have you
> done to improve Gentoo in the last year?  Please focus on noticeable
> achievements and successes, rather than general things like 'I've copied
> few hundred ebuilds to newer versions'.
>
briefly about what I consider the most important:

- with new tooling I was able to test packages much faster and bugs
handling time for the most used arches (e.g. amd64) was reduced (can be
seen from the arches statistics provided by dilfridge)

- took over linux-pam and friends maintenance and started full m4
pambase migration (should be ready soon)

- together with dilfridge introduced the official Gentoo RISC-V port
with stable profile.

    Started a real hardware builds (including kernel, looking into
possibility of X.org support as well).

- brought texlive-2019 into the tree (including patches back ports,
eclasses update, etc)

    and also started helping out with general TeX  maintenance.


non-technical:

- helped out with the proctors project launching

- glep48 changes

- revised our developer quizzes which was:

    1. ebuild and end of mentoring quizzes were merged into the
ebuild-maintainer quiz

    2. quizzes were revised (old questions removed, some new ones
written from scratch and added)

    (thanks to Amynka for her patience during patches review)




[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: your achievements

[Mart Raudsepp]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

Ühel kenal päeval, P, 23.06.2019 kell 01:57, kirjutas Mikle Kolyada:
> On 21.06.2019 16:21, Michał Górny wrote:
> > On Sat, 2019-06-15 at 12:42 +0300, Andrew Savchenko wrote:
> > > I propose to have one question per thread spawned by this e-mail
> > > to
> > > keep discussion focused. If you have multiple questions, please
> > > start multiple threads. If your question was already asked,
> > > please
> > > join a thread.
> > > 
> > I'd like to ask all nominees a very simple open question: what have
> > you
> > done to improve Gentoo in the last year?  Please focus on
> > noticeable
> > achievements and successes, rather than general things like 'I've
> > copied
> > few hundred ebuilds to newer versions'.
> > 
> briefly about what I consider the most important:
> 
> - with new tooling I was able to test packages much faster and bugs
> handling time for the most used arches (e.g. amd64) was reduced (can
> be
> seen from the arches statistics provided by dilfridge)

Where can we find the code for that tooling, as to evaluate using it
ourselves as well, and improve upon it or merge with other existing
solutions in this area?


Mart

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

[gentoo-project] Questions for Gentoo Council nominees: traits of a good Council member

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 458 bytes --]

On Sat, 2019-06-15 at 12:42 +0300, Andrew Savchenko wrote:
> I propose to have one question per thread spawned by this e-mail to
> keep discussion focused. If you have multiple questions, please
> start multiple threads. If your question was already asked, please
> join a thread.
> 

What makes you a potentially good Council members?  What are the traits
of an ideal Council member from your point of view?

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 4311 bytes --]

Hi all!

On Sat, 15 Jun 2019 12:49:33 +0300 Andrew Savchenko wrote:
> On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
> > Hi all!
> > 
> > Last year we had a good initiative: it addition to (or even instead
> > of) manifests nominees were asked questions by voters. So let's
> > continue this year.
> > 
> > I propose to have one question per thread spawned by this e-mail to
> > keep discussion focused. If you have multiple questions, please
> > start multiple threads. If your question was already asked, please
> > join a thread.
> > 
> > I'll ask my questions in subsequent e-mails.
> 
> In my opinion GLEP 76 is the most controversial decision made by
> running council. While it fixed some long standing issues like
> copyright headers and proper acknowledgement of out of the tree
> contributors, it created grave problems: now some long-time
> contributors and even developer are seriously discriminated because
> they want to keep their privacy.
> 
> What is your opinion on this problem?
> Should GLEP 76 be left as is?
> Should GLEP 76 be cancelled?
> Should GLEP 76 be improved and how?

Since I've accepted the nomination, it's my turn to answer as well.

I'll tell you frankly that GLEP 76 was the main motivation for me
to accept the nomination. I consider it — in the way it exists now —
harmful and in need to be fixed. This is how free software works:
if something is broken and nobody repairs it, go and fix it
yourself.

What is wrong with GLEP 76? It kicks some active contributors and
rejects some of new ones. No, it is not just one developer
affected as someone may assume. We have external contributors
kicked out, we have at least one high quality maintainer who worked
on quizzes, but this work was stopped due to hostility to and
further ban on anonymous contributions.

I believe that for free software development privacy concern is of
paramount importance, especially when we are dealing with security
or privacy oriented software.

One may argue that ban on anonymous contributions was to protect
Gentoo from possible copyright claims in the future. But does it
really gives us such protection? In my opinion NO, because:

1. GLEP 76 was prepared without legal expertise from experts in
this field. (At least such expertise was not published.) Hereby we
have no evidence that it will work if real case will be opened.

2. No law or legal precedent was provided to prove that GLEP 76
will be useful in alleged case or that we have a legal requirement
to put such restrictive demand on our contributors.

3. We objectively have no means to verify developer's credentials.
Current approach is based on realistic-like approach: if someone
names themselve "John Doe" we accept it, if someone names as
"qwerty123" we do not recognize this as an ID. But we have no means
to verify that "John Doe" is real (natural) name. Even GnuPG Web of
Trust doesn't provide such means, because what it really provides
is a link between a person and their GnuPG key, as we're not
authorized legal entities empowered and fully informed to verify
validity of IDs present during GnuPG signing.

So in my opinion current state of affairs is not acceptable and
must be amended. What I propose to do:

1. To mitigate current crisis we should allow developers to commit
under any unique non-offensive id (text string) as long as the
trustees know how it maps to a real name.

The rationale is that the trustees are the legal body to handle all
legal issues of Gentoo, so even if we agree that real names are
mandatory, there is no practical legal need for anyone outside of
trustees to know them. This way we can include people who agree to
keep their privacy from anyone except trustees and in the same way
this will keep the legal effect of GLEP 76 intact.

2. Work together with trustees and possibly some external expertise
(both legal and risk assessment) to clarify if we are really
expected to check all these data and search for a way to accept
private contributions.

My goal is to help Gentoo to be open and inclusive society and not
some bureaucratic club fighting ghosts (I *don't* claim it is that
way now, but there are some alarming tendencies...).

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

[gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Robin H. Johnson]

[-- Attachment #1: Type: text/plain, Size: 561 bytes --]

To the Council nominees, I put forward the following questions, around
the Gentoo Foundation:

1. What's your opinion of the past relationship between the Council &
   Foundation?
2. What should the future relationship between the Council & Foundation
   look like?
3. What should the future of the Foundation itself look like?

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail   : robbat2@gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 1113 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 4441 bytes --]

On Tue, 2019-06-25 at 01:18 +0300, Andrew Savchenko wrote:
> Hi all!
> 
> On Sat, 15 Jun 2019 12:49:33 +0300 Andrew Savchenko wrote:
> > On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
> > > Hi all!
> > > 
> > > Last year we had a good initiative: it addition to (or even instead
> > > of) manifests nominees were asked questions by voters. So let's
> > > continue this year.
> > > 
> > > I propose to have one question per thread spawned by this e-mail to
> > > keep discussion focused. If you have multiple questions, please
> > > start multiple threads. If your question was already asked, please
> > > join a thread.
> > > 
> > > I'll ask my questions in subsequent e-mails.
> > 
> > In my opinion GLEP 76 is the most controversial decision made by
> > running council. While it fixed some long standing issues like
> > copyright headers and proper acknowledgement of out of the tree
> > contributors, it created grave problems: now some long-time
> > contributors and even developer are seriously discriminated because
> > they want to keep their privacy.
> > 
> > What is your opinion on this problem?
> > Should GLEP 76 be left as is?
> > Should GLEP 76 be cancelled?
> > Should GLEP 76 be improved and how?
> 
> Since I've accepted the nomination, it's my turn to answer as well.
> 
> I'll tell you frankly that GLEP 76 was the main motivation for me
> to accept the nomination. I consider it — in the way it exists now —
> harmful and in need to be fixed. This is how free software works:
> if something is broken and nobody repairs it, go and fix it
> yourself.
> 
> What is wrong with GLEP 76? It kicks some active contributors and
> rejects some of new ones. No, it is not just one developer
> affected as someone may assume. We have external contributors
> kicked out, we have at least one high quality maintainer who worked
> on quizzes, but this work was stopped due to hostility to and
> further ban on anonymous contributions.
> 
> I believe that for free software development privacy concern is of
> paramount importance, especially when we are dealing with security
> or privacy oriented software.
> 
> One may argue that ban on anonymous contributions was to protect
> Gentoo from possible copyright claims in the future. But does it
> really gives us such protection? In my opinion NO, because:
> 
> 1. GLEP 76 was prepared without legal expertise from experts in
> this field. (At least such expertise was not published.) Hereby we
> have no evidence that it will work if real case will be opened.
> 
> 2. No law or legal precedent was provided to prove that GLEP 76
> will be useful in alleged case or that we have a legal requirement
> to put such restrictive demand on our contributors.

What 'legal expertise', 'law' or 'legal precedent' do you have to say
otherwise?  It's easy to blame others when all you have is your private
opinion.

> 
> 3. We objectively have no means to verify developer's credentials.
> Current approach is based on realistic-like approach: if someone
> names themselve "John Doe" we accept it, if someone names as
> "qwerty123" we do not recognize this as an ID. But we have no means
> to verify that "John Doe" is real (natural) name. Even GnuPG Web of
> Trust doesn't provide such means, because what it really provides
> is a link between a person and their GnuPG key, as we're not
> authorized legal entities empowered and fully informed to verify
> validity of IDs present during GnuPG signing.
> 
> So in my opinion current state of affairs is not acceptable and
> must be amended. What I propose to do:
> 
> 1. To mitigate current crisis we should allow developers to commit
> under any unique non-offensive id (text string) as long as the
> trustees know how it maps to a real name.
> 
> The rationale is that the trustees are the legal body to handle all
> legal issues of Gentoo, so even if we agree that real names are
> mandatory, there is no practical legal need for anyone outside of
> trustees to know them. This way we can include people who agree to
> keep their privacy from anyone except trustees and in the same way
> this will keep the legal effect of GLEP 76 intact.
> 

How are Trustees supposed to know whether the 'real name' is actually a
real natural name?  You just said it is apparently impossible to verify.


-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 903 bytes --]

On 6/25/19 1:23 AM, Robin H. Johnson wrote:
> To the Council nominees, I put forward the following questions, around
> the Gentoo Foundation:
> 
> 1. What's your opinion of the past relationship between the Council &
>    Foundation?

The council has been critical of the way the foundation has been run,
for good reasons.

> 2. What should the future relationship between the Council & Foundation
>    look like?

As long as the foundation does it job and doesn't meddle in the running
of the distro I'm fine, but the foundation is there to support the distro.

> 3. What should the future of the Foundation itself look like?

I'm fond of having an own foundation rather than an umbrella org, but it
requires that it is properly run.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Matthew Thode]

[-- Attachment #1: Type: text/plain, Size: 1020 bytes --]

On 19-06-26 21:45:48, Kristian Fiskerstrand wrote:
> On 6/25/19 1:23 AM, Robin H. Johnson wrote:
> > To the Council nominees, I put forward the following questions, around
> > the Gentoo Foundation:
> > 
> > 1. What's your opinion of the past relationship between the Council &
> >    Foundation?
> 
> The council has been critical of the way the foundation has been run,
> for good reasons.
> 

Do you mind enumerating the reasons and the actions you wish to see
taken?

> > 2. What should the future relationship between the Council & Foundation
> >    look like?
> 
> As long as the foundation does it job and doesn't meddle in the running
> of the distro I'm fine, but the foundation is there to support the distro.
> 
> > 3. What should the future of the Foundation itself look like?
> 
> I'm fond of having an own foundation rather than an umbrella org, but it
> requires that it is properly run.
> 

Do you mind being more specific here as well?

-- 
Matthew Thode (prometheanfire)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 1635 bytes --]

On 6/26/19 11:54 PM, Matthew Thode wrote:
> On 19-06-26 21:45:48, Kristian Fiskerstrand wrote:
>> On 6/25/19 1:23 AM, Robin H. Johnson wrote:
>>> To the Council nominees, I put forward the following questions, around
>>> the Gentoo Foundation:
>>>
>>> 1. What's your opinion of the past relationship between the Council &
>>>    Foundation?
>>
>> The council has been critical of the way the foundation has been run,
>> for good reasons.
>>
> 
> Do you mind enumerating the reasons and the actions you wish to see
> taken?

The foundation has failed to run an operation in accordance with the
laws and legislation of a foundation when it comes to, in particular,
accounting matters of a number of years, which is a disgrace. The
primary responsibility of the board of directors and its officers is to
ensure that the foundation comply with applicable laws and file the
necessary paperwork for its operation for things including tax matters.

> 
>>> 2. What should the future relationship between the Council & Foundation
>>>    look like?
>>
>> As long as the foundation does it job and doesn't meddle in the running
>> of the distro I'm fine, but the foundation is there to support the distro.
>>
>>> 3. What should the future of the Foundation itself look like?
>>
>> I'm fond of having an own foundation rather than an umbrella org, but it
>> requires that it is properly run.
>>
> 
> Do you mind being more specific here as well?

see above.


-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 1568 bytes --]

On 6/27/19 12:03 AM, Kristian Fiskerstrand wrote:
> On 6/26/19 11:54 PM, Matthew Thode wrote:
>> On 19-06-26 21:45:48, Kristian Fiskerstrand wrote:
>>> On 6/25/19 1:23 AM, Robin H. Johnson wrote:
>>>> To the Council nominees, I put forward the following questions, around
>>>> the Gentoo Foundation:
>>>>
>>>> 1. What's your opinion of the past relationship between the Council &
>>>>    Foundation?
>>>
>>> The council has been critical of the way the foundation has been run,
>>> for good reasons.
>>>
>>
>> Do you mind enumerating the reasons and the actions you wish to see
>> taken?
> 
> The foundation has failed to run an operation in accordance with the
> laws and legislation of a foundation when it comes to, in particular,
> accounting matters of a number of years, which is a disgrace. The
> primary responsibility of the board of directors and its officers is to
> ensure that the foundation comply with applicable laws and file the
> necessary paperwork for its operation for things including tax matters.

the other thing the foundation is responsible for is protecting
copyright, in this case there isn't a significant issue, but it needs to
keep track of, and defend against, others using the Gentoo brand for
various cases (since most of Gentoo Foundation IP is tied to the
logo/brand) and no anything related to the actual code (that belongs to
other copyright owners)


-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Matthew Thode]

[-- Attachment #1: Type: text/plain, Size: 1439 bytes --]

On 19-06-27 00:03:16, Kristian Fiskerstrand wrote:
> On 6/26/19 11:54 PM, Matthew Thode wrote:
> > On 19-06-26 21:45:48, Kristian Fiskerstrand wrote:
> >> On 6/25/19 1:23 AM, Robin H. Johnson wrote:
> >>> To the Council nominees, I put forward the following questions, around
> >>> the Gentoo Foundation:
> >>>
> >>> 1. What's your opinion of the past relationship between the Council &
> >>>    Foundation?
> >>
> >> The council has been critical of the way the foundation has been run,
> >> for good reasons.
> >>
> > 
> > Do you mind enumerating the reasons and the actions you wish to see
> > taken?
> 
> The foundation has failed to run an operation in accordance with the
> laws and legislation of a foundation when it comes to, in particular,
> accounting matters of a number of years, which is a disgrace. The
> primary responsibility of the board of directors and its officers is to
> ensure that the foundation comply with applicable laws and file the
> necessary paperwork for its operation for things including tax matters.
> 

True, though in our defense we were handed basically nothing and have
been picking up the pieces sense.  Good news is that we've found a firm
finally and have used them to get our status with the IRS.  Stuff beyond
that is in progress (not sure if it's right to vote for something so
expensive right before the trustee election).

-- 
Matthew Thode (prometheanfire)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Matthew Thode]

[-- Attachment #1: Type: text/plain, Size: 1827 bytes --]

On 19-06-27 00:06:05, Kristian Fiskerstrand wrote:
> On 6/27/19 12:03 AM, Kristian Fiskerstrand wrote:
> > On 6/26/19 11:54 PM, Matthew Thode wrote:
> >> On 19-06-26 21:45:48, Kristian Fiskerstrand wrote:
> >>> On 6/25/19 1:23 AM, Robin H. Johnson wrote:
> >>>> To the Council nominees, I put forward the following questions, around
> >>>> the Gentoo Foundation:
> >>>>
> >>>> 1. What's your opinion of the past relationship between the Council &
> >>>>    Foundation?
> >>>
> >>> The council has been critical of the way the foundation has been run,
> >>> for good reasons.
> >>>
> >>
> >> Do you mind enumerating the reasons and the actions you wish to see
> >> taken?
> > 
> > The foundation has failed to run an operation in accordance with the
> > laws and legislation of a foundation when it comes to, in particular,
> > accounting matters of a number of years, which is a disgrace. The
> > primary responsibility of the board of directors and its officers is to
> > ensure that the foundation comply with applicable laws and file the
> > necessary paperwork for its operation for things including tax matters.
> 
> the other thing the foundation is responsible for is protecting
> copyright, in this case there isn't a significant issue, but it needs to
> keep track of, and defend against, others using the Gentoo brand for
> various cases (since most of Gentoo Foundation IP is tied to the
> logo/brand) and no anything related to the actual code (that belongs to
> other copyright owners)
> 

This one I think we have done well at, mainly sending C&D emails/letters
as needed (which it generally is not needed).

Beyond the above two points, as a follow on question.

1. How would you work to improve the relationship with the foundation?

-- 
Matthew Thode (prometheanfire)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Michael Everitt]

[-- Attachment #1.1: Type: text/plain, Size: 1948 bytes --]

On 26/06/19 23:03, Kristian Fiskerstrand wrote:
> On 6/26/19 11:54 PM, Matthew Thode wrote:
>> On 19-06-26 21:45:48, Kristian Fiskerstrand wrote:
>>> On 6/25/19 1:23 AM, Robin H. Johnson wrote:
>>>> To the Council nominees, I put forward the following questions, around
>>>> the Gentoo Foundation:
>>>>
>>>> 1. What's your opinion of the past relationship between the Council &
>>>>    Foundation?
>>> The council has been critical of the way the foundation has been run,
>>> for good reasons.
>>>
>> Do you mind enumerating the reasons and the actions you wish to see
>> taken?
> The foundation has failed to run an operation in accordance with the
> laws and legislation of a foundation when it comes to, in particular,
> accounting matters of a number of years, which is a disgrace. The
> primary responsibility of the board of directors and its officers is to
> ensure that the foundation comply with applicable laws and file the
> necessary paperwork for its operation for things including tax matters.
>
Isn't it about time we quit pinning the mistakes of the past on the
officers of the present? From what I understand, the present and recent
officers have made extraordinary efforts to rectify the shortcomings of
previous trustees, and to bang on about the status quo and that of previous
foundation officers is hardly either constructive nor helpful to rectifying
the present situation.
>>>> 2. What should the future relationship between the Council & Foundation
>>>>    look like?
>>> As long as the foundation does it job and doesn't meddle in the running
>>> of the distro I'm fine, but the foundation is there to support the distro.
>>>
>>>> 3. What should the future of the Foundation itself look like?
>>> I'm fond of having an own foundation rather than an umbrella org, but it
>>> requires that it is properly run.
>>>
>> Do you mind being more specific here as well?
> see above.
>
>



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 801 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Kristian Fiskerstrand]

[-- Attachment #1: Type: text/plain, Size: 2186 bytes --]

The question wasnt regarding the current board, but the historical relationship.
-------- Original message --------From: Michael Everitt <m.j.everitt@iee.org> Date: 6/27/19  00:15  (GMT+01:00) To: gentoo-project@lists.gentoo.org Subject: Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation On 26/06/19 23:03, Kristian Fiskerstrand wrote:> On 6/26/19 11:54 PM, Matthew Thode wrote:>> On 19-06-26 21:45:48, Kristian Fiskerstrand wrote:>>> On 6/25/19 1:23 AM, Robin H. Johnson wrote:>>>> To the Council nominees, I put forward the following questions, around>>>> the Gentoo Foundation:>>>>>>>> 1. What's your opinion of the past relationship between the Council &>>>>    Foundation?>>> The council has been critical of the way the foundation has been run,>>> for good reasons.>>>>> Do you mind enumerating the reasons and the actions you wish to see>> taken?> The foundation has failed to run an operation in accordance with the> laws and legislation of a foundation when it comes to, in particular,> accounting matters of a number of years, which is a disgrace. The> primary responsibility of the board of directors and its officers is to> ensure that the foundation comply with applicable laws and file the> necessary paperwork for its operation for things including tax matters.>Isn't it about time we quit pinning the mistakes of the past on theofficers of the present? From what I understand, the present and recentofficers have made extraordinary efforts to rectify the shortcomings ofprevious trustees, and to bang on about the status quo and that of previousfoundation officers is hardly either constructive nor helpful to rectifyingthe present situation.>>>> 2. What should the future relationship between the Council & Foundation>>>>    look like?>>> As long as the foundation does it job and doesn't meddle in the running>>> of the distro I'm fine, but the foundation is there to support the distro.>>>>>>> 3. What should the future of the Foundation itself look like?>>> I'm fond of having an own foundation rather than an umbrella org, but it>>> requires that it is properly run.>>>>> Do you mind being more specific here as well?> see above.>>

[-- Attachment #2: Type: text/html, Size: 2912 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Kristian Fiskerstrand]

[-- Attachment #1: Type: text/plain, Size: 2239 bytes --]

In my specific case I've offered my expertise by answering accounting specific questions as well as writing a proposal for a RFP for further help. I do however get annoyed when some foundation members starting to interfere in matters outside ther scope.
-------- Original message --------From: Matthew Thode <prometheanfire@gentoo.org> Date: 6/27/19  00:13  (GMT+01:00) To: gentoo-project@lists.gentoo.org Subject: Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation On 19-06-27 00:06:05, Kristian Fiskerstrand wrote:> On 6/27/19 12:03 AM, Kristian Fiskerstrand wrote:> > On 6/26/19 11:54 PM, Matthew Thode wrote:> >> On 19-06-26 21:45:48, Kristian Fiskerstrand wrote:> >>> On 6/25/19 1:23 AM, Robin H. Johnson wrote:> >>>> To the Council nominees, I put forward the following questions, around> >>>> the Gentoo Foundation:> >>>>> >>>> 1. What's your opinion of the past relationship between the Council &> >>>>    Foundation?> >>>> >>> The council has been critical of the way the foundation has been run,> >>> for good reasons.> >>>> >>> >> Do you mind enumerating the reasons and the actions you wish to see> >> taken?> > > > The foundation has failed to run an operation in accordance with the> > laws and legislation of a foundation when it comes to, in particular,> > accounting matters of a number of years, which is a disgrace. The> > primary responsibility of the board of directors and its officers is to> > ensure that the foundation comply with applicable laws and file the> > necessary paperwork for its operation for things including tax matters.> > the other thing the foundation is responsible for is protecting> copyright, in this case there isn't a significant issue, but it needs to> keep track of, and defend against, others using the Gentoo brand for> various cases (since most of Gentoo Foundation IP is tied to the> logo/brand) and no anything related to the actual code (that belongs to> other copyright owners)> This one I think we have done well at, mainly sending C&D emails/lettersas needed (which it generally is not needed).Beyond the above two points, as a follow on question.1. How would you work to improve the relationship with the foundation?-- Matthew Thode (prometheanfire)

[-- Attachment #2: Type: text/html, Size: 2941 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 4291 bytes --]

Hi all!

On Tue, 25 Jun 2019 08:15:07 +0200 Michał Górny wrote:
> On Tue, 2019-06-25 at 01:18 +0300, Andrew Savchenko wrote:
[...]
> > Since I've accepted the nomination, it's my turn to answer as well.
> > 
> > I'll tell you frankly that GLEP 76 was the main motivation for me
> > to accept the nomination. I consider it — in the way it exists now —
> > harmful and in need to be fixed. This is how free software works:
> > if something is broken and nobody repairs it, go and fix it
> > yourself.
> > 
> > What is wrong with GLEP 76? It kicks some active contributors and
> > rejects some of new ones. No, it is not just one developer
> > affected as someone may assume. We have external contributors
> > kicked out, we have at least one high quality maintainer who worked
> > on quizzes, but this work was stopped due to hostility to and
> > further ban on anonymous contributions.
> > 
> > I believe that for free software development privacy concern is of
> > paramount importance, especially when we are dealing with security
> > or privacy oriented software.
> > 
> > One may argue that ban on anonymous contributions was to protect
> > Gentoo from possible copyright claims in the future. But does it
> > really gives us such protection? In my opinion NO, because:
> > 
> > 1. GLEP 76 was prepared without legal expertise from experts in
> > this field. (At least such expertise was not published.) Hereby we
> > have no evidence that it will work if real case will be opened.
> > 
> > 2. No law or legal precedent was provided to prove that GLEP 76
> > will be useful in alleged case or that we have a legal requirement
> > to put such restrictive demand on our contributors.
> 
> What 'legal expertise', 'law' or 'legal precedent' do you have to say
> otherwise?  It's easy to blame others when all you have is your private
> opinion.

This is not blaming, this not how the law works: everything which
is not denied is allowed, everything which is not required is not
mandatory. Of course this applies to full set of laws: from federal
to local level and legal precendents.

So, at least for my knowledge, Gentoo Foundation is not forbidden
by the law to require real name signatures, but is neither obliged
to do so.

> > 3. We objectively have no means to verify developer's credentials.
> > Current approach is based on realistic-like approach: if someone
> > names themselve "John Doe" we accept it, if someone names as
> > "qwerty123" we do not recognize this as an ID. But we have no means
> > to verify that "John Doe" is real (natural) name. Even GnuPG Web of
> > Trust doesn't provide such means, because what it really provides
> > is a link between a person and their GnuPG key, as we're not
> > authorized legal entities empowered and fully informed to verify
> > validity of IDs present during GnuPG signing.
> > 
> > So in my opinion current state of affairs is not acceptable and
> > must be amended. What I propose to do:
> > 
> > 1. To mitigate current crisis we should allow developers to commit
> > under any unique non-offensive id (text string) as long as the
> > trustees know how it maps to a real name.
> > 
> > The rationale is that the trustees are the legal body to handle all
> > legal issues of Gentoo, so even if we agree that real names are
> > mandatory, there is no practical legal need for anyone outside of
> > trustees to know them. This way we can include people who agree to
> > keep their privacy from anyone except trustees and in the same way
> > this will keep the legal effect of GLEP 76 intact.
> > 
> 
> How are Trustees supposed to know whether the 'real name' is actually a
> real natural name?  You just said it is apparently impossible to verify.

Please read carefully my original e-mail and do not twist my words.

I never stated that the trustees will know better, I stated that
their knowledge of what we assume to be real names will be
sufficient and there is no need for all developers to know them.
This is because the trustees are responsible for legal issues of
Gentoo.

With such approach we lose nothing, but gain something valuable: we
may and will accept more people and more contributions.

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Rich Freeman]

On Fri, Jun 28, 2019 at 7:49 AM Andrew Savchenko <bircoph@gentoo.org> wrote:
>
> I never stated that the trustees will know better, I stated that
> their knowledge of what we assume to be real names will be
> sufficient and there is no need for all developers to know them.
> This is because the trustees are responsible for legal issues of
> Gentoo.
>
> With such approach we lose nothing, but gain something valuable: we
> may and will accept more people and more contributions.

IMO you lose a professional atmosphere.  I think there is a difference
in atmosphere when you have Andrew and Rich and Michał having a
discussion, versus codebozo and leetcoder and trollmaster.  (Just
making up random handles - no correspondence implied.)

I mean, which would you prefer to have on your linkedin network?

Many FOSS projects require the use of real names, including Linux.

-- 
Rich

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Andrew Savchenko]

[-- Attachment #1: Type: text/plain, Size: 1700 bytes --]

Hi!

On Fri, 28 Jun 2019 08:09:28 -0400 Rich Freeman wrote:
> On Fri, Jun 28, 2019 at 7:49 AM Andrew Savchenko <bircoph@gentoo.org> wrote:
> >
> > I never stated that the trustees will know better, I stated that
> > their knowledge of what we assume to be real names will be
> > sufficient and there is no need for all developers to know them.
> > This is because the trustees are responsible for legal issues of
> > Gentoo.
> >
> > With such approach we lose nothing, but gain something valuable: we
> > may and will accept more people and more contributions.
> 
> IMO you lose a professional atmosphere.  I think there is a difference
> in atmosphere when you have Andrew and Rich and Michał having a
> discussion, versus codebozo and leetcoder and trollmaster.  (Just
> making up random handles - no correspondence implied.)

Gentoo is made by volunteers. I see nothing wrong that we all are
not sitting in suits and white shirts. (If someone are I'm also
fine with this.)

> I mean, which would you prefer to have on your linkedin network?

I refused to use linkedin and other social networks long time ago.
Practice shows that people interested in finding me can do this
without linkedin or similar networks.

In my professional activities on my job I'm often refered to on
wiki or mail lists as bircoph and I'm fine with this. I often refer
my colleagues including superiors and managers up to directors
board the same way.

> Many FOSS projects require the use of real names, including Linux.

Linux foundation is run mostly by conglomeration of corporations, so
little surprise they do. But many FOSS projects don't. 

Best regards,
Andrew Savchenko

[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Andreas K. Huettel]

> Isn't it about time we quit pinning the mistakes of the past on the
> officers of the present? 

Well, yes. Though, we tried something in the past, it didnt work, we should do 
it different in the future.

> From what I understand, the present and recent
> officers have made extraordinary efforts to rectify the shortcomings of
> previous trustees

And that's great. 

But are you sure that we should require continuous "extraordinary efforts" 
from trustees in the future, just to keep things running?

FWIW, I endorse antarus / Alec for trustee. :)

-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer 
(council, toolchain, base-system, perl, libreoffice)

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[desultory]

On 06/28/19 08:09, Rich Freeman wrote:
> On Fri, Jun 28, 2019 at 7:49 AM Andrew Savchenko <bircoph@gentoo.org> wrote:
>>
>> I never stated that the trustees will know better, I stated that
>> their knowledge of what we assume to be real names will be
>> sufficient and there is no need for all developers to know them.
>> This is because the trustees are responsible for legal issues of
>> Gentoo.
>>
>> With such approach we lose nothing, but gain something valuable: we
>> may and will accept more people and more contributions.
> 
> IMO you lose a professional atmosphere.  I think there is a difference
> in atmosphere when you have Andrew and Rich and Michał having a
> discussion, versus codebozo and leetcoder and trollmaster.  (Just
> making up random handles - no correspondence implied.)
> 
What you describe as, in effect, a dehumamizing interface, others
perceive as a way to keep minimize their social exposure. Where you find
some ill-defined negative, others find a distinct positive. Is Gentoo
really in a position where it can turn away demonstrably skilled
contributors based solely on their wanting to minimize personal exposure?

> I mean, which would you prefer to have on your linkedin network?
> 
Maybe, just maybe, people who have no interest in publishing their
involvement with a project have no interest in publishing their
involvement with a project's members. Which leads me to the radical leap
of logic that they probably wouldn't be making such associations known
on a social networking site, and if they would at some point want to do
so, they would likely make their involvement itself public.

> Many FOSS projects require the use of real names, including Linux.
> 
"Other people do it" is not exactly a great logical argument, given that
precisely the same argument could be used to justify doing literally
anything that anyone else has done.

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Patrick Lauer]

On 6/15/19 11:49 AM, Andrew Savchenko wrote:
> On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
>> Hi all!
>>
>> Last year we had a good initiative: it addition to (or even instead
>> of) manifests nominees were asked questions by voters. So let's
>> continue this year.
>>
>> I propose to have one question per thread spawned by this e-mail to
>> keep discussion focused. If you have multiple questions, please
>> start multiple threads. If your question was already asked, please
>> join a thread.
>>
>> I'll ask my questions in subsequent e-mails.
> 
> In my opinion GLEP 76 is the most controversial decision made by
> running council. While it fixed some long standing issues like
> copyright headers and proper acknowledgement of out of the tree
> contributors, it created grave problems: now some long-time
> contributors and even developer are seriously discriminated because
> they want to keep their privacy.
> 
> What is your opinion on this problem?

I think everyone involved in the discussion meant well, but different
cultural starting points (e.g. different ideas about what copyright
means), trying to find a compromise, not being experienced with legal
language/concepts (or even legal concepts not translating well between
languages) etc.etc. conspired to make this a very weirdly shaped thing
that imo doesn't do what people think it does.

I mostly ignored the discussion because it was a too high volume of
email on a topic where I don't see a strong need to act, in hindsight
that was naive optimism on my side.

> Should GLEP 76 be left as is?

No,it should be improved.
E.g. having signed commits, and adding signed-off-by, is ... weird.
It also leads to semantic satiation, where every commit has
signed-off-by, every commit, signed-off-by, signed-off-by ...

And since it's autogenerated it doesn't really mean anything. It would
make more sense to add it *only* to commits from not-gentoo-devs, since
all the other commits are already signed by authenticated users.

> Should GLEP 76 be cancelled?
> Should GLEP 76 be improved and how?
See above :)

Re: [gentoo-project] Questions for Gentoo Council nominees: Power balance

[Patrick Lauer]

On 6/15/19 12:00 PM, Andrew Savchenko wrote:
> On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
>> Hi all!
>>
>> Last year we had a good initiative: it addition to (or even instead
>> of) manifests nominees were asked questions by voters. So let's
>> continue this year.
>>
>> I propose to have one question per thread spawned by this e-mail to
>> keep discussion focused. If you have multiple questions, please
>> start multiple threads. If your question was already asked, please
>> join a thread.
>>
>> I'll ask my questions in subsequent e-mails.
> 
> Gentoo power balance was carefully crafted over the years. However
> during last year that balance was disrupted:
> 
Over the years there were lots of changes. The recent changes are not
/that/ unusual, so I don't see it as a disruption of the balance more
than previous changes.

> 1. The same person can now be in the Gentoo Council and the Trustees
> board.
I don't directly see that as a problem. But both Council and Trustees
seem to have a lack of members with enough time already, so not having
time in two places sounds inconvenient

> 2. QA can now bypass Comrel on bans.
Every decision involving QA and ComRel upsets someone.
The goal of these rules is to contain and isolate bad actors, now we
have ... infra, qa, comrel at least, able to act. I'm not sure if
delegating capabilities to that many groups make sense, but there are
good arguments why any of them should be able to act.

> What is your opinion on this?
> Should this balance be left as is?
> If it should be tuned, then how?
> 
> I'm worried about that some people or teams may gain too much power
> and misuse it.
> 
Those with more free time already have a disproportional effect, should
we limit their acceptable amount of contributions?

If you're worried about people pushing things the wrong way the only way
I see to fix it is to recruit allies (e.g. recruit new devs who have
ideas similar to yours, or motivate existing devs to work on a problem)
and spend time on bending things more towards your ideals.

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 2525 bytes --]

On Sun, 2019-06-30 at 09:11 +0200, Patrick Lauer wrote:
> On 6/15/19 11:49 AM, Andrew Savchenko wrote:
> > On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
> > > Hi all!
> > > 
> > > Last year we had a good initiative: it addition to (or even instead
> > > of) manifests nominees were asked questions by voters. So let's
> > > continue this year.
> > > 
> > > I propose to have one question per thread spawned by this e-mail to
> > > keep discussion focused. If you have multiple questions, please
> > > start multiple threads. If your question was already asked, please
> > > join a thread.
> > > 
> > > I'll ask my questions in subsequent e-mails.
> > 
> > In my opinion GLEP 76 is the most controversial decision made by
> > running council. While it fixed some long standing issues like
> > copyright headers and proper acknowledgement of out of the tree
> > contributors, it created grave problems: now some long-time
> > contributors and even developer are seriously discriminated because
> > they want to keep their privacy.
> > 
> > What is your opinion on this problem?
> 
> I think everyone involved in the discussion meant well, but different
> cultural starting points (e.g. different ideas about what copyright
> means), trying to find a compromise, not being experienced with legal
> language/concepts (or even legal concepts not translating well between
> languages) etc.etc. conspired to make this a very weirdly shaped thing
> that imo doesn't do what people think it does.
> 
> I mostly ignored the discussion because it was a too high volume of
> email on a topic where I don't see a strong need to act, in hindsight
> that was naive optimism on my side.

It's funny you say that given that you've trolled the result
for 4 months.

> 
> > Should GLEP 76 be left as is?
> 
> No,it should be improved.
> E.g. having signed commits, and adding signed-off-by, is ... weird.
> It also leads to semantic satiation, where every commit has
> signed-off-by, every commit, signed-off-by, signed-off-by ...
> 
> And since it's autogenerated it doesn't really mean anything. It would
> make more sense to add it *only* to commits from not-gentoo-devs, since
> all the other commits are already signed by authenticated users.

How would you verify that devs have actually read the new spec, and not
just ignored it?  Do you prefer that we disabled commit access for
everyone, and then asked everyone to make a vow?

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Patrick Lauer]

On 6/30/19 9:42 AM, Michał Górny wrote:
> On Sun, 2019-06-30 at 09:11 +0200, Patrick Lauer wrote:
>> On 6/15/19 11:49 AM, Andrew Savchenko wrote:
>>> On Sat, 15 Jun 2019 12:42:20 +0300 Andrew Savchenko wrote:
>>>> Hi all!
>>>>
>>>> Last year we had a good initiative: it addition to (or even instead
>>>> of) manifests nominees were asked questions by voters. So let's
>>>> continue this year.
>>>>
>>>> I propose to have one question per thread spawned by this e-mail to
>>>> keep discussion focused. If you have multiple questions, please
>>>> start multiple threads. If your question was already asked, please
>>>> join a thread.
>>>>
>>>> I'll ask my questions in subsequent e-mails.
>>>
>>> In my opinion GLEP 76 is the most controversial decision made by
>>> running council. While it fixed some long standing issues like
>>> copyright headers and proper acknowledgement of out of the tree
>>> contributors, it created grave problems: now some long-time
>>> contributors and even developer are seriously discriminated because
>>> they want to keep their privacy.
>>>
>>> What is your opinion on this problem?
>>
>> I think everyone involved in the discussion meant well, but different
>> cultural starting points (e.g. different ideas about what copyright
>> means), trying to find a compromise, not being experienced with legal
>> language/concepts (or even legal concepts not translating well between
>> languages) etc.etc. conspired to make this a very weirdly shaped thing
>> that imo doesn't do what people think it does.
>>
>> I mostly ignored the discussion because it was a too high volume of
>> email on a topic where I don't see a strong need to act, in hindsight
>> that was naive optimism on my side.
> 
> It's funny you say that given that you've trolled the result
> for 4 months.
> 
Hey I've really missed the personal attacks from you.

Do you think I can get 20% off if I order a pack of ten?

I consider the *ideas* behind GLEP76 pretty reasonable (even if I don't
agree with it completely), just the way it is written is ... eh ... very
much open to individual subjective interpretation, which is not what you
want in a standard. Especially not near legal issues.


>>
>>> Should GLEP 76 be left as is?
>>
>> No,it should be improved.
>> E.g. having signed commits, and adding signed-off-by, is ... weird.
>> It also leads to semantic satiation, where every commit has
>> signed-off-by, every commit, signed-off-by, signed-off-by ...
>>
>> And since it's autogenerated it doesn't really mean anything. It would
>> make more sense to add it *only* to commits from not-gentoo-devs, since
>> all the other commits are already signed by authenticated users.
> 
> How would you verify that devs have actually read the new spec, and not
> just ignored it?  Do you prefer that we disabled commit access for
> everyone, and then asked everyone to make a vow?
> 
I don't quite understand what you read into my comment.

Adding an autogenerated "Blessed-by-Krom" has very little *meaning*, so
what do we gain by adding an autogenerated "Blessed-by-Krom"? (No,
eternal battle in the afterlife is not guaranteed)

Since it's mandatory to continue committing, and autogenerated ... what
does it really do? And how does it do more than requiring people to read
and understand the rules before, and signing their commits? (Which,
legally, shows an equivalent intent)

(Does anyone actually read *and understand* Terms&Conditions? How do you
verify that? Usually you'd just assume that people are not actively
malicious and that their word is enough)

So from my perspective GLEP76 doesn't really improve the situation, just
makes everything more complex and causes exhausting discussions about
non-technical topics that don't improve the distro.

Re: [gentoo-project] Questions for Gentoo Council nominees

[Roy Bamford]

[-- Attachment #1: Type: text/plain, Size: 1147 bytes --]

On 2019.06.15 10:42, Andrew Savchenko wrote:
> Hi all!
> 
> Last year we had a good initiative: it addition to (or even instead
> of) manifests nominees were asked questions by voters. So let's
> continue this year.
> 
> I propose to have one question per thread spawned by this e-mail to
> keep discussion focused. If you have multiple questions, please
> start multiple threads. If your question was already asked, please
> join a thread.
> 
> I'll ask my questions in subsequent e-mails.
> 
> Best regards,
> Andrew Savchenko
> 

Team,

We now have two candidates for the trustee election who have 
a stated aim to wind up the foundation and move the assets to
an umbrella.

If that is successful, the bookkeeping and tax filing mechanics
would be done by the umbrella but direction of the umbrella, on 
behalf of Gentoo remains with Gentoo.

Logically, that role would fall to council.

How do council candidates foresee the financial management 
of Gentoo being undertaken should the Foundation be dissolved? 

-- 
Regards,

Roy Bamford
(Neddyseagoon) a member of
elections
gentoo-ops
forum-mods
arm64

[-- Attachment #2: Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 1217 bytes --]

On 2019-06-30 12:36, Roy Bamford wrote:
> Team,
> 
> We now have two candidates for the trustee election who have 
> a stated aim to wind up the foundation and move the assets to
> an umbrella.
> 
> If that is successful, the bookkeeping and tax filing mechanics
> would be done by the umbrella but direction of the umbrella, on 
> behalf of Gentoo remains with Gentoo.
> 
> Logically, that role would fall to council.
> 
> How do council candidates foresee the financial management 
> of Gentoo being undertaken should the Foundation be dissolved? 

From my P.O.V. this is not within the scope of the council:

Foundation is independent at the moment. They can do whatever they want
to do. Council can't force them to take any actions (like foundation
cannot force council to take a specific action). That's a legal thing...

So if foundation will be dissolved, foundation can ask community to come
up with some ideas. But in the end only foundation can decide. Maybe we
will move to SPI (https://www.spi-inc.org/projects/) but again, _only_
foundation can decide on that.


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Rich Freeman]

On Sun, Jun 30, 2019 at 12:48 AM desultory <desultory@gentoo.org> wrote:
>
> On 06/28/19 08:09, Rich Freeman wrote:
> > On Fri, Jun 28, 2019 at 7:49 AM Andrew Savchenko <bircoph@gentoo.org> wrote:
> >>
> >> I never stated that the trustees will know better, I stated that
> >> their knowledge of what we assume to be real names will be
> >> sufficient and there is no need for all developers to know them.
> >> This is because the trustees are responsible for legal issues of
> >> Gentoo.
> >>
> >> With such approach we lose nothing, but gain something valuable: we
> >> may and will accept more people and more contributions.
> >
> > IMO you lose a professional atmosphere.  I think there is a difference
> > in atmosphere when you have Andrew and Rich and Michał having a
> > discussion, versus codebozo and leetcoder and trollmaster.  (Just
> > making up random handles - no correspondence implied.)
> >
> What you describe as, in effect, a dehumamizing interface, others
> perceive as a way to keep minimize their social exposure. Where you find
> some ill-defined negative, others find a distinct positive. Is Gentoo
> really in a position where it can turn away demonstrably skilled
> contributors based solely on their wanting to minimize personal exposure?

I think either decision will turn people away.

You claim that we have an environment that people do not want to be
personally exposed to.  I think it makes more sense to fix these
issues than to cover them up by making it easier to avoid personal
association with the distro.

Minimizing social exposure also means minimizing the personal
consequences of your own actions.  I suspect that is likely to make
the existing problems worse.

I think it is more important to make Gentoo a project that people are
proud to be associated with.  This isn't just to avoid personal damage
to reputation, but because it will actually make people want to
participate.

If Gentoo turns into just another online forum where everybody trolls
everybody else all the time and nobody bothers to do anything about
it, then why would anybody but a troll want to participate?

> "Other people do it" is not exactly a great logical argument

Sure, not on its own.  However, keep in mind that most of the stuff
that people are complaining about with regard to GLEP 76 are standing
policy in other well-funded and mainstream FOSS projects, like the
Linux kernel.

The fact that the Linux Foundation considers something a good idea
doesn't automatically make it a good idea.  However, they do have all
those pesky lawyers and all that which people seem to think we don't
have enough of, and they also have a very positive reputation for the
most part.  I don't see too many people who are ashamed to have their
name in a signed-off-by header in the kernel.

It doesn't hurt to point out when a process resembles something that
has been used elsewhere, so that others can look more closely and
decide for themselves whether this has been a positive or negative
thing.  MANY of Gentoo's policies are patterned after things other
projects have done, since there is no point in re-inventing the wheel.

-- 
Rich

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Andreas K. Huettel]

[-- Attachment #1: Type: text/plain, Size: 547 bytes --]

> Beyond the above two points, as a follow on question.
> 
> 1. How would you work to improve the relationship with the foundation?

By dissolving it and having the day-to-day business handled by an umbrella 
organization.

Gentoo needs to be able to function, and a dual-headed model has turned out to 
be highly problematic in the past.

[It may work now, but there's no guarantee it will work in the future.]

-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees

[Andreas K. Huettel]

[-- Attachment #1: Type: text/plain, Size: 871 bytes --]

> If that is successful, the bookkeeping and tax filing mechanics
> would be done by the umbrella but direction of the umbrella, on
> behalf of Gentoo remains with Gentoo.
> How do council candidates foresee the financial management
> of Gentoo being undertaken should the Foundation be dissolved?

Typically an umbrella organization has a designated contact in the project it 
administrates. So we need to come up with a way to introduce this office, 
under supervision and authority of the elected council.

It does *not* make sense to introduce a second body again, since then we 
plainly don't gain anything (well except that the books are handled by 
professionals, but as long as Robin does it they are in good hands anyway).


-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Aaron Bauman]

[-- Attachment #1: Type: text/plain, Size: 880 bytes --]

On Sun, Jun 30, 2019 at 05:54:35PM -0400, Aaron Bauman wrote:
> On Sat, Jun 29, 2019 at 01:49:58AM +0200, Andreas K. Huettel wrote:
> > > Isn't it about time we quit pinning the mistakes of the past on the
> > > officers of the present? 
> > 
> > Well, yes. Though, we tried something in the past, it didnt work, we should do 
> > it different in the future.
> > 
> > > From what I understand, the present and recent
> > > officers have made extraordinary efforts to rectify the shortcomings of
> > > previous trustees
> > 
> > And that's great. 
> > 
> > But are you sure that we should require continuous "extraordinary efforts" 
> > from trustees in the future, just to keep things running?
> > 
> > FWIW, I endorse antarus / Alec for trustee. :)
> 

No, once fixed, the books will likely be continued to be done by a full time CPA.

-- 
Cheers,
Aaron

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Robin H. Johnson]

[-- Attachment #1: Type: text/plain, Size: 2227 bytes --]

On Sun, Jun 30, 2019 at 10:03:52AM +0200, Patrick Lauer wrote:
> Adding an autogenerated "Blessed-by-Krom" has very little *meaning*, so
> what do we gain by adding an autogenerated "Blessed-by-Krom"? (No,
> eternal battle in the afterlife is not guaranteed)
> 
> Since it's mandatory to continue committing, and autogenerated ... what
> does it really do? And how does it do more than requiring people to read
> and understand the rules before, and signing their commits? (Which,
> legally, shows an equivalent intent)
> 
> (Does anyone actually read *and understand* Terms&Conditions? How do you
> verify that? Usually you'd just assume that people are not actively
> malicious and that their word is enough)
> 
> So from my perspective GLEP76 doesn't really improve the situation, just
> makes everything more complex and causes exhausting discussions about
> non-technical topics that don't improve the distro.
As a clear example of meaningful agreement to the DCO vs the
autogenerated agreement that Patrick is concerned about, look at GnuPG's
model:

1. A new contributor must send a OpenPGP-signed copy of the GnuPG DCO
   text to the public mailing list (the exact wording of the DCO
   contains only a minor change s/open/free/ per FSF principles).
2. Signed-off-by trailer in the commit message is ALSO required, and is
   only used to verify against the DCO registry.
3. The documentation says a) no pseudonyms, and b) anonymous contributions
   can be done with a proxy who is willing to certify for you:
   https://gnupg.org/faq/HACKING.html#sec-1-3
4. There's a registry of DCO signatories:
   https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=AUTHORS;hb=HEAD#l163

However, there are two names that stand out as pseudonyms:
https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=AUTHORS;hb=HEAD#l187

I think is an implicit outcome of the two policy statements together:
Pseudonyms are also valid if there is a certifying proxy.


-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail   : robbat2@gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 1113 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 2995 bytes --]

On 2019-07-01 00:27, Robin H. Johnson wrote:
> As a clear example of meaningful agreement to the DCO vs the
> autogenerated agreement that Patrick is concerned about, look at GnuPG's
> model:
> 
> 1. A new contributor must send a OpenPGP-signed copy of the GnuPG DCO
>    text to the public mailing list (the exact wording of the DCO
>    contains only a minor change s/open/free/ per FSF principles).
> 2. Signed-off-by trailer in the commit message is ALSO required, and is
>    only used to verify against the DCO registry.

From my understanding of Patrick's concerns, this doesn't change
anything for him: It's still possible to autogenerate such a statement.

From my understanding he is questioning the whole idea behind this: I.e.
is there really a chance that this will protect anyone/anything? Is
there really a chance that the committer can be legally held accountable?

At least in Europe, a GPG signature has no legal meaning. You will need
a qualified digital signature for any legal implications.

There are still companies/projects out there requiring that you add your
handwritten signature below the CLA (i.e. this will require that you
send the document via post or fax).

So if we are not 100% sure that this will fix a real problem and will
stand up in court if necessary, the whole thing was just a waste of time.

But maybe that's not what Patrick wanted to say :-)


I was told that the main driver for GLEP 76 was to protect the Gentoo
foundation: Whenever something happens within Gentoo namespace, Gentoo
foundation is the only accountable body.

In case someone violated DCO and added IP he/she didn't own, the main
interest of the actual copyright owner is to remove the IP in question.
I really hope we will never experience such a situation but judging from
GitHub's public DMCA log I would expect that we will either have to
spend a lot of money trying to defend Gentoo or would at least have to
prune (rewrite) repository to get rid of any affected fragment (which
could be challenging).

The copyright holder may also demand compensation.

It's important to understand that the foundation will have to pay for
this...

Now thanks to the DCO statement, the foundation is in the position to
get the money back from contributor who violated DCO and caused the
trouble. Because I don't expect that the contributor will say, "Oh
right, I am sorry, this was my fault, let me pay your expenses",
foundation will now have to sue the contributor. The chances of success
are very low if contributor isn't within same jurisdiction. In other
words: It will be hard for the foundation to sue anyone in Europe for
example because the GPG-signed statement has no legal significance for
Europeans.

So this is mainly a US-only thing from legal perspective, if at all (I
am not familiar with US law).


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[desultory]

On 06/30/19 14:53, Rich Freeman wrote:
> On Sun, Jun 30, 2019 at 12:48 AM desultory <desultory@gentoo.org> wrote:
>>
>> On 06/28/19 08:09, Rich Freeman wrote:
>>> On Fri, Jun 28, 2019 at 7:49 AM Andrew Savchenko <bircoph@gentoo.org> wrote:
>>>>
>>>> I never stated that the trustees will know better, I stated that
>>>> their knowledge of what we assume to be real names will be
>>>> sufficient and there is no need for all developers to know them.
>>>> This is because the trustees are responsible for legal issues of
>>>> Gentoo.
>>>>
>>>> With such approach we lose nothing, but gain something valuable: we
>>>> may and will accept more people and more contributions.
>>>
>>> IMO you lose a professional atmosphere.  I think there is a difference
>>> in atmosphere when you have Andrew and Rich and Michał having a
>>> discussion, versus codebozo and leetcoder and trollmaster.  (Just
>>> making up random handles - no correspondence implied.)
>>>
>> What you describe as, in effect, a dehumamizing interface, others
>> perceive as a way to keep minimize their social exposure. Where you find
>> some ill-defined negative, others find a distinct positive. Is Gentoo
>> really in a position where it can turn away demonstrably skilled
>> contributors based solely on their wanting to minimize personal exposure?
> 
> I think either decision will turn people away.
> 
I realize that I am asking for hearsay here, but have you have anyone
tell you that allowing contributors to remain anonymous, at least to the
public at large, is an active turnoff to contributing to the project?

> You claim that we have an environment that people do not want to be
> personally exposed to.  I think it makes more sense to fix these
> issues than to cover them up by making it easier to avoid personal
> association with the distro.
> 
No, my claim is that some people would prefer to avoid social exposure
in general, regardless of the environment; not that Gentoo has some
special toxicity to it. Furthermore, by even pseudonymously
contributing, they would be exposing themselves to the immediate
environment regardless, however by contributing pseudonymously they
could avoid secondary social effects. That and the recent purported
attempt to "fix" issues is more likely to turn people away than attract
them. Further, it is overtly silly to claim that something is being
"covered up" with regard to public interactions by not publishing the
particulars of all potential individuals engaged in those interactions,
after all, the interactions would be in public.

> Minimizing social exposure also means minimizing the personal
> consequences of your own actions.  I suspect that is likely to make
> the existing problems worse.
> 
Again you make the argument that people need to be personally exposed to
"consequences" in order to be trustworthy while ignoring that existing
disciplinary mechanisms in Gentoo do not depend in any functional way on
PII, and that publishing PII purely on the basis of disciplinary
considerations could be quite reasonably considered to be an outrageous
overreach. There are reasons that "doxing" is generally considered to be
rather reprehensible.

> I think it is more important to make Gentoo a project that people are
> proud to be associated with.  This isn't just to avoid personal damage
> to reputation, but because it will actually make people want to
> participate.
> 
If your contention, as you had previously strawmanned my contention to
be, is that people as a whole don't want to contribute to Gentoo now,
how do you explain the current pool of developers and other contributors
who are not listed in the rolls [devlist]? Are we all being coerced?

> If Gentoo turns into just another online forum where everybody trolls
> everybody else all the time and nobody bothers to do anything about
> it, then why would anybody but a troll want to participate?
> 
Is your contention seriously that anyone who is not publicly know is a
troll and anyone who is publicly know is not? This seems distinctly
counter-evidentiary.

>> "Other people do it" is not exactly a great logical argument
> 
> Sure, not on its own.  However, keep in mind that most of the stuff
> that people are complaining about with regard to GLEP 76 are standing
> policy in other well-funded and mainstream FOSS projects, like the
> Linux kernel.
> 
> The fact that the Linux Foundation considers something a good idea
> doesn't automatically make it a good idea.  However, they do have all
> those pesky lawyers and all that which people seem to think we don't
> have enough of, and they also have a very positive reputation for the
> most part.  I don't see too many people who are ashamed to have their
> name in a signed-off-by header in the kernel.
> 
The fact that the Linux Foundation considers something to be a good idea
for itself does not mean that even the Linux Foundation would consider
that same thing to be a good idea for everyone, or even anyone, else.
Having "all those pesky lawyers" working for you tends to imply that
they are, at least nominally, providing counsel apropos your specific
needs, or at least their conception thereof.

Also, why, exactly, do you think that if someone wishes to remain
anonymous, they would necessarily be "ashamed" of their work, or the
project they contributed to? Apropos Gentoo in specific, are you
deliberately implying that we regularly accept contributions which
should leave those providing them "ashamed" of themselves? If so,
perhaps that is something which should be fixed.

> It doesn't hurt to point out when a process resembles something that
> has been used elsewhere, so that others can look more closely and
> decide for themselves whether this has been a positive or negative
> thing.  MANY of Gentoo's policies are patterned after things other
> projects have done, since there is no point in re-inventing the wheel.
> 
And, again, the circumstances of different projects are, somewhat
unsurprisingly, different. That project A does one thing and project B
does another does not make either necessarily right or wrong for project
C. Simply stating "they do it too" remains a weak argument for doing any
particular thing. For instance: Linux kernel uses GPL2 only (in that it
does not adopt the "or later" clause), that in itself is not a
particularly strong argument for another project to use GPL2 only, or
even GPL at all, if the project has different considerations in play.
Given that Gentoo is not the Linux Foundation, there are almost
certainly different considerations in play, and ignoring them on poorly
supported grounds is not productive.

[devlist] https://www.gentoo.org/inside-gentoo/developers/

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 1118 bytes --]

On Sun, 2019-06-30 at 17:55 -0400, Aaron Bauman wrote:
> On Sun, Jun 30, 2019 at 05:54:35PM -0400, Aaron Bauman wrote:
> > On Sat, Jun 29, 2019 at 01:49:58AM +0200, Andreas K. Huettel wrote:
> > > > Isn't it about time we quit pinning the mistakes of the past on the
> > > > officers of the present? 
> > > 
> > > Well, yes. Though, we tried something in the past, it didnt work, we should do 
> > > it different in the future.
> > > 
> > > > From what I understand, the present and recent
> > > > officers have made extraordinary efforts to rectify the shortcomings of
> > > > previous trustees
> > > 
> > > And that's great. 
> > > 
> > > But are you sure that we should require continuous "extraordinary efforts" 
> > > from trustees in the future, just to keep things running?
> > > 
> > > FWIW, I endorse antarus / Alec for trustee. :)
> 
> No, once fixed, the books will likely be continued to be done by a full time CPA.
> 

Wouldn't a dedicated 'full time CPA' be more expensive than an umbrella
that has a financial team for multiple projects?

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Roy Bamford]

[-- Attachment #1: Type: text/plain, Size: 1577 bytes --]

On 2019.07.01 08:50, Michał Górny wrote:
> On Sun, 2019-06-30 at 17:55 -0400, Aaron Bauman wrote:
> > On Sun, Jun 30, 2019 at 05:54:35PM -0400, Aaron Bauman wrote:
> > > On Sat, Jun 29, 2019 at 01:49:58AM +0200, Andreas K. Huettel
> wrote:
> > > > > Isn't it about time we quit pinning the mistakes of the past
> on the
> > > > > officers of the present? 
> > > > 
> > > > Well, yes. Though, we tried something in the past, it didnt
> work, we should do 
> > > > it different in the future.
> > > > 
> > > > > From what I understand, the present and recent
> > > > > officers have made extraordinary efforts to rectify the
> shortcomings of
> > > > > previous trustees
> > > > 
> > > > And that's great. 
> > > > 
> > > > But are you sure that we should require continuous
> "extraordinary efforts" 
> > > > from trustees in the future, just to keep things running?
> > > > 
> > > > FWIW, I endorse antarus / Alec for trustee. :)
> > 
> > No, once fixed, the books will likely be continued to be done by a
> full time CPA.
> > 
> 
> Wouldn't a dedicated 'full time CPA' be more expensive than an
> umbrella
> that has a financial team for multiple projects?
> 
> -- 
> Best regards,
> Michał Górny
> 
> 

Ah, the nuances of the English language used between two non 
native spears. 

A 'full time CPA' means that the person does that sort of work full
time. It does not mean that he or she works full time for any one
client. 

-- 
Regards,

Roy Bamford
(Neddyseagoon) a member of
elections
gentoo-ops
forum-mods
arm64

[-- Attachment #2: Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 2198 bytes --]

On Mon, 2019-07-01 at 10:31 +0100, Roy Bamford wrote:
> On 2019.07.01 08:50, Michał Górny wrote:
> > On Sun, 2019-06-30 at 17:55 -0400, Aaron Bauman wrote:
> > > On Sun, Jun 30, 2019 at 05:54:35PM -0400, Aaron Bauman wrote:
> > > > On Sat, Jun 29, 2019 at 01:49:58AM +0200, Andreas K. Huettel
> > wrote:
> > > > > > Isn't it about time we quit pinning the mistakes of the past
> > on the
> > > > > > officers of the present? 
> > > > > 
> > > > > Well, yes. Though, we tried something in the past, it didnt
> > work, we should do 
> > > > > it different in the future.
> > > > > 
> > > > > > From what I understand, the present and recent
> > > > > > officers have made extraordinary efforts to rectify the
> > shortcomings of
> > > > > > previous trustees
> > > > > 
> > > > > And that's great. 
> > > > > 
> > > > > But are you sure that we should require continuous
> > "extraordinary efforts" 
> > > > > from trustees in the future, just to keep things running?
> > > > > 
> > > > > FWIW, I endorse antarus / Alec for trustee. :)
> > > 
> > > No, once fixed, the books will likely be continued to be done by a
> > full time CPA.
> > 
> > Wouldn't a dedicated 'full time CPA' be more expensive than an
> > umbrella
> > that has a financial team for multiple projects?
> > 
> > -- 
> > Best regards,
> > Michał Górny
> > 
> > 
> 
> Ah, the nuances of the English language used between two non 
> native spears. 
> 
> A 'full time CPA' means that the person does that sort of work full
> time. It does not mean that he or she works full time for any one
> client. 
> 

Yes, I understand that.  However, I still believe that a contract
initiated between CPA and a single small-ish entity such a Gentoo
involves more costs than fees taken by umbrella dedicated to multiple
entities.  Please correct me if I'm wrong.

While I can agree that we need to pay more at the moment due to past
issues, I also believe that we owe it to our donors that we try not to
spend most of their money on unnecessary bureaucracy (read: keeping
a dedicated Foundation if there's an alternative that works for Gentoo).

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Michael Everitt]

[-- Attachment #1.1: Type: text/plain, Size: 2440 bytes --]

On 01/07/19 10:52, Michał Górny wrote:
> On Mon, 2019-07-01 at 10:31 +0100, Roy Bamford wrote:
>> On 2019.07.01 08:50, Michał Górny wrote:
>>> On Sun, 2019-06-30 at 17:55 -0400, Aaron Bauman wrote:
>>>> On Sun, Jun 30, 2019 at 05:54:35PM -0400, Aaron Bauman wrote:
>>>>> On Sat, Jun 29, 2019 at 01:49:58AM +0200, Andreas K. Huettel
>>> wrote:
>>>>>>> Isn't it about time we quit pinning the mistakes of the past
>>> on the
>>>>>>> officers of the present? 
>>>>>> Well, yes. Though, we tried something in the past, it didnt
>>> work, we should do 
>>>>>> it different in the future.
>>>>>>
>>>>>>> From what I understand, the present and recent
>>>>>>> officers have made extraordinary efforts to rectify the
>>> shortcomings of
>>>>>>> previous trustees
>>>>>> And that's great. 
>>>>>>
>>>>>> But are you sure that we should require continuous
>>> "extraordinary efforts" 
>>>>>> from trustees in the future, just to keep things running?
>>>>>>
>>>>>> FWIW, I endorse antarus / Alec for trustee. :)
>>>> No, once fixed, the books will likely be continued to be done by a
>>> full time CPA.
>>>
>>> Wouldn't a dedicated 'full time CPA' be more expensive than an
>>> umbrella
>>> that has a financial team for multiple projects?
>>>
>>> -- 
>>> Best regards,
>>> Michał Górny
>>>
>>>
>> Ah, the nuances of the English language used between two non 
>> native spears. 
>>
>> A 'full time CPA' means that the person does that sort of work full
>> time. It does not mean that he or she works full time for any one
>> client. 
>>
> Yes, I understand that.  However, I still believe that a contract
> initiated between CPA and a single small-ish entity such a Gentoo
> involves more costs than fees taken by umbrella dedicated to multiple
> entities.  Please correct me if I'm wrong.
>
> While I can agree that we need to pay more at the moment due to past
> issues, I also believe that we owe it to our donors that we try not to
> spend most of their money on unnecessary bureaucracy (read: keeping
> a dedicated Foundation if there's an alternative that works for Gentoo).
>
Has anyone got any ball-park figures for the costs of being part of an
umbrella organisation?
And how would this compare to the forecasted costs ongoing for Gentoo
Foundation Inc. or a future non-profit?
What would the tax implications of an umbrella org look like, vs Gentoo
keeping these in-house?


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 801 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Michael Everitt]

[-- Attachment #1.1: Type: text/plain, Size: 2702 bytes --]

On 01/07/19 11:02, Michael Everitt wrote:
> On 01/07/19 10:52, Michał Górny wrote:
>> On Mon, 2019-07-01 at 10:31 +0100, Roy Bamford wrote:
>>> On 2019.07.01 08:50, Michał Górny wrote:
>>>> On Sun, 2019-06-30 at 17:55 -0400, Aaron Bauman wrote:
>>>>> On Sun, Jun 30, 2019 at 05:54:35PM -0400, Aaron Bauman wrote:
>>>>>> On Sat, Jun 29, 2019 at 01:49:58AM +0200, Andreas K. Huettel
>>>> wrote:
>>>>>>>> Isn't it about time we quit pinning the mistakes of the past
>>>> on the
>>>>>>>> officers of the present? 
>>>>>>> Well, yes. Though, we tried something in the past, it didnt
>>>> work, we should do 
>>>>>>> it different in the future.
>>>>>>>
>>>>>>>> From what I understand, the present and recent
>>>>>>>> officers have made extraordinary efforts to rectify the
>>>> shortcomings of
>>>>>>>> previous trustees
>>>>>>> And that's great. 
>>>>>>>
>>>>>>> But are you sure that we should require continuous
>>>> "extraordinary efforts" 
>>>>>>> from trustees in the future, just to keep things running?
>>>>>>>
>>>>>>> FWIW, I endorse antarus / Alec for trustee. :)
>>>>> No, once fixed, the books will likely be continued to be done by a
>>>> full time CPA.
>>>>
>>>> Wouldn't a dedicated 'full time CPA' be more expensive than an
>>>> umbrella
>>>> that has a financial team for multiple projects?
>>>>
>>>> -- 
>>>> Best regards,
>>>> Michał Górny
>>>>
>>>>
>>> Ah, the nuances of the English language used between two non 
>>> native spears. 
>>>
>>> A 'full time CPA' means that the person does that sort of work full
>>> time. It does not mean that he or she works full time for any one
>>> client. 
>>>
>> Yes, I understand that.  However, I still believe that a contract
>> initiated between CPA and a single small-ish entity such a Gentoo
>> involves more costs than fees taken by umbrella dedicated to multiple
>> entities.  Please correct me if I'm wrong.
>>
>> While I can agree that we need to pay more at the moment due to past
>> issues, I also believe that we owe it to our donors that we try not to
>> spend most of their money on unnecessary bureaucracy (read: keeping
>> a dedicated Foundation if there's an alternative that works for Gentoo).
>>
> Has anyone got any ball-park figures for the costs of being part of an
> umbrella organisation?
> And how would this compare to the forecasted costs ongoing for Gentoo
> Foundation Inc. or a future non-profit?
> What would the tax implications of an umbrella org look like, vs Gentoo
> keeping these in-house?
>
Finally, would the Council (prospective) prefer to pay an additional cost
to an Umbrella org to be free of Gentoo Foundation or other sub-project?


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 801 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Roy Bamford]

[-- Attachment #1: Type: text/plain, Size: 2944 bytes --]

On 2019.07.01 10:52, Michał Górny wrote:
> On Mon, 2019-07-01 at 10:31 +0100, Roy Bamford wrote:
> > On 2019.07.01 08:50, Michał Górny wrote:
> > > On Sun, 2019-06-30 at 17:55 -0400, Aaron Bauman wrote:
> > > > On Sun, Jun 30, 2019 at 05:54:35PM -0400, Aaron Bauman wrote:
> > > > > On Sat, Jun 29, 2019 at 01:49:58AM +0200, Andreas K. Huettel
> > > wrote:
> > > > > > > Isn't it about time we quit pinning the mistakes of the
> past
> > > on the
> > > > > > > officers of the present? 
> > > > > > 
> > > > > > Well, yes. Though, we tried something in the past, it didnt
> > > work, we should do 
> > > > > > it different in the future.
> > > > > > 
> > > > > > > From what I understand, the present and recent
> > > > > > > officers have made extraordinary efforts to rectify the
> > > shortcomings of
> > > > > > > previous trustees
> > > > > > 
> > > > > > And that's great. 
> > > > > > 
> > > > > > But are you sure that we should require continuous
> > > "extraordinary efforts" 
> > > > > > from trustees in the future, just to keep things running?
> > > > > > 
> > > > > > FWIW, I endorse antarus / Alec for trustee. :)
> > > > 
> > > > No, once fixed, the books will likely be continued to be done by
> a
> > > full time CPA.
> > > 
> > > Wouldn't a dedicated 'full time CPA' be more expensive than an
> > > umbrella
> > > that has a financial team for multiple projects?
> > > 
> > > -- 
> > > Best regards,
> > > Michał Górny
> > > 
> > > 
> > 
> > Ah, the nuances of the English language used between two non 
> > native spears. 
> > 
> > A 'full time CPA' means that the person does that sort of work full
> > time. It does not mean that he or she works full time for any one
> > client. 
> > 
> 
> Yes, I understand that.  However, I still believe that a contract
> initiated between CPA and a single small-ish entity such a Gentoo
> involves more costs than fees taken by umbrella dedicated to multiple
> entities.  Please correct me if I'm wrong.

Nobody knows yet. Different umbrellas work differently. Different CPAs
charge differently and perform different scopes of work.
The Foundation will need to perform a value judgement based on 
quotations not beliefs.

Its not all for the Foundation to decide. We have to find an umbrella to 
have us before dissolving the Foundation is even an option.

> 
> While I can agree that we need to pay more at the moment due to past
> issues, I also believe that we owe it to our donors that we try not to
> spend most of their money on unnecessary bureaucracy (read: keeping
> a dedicated Foundation if there's an alternative that works for
> Gentoo).

Yes. That's what due diligence is partly about, ensuring the Foundation 
gets value for money. 
 
> 
> -- 
> Best regards,
> Michał Górny
> 
> 

-- 
Regards,

Roy Bamford
(Neddyseagoon) a member of
elections
gentoo-ops
forum-mods
arm64

[-- Attachment #2: Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Rich Freeman]

On Mon, Jul 1, 2019 at 1:02 AM desultory <desultory@gentoo.org> wrote:
>
> publishing PII purely on the basis of disciplinary
> considerations could be quite reasonably considered to be an outrageous
> overreach. There are reasons that "doxing" is generally considered to be
> rather reprehensible.

It obviously is reprehensible.  However, nobody is suggesting
publishing PII for any reason, and I have no idea where this idea even
came from.

For the sake of clarity, I do not believe that Gentoo should publish
PII collected confidentially for any reason.

Furthermore, I do not think that Gentoo should be collecting PII under
conditions of confidentiality for any reason in the first place.  Nor
should we be doing any activities that require us to do so, such as
accepting money from people, or paying people.  IMO we do not have the
demonstrated ability to do this in a safe and compliant manner, and we
have a history of not performing legally-required activities in a
compliant manner.

For this reason, I think it would be a big mistake to allow people to
contribute under pseudonyms under the condition that they reveal their
real identities to some Gentoo body that would retain this information
in confidentiality.  That would expose Gentoo to a rather large number
of privacy laws in a large number of places, for IMO little gain.

None of this is a risk with GLEP 76 as it currently stands.  People
who wish to contribute code to Gentoo must divulge their names.  They
can choose to do this, or not, and if they choose not to, then their
contributions will not be accepted.  If they do, then Gentoo doesn't
have any private information they have to safeguard, because it has
been made public by the person it pertains to.  There is no database
of PII that we have to make accessible to people we already barely
know scattered around the world, but protect from exposure via hacking
attacks/etc.

None of this is intended as some kind of attack on Trustees/Infra/etc.
They're volunteers doing the best they can do without pay, and
generally trying to clean up after a long period of neglect.  It is
simply a fact that if you have nothing to steal, then it is impossible
to steal it, and no effort is required to protect it.

-- 
Rich

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Rich Freeman]

On Mon, Jul 1, 2019 at 7:26 AM Roy Bamford <neddyseagoon@gentoo.org> wrote:
>
> Nobody knows yet. Different umbrellas work differently. Different CPAs
> charge differently and perform different scopes of work.
> The Foundation will need to perform a value judgement based on
> quotations not beliefs.
>

My understanding is that most of these will either take a percentage
of donations for internal operations, or will accept donations
separately to fund internal operations, or both.

I suspect that the cost will be significantly less simply due to the
standardization and volumes involved.  Plus most of these are 501c3 so
they don't have to pay taxes for most things, and of course US
taxpayers can further deduct whatever they do contribute (though with
the recent increase in the standard deduction this benefit is going to
be much less universal than it was a few years ago).

However, I think Gentoo really should think about ways to go a step
further and minimize its reliance on owning stuff in the first place.
It is nice that we have all these donated hosts and volunteers to
maintain them, but as we depend on all this stuff we increase our
exposure to harm when somebody threatens to take that stuff away.
Distributed technologies like git greatly help to reduce these risks
as it makes our data much more portable - it would be nice if at some
point somebody came up with something similar for some of our other
needs, starting with bugzilla (which is always the first thing that
comes up anytime we talk about using a service like Github, and for
good reason).

-- 
Rich

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Andreas K. Huettel]

[-- Attachment #1: Type: text/plain, Size: 799 bytes --]

> > Yes, I understand that.  However, I still believe that a contract
> > initiated between CPA and a single small-ish entity such a Gentoo
> > involves more costs than fees taken by umbrella dedicated to multiple
> > entities.  Please correct me if I'm wrong.
> 
> Nobody knows yet. Different umbrellas work differently.

Sigh. I agree with the second statement. The first one, well...

Here's the example of SPI (disclaimer, we do not know if they would take us):
* no direct costs associated
* 5% deduction from donations for SPI's overhead

Big Hint, it helps to first research something and then talk / discuss. That's 
however, rather rare on this list.

-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Andreas K. Huettel]

[-- Attachment #1: Type: text/plain, Size: 994 bytes --]

[I'm moving this back to gentoo-project only because otherwise the mess gets 
even bigger.]

> What would the tax implications of an umbrella org look like, vs Gentoo
> keeping these in-house?

Well, at the example of SPI (for disclaimer see other mail):

* SPI qualifies as a domestic public charity for purposes of US tax law
* Tax-exempt status under section 501(c)3 of the United States Internal 
Revenue Code was granted on May 23, 1999.
* Donations are tax-deductible in the US

https://www.spi-inc.org/donations/

At the example of the Software Conservancy: 

* Software Freedom Conservancy, Inc. is a 501(c)(3) organization incorporated 
in New York, and donations made to it are fully tax-deductible to the extent 
permitted by law.

https://sfconservancy.org/donate/

Donations to the Gentoo Foundation are not tax-deductible anywhere.

-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Andreas K. Huettel]

[-- Attachment #1: Type: text/plain, Size: 281 bytes --]

Am Montag, 1. Juli 2019, 21:42:29 CEST schrieb Andreas K. Huettel:
[...]

Oh and btw, I found all this out by less than 5min of googling.
Puh--leeease.

-- 
Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 981 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 663 bytes --]

On Mon, Jul 1, 2019 at 12:44 PM Andreas K. Huettel <dilfridge@gentoo.org>
wrote:

> Am Montag, 1. Juli 2019, 21:42:29 CEST schrieb Andreas K. Huettel:
> [...]
>
> Oh and btw, I found all this out by less than 5min of googling.
> Puh--leeease.
>

I have a list of about 20 umbrella organizations that we should be
contacting, I don't really expect to have a discussion about them on the
list until we produce a report with our findings.
I'm happy to publish the list; maybe we are missing some of them.

-A


>
> --
> Andreas K. Hüttel
> dilfridge@gentoo.org
> Gentoo Linux developer
> (council, toolchain, base-system, perl, libreoffice)

[-- Attachment #2: Type: text/html, Size: 1195 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Roy Bamford]

[-- Attachment #1: Type: text/plain, Size: 1242 bytes --]

On 2019.07.01 21:10, Alec Warner wrote:
> On Mon, Jul 1, 2019 at 12:44 PM Andreas K. Huettel
> <dilfridge@gentoo.org>
> wrote:
> 
> > Am Montag, 1. Juli 2019, 21:42:29 CEST schrieb Andreas K. Huettel:
> > [...]
> >
> > Oh and btw, I found all this out by less than 5min of googling.
> > Puh--leeease.
> >
> 
> I have a list of about 20 umbrella organizations that we should be
> contacting, I don't really expect to have a discussion about them on
> the
> list until we produce a report with our findings.
> I'm happy to publish the list; maybe we are missing some of them.
> 
> -A
> 
> 
> >
> > --
> > Andreas K. Hüttel
> > dilfridge@gentoo.org
> > Gentoo Linux developer
> > (council, toolchain, base-system, perl, libreoffice)
> 

We are getting into the weeds when my question to council candidates
was along the lines of in the event the Foundation is dissolved, who 
or what group will manage the financial responsibility that will remain with
Gentoo?

So far, there have been answers to that from only two candidates.

Gentoo needs to plan for that. The Foundation could be gone by 
30 June 2020.

-- 
Regards,

Roy Bamford
(Neddyseagoon) a member of
elections
gentoo-ops
forum-mods
arm64

[-- Attachment #2: Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[desultory]

On 07/01/19 07:59, Rich Freeman wrote:
> On Mon, Jul 1, 2019 at 1:02 AM desultory <desultory@gentoo.org> wrote:
>>
>> publishing PII purely on the basis of disciplinary
>> considerations could be quite reasonably considered to be an outrageous
>> overreach. There are reasons that "doxing" is generally considered to be
>> rather reprehensible.
> 
> It obviously is reprehensible.  However, nobody is suggesting
> publishing PII for any reason, and I have no idea where this idea even
> came from.
> 
How, exactly, is a requirement to provide and publish "legal name as a
natural person, i.e., the name that would appear in a government issued
document" [GLEP76] not a requirement to publish persona data [PII]?
Though, I suppose GLEP 76 is not "suggesting" anything.

> For the sake of clarity, I do not believe that Gentoo should publish
> PII collected confidentially for any reason.
> 
On that much, we agree. Well, modulo when it is actually legally required.

> Furthermore, I do not think that Gentoo should be collecting PII under
> conditions of confidentiality for any reason in the first place.  Nor
> should we be doing any activities that require us to do so, such as
> accepting money from people, or paying people.  IMO we do not have the
> demonstrated ability to do this in a safe and compliant manner, and we
> have a history of not performing legally-required activities in a
> compliant manner.
> 
Too late, Gentoo has multiple services which collect some form of PII
(e.g. the EU considers an IP address to be, at least potentially, PII),
and retain at least some of that data without publishing it.

> For this reason, I think it would be a big mistake to allow people to
> contribute under pseudonyms under the condition that they reveal their
> real identities to some Gentoo body that would retain this information
> in confidentiality.  That would expose Gentoo to a rather large number
> of privacy laws in a large number of places, for IMO little gain.
> 
So, under the mistaken premise that Gentoo does not collect or retain
any form of PII you believe that Gentoo should not collect or retain any
PII, correct?

Knowing that Gentoo does indeed collect and retain some PII, does your
opinion change? And no, not collecting any PII, at all, ever is not a
practical solution to "replace" the cases where it is presently
collected and retained.

> None of this is a risk with GLEP 76 as it currently stands.  People
> who wish to contribute code to Gentoo must divulge their names.  They
> can choose to do this, or not, and if they choose not to, then their
> contributions will not be accepted.  If they do, then Gentoo doesn't
> have any private information they have to safeguard, because it has
> been made public by the person it pertains to.  There is no database
> of PII that we have to make accessible to people we already barely
> know scattered around the world, but protect from exposure via hacking
> attacks/etc.
> 
LDAP, though most of that data is now published in some form it is still
by and large a collection of PII.

> None of this is intended as some kind of attack on Trustees/Infra/etc.
> They're volunteers doing the best they can do without pay, and
> generally trying to clean up after a long period of neglect.  It is
> simply a fact that if you have nothing to steal, then it is impossible
> to steal it, and no effort is required to protect it.
> 
Believing that you have nothing worth stealing is no defense against
those who believe that you do and intend to take it.

Note that in this message I am addressing only the the points you raised
in regard to the comments which you quoted out of context. And,
diverting as it may be to have your attention so squarely focused on
part of one point, I would very much appreciate it if you would address
the other concerns I mentioned in that e-mail. Most especially I would
appreciate clarification on why your arguments appear to completely
discount introverted individuals, is it a disbelief in their existence,
in the value of their work, or mere oversight? Also, would you be so
kind as to either respond to the whole of the comment you took out of
context or, better still, the entire message?

[GLEP76] https://www.gentoo.org/glep/glep-0076.html
[PII] https://en.wikipedia.org/wiki/Personal_data

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Rich Freeman]

On Tue, Jul 2, 2019 at 12:24 AM desultory <desultory@gentoo.org> wrote:
>
> On 07/01/19 07:59, Rich Freeman wrote:
> > On Mon, Jul 1, 2019 at 1:02 AM desultory <desultory@gentoo.org> wrote:
> >>
> >> publishing PII purely on the basis of disciplinary
> >> considerations could be quite reasonably considered to be an outrageous
> >> overreach. There are reasons that "doxing" is generally considered to be
> >> rather reprehensible.
> >
> > It obviously is reprehensible.  However, nobody is suggesting
> > publishing PII for any reason, and I have no idea where this idea even
> > came from.
> >
> How, exactly, is a requirement to provide and publish "legal name as a
> natural person, i.e., the name that would appear in a government issued
> document" [GLEP76] not a requirement to publish persona data [PII]?

It isn't an issue if the person involved publishes itself and Gentoo
is merely the medium, IMO.

> > Furthermore, I do not think that Gentoo should be collecting PII under
> > conditions of confidentiality for any reason in the first place.  Nor
> > should we be doing any activities that require us to do so, such as
> > accepting money from people, or paying people.  IMO we do not have the
> > demonstrated ability to do this in a safe and compliant manner, and we
> > have a history of not performing legally-required activities in a
> > compliant manner.
> >
> Too late, Gentoo has multiple services which collect some form of PII
> (e.g. the EU considers an IP address to be, at least potentially, PII),
> and retain at least some of that data without publishing it.

I said that I don't think that it should be.  I never claimed that it wasn't.

> > For this reason, I think it would be a big mistake to allow people to
> > contribute under pseudonyms under the condition that they reveal their
> > real identities to some Gentoo body that would retain this information
> > in confidentiality.  That would expose Gentoo to a rather large number
> > of privacy laws in a large number of places, for IMO little gain.
> >
> So, under the mistaken premise that Gentoo does not collect or retain
> any form of PII you believe that Gentoo should not collect or retain any
> PII, correct?

I never said that Gentoo doesn't collect PII.  I said it shouldn't.
And it shouldn't.

> Knowing that Gentoo does indeed collect and retain some PII, does your
> opinion change?

No.  Obviously whatever PII we do collect needs to be properly
protected, just as we ought to be filing taxes and doing various other
things that we have trouble doing.

In both cases the problem can simply be avoided by structuring
ourselves in a manner that doesn't introduce the burden of compliance.

> LDAP, though most of that data is now published in some form it is still
> by and large a collection of PII.

We should not collect non-public PII in LDAP.  There is no harm in
allowing individuals to freely list their names/locations/etc if they
wish, but we shouldn't have anything in the database, other than
passwords or similar credentials, which isn't just published on the
website.  Hence there should be nothing to steal (well, other than
passwords, and those are useless after they are changed).

As I understand it we've already been pushing to eliminate much of the
PII from LDAP as it is - I'm curious as to what still remains that
would be of concern.  In particular I believe the birthdate field was
dropped some time ago.  Much of the rest gets published in the
directory/etc and so it isn't anything that isn't open to see.

> > None of this is intended as some kind of attack on Trustees/Infra/etc.
> > They're volunteers doing the best they can do without pay, and
> > generally trying to clean up after a long period of neglect.  It is
> > simply a fact that if you have nothing to steal, then it is impossible
> > to steal it, and no effort is required to protect it.
>
> Believing that you have nothing worth stealing is no defense against
> those who believe that you do and intend to take it.

I never claimed that we should shield ourselves with "belief."  I said
we shouldn't have anything to steal in the first place.

Sure, that won't stop people from trying.  It will definitely stop
them from succeeding.

-- 
Rich

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 1199 bytes --]

On 7/1/19 11:14 PM, Roy Bamford wrote:
> We are getting into the weeds when my question to council candidates
> was along the lines of in the event the Foundation is dissolved, who 
> or what group will manage the financial responsibility that will remain with
> Gentoo?
> 
> So far, there have been answers to that from only two candidates.
> 
> Gentoo needs to plan for that. The Foundation could be gone by 
> 30 June 2020.

There are too many uncertainties on how an alternative structure looks
to really comment on the question comprehensively, but I'm not worried
about the council directing payment instructions to the umbrella org,
likely via a council-specified contact. In all fairness, in many ways it
is an issue that Gentoo doesn't use more money than it already does,
mainly since it is based on incoming proposals for activities. I'd be
very happy to see more good proposals come along for events etc and be
part of voting for it in council (I really doubt the end result will
differ anything from today's on that).

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[desultory]

On 07/02/19 07:57, Rich Freeman wrote:
> On Tue, Jul 2, 2019 at 12:24 AM desultory <desultory@gentoo.org> wrote:
>>
>> On 07/01/19 07:59, Rich Freeman wrote:
>>> On Mon, Jul 1, 2019 at 1:02 AM desultory <desultory@gentoo.org> wrote:
>>>>
>>>> publishing PII purely on the basis of disciplinary
>>>> considerations could be quite reasonably considered to be an outrageous
>>>> overreach. There are reasons that "doxing" is generally considered to be
>>>> rather reprehensible.
>>>
>>> It obviously is reprehensible.  However, nobody is suggesting
>>> publishing PII for any reason, and I have no idea where this idea even
>>> came from.
>>>
>> How, exactly, is a requirement to provide and publish "legal name as a
>> natural person, i.e., the name that would appear in a government issued
>> document" [GLEP76] not a requirement to publish persona data [PII]?
> 
> It isn't an issue if the person involved publishes itself and Gentoo
> is merely the medium, IMO.
> 
In effect, so long as you can get some people to do it, the rest don't
matter. Is that really such a good stance for an organization which is
chronically in search of additional volunteers?

>>> Furthermore, I do not think that Gentoo should be collecting PII under
>>> conditions of confidentiality for any reason in the first place.  Nor
>>> should we be doing any activities that require us to do so, such as
>>> accepting money from people, or paying people.  IMO we do not have the
>>> demonstrated ability to do this in a safe and compliant manner, and we
>>> have a history of not performing legally-required activities in a
>>> compliant manner.
>>>
>> Too late, Gentoo has multiple services which collect some form of PII
>> (e.g. the EU considers an IP address to be, at least potentially, PII),
>> and retain at least some of that data without publishing it.
> 
> I said that I don't think that it should be.  I never claimed that it wasn't.
> 
You based your argument on your preference, as opposed to reality. The
reality is that it does, and that there is no practical way to avoid it
entirely. Accepting and providing payments are fairly basic operations
for legal entities to engage in, even if the foundation were to be
dissolved there would still be financial transactions apropos Gentoo.
Not to mention that accepting and providing payments are hardly the only
areas in which PII is exchanged and/or retained. Having a preference
does not change reality; treating that preference as reality when it is
counter to reality is, at best, unproductive.

>>> For this reason, I think it would be a big mistake to allow people to
>>> contribute under pseudonyms under the condition that they reveal their
>>> real identities to some Gentoo body that would retain this information
>>> in confidentiality.  That would expose Gentoo to a rather large number
>>> of privacy laws in a large number of places, for IMO little gain.
>>>
>> So, under the mistaken premise that Gentoo does not collect or retain
>> any form of PII you believe that Gentoo should not collect or retain any
>> PII, correct?
> 
> I never said that Gentoo doesn't collect PII.  I said it shouldn't.
> And it shouldn't.
> 
How, exactly, would this work in practice?

>> Knowing that Gentoo does indeed collect and retain some PII, does your
>> opinion change?
> 
> No.  Obviously whatever PII we do collect needs to be properly
> protected, just as we ought to be filing taxes and doing various other
> things that we have trouble doing.
> 
Are you deliberately implying that Gentoo has systemic problems with
maintaining user confidentiality where required? If so, why?

> In both cases the problem can simply be avoided by structuring
> ourselves in a manner that doesn't introduce the burden of compliance.
> 
Again, you claim that it is a simple matter to restructure services to
avoid any retention of PII or the need to comply with regulations
regarding PII, and again, I ask you to detail your simple plan. Or at
least license the patents to allow Gentoo services to use them.

>> LDAP, though most of that data is now published in some form it is still
>> by and large a collection of PII.
> 
> We should not collect non-public PII in LDAP.  There is no harm in
> allowing individuals to freely list their names/locations/etc if they
> wish, but we shouldn't have anything in the database, other than
> passwords or similar credentials, which isn't just published on the
> website.  Hence there should be nothing to steal (well, other than
> passwords, and those are useless after they are changed).
> 
Again, you state your preferences as though they take precedence over
reality, while handwaving away any practical considerations, this is not
productive.

Passwords are often considered high value targets for data theft, even
if they "are useless after they are changed". You are familiar with the
common practice of password reuse, aren't you? It is highly deprecated,
and with good reason, but still quite common.

> As I understand it we've already been pushing to eliminate much of the
> PII from LDAP as it is - I'm curious as to what still remains that
> would be of concern.  In particular I believe the birthdate field was
> dropped some time ago.  Much of the rest gets published in the
> directory/etc and so it isn't anything that isn't open to see.
> 
As I noted, and you even included in your quotation, most of the data is
public but not all. Given that this is a public mailing list, I will
leave my description of what unpublished PII is present on LDAP as:
things which are not typically high value for theft, but still
technically PII.

>>> None of this is intended as some kind of attack on Trustees/Infra/etc.
>>> They're volunteers doing the best they can do without pay, and
>>> generally trying to clean up after a long period of neglect.  It is
>>> simply a fact that if you have nothing to steal, then it is impossible
>>> to steal it, and no effort is required to protect it.
>>
>> Believing that you have nothing worth stealing is no defense against
>> those who believe that you do and intend to take it.
> 
> I never claimed that we should shield ourselves with "belief."  I said
> we shouldn't have anything to steal in the first place.
> 
In that case, you are advocating for having no: passwords, password
hashes, private e-mail (including security related correspondence), no
encryption keys, no signing keys, no pre-release code, no closed source
code, no code not meant for release for any reason at all, no
confidential data at all, and probably other things that I neglected to
list. In short, there would need to be an abolition of all services
which were at all secured just to start with complying with your
preferences. Dissolving Gentoo as a functional entity to satisfy your
preferences with regard to the state of Gentoo seems like it would be
rather counterproductive.

> Sure, that won't stop people from trying.  It will definitely stop
> them from succeeding.
> 
While we can both agree that you cannot steal something which does not
exist, you also cannot use it. By your rationale, I appear to be under
the grossly mistaken impression that we are here to make something
useful and make that available to ourselves and others to use by means
of maintaining basic infrastructure by which it is maintained and
supported in addition to the maintenance of the thing itself. Pardon me
while I retain, and even attempt to spread, my delusions.

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation

[desultory]

On 07/01/19 15:34, Andreas K. Huettel wrote:
>>> Yes, I understand that.  However, I still believe that a contract
>>> initiated between CPA and a single small-ish entity such a Gentoo
>>> involves more costs than fees taken by umbrella dedicated to multiple
>>> entities.  Please correct me if I'm wrong.
>>
>> Nobody knows yet. Different umbrellas work differently.
> 
> Sigh. I agree with the second statement. The first one, well...
> 
> Here's the example of SPI (disclaimer, we do not know if they would take us):
> * no direct costs associated
> * 5% deduction from donations for SPI's overhead
> 
> Big Hint, it helps to first research something and then talk / discuss. That's 
> however, rather rare on this list.
> 
Given that the financial reports for the current year are not yet in, it
is entirely true that the costs involved are presently unknown. As, bear
with me here, 5% of an unknown quantity is still an unknown quantity.
Further, comparing a known percentage of an unknown quantity to another
unknown quantity of unknown relative magnitude is an effectively
valueless proposition. So could we please avoid pointlessly belittling
others and their factual comments?

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation - Treasurer Response!

[Robin H. Johnson]

[-- Attachment #1: Type: text/plain, Size: 3093 bytes --]

On Mon, Jul 01, 2019 at 09:34:06PM +0200, Andreas K. Huettel wrote:
> > > Yes, I understand that.  However, I still believe that a contract
> > > initiated between CPA and a single small-ish entity such a Gentoo
> > > involves more costs than fees taken by umbrella dedicated to multiple
> > > entities.  Please correct me if I'm wrong.
> > 
> > Nobody knows yet. Different umbrellas work differently.

The CPA we have engaged so far, Corporate Capital, has a standard
preparation fee of USD1500 per fiscal year. We do have some estimates of
Umbrella fees, plus the Financial Statements I prepared...

> 
> Sigh. I agree with the second statement. The first one, well...
> 
> Here's the example of SPI (disclaimer, we do not know if they would take us):
> * no direct costs associated
> * 5% deduction from donations for SPI's overhead
> 
> Big Hint, it helps to first research something and then talk / discuss. That's 
> however, rather rare on this list.

The Trustees HAVE previously done _some_ of this legwork on the major
umbrellas, I don't have a link to hand, but I do remember details,
because it was in scope of my work as Treasurer; and we can combine
these with the financial statements to compare against the CPA quotes to
date. Further would should take the longer list of Umbrellas and
comprehensively document their costs.

As further concrete example:
https://sfconservancy.org/projects/apply/
>> How much does it cost us financially to join Conservancy?
>> New Conservancy members are required to pay 10% of their revenue

The umbrella fees I've seen range:
- smallest: 5% of net revenue (income less expenses)
- largest: 20% of gross income

The exact definition of which expenses might be included/excluded by a
given umbrella might also vary, I didn't find a clear public
documentation on it.

Basing that on the FY2018 fiscal, with the additional caveat that I
don't have any value assigned to in-kind server/hosting services
received by Infra; That would increase gross & net values.

Gross Income: USD 28,600.15
Gross Expenses: USD 9,292.95 
- Depreciation: USD 3,659.64 (it devalued assets but wasn't something we actually spent)
- "Real" Expense: USD 5,633.31
= Net revenue: USD 22,966.84

5% of net: USD 1,148.34
20% of gross: USD 5,720.03

At an outward glance, this does imply that some umbrellas would be
cheaper than a CPA, while others would be more expensive; but the
equation is more complicated, because we need to be careful about the
accounting of services that the umbrella would provide.

The equation therefore should be more of:
Cost(Umbrella) vs [Umbrella baseline without umbrella-provided expenses]

Regardless of the scale of the numbers, the change would REDUCE the
expenses, and increase the net revenue number (and thus also the
Umbrella's actual fee).

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail   : robbat2@gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 1113 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation - Treasurer Response!

[Michael Everitt]

[-- Attachment #1.1: Type: text/plain, Size: 3167 bytes --]

On 03/07/19 07:12, Robin H. Johnson wrote:
> On Mon, Jul 01, 2019 at 09:34:06PM +0200, Andreas K. Huettel wrote:
>>>> Yes, I understand that.  However, I still believe that a contract
>>>> initiated between CPA and a single small-ish entity such a Gentoo
>>>> involves more costs than fees taken by umbrella dedicated to multiple
>>>> entities.  Please correct me if I'm wrong.
>>> Nobody knows yet. Different umbrellas work differently.
> The CPA we have engaged so far, Corporate Capital, has a standard
> preparation fee of USD1500 per fiscal year. We do have some estimates of
> Umbrella fees, plus the Financial Statements I prepared...
>
>> Sigh. I agree with the second statement. The first one, well...
>>
>> Here's the example of SPI (disclaimer, we do not know if they would take us):
>> * no direct costs associated
>> * 5% deduction from donations for SPI's overhead
>>
>> Big Hint, it helps to first research something and then talk / discuss. That's 
>> however, rather rare on this list.
> The Trustees HAVE previously done _some_ of this legwork on the major
> umbrellas, I don't have a link to hand, but I do remember details,
> because it was in scope of my work as Treasurer; and we can combine
> these with the financial statements to compare against the CPA quotes to
> date. Further would should take the longer list of Umbrellas and
> comprehensively document their costs.
>
> As further concrete example:
> https://sfconservancy.org/projects/apply/
>>> How much does it cost us financially to join Conservancy?
>>> New Conservancy members are required to pay 10% of their revenue
> The umbrella fees I've seen range:
> - smallest: 5% of net revenue (income less expenses)
> - largest: 20% of gross income
>
> The exact definition of which expenses might be included/excluded by a
> given umbrella might also vary, I didn't find a clear public
> documentation on it.
>
> Basing that on the FY2018 fiscal, with the additional caveat that I
> don't have any value assigned to in-kind server/hosting services
> received by Infra; That would increase gross & net values.
>
> Gross Income: USD 28,600.15
> Gross Expenses: USD 9,292.95 
> - Depreciation: USD 3,659.64 (it devalued assets but wasn't something we actually spent)
> - "Real" Expense: USD 5,633.31
> = Net revenue: USD 22,966.84
>
> 5% of net: USD 1,148.34
> 20% of gross: USD 5,720.03
>
> At an outward glance, this does imply that some umbrellas would be
> cheaper than a CPA, while others would be more expensive; but the
> equation is more complicated, because we need to be careful about the
> accounting of services that the umbrella would provide.
>
> The equation therefore should be more of:
> Cost(Umbrella) vs [Umbrella baseline without umbrella-provided expenses]
>
> Regardless of the scale of the numbers, the change would REDUCE the
> expenses, and increase the net revenue number (and thus also the
> Umbrella's actual fee).
>
Thank you very much for providing some indicative figures, and for the work
you have tirelessly done on the Gentoo finances, Robin.

I hope the council considers them wisely.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 801 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation - Treasurer Response!

[Rich Freeman]

On Wed, Jul 3, 2019 at 2:12 AM Robin H. Johnson <robbat2@gentoo.org> wrote:
>
> At an outward glance, this does imply that some umbrellas would be
> cheaper than a CPA, while others would be more expensive; but the
> equation is more complicated, because we need to be careful about the
> accounting of services that the umbrella would provide.
>
> The equation therefore should be more of:
> Cost(Umbrella) vs [Umbrella baseline without umbrella-provided expenses]
>

You also need to consider the tax savings themselves if the umbrella
is 501c3.  That is also a percentage of the net (the CPA costs being
deductible most likely).

You also need to consider services that we would receive that we
currently lack.  After all, Gentoo hasn't spent a dime on CPAs for a
long time, but that was hardly a true savings.

-- 
Rich

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation - Treasurer Response!

[Michael Everitt]

[-- Attachment #1.1: Type: text/plain, Size: 1393 bytes --]

On 03/07/19 11:47, Rich Freeman wrote:
> On Wed, Jul 3, 2019 at 2:12 AM Robin H. Johnson <robbat2@gentoo.org> wrote:
>> At an outward glance, this does imply that some umbrellas would be
>> cheaper than a CPA, while others would be more expensive; but the
>> equation is more complicated, because we need to be careful about the
>> accounting of services that the umbrella would provide.
>>
>> The equation therefore should be more of:
>> Cost(Umbrella) vs [Umbrella baseline without umbrella-provided expenses]
>>
> You also need to consider the tax savings themselves if the umbrella
> is 501c3.  That is also a percentage of the net (the CPA costs being
> deductible most likely).
>
> You also need to consider services that we would receive that we
> currently lack.  After all, Gentoo hasn't spent a dime on CPAs for a
> long time, but that was hardly a true savings.
>
What makes you suggest we need the extra services that would be included by
an umbrella org? What services are you thinking of? If Gentoo hasn't needed
them the past decade, why would they be useful now? What would be the cost
if the Gentoo Foundation Inc procured these services separately? How does
this provide a cost saving? Can you prove this is therefore "better value
for money" if despite having less "expenses" as Robin points out, but
larger net income, and hence larger net fees?


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 801 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[Rich Freeman]

On Wed, Jul 3, 2019 at 12:31 AM desultory <desultory@gentoo.org> wrote:
>
> You based your argument on your preference, as opposed to reality.

This entire thread is about preference.  The reality is that you need
to use your real name to contribute to Gentoo right now.  You would
prefer that it be otherwise.  There is no harm in expressing that.

> Accepting and providing payments are fairly basic operations
> for legal entities to engage in, even if the foundation were to be
> dissolved there would still be financial transactions apropos Gentoo.

If we were operating under an umbrella org, Gentoo would not be
legally responsible for these activities.

Also, I believe that these activities should STILL be minimized,
ideally towards zero.  Physical servers and bank accounts are
vulnerabilities that can be disrupted.  The less you depend on them,
the more resilient you are.

If Gentoo were nothing more than a git repo it would be almost
impossible to disrupt its operations as these are trivially
replicated.  If the services it did run were entirely open they would
be trivially mirrored (I mean open everything - not just the upstream
code, but all our configs/etc - obviously short of the credentials).

Yes, I'm obviously speaking aspirationally, but the principle is still
valid.  IMO FOSS solutions for replacing some of the infra-heavy
existing solutions like bugzilla are lacking, so this could be a long
road.  However, anytime we deploy something new we should be asking
whether any Gentoo user can trivially replicate the entire service
based on our documentation and published data (ideally with a few
lines), ideally including even authentication (no reason a Gentoo
credential shouldn't work on a non-Gentoo site in a world where
federation is common).  If the answer is no, then we're creating a
dependency on some black box that could be taken away from us.

> In that case, you are advocating for having no: passwords, password
> hashes, private e-mail (including security related correspondence), no
> encryption keys, no signing keys, no pre-release code, no closed source
> code, no code not meant for release for any reason at all, no
> confidential data at all, and probably other things that I neglected to
> list.

None of those are really PII.  However, we should certainly be
minimizing our dependence on all of these.  We should depend on actual
PII even less, and I'm skeptical that we need to retain this at all if
we stop operating a legal entity.

I'm not saying that we'll ever reach zero, but anytime we can
accomplish our goals without resorting to using the laundry list of
stuff you just provided, we should.

-- 
Rich

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation - Treasurer Response!

[Rich Freeman]

On Wed, Jul 3, 2019 at 7:05 AM Michael Everitt <m.j.everitt@iee.org> wrote:
>
> On 03/07/19 11:47, Rich Freeman wrote:
> > You also need to consider services that we would receive that we
> > currently lack.  After all, Gentoo hasn't spent a dime on CPAs for a
> > long time, but that was hardly a true savings.
> >
> What makes you suggest we need the extra services that would be included by
> an umbrella org? What services are you thinking of?

Well, I'm not the one going on endlessly about how Gentoo doesn't
consult lawyers often enough and that only lawyers can understand the
law...  :)

> What would be the cost
> if the Gentoo Foundation Inc procured these services separately? How does
> this provide a cost saving?

I suspect that the tax savings alone would pay for moving to an
umbrella org.  Savings on a CPA would be on top of that.  At that
point any additional services are basically "free."

However, I suspect that due to economies of scale it will still cost
less to get these other services through an umbrella than to buy them
ourselves.

As you say, though, you could certainly compare the costs, and I'm not
suggesting that this can't be done.

> Can you prove this is therefore "better value
> for money" if despite having less "expenses" as Robin points out, but
> larger net income, and hence larger net fees?

Having more net income might mean more fees, but since fees are a
percentage of income, it is a net benefit all the same.

Sure, if we have $5000 more to work with, we might end up spending an
extra $500 in fees, but that still leaves us off $4500 better than we
are today.

Certainly it would be beneficial to look at actual numbers, but I'm
dubious that these sorts of percentage-based solutions are going to
cost more than what we're spending already.  They also have the
benefit that anytime our income is reduced our overhead is
automatically reduced in kind, as opposed to with doing it ourselves
where the CPA probably costs the same whether we lose half our income
or not.

-- 
Rich

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation - Treasurer Response!

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 1294 bytes --]

On 7/3/19 12:47 PM, Rich Freeman wrote:
> On Wed, Jul 3, 2019 at 2:12 AM Robin H. Johnson <robbat2@gentoo.org> wrote:
>> At an outward glance, this does imply that some umbrellas would be
>> cheaper than a CPA, while others would be more expensive; but the
>> equation is more complicated, because we need to be careful about the
>> accounting of services that the umbrella would provide.
>>
>> The equation therefore should be more of:
>> Cost(Umbrella) vs [Umbrella baseline without umbrella-provided expenses]
>>
> You also need to consider the tax savings themselves if the umbrella
> is 501c3.  That is also a percentage of the net (the CPA costs being
> deductible most likely).

It depends on the type of income, iirc e.g GSoC wouldn't be tax exempt
in either case. Same for royalties from sale of merchandise

> 
> You also need to consider services that we would receive that we
> currently lack.  After all, Gentoo hasn't spent a dime on CPAs for a
> long time, but that was hardly a true savings.

Also needs to account for potentially higher future earnings, we haven't
actually been doing active fundraising.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation - Treasurer Response!

[Rich Freeman]

On Wed, Jul 3, 2019 at 7:27 AM Kristian Fiskerstrand <k_f@gentoo.org> wrote:
>
> On 7/3/19 12:47 PM, Rich Freeman wrote:
> > You also need to consider the tax savings themselves if the umbrella
> > is 501c3.  That is also a percentage of the net (the CPA costs being
> > deductible most likely).
>
> It depends on the type of income, iirc e.g GSoC wouldn't be tax exempt
> in either case. Same for royalties from sale of merchandise

Certainly some forms of income aren't tax-exempt, and we should
definitely get a professional opinion on this.  However, have you seen
anything to suggest GSoC specifically is taxable?

I have been skimming the IRS materials, and in their training on the
subject they specifically bring up the example of a once-a-year food
stand that generates income at a conference, and that it wouldn't be
taxable because it isn't "regular" income, being only once a year and
doesn't really compete with a normal business that would be open every
day [1].  However, I don't profess to be an expert on IRS tax law.

It is probably a good idea to consider that some income will be
taxable.  Of course, it is still only net profits that are taxable, so
any GSoC money spent on GSoC itself wouldn't be net-taxable even if
the overall income would be (at least, that is my understanding).

And of course if we were using an umbrella org the org itself would
have its compliance staff make these determinations and have rules
around this stuff.  We wouldn't need to develop our own expertise and
chances are their staff could also make recommendations on how to
structure activities to minimize tax burden.  If they're charging
based on net income then it would be in their interests to minimize
our taxes anyway.

>
> >
> > You also need to consider services that we would receive that we
> > currently lack.  After all, Gentoo hasn't spent a dime on CPAs for a
> > long time, but that was hardly a true savings.
>
> Also needs to account for potentially higher future earnings, we haven't
> actually been doing active fundraising.

I have mixed feelings on this.  Numbers-wise you're right - if some
professional umbrella org gets a shared of anything donated to
"Gentoo" they're going to be out there advocating for people to donate
to "Gentoo."  As a result "Gentoo" will probably end up with a lot
more money.  On the surface this seems like a good thing.  On the
other hand, I do get concerned about what effect this could have on
the community and atmosphere of the project.

This is part of why I advocate for trying to reduce our dependency on
money and servers and so on.  These things all potentially come with
strings attached, and I'd prefer to be more dependent on the goodwill
of our code contributors than the goodwill of our
financial/sponsorship contributors.  I feel like a lot of bigger FOSS
projects eventually reach a point where the people in charge end up
with the opposite concerns - where they prefer all the core stuff to
be paid so that they don't have to worry as much about the rank and
file deciding they don't like the people in charge.

As much as we have disagreements around here, I think that those in
charge are very much community-oriented in their roots.  Some might
disagree, but I'd caution that to the degree that some disagree, the
professional managers that come with big budgets are going to be FAR
less to your liking.

1 - https://www.stayexempt.irs.gov/home/existing-organizations/unrelated-business-income


--
Rich

Re: [gentoo-nfp] Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation - Treasurer Response!

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 818 bytes --]

On Wed, 2019-07-03 at 06:12 +0000, Robin H. Johnson wrote:
> On Mon, Jul 01, 2019 at 09:34:06PM +0200, Andreas K. Huettel wrote:
> > > > Yes, I understand that.  However, I still believe that a contract
> > > > initiated between CPA and a single small-ish entity such a Gentoo
> > > > involves more costs than fees taken by umbrella dedicated to multiple
> > > > entities.  Please correct me if I'm wrong.
> > > 
> > > Nobody knows yet. Different umbrellas work differently.
> 
> The CPA we have engaged so far, Corporate Capital, has a standard
> preparation fee of USD1500 per fiscal year.

Does this cover everything 'standard', or are there additional potential
fees involved?  Are you aware if the fee is going to be the same if we
go for proper non-profit?

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-nfp] Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation - Treasurer Response!

[Rich Freeman]

On Wed, Jul 3, 2019 at 8:56 AM Michał Górny <mgorny@gentoo.org> wrote:
>
> Are you aware if the fee is going to be the same if we
> go for proper non-profit?

Do you mean 501c3 by "proper non-profit?"  Or some other tax-exempt status?

I think most around here have abandoned all hope of ever running our
own 501c3.  A number don't even think we should try, and a 501c3 is
hard enough to get approved if you have a professional board all
towing the party line.  If you get people making public statements
like we ought to be a trade association (which is non-exempt) it would
be even harder.

However, I imagine most CPAs would charge more for a tax-exempt org as
there is MUCH more scrutiny on their operations.  I'd also argue that
we would need to be spending more on compliance in general or
consulting ad-hoc with professionals to not run afoul of the law.

If you meant a non-profit that isn't tax-exempt then I don't see why
their fees would be any different, but there really isn't any big tax
benefit to Gentoo to having one status or another as far as I can
tell.  The IRS taxes non-profits the same as for-profit companies if
they aren't tax-exempt.  It is the exempt status that comes with all
the rules and scrutiny.

Usually in the US when people say "non-profit" they tend to mean a
tax-exempt status like 501c3, but these are of course not the only
sorts of non-profit companies.  The US National Football League (the
kind where you usually don't hit the ball with your foot) is
non-profit, but definitely not tax-exempt, and I can only imagine what
their revenues are like.

-- 
Rich

Re: [gentoo-nfp] Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation - Treasurer Response!

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 385 bytes --]

On Wed, 2019-07-03 at 09:08 -0400, Rich Freeman wrote:
> On Wed, Jul 3, 2019 at 8:56 AM Michał Górny <mgorny@gentoo.org> wrote:
> > Are you aware if the fee is going to be the same if we
> > go for proper non-profit?
> 
> Do you mean 501c3 by "proper non-profit?"  Or some other tax-exempt status?

I meant anything that's tax-exempt.

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation - Treasurer Response!

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 3432 bytes --]

On 7/3/19 2:27 PM, Rich Freeman wrote:
> On Wed, Jul 3, 2019 at 7:27 AM Kristian Fiskerstrand <k_f@gentoo.org> wrote:
>>
>> On 7/3/19 12:47 PM, Rich Freeman wrote:
>>> You also need to consider the tax savings themselves if the umbrella
>>> is 501c3.  That is also a percentage of the net (the CPA costs being
>>> deductible most likely).
>>
>> It depends on the type of income, iirc e.g GSoC wouldn't be tax exempt
>> in either case. Same for royalties from sale of merchandise
> 
> Certainly some forms of income aren't tax-exempt, and we should
> definitely get a professional opinion on this.  However, have you seen
> anything to suggest GSoC specifically is taxable?
> 
[...]

Not really. Arguably Gentoo is in the business of producing code, to
receive monetary considerations for doing so is a related activity and
not a spurious one, we also have (or have had) mentor projects etc that
could be used to argue this case. I don't know, but if it is, it is a
more significant taxable income than most other we have which is why I
listed it first; the CPA/IRS which specialize in this under US tax law
will figure it out for us. But I agree that the merchandise is a cleaner
example, although not as regular and somewhat declining.

> It is probably a good idea to consider that some income will be 
> taxable.  Of course, it is still only net profits that are taxable
, so
> any GSoC money spent on GSoC itself wouldn't be net-taxable even if 
> the overall income would be (at least, that is my understanding).

Right, although there aren't that many expenditures related to GSoC.

> 
> And of course if we were using an umbrella org the org itself would
> have its compliance staff make these determinations and have rules
> around this stuff.  We wouldn't need to develop our own expertise and
> chances are their staff could also make recommendations on how to
> structure activities to minimize tax burden.  If they're charging
> based on net income then it would be in their interests to minimize
> our taxes anyway.

CPA would help us out in the case of foundation, iirc some tax forms
needs to be filled out related to payment from google as well, but I
haven't read these forms, they might shine some light on the
interpretations :)

>>
>> Also needs to account for potentially higher future earnings, we haven't
>> actually been doing active fundraising.
> 
> I have mixed feelings on this.  Numbers-wise you're right - if some
> professional umbrella org gets a shared of anything donated to
> "Gentoo" they're going to be out there advocating for people to donate
> to "Gentoo."  As a result "Gentoo" will probably end up with a lot
> more money.  On the surface this seems like a good thing.  On the
> other hand, I do get concerned about what effect this could have on
> the community and atmosphere of the project.
> 
> This is part of why I advocate for trying to reduce our dependency on
> money and servers and so on.  These things all potentially come with
> strings attached, and I'd prefer to be more dependent on the goodwill
> of our code contributors than the goodwill of our


Its an interesting point, but I personally don't agree, the discussion
is really too broad to take atm :)


-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-nfp] Re: [gentoo-project] Questions for Gentoo Council nominees: Gentoo Foundation - Treasurer Response! (part 2)

[Robin H. Johnson]

[-- Attachment #1: Type: text/plain, Size: 3569 bytes --]

(Apologies to the -nfp list, but I missed sending this to both -nfp and
-project the first time, and since it concerns the Council election, I
felt it important enough to resend. If everybody else could try to
include a header containing
Reply-To: gentoo-nfp@lists.gentoo.org, gentoo-project@lists.gentoo.org 
in the thread, I think it would help overall)

On Wed, Jul 03, 2019 at 10:41:36PM +0200, Michał Górny wrote:
> > > The fees remain the same for a c3 (1500 per year).  We've talked to the
> > > Accounting firm about our options in attaining c3 status.  There are a
> > > couple of ways we could go about it.  Filing fee remains the same (~1k
> > > iirc) for all options.
> > > 
> > > 1. fix all back taxes (10 years) then refile, this would cost 9k more
> > > for the back taxes alone (4 years was recently approved).
> > > 
> > 
> > Plus $15000 in CPA fees, correct?  Or do we assume a different fee for
> > that part?
> > 
> 
> Ok, Matthew corrected me on IRC.  He meant $9k of CPA fees for
> the remaining 6 of 10 years.
In my previous email, "Motion: approve preparation costs for tax filings
FY2016-FY2019", I covered my estimate of the
taxes/interest/penalties/fines that I expected for the FY2016-FY2018
periods (a total of USD9,300.00, on top of the preparation costs of
USD4,500 for those 3 years; the Motion included FY2019 that I omit
temporarily here).

For the further 6 years back:
- Preparation: 6x USD1500 = USD9,000.00
- Taxes/Interest/Penalties/Fines: USD16,000.00
Which gives a total of USD 25,000

The comparison quote from Corporate Capital, for preparation & legal
costs, to create new 501cX for Gentoo, is USD 2,500.

This doesn't include the filing fees, which prometheanfire estimating
around USD 1,000, but would vary greatly depending on which state we
filed in. I think that estimate might be as high as USD 2,000.00
depending on other states, with further traps of ongoing costs (Some
states effectively have state or local taxes even on NFP incomes)

The order of operations for the new org would be approximately:
- prepare state-level filings to start a new NFP
- file to state & wait for response
- file to IRS, initial stuff
- wait N years [depends on the exact NFP structure]
- file to IRS, later stuff

I do agree that the wind-up of the old 501c6 could happen in parallel,
with the donation made to the new entity

Another short-term reason AGAINST our own 501c3 are the donation
structure requirements, that are meant to ensure a diversity of donors.
FreeBSD ran into this in 2004:
https://web.archive.org/web/20050112120244/http://www.freebsdfoundation.org/press/20041221-newsletter.shtml
"The FreeBSD Foundation's 501(c)3 Status"

The Gentoo Foundation DOES presently have one large cash donor, who
would presently cause us to fail the 1/3rd test.

The proposal of doing a large donation from the old Foundation to a new
Foundation could ALSO violate the 1/3rd test, so doing the donations
over time might be needed (I'd literally start taking new donations, and
at the end of every month, have the old foundation make the maximum
possible donation that wouldn't violate the 2% clause on the 1/3rd
test). The old Foundation would also continue to pay expenses out of the
accounts, to reduce the need to shift amounts over.

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail   : robbat2@gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 1113 bytes --]

[gentoo-project] Questions for Gentoo Council nominees: Council demands on maintainers & council legal liability

[Robin H. Johnson]

[-- Attachment #1: Type: text/plain, Size: 1330 bytes --]

I realize that there is only a short period left in the election, but
I've been busy with IRL issues, and mgorny's trustee manifesto [1] ascribed
something to the Council members that concerned me; there's one
additional good question for the Council that I'll close with.

1. Points 1a&1c of mgorny's manifesto imply that the council can
   unilaterally prevent support of any given package in Gentoo, and
   basically remove the package from the distribution.

   This is despite any developers that may wish to support the package.

   What's your opinion of the council using this offensively against
   packages? As a hypothetical, say systemd-ng comes about, with an even
   worse opinionated choices than those presently in systemd. Should the
   council be able to force support for openrc & systemd stop?

2. As an additional point, can you try to give your version of a simple
   statement on the legal liabilities that the Council as a whole, and
   the Council members as individuals, have for their actions?

[1] https://dev.gentoo.org/~mgorny/trustee-manifesto-2019.txt

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail   : robbat2@gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 1113 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[desultory]

On 07/03/19 07:13, Rich Freeman wrote:
> On Wed, Jul 3, 2019 at 12:31 AM desultory <desultory@gentoo.org> wrote:
>>
>> You based your argument on your preference, as opposed to reality.
> 
> This entire thread is about preference.  The reality is that you need
> to use your real name to contribute to Gentoo right now.  You would
> prefer that it be otherwise.  There is no harm in expressing that.
> 
That "reality" is, once again, not real. Sure, there is the (practically
unverifiable) requirement for signing off commits, but that is hardly
the only way to contribute to Gentoo right now.

>> Accepting and providing payments are fairly basic operations
>> for legal entities to engage in, even if the foundation were to be
>> dissolved there would still be financial transactions apropos Gentoo.
> 
> If we were operating under an umbrella org, Gentoo would not be
> legally responsible for these activities.
> 
> Also, I believe that these activities should STILL be minimized,
> ideally towards zero.  Physical servers and bank accounts are
> vulnerabilities that can be disrupted.  The less you depend on them,
> the more resilient you are.
> 
Again, I ask: how?

> If Gentoo were nothing more than a git repo it would be almost
> impossible to disrupt its operations as these are trivially
> replicated.  If the services it did run were entirely open they would
> be trivially mirrored (I mean open everything - not just the upstream
> code, but all our configs/etc - obviously short of the credentials).
> 
If Gentoo were nothing more than a git repo it would be almost useless.
No bug tracking, no integrated communications channels beyond various
forms of repo abuse, no user support, no mailing lists, no bespoke
package manager, no non-trivial analogs of e.g. eselect, not even
documentation outside of a git repo. On the plus side, there would
likely be next to no pesky users either.

> Yes, I'm obviously speaking aspirationally, but the principle is still
> valid.  IMO FOSS solutions for replacing some of the infra-heavy
> existing solutions like bugzilla are lacking, so this could be a long
> road.  However, anytime we deploy something new we should be asking
> whether any Gentoo user can trivially replicate the entire service
> based on our documentation and published data (ideally with a few
> lines), ideally including even authentication (no reason a Gentoo
> credential shouldn't work on a non-Gentoo site in a world where
> federation is common).  If the answer is no, then we're creating a
> dependency on some black box that could be taken away from us.
> 
As with most principles, what validity it has only extends to a point
and that point s far and away exceeded by what could loosely be termed
your proposals (given that there are no details beyond handwaving away
all practical considerations). By your argument, virtually everything
hosted on Gentoo controlled infra is a liability, not just bugzilla, but
the mailing lists (especially -core), developer mail in general, the
forums, the wiki, even your reductive case of gentoo.git would bear some
"black box".

>> In that case, you are advocating for having no: passwords, password
>> hashes, private e-mail (including security related correspondence), no
>> encryption keys, no signing keys, no pre-release code, no closed source
>> code, no code not meant for release for any reason at all, no
>> confidential data at all, and probably other things that I neglected to
>> list.
> 
> None of those are really PII.  However, we should certainly be
> minimizing our dependence on all of these.  We should depend on actual
> PII even less, and I'm skeptical that we need to retain this at all if
> we stop operating a legal entity.
> 
Having "nothing to steal" means having nothing that other people value,
not just not having one specific class of things other people might value.

Bearing in mind that none of the things I listed are at all specific to
the foundation; how, exactly, would not having a legal entity (good luck
with enforcing  and defending licensing and the use of marks, among
other things) remove the need to have any of the things I listed? Any
given one, your choice, how would an existing need for it go away
without a legal entity?

> I'm not saying that we'll ever reach zero, but anytime we can
> accomplish our goals without resorting to using the laundry list of
> stuff you just provided, we should.
> 
While having preferences for lighter and more open systems is, to an
extent, something toward which one can work, the degree of purity
testing that you are implying is a virtually guaranteed path to extinction.

Re: [gentoo-project] Questions for Gentoo Council nominees: Council demands on maintainers & council legal liability

[Michał Górny]

[-- Attachment #1: Type: text/plain, Size: 1555 bytes --]

On Thu, 2019-07-04 at 02:14 +0000, Robin H. Johnson wrote:
> I realize that there is only a short period left in the election, but
> I've been busy with IRL issues, and mgorny's trustee manifesto [1] ascribed
> something to the Council members that concerned me; there's one
> additional good question for the Council that I'll close with.
> 
> 1. Points 1a&1c of mgorny's manifesto imply that the council can
>    unilaterally prevent support of any given package in Gentoo, and
>    basically remove the package from the distribution.
> 
>    This is despite any developers that may wish to support the package.

For the record, I think you are ascribing to me something I didn't mean.
Sure, Council can adjust the direction distribution takes (= decide
on the default, suggest developers what to work on) but I don't see it
as completely blocking support for anything.  My examples were rather
exaggerated.

> 
>    What's your opinion of the council using this offensively against
>    packages? As a hypothetical, say systemd-ng comes about, with an even
>    worse opinionated choices than those presently in systemd. Should the
>    council be able to force support for openrc & systemd stop?
> 
> 2. As an additional point, can you try to give your version of a simple
>    statement on the legal liabilities that the Council as a whole, and
>    the Council members as individuals, have for their actions?
> 
> [1] https://dev.gentoo.org/~mgorny/trustee-manifesto-2019.txt
> 

-- 
Best regards,
Michał Górny


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Council demands on maintainers & council legal liability

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 1967 bytes --]

On 7/4/19 4:14 AM, Robin H. Johnson wrote:
> I realize that there is only a short period left in the election, but
> I've been busy with IRL issues, and mgorny's trustee manifesto [1] ascribed
> something to the Council members that concerned me; there's one
> additional good question for the Council that I'll close with.
> 
> 1. Points 1a&1c of mgorny's manifesto imply that the council can
>    unilaterally prevent support of any given package in Gentoo, and
>    basically remove the package from the distribution.
> 
>    This is despite any developers that may wish to support the package.
> 
>    What's your opinion of the council using this offensively against
>    packages? As a hypothetical, say systemd-ng comes about, with an even
>    worse opinionated choices than those presently in systemd. Should the
>    council be able to force support for openrc & systemd stop?

Its definitely within the purview of the council to do it, but in most
cases Gentoo is about flexibility so you don't want to. There are
scenarios where you would have to consider it, though, e.g large impacts
on others work (project out of scope), security issues , etc
> 
> 2. As an additional point, can you try to give your version of a simple
>    statement on the legal liabilities that the Council as a whole, and
>    the Council members as individuals, have for their actions?
> 

Council is no legal entity, so there is no as a whole, the individual
legal liability is somewhat limited as there is no fiduciary duty etc
arising due to this; which means no negligence claims etc.. So basically
you're left with whatever else you can be sued for as an individual, but
you're in a more profiled position so it is possibly more likely that
you will face it by some angry internet people...


-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Council demands on maintainers & council legal liability

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 4982 bytes --]

On 2019-07-04 04:14, Robin H. Johnson wrote:
> I realize that there is only a short period left in the election, but
> I've been busy with IRL issues, and mgorny's trustee manifesto [1] ascribed
> something to the Council members that concerned me; there's one
> additional good question for the Council that I'll close with.
> 
> 1. Points 1a&1c of mgorny's manifesto imply that the council can
>    unilaterally prevent support of any given package in Gentoo, and
>    basically remove the package from the distribution.
> 
>    This is despite any developers that may wish to support the package.
> 
>    What's your opinion of the council using this offensively against
>    packages? As a hypothetical, say systemd-ng comes about, with an even
>    worse opinionated choices than those presently in systemd. Should the
>    council be able to force support for openrc & systemd stop?

My understanding of the council is, that the council itself is 'passive'
and isn't responsible for developing/pushing new visions/ideas just
because it is the council. That means that the council, representing the
community, will *only* vote on behalf of the community on motions the
community brought up. Of course because any council member is also part
of the community, council members can start a motion like any other
community member. But it will happen without any council hat and
everything must follow the same rules/process (mailing lists...).

Regarding the specific example:
At the moment, and I don't see this changing, any developer is free to
do whatever they want to do in Gentoo as long as they don't break things
and follow Gentoo rules. So if there will be a new init system and
someone wants to support that, he/she is free to do that (as long as
he/she is able to do that across whole repository without violating
Gentoo rules (like QA...). tl;dr "As long as maintainer isn't doing
something crazy").

Only if someone else within community will create a motion that the
proposition should be stopped for $reasons this will become topic for
council. And after following the process, council member will finally
have decide on that motion.

Regarding 1c: It's the money of the foundation. At the moment, council
has no rights to tell foundation how they have to spend the money. As
long as foundation won't change that (for example they could at least
give council one vote for funding requests), we don't really need to
talk about this.


For the records: When I read mgorny's statement I got a different
message in first place. Do you remind the sys-firmware/intel-microcode
license hick hack around ~2018-08-23? As maintainer and as a person with
some insights I *knew* that Intel was going to revert that license
change. Therefore I didn't want to rev bump package for just a few hours
or days to avoid causing unnecessary work for all of us, including
Gentoo users. What happened? A trustee went forward and did that change
on behalf of trustees ("copyright is trustee territory") against my will
[1]. A few hours later, as I had 'predicted', Intel finally publicly
announced that the license change will be reverted and I was able to
revert that commit [2]. The message I got from reading mgorny's
*Trustee* manifesto is, that he doesn't like such an interference (which
will bring us to your second question).


> 2. As an additional point, can you try to give your version of a simple
>    statement on the legal liabilities that the Council as a whole, and
>    the Council members as individuals, have for their actions?

At the moment, council has zero legal liabilities. That's because
council has no legal body. In Gentoo, only the Gentoo foundation has a
legal body. But to my knowledge, foundation doesn't even mention council
in any legal document, i.e. council doesn't exist from foundation's POV
(council is only tolerated) so council currently doesn't have any
official position with legal liabilities.

With this in mind, sure, as trustee with legal obligations for the
foundation no one else has, I understand that you sometimes believe you
must cover your 'ass' because foundation will hold you responsible for
any damage you may cause (this will include damages you don't cause in
first place but could have prevented).
Regarding my example with intel-microcode package: If you as trustee
really believe that Gentoo foundation could be in *real trouble* due to
that license violation... you have to do your thing because if you are
right and didn't do your job, you can be sure that foundation will try
to get their money back from you... assuming board won't get approval of
the actions).


See also:
=========
[1] https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=933df6

[2] https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=db0abe


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Council demands on maintainers & council legal liability

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 1904 bytes --]

>>>>> On Thu, 04 Jul 2019, Thomas Deutschmann wrote:

> For the records: When I read mgorny's statement I got a different
> message in first place. Do you remind the sys-firmware/intel-microcode
> license hick hack around ~2018-08-23? As maintainer and as a person with
> some insights I *knew* that Intel was going to revert that license
> change. Therefore I didn't want to rev bump package for just a few hours
> or days to avoid causing unnecessary work for all of us, including
> Gentoo users.

Sorry, I don't understand. If you knew in advance (how?) that Intel was
going to revert, why had you added an ebuild for that 20180807 snapshot
version with the restrictive terms, in the first place [3]?

Also with the information available at that point, we had to assume that
redistribution of that particular microcode-20180807.tgz tarball was not
allowed, so the ebuild should have had mirror restriction.

>               What happened? A trustee went forward and did that change
> on behalf of trustees ("copyright is trustee territory") against my will
> [1]. A few hours later, as I had 'predicted', Intel finally publicly
> announced that the license change will be reverted and I was able to
> revert that commit [2]. The message I got from reading mgorny's
> *Trustee* manifesto is, that he doesn't like such an interference (which
> will bring us to your second question).

I agree that immediately assigning bug 664134 [4] to Trustees seems a
little strange. Normally, such simple mistakes should be worked out with
the maintainer, and only escalated to Trustees if (e.g.) a decision of
general principle is needed.

Ulrich

> [1] https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=933df6
> [2] https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=db0abe

[3] https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=027f0fe01f13d654cb1aebf8b9f45006002851a8
[4] https://bugs.gentoo.org/664134

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Council demands on maintainers & council legal liability

[Thomas Deutschmann]

[-- Attachment #1.1: Type: text/plain, Size: 2842 bytes --]

On 2019-07-04 18:37, Ulrich Mueller wrote:
>>>>>> On Thu, 04 Jul 2019, Thomas Deutschmann wrote:
>> For the records: When I read mgorny's statement I got a different
>> message in first place. Do you remind the sys-firmware/intel-microcode
>> license hick hack around ~2018-08-23? As maintainer and as a person with
>> some insights I *knew* that Intel was going to revert that license
>> change. Therefore I didn't want to rev bump package for just a few hours
>> or days to avoid causing unnecessary work for all of us, including
>> Gentoo users.
> 
> Sorry, I don't understand. If you knew in advance (how?) that Intel was
> going to revert, why had you added an ebuild for that 20180807 snapshot
> version with the restrictive terms, in the first place [3]?

What do you mean? "intel-microcode-20180807_p20180808.ebuild" didn't add
new restriction or changed anything. Yes, I missed that license change
when 20180807 release was added. If I would have noticed that license
change at time, I wouldn't have bumped the package.


> Also with the information available at that point, we had to assume that
> redistribution of that particular microcode-20180807.tgz tarball was not
> allowed, so the ebuild should have had mirror restriction.

No, my point was, at the time when people within in Gentoo learned about
the changed license through the Debian bug (weeks after the bump), they
suddenly switched into panic mode. There wasn't even time to wait for
Debian and other, no, people not knowing *any* details and weren't aware
of any communication between maintainers across distributions just
thought that they must do something and they must do it immediately.

Please see the IRC discussion we had in #gentoo-dev around 2018-08-23. I
told everyone involved before a trustee changed ebuild that Intel will
revert. The information was leaked through Intel PR team starting to
give interviews because the changed license received media attention
that day. May I remind everyone about the ridiculous discussion we had
about whether Intel(!) PR(!) is credible or if we can't trust because
they aren't lawyers and maybe they aren't allowed to make such a
statement? An hour later I was able to confirm that information through
Intel OEM partner channel. All I was asking for was time. But Matthew
ignored everything I said, rushed forward and pushed that change with
trustee hat.

Like said, if you can be held legally accountable and don't understand
what's going on I can understand if at some point you just decide to
take action to cover your ass because if you get in trouble because of
that you will be on your own and nobody will help you. Anyway, this is
now history.


-- 
Regards,
Thomas Deutschmann / Gentoo Linux Developer
C4DD 695F A713 8F24 2AA1 5638 5849 7EE5 1D5D 74A5


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 618 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Council demands on maintainers & council legal liability

[Ulrich Mueller]

[-- Attachment #1: Type: text/plain, Size: 2289 bytes --]

>>>>> On Thu, 04 Jul 2019, Thomas Deutschmann wrote:

> On 2019-07-04 18:37, Ulrich Mueller wrote:
>> Sorry, I don't understand. If you knew in advance (how?) that Intel was
>> going to revert, why had you added an ebuild for that 20180807 snapshot
>> version with the restrictive terms, in the first place [3]?

> What do you mean? "intel-microcode-20180807_p20180808.ebuild" didn't add
> new restriction or changed anything. Yes, I missed that license change
> when 20180807 release was added. If I would have noticed that license
> change at time, I wouldn't have bumped the package.

Exactly, and nobody will blame you for that mistake, because the license
change was unannounced and easy to miss.

>> Also with the information available at that point, we had to assume that
>> redistribution of that particular microcode-20180807.tgz tarball was not
>> allowed, so the ebuild should have had mirror restriction.

> No, my point was, at the time when people within in Gentoo learned about
> the changed license through the Debian bug (weeks after the bump), they
> suddenly switched into panic mode. There wasn't even time to wait for
> Debian and other, no, people not knowing *any* details and weren't aware
> of any communication between maintainers across distributions just
> thought that they must do something and they must do it immediately.

> Please see the IRC discussion we had in #gentoo-dev around 2018-08-23. I
> told everyone involved before a trustee changed ebuild that Intel will
> revert. The information was leaked through Intel PR team starting to
> give interviews because the changed license received media attention
> that day. May I remind everyone about the ridiculous discussion we had
> about whether Intel(!) PR(!) is credible or if we can't trust because
> they aren't lawyers and maybe they aren't allowed to make such a
> statement? An hour later I was able to confirm that information through
> Intel OEM partner channel. All I was asking for was time. But Matthew
> ignored everything I said, rushed forward and pushed that change with
> trustee hat.

Thanks, with this additional context about the IRC discussion, things
become clearer. I was going by the information visible in bug 664134,
where there is no indication of any disagreement.

Ulrich

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 487 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Council demands on maintainers & council legal liability

[Alec Warner]

[-- Attachment #1: Type: text/plain, Size: 4526 bytes --]

On Thu, Jul 4, 2019 at 1:05 AM Kristian Fiskerstrand <k_f@gentoo.org> wrote:

> On 7/4/19 4:14 AM, Robin H. Johnson wrote:
> > I realize that there is only a short period left in the election, but
> > I've been busy with IRL issues, and mgorny's trustee manifesto [1]
> ascribed
> > something to the Council members that concerned me; there's one
> > additional good question for the Council that I'll close with.
> >
> > 1. Points 1a&1c of mgorny's manifesto imply that the council can
> >    unilaterally prevent support of any given package in Gentoo, and
> >    basically remove the package from the distribution.
> >
> >    This is despite any developers that may wish to support the package.
> >
> >    What's your opinion of the council using this offensively against
> >    packages? As a hypothetical, say systemd-ng comes about, with an even
> >    worse opinionated choices than those presently in systemd. Should the
> >    council be able to force support for openrc & systemd stop?
>
> Its definitely within the purview of the council to do it, but in most
> cases Gentoo is about flexibility so you don't want to. There are
> scenarios where you would have to consider it, though, e.g large impacts
> on others work (project out of scope), security issues , etc.
>

Clearly someone in Gentoo has this power, because in the end we choose who
has access to the means of production (nominally the mailing lists, irc,
bugzilla, git, etc..)
There is a question of centrality (should it be solely the council) vs some
other facility. If you literally read the GLEP[0] it makes it pretty clear
that:

1) The council is responsible for global issues.
2) Project leads still have some responsibility to their specific area.
3) Disciplinary actions can be appealed to the council.

If you were an originalist[2] and the council decided that
"mail-client/novell-groupwise-client"[1] was not suitable for the tree; I
wouldn't really expect the Council to have any particular say over this.
Not that they could not formulate an argument, but that literally their
purview does not extend here. This is explicitly called out in the GLEP
itself:

"Any dev may create a new project just by creating a new project page on
the wiki.gentoo.org (see [2]) and sending a Request For Comments (RFC)
e-mail to gentoo-dev. Note that this GLEP does not provide for a way for
the community at large to block a new project, even if the comments are
wholly negative."

I struggle to reconcile this text from GLEP 39 with the operational policy
that the "Council can do whatever they want and they are the ultimately
authority on ::gentoo."

Ultimately I think this is part of the point that Robin is raising and is a
key goal / right of Gentoo; because I do not think the council's purview
extends this far.

Note that (1) above is pretty vague, which is where i think all the leeway
comes into place in terms of the power the community lets the council have
(regardless of the actual text of the GLEP). It reminds me of the Commerce
Clause[3] in the US where the literal text of the amendment gives the
government broad regulatory authority. In the case of Gentoo, the Council's
authority extends only so far as the community tolerates them classifying
problems as 'global' (which is their clear purview) vs a local problem,
where its clearly the domain of a project lead or individual developer. I
don't expect a clearly written policy to cover all the ground here (because
there is too much ground to cover.)

-A

[0] https://www.gentoo.org/glep/glep-0039.html
[1] I randomly picked this package as an example.
[2] For the record, I am not, but I can certainly see how others might be.
[3] https://en.wikipedia.org/wiki/Commerce_Clause


> >
> > 2. As an additional point, can you try to give your version of a simple
> >    statement on the legal liabilities that the Council as a whole, and
> >    the Council members as individuals, have for their actions?
> >
>
> Council is no legal entity, so there is no as a whole, the individual
> legal liability is somewhat limited as there is no fiduciary duty etc
> arising due to this; which means no negligence claims etc.. So basically
> you're left with whatever else you can be sued for as an individual, but
> you're in a more profiled position so it is possibly more likely that
> you will face it by some angry internet people...
>

> --
> Kristian Fiskerstrand
> OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
> fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
>
>

[-- Attachment #2: Type: text/html, Size: 5862 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Council demands on maintainers & council legal liability

[Kristian Fiskerstrand]

[-- Attachment #1.1: Type: text/plain, Size: 1132 bytes --]

On 7/4/19 10:33 PM, Alec Warner wrote:
> Note that (1) above is pretty vague, which is where i think all the leeway
> comes into place in terms of the power the community lets the council have
> (regardless of the actual text of the GLEP). It reminds me of the Commerce
> Clause[3] in the US where the literal text of the amendment gives the
> government broad regulatory authority. In the case of Gentoo, the Council's
> authority extends only so far as the community tolerates them classifying
> problems as 'global' (which is their clear purview) vs a local problem,
> where its clearly the domain of a project lead or individual developer. I
> don't expect a clearly written policy to cover all the ground here (because
> there is too much ground to cover.)

the requirement for an issue to be global isn't a very high bar. e.g an
expectation for a negative PR feedback from outsiders of Gentoo makes an
issue global per se, so I still stick to my original answer.

-- 
Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [gentoo-project] Questions for Gentoo Council nominees: Council demands on maintainers & council legal liability

[desultory]

On 07/04/19 19:46, Kristian Fiskerstrand wrote:
> On 7/4/19 10:33 PM, Alec Warner wrote:
>> Note that (1) above is pretty vague, which is where i think all the leeway
>> comes into place in terms of the power the community lets the council have
>> (regardless of the actual text of the GLEP). It reminds me of the Commerce
>> Clause[3] in the US where the literal text of the amendment gives the
>> government broad regulatory authority. In the case of Gentoo, the Council's
>> authority extends only so far as the community tolerates them classifying
>> problems as 'global' (which is their clear purview) vs a local problem,
>> where its clearly the domain of a project lead or individual developer. I
>> don't expect a clearly written policy to cover all the ground here (because
>> there is too much ground to cover.)
> 
> the requirement for an issue to be global isn't a very high bar. e.g an
> expectation for a negative PR feedback from outsiders of Gentoo makes an
> issue global per se, so I still stick to my original answer.
> 
Using "I posit that someone might say something bad about $thing" as
grounds to make a "global issue" out of $thing is indeed not a high bar,
it is handwaving of the cheap undefined hypothetical variety, and if
that is really all that makes some consideration a "global issue" then
whoever made the claim in the first place has nothing but a poor
argument to make their claims on. Such claims seem rather more like a
petty waste of everyone's time than a substantive reason to involve the
council.

In case that was ambiguous, I mean both in theory and in practice.