Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Aris Merchant via agora-discussion
On Sun, Jun 14, 2020 at 11:36 AM Publius Scribonius Scholasticus via
agora-discussion  wrote:
> > Totally agree with this, and Trigon just made some good points too. I'm
> > starting to proto a rule that lets the Webmastor write regulations for
> > the github that would regulate who should be owners, who is in charge of
> > which repo, when to push vs fork and make a request... All of that will
> > be based on a process of feedback and consensus. This was me realizing
> > the system was set up really sloppily (and potentially dangerously) and
> > deciding to do something about it in the meantime since I have no idea
> > how long said regulations will take to make.
> >
>
> I think that any rule we pass on this should explicitly exempt the
> Distributor because they obviously need access in emergencies to
> coordinate any changes they could be making to the mailing lists.

Yeah.

Suggested criteria (just proposals for discussion):
-Is Distributor;
-Is Webmastor;
-Is one of the N first registered active players (excluding the Distributor); or
-Is one of the N longest continuous registered active players
(excluding the Distributor);

-Aris


Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Publius Scribonius Scholasticus via agora-discussion

On 6/14/20 2:22 PM, nch via agora-discussion wrote:

On 6/14/20 1:18 PM, Aris Merchant via agora-discussion wrote:

On Sun, Jun 14, 2020 at 11:08 AM nch via agora-discussion
 wrote:

Inactivity in the game doesn't really mean unreachable though. omd has
been active on github with an occasional month off for 7 straight years.
This email address for me is an alias of my main protonmail address, and
emails directly to me go to the main inbox which will pop up on a few of
my devices immediately. The owners aren't the currently most engaged
players, they're people who have shown consistent contactability.

That said, I'm not really that invested in my criteria, I just chose
what seemed reasonable. But if we're going to tweak it further, I'd
rather seek some sort of consensus.

Says the person who just staged a coup without gathering any consensus
whatsoever. ;)

Okay, actual reply time. Nothing you've said is incorrect. I simply
think that having to email someone who isn't active is annoying. It's
not a huge deal, and inactive-but-contactable players certainly work
as a backup. I'm just suggesting we should have more reliably on list
people so we need to contact the backups less often.

-Aris


Totally agree with this, and Trigon just made some good points too. I'm
starting to proto a rule that lets the Webmastor write regulations for
the github that would regulate who should be owners, who is in charge of
which repo, when to push vs fork and make a request... All of that will
be based on a process of feedback and consensus. This was me realizing
the system was set up really sloppily (and potentially dangerously) and
deciding to do something about it in the meantime since I have no idea
how long said regulations will take to make.



I think that any rule we pass on this should explicitly exempt the 
Distributor because they obviously need access in emergencies to 
coordinate any changes they could be making to the mailing lists.


--

Publius Scribonius Scholasticus, Herald, Referee, Tailor, Pirate
Champion, Badge of the Great Agoran Revival, Badge of the Salted Earth


Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Aris Merchant via agora-discussion
On Sun, Jun 14, 2020 at 11:22 AM nch via agora-discussion
 wrote:
>
> On 6/14/20 1:18 PM, Aris Merchant via agora-discussion wrote:
> > On Sun, Jun 14, 2020 at 11:08 AM nch via agora-discussion
> >  wrote:
> >> Inactivity in the game doesn't really mean unreachable though. omd has
> >> been active on github with an occasional month off for 7 straight years.
> >> This email address for me is an alias of my main protonmail address, and
> >> emails directly to me go to the main inbox which will pop up on a few of
> >> my devices immediately. The owners aren't the currently most engaged
> >> players, they're people who have shown consistent contactability.
> >>
> >> That said, I'm not really that invested in my criteria, I just chose
> >> what seemed reasonable. But if we're going to tweak it further, I'd
> >> rather seek some sort of consensus.
> > Says the person who just staged a coup without gathering any consensus
> > whatsoever. ;)
> >
> > Okay, actual reply time. Nothing you've said is incorrect. I simply
> > think that having to email someone who isn't active is annoying. It's
> > not a huge deal, and inactive-but-contactable players certainly work
> > as a backup. I'm just suggesting we should have more reliably on list
> > people so we need to contact the backups less often.
> >
> > -Aris
>
> Totally agree with this, and Trigon just made some good points too. I'm
> starting to proto a rule that lets the Webmastor write regulations for
> the github that would regulate who should be owners, who is in charge of
> which repo, when to push vs fork and make a request... All of that will
> be based on a process of feedback and consensus. This was me realizing
> the system was set up really sloppily (and potentially dangerously) and
> deciding to do something about it in the meantime since I have no idea
> how long said regulations will take to make.

There's a proposal in the next distribution that should let you do
that. Populist Administration basically lets any officer write
regulations for anything relating to their office (backed only by a
SHOULD, so it's not dangerous, and still needs 1.5 Agoran Consent).

-Aris


Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Kerim Aydin via agora-discussion


On 6/14/2020 11:19 AM, nch via agora-discussion wrote:
> On 6/14/20 1:12 PM, Kerim Aydin via agora-discussion wrote:
>>
>> On 6/14/2020 10:14 AM, Aris Merchant via agora-discussion wrote:
>>> On Sun, Jun 14, 2020 at 7:02 AM nch  wrote:
 On 6/14/20 8:55 AM, Jason Cobb via agora-discussion wrote:
>> * All members have been downgraded except me, g, and comex.
>>
>> Now that everyone has read and write access the vast majority of
>>> people shouldn't need to be owners. Please let me know if you have a reason
>>> you need to be.
>> Just to add, that while I don't mind being included as an owner and
>> certainly appreciate it, my git skills are "bare minimum to push pull
>> branch and commit" so I'd pretty much have to be told exactly what to do
>> if something came up (not that I couldn't google and try but there might
>> be better experts on call).
>>
>> -G.
>>
> The only real difference between owners and members now is that owners 
> have administrative access on github itself (to the repos and the group 
> as a whole), not access to the git tools.
> 

Sorry, I meant to add "and I don't really use github itself very much
other than to push to it - mostly interact with it through the CLI to do
simple stuff"  (I mean, github's interface is pretty clear, and everything
I've needed to do there has been searchable, but if there's anything
subtle with admin fixes, I'm not the go-to).



Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread nch via agora-discussion
On 6/14/20 1:18 PM, Aris Merchant via agora-discussion wrote:
> On Sun, Jun 14, 2020 at 11:08 AM nch via agora-discussion
>  wrote:
>> Inactivity in the game doesn't really mean unreachable though. omd has
>> been active on github with an occasional month off for 7 straight years.
>> This email address for me is an alias of my main protonmail address, and
>> emails directly to me go to the main inbox which will pop up on a few of
>> my devices immediately. The owners aren't the currently most engaged
>> players, they're people who have shown consistent contactability.
>>
>> That said, I'm not really that invested in my criteria, I just chose
>> what seemed reasonable. But if we're going to tweak it further, I'd
>> rather seek some sort of consensus.
> Says the person who just staged a coup without gathering any consensus
> whatsoever. ;)
>
> Okay, actual reply time. Nothing you've said is incorrect. I simply
> think that having to email someone who isn't active is annoying. It's
> not a huge deal, and inactive-but-contactable players certainly work
> as a backup. I'm just suggesting we should have more reliably on list
> people so we need to contact the backups less often.
>
> -Aris

Totally agree with this, and Trigon just made some good points too. I'm 
starting to proto a rule that lets the Webmastor write regulations for 
the github that would regulate who should be owners, who is in charge of 
which repo, when to push vs fork and make a request... All of that will 
be based on a process of feedback and consensus. This was me realizing 
the system was set up really sloppily (and potentially dangerously) and 
deciding to do something about it in the meantime since I have no idea 
how long said regulations will take to make.

-- 
nch
Webmastor, NAX Exchange Manager, Pirate




Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Aris Merchant via agora-discussion
On Sun, Jun 14, 2020 at 11:16 AM Kerim Aydin via agora-discussion
 wrote:
>
>
> On 6/14/2020 10:14 AM, Aris Merchant via agora-discussion wrote:
> > On Sun, Jun 14, 2020 at 7:02 AM nch  wrote:
> >> On 6/14/20 8:55 AM, Jason Cobb via agora-discussion wrote:
>  * All members have been downgraded except me, g, and comex.
> 
>  Now that everyone has read and write access the vast majority of
> > people shouldn't need to be owners. Please let me know if you have a reason
> > you need to be.
>
> Just to add, that while I don't mind being included as an owner and
> certainly appreciate it, my git skills are "bare minimum to push pull
> branch and commit" so I'd pretty much have to be told exactly what to do
> if something came up (not that I couldn't google and try but there might
> be better experts on call).

I have a fair bit of git experience, although it's a few years old. I
was the guy who got called in when there was a git problem for a small
development team (~5 people) a few years back.

That being said, most (actually I think all) of the things you need
owner for at this point are in the GitHub GUI, so that's not a huge
deal. Though, if anyone ever has a git problem, I'd love to help.
They're fun.

-Aris


Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread nch via agora-discussion
On 6/14/20 1:12 PM, Kerim Aydin via agora-discussion wrote:
>
> On 6/14/2020 10:14 AM, Aris Merchant via agora-discussion wrote:
>> On Sun, Jun 14, 2020 at 7:02 AM nch  wrote:
>>> On 6/14/20 8:55 AM, Jason Cobb via agora-discussion wrote:
> * All members have been downgraded except me, g, and comex.
>
> Now that everyone has read and write access the vast majority of
>> people shouldn't need to be owners. Please let me know if you have a reason
>> you need to be.
> Just to add, that while I don't mind being included as an owner and
> certainly appreciate it, my git skills are "bare minimum to push pull
> branch and commit" so I'd pretty much have to be told exactly what to do
> if something came up (not that I couldn't google and try but there might
> be better experts on call).
>
> -G.
>
The only real difference between owners and members now is that owners 
have administrative access on github itself (to the repos and the group 
as a whole), not access to the git tools.

-- 
nch
Webmastor, NAX Exchange Manager, Pirate




Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Aris Merchant via agora-discussion
On Sun, Jun 14, 2020 at 11:08 AM nch via agora-discussion
 wrote:
>
> Inactivity in the game doesn't really mean unreachable though. omd has
> been active on github with an occasional month off for 7 straight years.
> This email address for me is an alias of my main protonmail address, and
> emails directly to me go to the main inbox which will pop up on a few of
> my devices immediately. The owners aren't the currently most engaged
> players, they're people who have shown consistent contactability.
>
> That said, I'm not really that invested in my criteria, I just chose
> what seemed reasonable. But if we're going to tweak it further, I'd
> rather seek some sort of consensus.

Says the person who just staged a coup without gathering any consensus
whatsoever. ;)

Okay, actual reply time. Nothing you've said is incorrect. I simply
think that having to email someone who isn't active is annoying. It's
not a huge deal, and inactive-but-contactable players certainly work
as a backup. I'm just suggesting we should have more reliably on list
people so we need to contact the backups less often.

-Aris


Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Reuben Staley via agora-discussion

On 2020-06-14 11:14, Aris Merchant via agora-discussion wrote:

On Sun, Jun 14, 2020 at 7:02 AM nch via agora-discussion <
agora-discussion@agoranomic.org> wrote:


On 6/14/20 8:55 AM, Jason Cobb via agora-discussion wrote:

On 6/14/20 7:04 AM, nch via agora-discussion wrote:

A large number of members of the github were owners. Owners can
downgrade each other, delete repositories, and even delete the org.
Obviously these are all major security issues.

I have made the following changes:

* All members have read and write access to all repos

* All members have been downgraded except me, g, and comex.

Now that everyone has read and write access the vast majority of

people shouldn't need to be owners. Please let me know if you have a reason
you need to be.



Fine by me, although I am slightly concerned that bus factor for control
of the Github org has been lowered considerably.

--
Jason Cobb


That's why I reduced it to the three longest-active players in the org
(unless someone has been around longer than me that I missed?). If for
some reason one becomes uncontactable the other two are very likely
still around.


So, I'm not worried about the bus risk for the reasons you describe, but am
I concerned that there's another problem with your selection criteria.
You've selected for the longest involvement in Agora, which does increase
the chance that one of the owners will be reachable in an emergency.
However, most of the people you've selected have relatively low continuous
activity levels.

omd has been a registered player for the longest time, but only because e's
the Distributor and thus has been immune from deregistration. E's actually
been inactive, as a player, for a lot of that time.

You've also been inactive for a lot of the time since your first
registration. I believe you recently registered after a fairly long lapse
in registration.

G. is fine on this front. E deregisters every now and then for a short
while, so e's only the fourth most recently registered player (the third,
not counting the Distributor), but e's never gone for more than a month at
a time. Also, e usually checks email even when not registered. E definitely
isn't available all the time though; sometimes e takes vacations or is
otherwise temporarily absent.

So, of the three owners you've selected, only one can be relied on to be on
list with any consistency. That means that if someone has a problem that
requires an owner, there's only one person who can be relied on to be
checking the mailing lists. If e's unavailable and the others happen to be
inactive (which, again, they are relatively often), we have to either wait
or roust someone who isn't currently active. That isn't the end of the
world, but is certainly an annoyance for all concerned. And it's really
likely to happen, because again, of the three people you picked, only one
is reliably on list. Your on-list redundancy is non-existent.

The solution is simple: augment your selection criteria with another one,
picking someone who's been active for the longest continuous amount of
time. This would be the longest continuously registered player, apart from
the Distributor (who doesn't need to stay active to stay registered). This
just happens to be someone who's never even been zombified and has been
around for over three years. I wonder who that is? :)


I like this idea but have some suggestions myself.

Another criterion I think would be valuable is familiarity with Github 
itself. Sure, there are people who have been continuously active for a 
long time, but I would rather rely upon players who know their way 
around Github (especially Github orgs) and can find the options to deal 
with any emergencies quick. Also perhaps the amount of contribution the 
player has made to the Github repositories.


--
Trigon

Speaker and Treasuror of Agora; Former Rulekeepor (12 months) and 
Cartographor (8 months) of Agora; Champion of Agora by High Score and 
Proposal; Bearer of the Badge of the Salted Earth; Founder of the League 
of Agorans Facilitating Effective Recordkeeping; Arcadian Revivalist; 
Sixth-Longest Continually Registered Player of Agora; Player and former 
Emperor of BlogNomic; Player, Book-keeper, and Originator of the 
Metaruleset of Infinite Nomic; Contributor to the nomic.club wiki and 
the Talk:Nomic page on Wikipedia.


Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Kerim Aydin via agora-discussion


On 6/14/2020 10:14 AM, Aris Merchant via agora-discussion wrote:
> On Sun, Jun 14, 2020 at 7:02 AM nch  wrote:
>> On 6/14/20 8:55 AM, Jason Cobb via agora-discussion wrote:
 * All members have been downgraded except me, g, and comex.

 Now that everyone has read and write access the vast majority of
> people shouldn't need to be owners. Please let me know if you have a reason
> you need to be.

Just to add, that while I don't mind being included as an owner and
certainly appreciate it, my git skills are "bare minimum to push pull
branch and commit" so I'd pretty much have to be told exactly what to do
if something came up (not that I couldn't google and try but there might
be better experts on call).

-G.



Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread nch via agora-discussion
On 6/14/20 12:14 PM, Aris Merchant via agora-discussion wrote:
> On Sun, Jun 14, 2020 at 7:02 AM nch via agora-discussion <
> agora-discussion@agoranomic.org> wrote:
>> On 6/14/20 8:55 AM, Jason Cobb via agora-discussion wrote:
>>> On 6/14/20 7:04 AM, nch via agora-discussion wrote:
 A large number of members of the github were owners. Owners can
 downgrade each other, delete repositories, and even delete the org.
 Obviously these are all major security issues.

 I have made the following changes:

 * All members have read and write access to all repos

 * All members have been downgraded except me, g, and comex.

 Now that everyone has read and write access the vast majority of
> people shouldn't need to be owners. Please let me know if you have a reason
> you need to be.
>>> Fine by me, although I am slightly concerned that bus factor for control
>>> of the Github org has been lowered considerably.
>>>
>>> --
>>> Jason Cobb
>>>
>> That's why I reduced it to the three longest-active players in the org
>> (unless someone has been around longer than me that I missed?). If for
>> some reason one becomes uncontactable the other two are very likely
>> still around.
> So, I'm not worried about the bus risk for the reasons you describe, but am
> I concerned that there's another problem with your selection criteria.
> You've selected for the longest involvement in Agora, which does increase
> the chance that one of the owners will be reachable in an emergency.
> However, most of the people you've selected have relatively low continuous
> activity levels.
>
> omd has been a registered player for the longest time, but only because e's
> the Distributor and thus has been immune from deregistration. E's actually
> been inactive, as a player, for a lot of that time.
>
> You've also been inactive for a lot of the time since your first
> registration. I believe you recently registered after a fairly long lapse
> in registration.


Inactivity in the game doesn't really mean unreachable though. omd has 
been active on github with an occasional month off for 7 straight years. 
This email address for me is an alias of my main protonmail address, and 
emails directly to me go to the main inbox which will pop up on a few of 
my devices immediately. The owners aren't the currently most engaged 
players, they're people who have shown consistent contactability.

That said, I'm not really that invested in my criteria, I just chose 
what seemed reasonable. But if we're going to tweak it further, I'd 
rather seek some sort of consensus.

-- 
nch
Webmastor, NAX Exchange Manager, Pirate




Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Publius Scribonius Scholasticus via agora-discussion

On 6/14/20 1:14 PM, Aris Merchant via agora-discussion wrote:

On Sun, Jun 14, 2020 at 7:02 AM nch via agora-discussion <
agora-discussion@agoranomic.org> wrote:


On 6/14/20 8:55 AM, Jason Cobb via agora-discussion wrote:

On 6/14/20 7:04 AM, nch via agora-discussion wrote:

A large number of members of the github were owners. Owners can
downgrade each other, delete repositories, and even delete the org.
Obviously these are all major security issues.

I have made the following changes:

* All members have read and write access to all repos

* All members have been downgraded except me, g, and comex.

Now that everyone has read and write access the vast majority of

people shouldn't need to be owners. Please let me know if you have a reason
you need to be.



Fine by me, although I am slightly concerned that bus factor for control
of the Github org has been lowered considerably.

--
Jason Cobb


That's why I reduced it to the three longest-active players in the org
(unless someone has been around longer than me that I missed?). If for
some reason one becomes uncontactable the other two are very likely
still around.


So, I'm not worried about the bus risk for the reasons you describe, but am
I concerned that there's another problem with your selection criteria.
You've selected for the longest involvement in Agora, which does increase
the chance that one of the owners will be reachable in an emergency.
However, most of the people you've selected have relatively low continuous
activity levels.

omd has been a registered player for the longest time, but only because e's
the Distributor and thus has been immune from deregistration. E's actually
been inactive, as a player, for a lot of that time.

You've also been inactive for a lot of the time since your first
registration. I believe you recently registered after a fairly long lapse
in registration.

G. is fine on this front. E deregisters every now and then for a short
while, so e's only the fourth most recently registered player (the third,
not counting the Distributor), but e's never gone for more than a month at
a time. Also, e usually checks email even when not registered. E definitely
isn't available all the time though; sometimes e takes vacations or is
otherwise temporarily absent.

So, of the three owners you've selected, only one can be relied on to be on
list with any consistency. That means that if someone has a problem that
requires an owner, there's only one person who can be relied on to be
checking the mailing lists. If e's unavailable and the others happen to be
inactive (which, again, they are relatively often), we have to either wait
or roust someone who isn't currently active. That isn't the end of the
world, but is certainly an annoyance for all concerned. And it's really
likely to happen, because again, of the three people you picked, only one
is reliably on list. Your on-list redundancy is non-existent.

The solution is simple: augment your selection criteria with another one,
picking someone who's been active for the longest continuous amount of
time. This would be the longest continuously registered player, apart from
the Distributor (who doesn't need to stay active to stay registered). This
just happens to be someone who's never even been zombified and has been
around for over three years. I wonder who that is? :)

-Aris



I'd be supportive of so augmenting the criteria.

--

Publius Scribonius Scholasticus, Herald, Referee, Tailor, Pirate
Champion, Badge of the Great Agoran Revival, Badge of the Salted Earth


Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Aris Merchant via agora-discussion
On Sun, Jun 14, 2020 at 7:02 AM nch via agora-discussion <
agora-discussion@agoranomic.org> wrote:
>
> On 6/14/20 8:55 AM, Jason Cobb via agora-discussion wrote:
> > On 6/14/20 7:04 AM, nch via agora-discussion wrote:
> >> A large number of members of the github were owners. Owners can
> >> downgrade each other, delete repositories, and even delete the org.
> >> Obviously these are all major security issues.
> >>
> >> I have made the following changes:
> >>
> >> * All members have read and write access to all repos
> >>
> >> * All members have been downgraded except me, g, and comex.
> >>
> >> Now that everyone has read and write access the vast majority of
people shouldn't need to be owners. Please let me know if you have a reason
you need to be.
> >>
> > Fine by me, although I am slightly concerned that bus factor for control
> > of the Github org has been lowered considerably.
> >
> > --
> > Jason Cobb
> >
> That's why I reduced it to the three longest-active players in the org
> (unless someone has been around longer than me that I missed?). If for
> some reason one becomes uncontactable the other two are very likely
> still around.

So, I'm not worried about the bus risk for the reasons you describe, but am
I concerned that there's another problem with your selection criteria.
You've selected for the longest involvement in Agora, which does increase
the chance that one of the owners will be reachable in an emergency.
However, most of the people you've selected have relatively low continuous
activity levels.

omd has been a registered player for the longest time, but only because e's
the Distributor and thus has been immune from deregistration. E's actually
been inactive, as a player, for a lot of that time.

You've also been inactive for a lot of the time since your first
registration. I believe you recently registered after a fairly long lapse
in registration.

G. is fine on this front. E deregisters every now and then for a short
while, so e's only the fourth most recently registered player (the third,
not counting the Distributor), but e's never gone for more than a month at
a time. Also, e usually checks email even when not registered. E definitely
isn't available all the time though; sometimes e takes vacations or is
otherwise temporarily absent.

So, of the three owners you've selected, only one can be relied on to be on
list with any consistency. That means that if someone has a problem that
requires an owner, there's only one person who can be relied on to be
checking the mailing lists. If e's unavailable and the others happen to be
inactive (which, again, they are relatively often), we have to either wait
or roust someone who isn't currently active. That isn't the end of the
world, but is certainly an annoyance for all concerned. And it's really
likely to happen, because again, of the three people you picked, only one
is reliably on list. Your on-list redundancy is non-existent.

The solution is simple: augment your selection criteria with another one,
picking someone who's been active for the longest continuous amount of
time. This would be the longest continuously registered player, apart from
the Distributor (who doesn't need to stay active to stay registered). This
just happens to be someone who's never even been zombified and has been
around for over three years. I wonder who that is? :)

-Aris


Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Jason Cobb via agora-discussion
On 6/14/20 10:02 AM, nch via agora-discussion wrote:
> On 6/14/20 8:55 AM, Jason Cobb via agora-discussion wrote:
>> On 6/14/20 7:04 AM, nch via agora-discussion wrote:
>>> A large number of members of the github were owners. Owners can
>>> downgrade each other, delete repositories, and even delete the org.
>>> Obviously these are all major security issues.
>>>
>>> I have made the following changes:
>>>
>>> * All members have read and write access to all repos
>>>
>>> * All members have been downgraded except me, g, and comex.
>>>
>>> Now that everyone has read and write access the vast majority of people 
>>> shouldn't need to be owners. Please let me know if you have a reason you 
>>> need to be.
>>>
>> Fine by me, although I am slightly concerned that bus factor for control
>> of the Github org has been lowered considerably.
>>
>> --
>> Jason Cobb
>>
> That's why I reduced it to the three longest-active players in the org 
> (unless someone has been around longer than me that I missed?). If for 
> some reason one becomes uncontactable the other two are very likely 
> still around.
>

Fair enough.

-- 
Jason Cobb



Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread nch via agora-discussion
On 6/14/20 8:55 AM, Jason Cobb via agora-discussion wrote:
> On 6/14/20 7:04 AM, nch via agora-discussion wrote:
>> A large number of members of the github were owners. Owners can
>> downgrade each other, delete repositories, and even delete the org.
>> Obviously these are all major security issues.
>>
>> I have made the following changes:
>>
>> * All members have read and write access to all repos
>>
>> * All members have been downgraded except me, g, and comex.
>>
>> Now that everyone has read and write access the vast majority of people 
>> shouldn't need to be owners. Please let me know if you have a reason you 
>> need to be.
>>
> Fine by me, although I am slightly concerned that bus factor for control
> of the Github org has been lowered considerably.
>
> --
> Jason Cobb
>
That's why I reduced it to the three longest-active players in the org 
(unless someone has been around longer than me that I missed?). If for 
some reason one becomes uncontactable the other two are very likely 
still around.

-- 
nch
Webmastor, NAX Exchange Manager, Pirate




Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Publius Scribonius Scholasticus via agora-discussion

On 6/14/20 9:55 AM, Jason Cobb via agora-discussion wrote:

On 6/14/20 7:04 AM, nch via agora-discussion wrote:

A large number of members of the github were owners. Owners can
downgrade each other, delete repositories, and even delete the org.
Obviously these are all major security issues.

I have made the following changes:

* All members have read and write access to all repos

* All members have been downgraded except me, g, and comex.

Now that everyone has read and write access the vast majority of people 
shouldn't need to be owners. Please let me know if you have a reason you need 
to be.



Fine by me, although I am slightly concerned that bus factor for control
of the Github org has been lowered considerably.

In this regard, there will always be a tradeoff between security and 
resiliency. As it stands, we will always lose key infrastructure if 
either the domain name or mailing list controllers were hit by a bus, 
which I think are more serious concerns than loss of the GitHub 
organization.


--

Publius Scribonius Scholasticus, Herald, Referee, Tailor, Pirate
Champion, Badge of the Great Agoran Revival, Badge of the Salted Earth


Re: DIS: [Webmastor] A Github Coup

2020-06-14 Thread Jason Cobb via agora-discussion
On 6/14/20 7:04 AM, nch via agora-discussion wrote:
> A large number of members of the github were owners. Owners can 
> downgrade each other, delete repositories, and even delete the org. 
> Obviously these are all major security issues.
>
> I have made the following changes:
>
> * All members have read and write access to all repos
>
> * All members have been downgraded except me, g, and comex.
>
> Now that everyone has read and write access the vast majority of people 
> shouldn't need to be owners. Please let me know if you have a reason you need 
> to be.
>

Fine by me, although I am slightly concerned that bus factor for control
of the Github org has been lowered considerably.

-- 
Jason Cobb