Re: [gentoo-project] [RFC] GLEP 76: Copyright Policy [v4]

[NP-Hardass <NP-Hardass@gentoo.org>]

[-- Attachment #1.1: Type: text/plain, Size: 3420 bytes --]

On 09/27/2018 10:13 AM, Rich Freeman wrote:
> On Thu, Sep 27, 2018 at 9:52 AM NP-Hardass <NP-Hardass@gentoo.org> wrote:
>>
>> But that's really besides the point... The current status quo (as is the
>> case with me) is that a committer may be pseudonymous under the
>> condition that the Foundation have that individual's name in the event
>> of a copyright issue. So, I still don't understand how forcing everyone
>> to publicly use a real name achieves something that we aren't currently
>> achieving...  Is that incorrect?
> 
> Interesting point.
> 
> If we were going to go down this road I'd still suggest that the
> Foundation have a policy on when the real names of contributors can be
> disclosed, either privately or publicly.  If we were to use the
> defense that we have a statement from a contributor that they checked
> the copyright and it was ok, the first question somebody will respond
> with is, "who?"  An answer of "we know who it is but can't tell
> anybody, even a court" probably isn't going to work.
> 
> I think there are other arguments to be made against anonymity.
> You're hardly a list troll, but anonymity can breed this sort of
> thing.  From a strictly copyright standpoint I don't see why the
> identity of contributors needs to be publicly disclosed, as long as it
> can be disclosed where legally necessary.  Of course, if that is a
> court then depending on the jurisdiction it may become public anyway.
> Also, if we were going to go down this route then we also need to have
> better archives of such things, as trying to dig up some trustee email
> from 10 years ago is not the right solution.  A secured repository of
> identities/etc would be better (the Foundation already has a place to
> store stuff like bank account details).
> 
> Another practical argument against anonymity.  If everybody agrees
> everything is public, then we don't have any personal information we
> need to protect under various privacy laws.  As soon as we agree to
> keep some info private, then we potentially have obligations under
> such laws.  Also, legally the Foundation is a US organization - so I'm
> not sure if things like the US-EU Safe Harbor provisions start to
> apply if we want to collect this sort of info from EU citizens.  It is
> just a can of worms you can avoid simply by not hanging onto this kind
> of information.  I believe that many of these privacy protections
> cannot be simply waived - we can't get some EU citizen to agree that
> they don't apply to us.  If the laws apply then we need to follow
> them.  Now, we're obviously not a big fish, so enforcement may never
> happen.  Maybe compliance isn't burdensome - I only know enough about
> such things to know that I'd want to know more before going down that
> road...
> 

But enforcing committers only to be named doesn't really avoid the
issues you are espousing wrt copyright issues... All it does is give you
someone to blame (who isn't the perpetrator of the copyright violation).
 Any random person can submit code under the new proposed copyright
policy, and as long as they aren't making a commit, there is no force
for using a real name.

So, unless we are outlawing all anonymous and pseudonymous contributions
of any sort (authorship, not just a commit), there is really no point in
forcing committers to be publicly named.

-- 
NP-Hardass


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]