Re: Do we need to hide packages in NEW queue

2022-01-31 Thread Russ Allbery
The Wanderer writes: > I am not on the inside of these things, certainly, but I have kept my > eyes open from the outside, and I am not aware of there being any > mechanism for removing something root-and-branch - across all affected > versions, however far back those may stretch - from these

Re: Do we need to hide packages in NEW queue

2022-01-31 Thread Scott Kitterman
On Monday, January 31, 2022 12:32:18 PM EST Russ Allbery wrote: ... > A lawyer cannot make that risk trade-off decision for us. We'll have to > make it as a project. But my hope would be that they could help put a > number on the likely legal cost in the worst-case scenario and provide > some

Re: Do we need to hide packages in NEW queue

2022-01-31 Thread The Wanderer
On 2022-01-31 at 12:32, Russ Allbery wrote: > Marc Haber writes: > >> Even if a lawyer says A, it doesn't buy us anything if J Robert DD >> gets sued and the judge says B, or "not A". > > Yes, a legal opinion cannot fully resolve the question, > unfortunately, since it's a risk judgment.

Re: Do we need to hide packages in NEW queue

2022-01-31 Thread Maxime Chambonnet
On 1/31/22 10:35, Pirate Praveen wrote: On തി, ജനു 31 2022 at 10:07:32 രാവിലെ +0100 +0100, Stephan Lachnit wrote: On Sun, Jan 30, 2022 at 8:35 PM Russ Allbery wrote: I do think that the amount of effort that the project puts into this pre-screening is of sufficiently high magnitude that

Re: Do we need to hide packages in NEW queue

2022-01-31 Thread Russ Allbery
Stephan Lachnit writes: > If I compare how other mediums handle copyright violations, most > services have a "file a claim infringed copyright here" button on their > site (e.g. YouTube). For example, we could write a DMCA policy like > e.g. Github [2], hyperlink in the footer of all our

Re: Do we need to hide packages in NEW queue

2022-01-31 Thread Russ Allbery
Marc Haber writes: > Even if a lawyer says A, it doesn't buy us anything if J Robert DD gets > sued and the judge says B, or "not A". Yes, a legal opinion cannot fully resolve the question, unfortunately, since it's a risk judgment. Copyright law is murky enough that it's unlikely that any

Re: Do we need to hide packages in NEW queue

2022-01-31 Thread Erik Huelsmann
Hi, On Mon, Jan 31, 2022 at 12:05 PM Marc Haber wrote: > >Looking at the last financial numbers I found [1], we have at least > >~750k USD we could use for this purpose. I don't really know how > >expensive lawyers are, but I doubt that this would cost more than 10k. > >Heck, we could even hire

Re: Do we need to hide packages in NEW queue

2022-01-31 Thread Marc Haber
On Mon, 31 Jan 2022 10:07:32 +0100, Stephan Lachnit wrote: >On Sun, Jan 30, 2022 at 8:35 PM Russ Allbery wrote: >> I do think that the amount of effort that the project puts into this >> pre-screening is of sufficiently high magnitude that it would be worth >> paying a lawyer for a legal opinion

Re: Do we need to hide packages in NEW queue

2022-01-31 Thread Jonathan Carter
Hey Russ On 2022/01/30 21:34, Russ Allbery wrote: Francesco Poli writes: I thought the basis was the fact that copyright and licensing bugs may have bad legal consequences (lawsuits against the Project for distributing legally undistributable packages, things like that), while technical bugs

Re: Do we need to hide packages in NEW queue

2022-01-31 Thread Jonathan Carter
Hey Russ On 2022/01/30 21:34, Russ Allbery wrote: Francesco Poli writes: I thought the basis was the fact that copyright and licensing bugs may have bad legal consequences (lawsuits against the Project for distributing legally undistributable packages, things like that), while technical bugs

Re: Do we need to hide packages in NEW queue

2022-01-31 Thread Pirate Praveen
On തി, ജനു 31 2022 at 10:07:32 രാവിലെ +0100 +0100, Stephan Lachnit wrote: On Sun, Jan 30, 2022 at 8:35 PM Russ Allbery wrote: I do think that the amount of effort that the project puts into this pre-screening is of sufficiently high magnitude that it would be worth paying a lawyer

Re: Do we need to hide packages in NEW queue

2022-01-31 Thread Stephan Lachnit
On Sun, Jan 30, 2022 at 8:35 PM Russ Allbery wrote: > > I do think that the amount of effort that the project puts into this > pre-screening is of sufficiently high magnitude that it would be worth > paying a lawyer for a legal opinion about whether or not we need to do > it. The savings to the

Re: Do we need to hide packages in NEW queue

2022-01-30 Thread Russ Allbery
Francesco Poli writes: > I thought the basis was the fact that copyright and licensing bugs may > have bad legal consequences (lawsuits against the Project for > distributing legally undistributable packages, things like that), while > technical bugs do not cause issues with lawyers and are, in

Re: Do we need to hide packages in NEW queue (Was: Lottery NEW queue (Re: Are libraries with bumped SONAME subject of inspection of ftpmaster or not))

2022-01-30 Thread Francesco Poli
On Wed, 26 Jan 2022 07:38:10 +0100 Andreas Tille wrote: > Am Tue, Jan 25, 2022 at 01:45:11PM -0800 schrieb Russ Allbery: [...] > > The question, which keeps being raised in part > > because I don't think it's gotten a good answer, is what the basis is for > > treating copyright and licensing bugs

Re: Do we need to hide packages in NEW queue (Was: Lottery NEW queue (Re: Are libraries with bumped SONAME subject of inspection of ftpmaster or not))

2022-01-26 Thread Philip Hands
Andreas Tille writes: ... > May be some intermediate step would be to not hide packages in NEW queue > but exposing them as an apt source. If I'm correct this is not the case > since it had certain legal consequences for the project if code with > certain non-free licenses would be downloadable

Do we need to hide packages in NEW queue (Was: Lottery NEW queue (Re: Are libraries with bumped SONAME subject of inspection of ftpmaster or not))

2022-01-25 Thread Andreas Tille
Am Tue, Jan 25, 2022 at 01:45:11PM -0800 schrieb Russ Allbery: > Jonas Smedegaard writes: > > > I just don't think the solution is to ignore copyright or licensing > > statements. > > That's not the goal. The question, which keeps being raised in part > because I don't think it's gotten a good