Re: [gentoo-project] Questions for Gentoo Council nominees: GLEP 76

[desultory <desultory@gentoo.org>]

On 07/01/19 07:59, Rich Freeman wrote:
> On Mon, Jul 1, 2019 at 1:02 AM desultory <desultory@gentoo.org> wrote:
>>
>> publishing PII purely on the basis of disciplinary
>> considerations could be quite reasonably considered to be an outrageous
>> overreach. There are reasons that "doxing" is generally considered to be
>> rather reprehensible.
> 
> It obviously is reprehensible.  However, nobody is suggesting
> publishing PII for any reason, and I have no idea where this idea even
> came from.
> 
How, exactly, is a requirement to provide and publish "legal name as a
natural person, i.e., the name that would appear in a government issued
document" [GLEP76] not a requirement to publish persona data [PII]?
Though, I suppose GLEP 76 is not "suggesting" anything.

> For the sake of clarity, I do not believe that Gentoo should publish
> PII collected confidentially for any reason.
> 
On that much, we agree. Well, modulo when it is actually legally required.

> Furthermore, I do not think that Gentoo should be collecting PII under
> conditions of confidentiality for any reason in the first place.  Nor
> should we be doing any activities that require us to do so, such as
> accepting money from people, or paying people.  IMO we do not have the
> demonstrated ability to do this in a safe and compliant manner, and we
> have a history of not performing legally-required activities in a
> compliant manner.
> 
Too late, Gentoo has multiple services which collect some form of PII
(e.g. the EU considers an IP address to be, at least potentially, PII),
and retain at least some of that data without publishing it.

> For this reason, I think it would be a big mistake to allow people to
> contribute under pseudonyms under the condition that they reveal their
> real identities to some Gentoo body that would retain this information
> in confidentiality.  That would expose Gentoo to a rather large number
> of privacy laws in a large number of places, for IMO little gain.
> 
So, under the mistaken premise that Gentoo does not collect or retain
any form of PII you believe that Gentoo should not collect or retain any
PII, correct?

Knowing that Gentoo does indeed collect and retain some PII, does your
opinion change? And no, not collecting any PII, at all, ever is not a
practical solution to "replace" the cases where it is presently
collected and retained.

> None of this is a risk with GLEP 76 as it currently stands.  People
> who wish to contribute code to Gentoo must divulge their names.  They
> can choose to do this, or not, and if they choose not to, then their
> contributions will not be accepted.  If they do, then Gentoo doesn't
> have any private information they have to safeguard, because it has
> been made public by the person it pertains to.  There is no database
> of PII that we have to make accessible to people we already barely
> know scattered around the world, but protect from exposure via hacking
> attacks/etc.
> 
LDAP, though most of that data is now published in some form it is still
by and large a collection of PII.

> None of this is intended as some kind of attack on Trustees/Infra/etc.
> They're volunteers doing the best they can do without pay, and
> generally trying to clean up after a long period of neglect.  It is
> simply a fact that if you have nothing to steal, then it is impossible
> to steal it, and no effort is required to protect it.
> 
Believing that you have nothing worth stealing is no defense against
those who believe that you do and intend to take it.

Note that in this message I am addressing only the the points you raised
in regard to the comments which you quoted out of context. And,
diverting as it may be to have your attention so squarely focused on
part of one point, I would very much appreciate it if you would address
the other concerns I mentioned in that e-mail. Most especially I would
appreciate clarification on why your arguments appear to completely
discount introverted individuals, is it a disbelief in their existence,
in the value of their work, or mere oversight? Also, would you be so
kind as to either respond to the whole of the comment you took out of
context or, better still, the entire message?

[GLEP76] https://www.gentoo.org/glep/glep-0076.html
[PII] https://en.wikipedia.org/wiki/Personal_data