Re: Testing Discourse for Debian

[Russ Allbery]

Ihor Antonov  writes:

> 1. I am now limited to Web Browser with JavaScript enabled. On mobile I
> am limited to the browser or centrally owned and developed app.

Yup, this is certainly a concern.

Note that, in the message to which you're responding, I was only
attempting to answer your question (what additional moderation over what
we have now would be useful) and laying out some of the reasons why it's
worth looking at this technology.  My goal was not to write an evaluation
of the pros and cons; my goal was to point out why there are advantages.

I personally am very comfortable with email and don't have a strong
opinion here, so maybe I should have stayed out of this discussion, but I
have a bit of a knee-jerk reaction to people getting very negative about
something *before* an evaluation (and I think Debian has a bit of a
tendency to do this).

It's okay to look at new things!  Often we'll decide that we don't like
them after we look at them.  Sometimes we'll decide we like them but there
are flaws that we can't live with.  Sometimes we can even fix those flaws.
It's a process.

> Here is what is wrong with this:

>  - You are making a God-like judgement call that everyone must have
>  graphical environment running, with a hardware powerful enough to run a
>  browser with JavaScript.

I seme to have gone from zero to God rather quickly in this discussion.
It's a bit dizzying.

I'm not sure that anything else I can say here will be all this useful,
but I do want to juxtapose these two quotes from your message.  I think
they may be somewhat related.

> This line of thinking is very much alike to racial and gender inclusion
> problems. Why do you think you can make this call for everyone?

and

> It is similar to saying that learning language, etiquette and how to be
> polite, how to listen to others is too hard and not welcoming to those
> barbarians toddlers that don't know how to talk. If all they want to eat
> is sugar and candy it doesn't mean that it the right thing to do.

-- 
Russ Allbery (r...@debian.org)  

Re: Testing Discourse for Debian

[Ihor Antonov]

Unfortunately part of my original message was truncated so I will continue it 
here:

On Sunday, April 12, 2020 1:15:23 PM PDT Russ Allbery wrote:

> > Coming from a corrupted-to-the-bone post USSR country I speak from
> > personal experience of being on receiving end of that situation. You may
> > think that it is for the best, but it is not.
> 
> This is a common argument, but I find it entirely unpersuasive.
> Censorship is highly concerning when done by a government because the
> government can use force to prevent any other form of discussion except
> the one the government controls.  The idea that Debian could do this is
> absurd.
> 
> If moderation of Debian forums suppressed some problem that a lot of
> people really cared about, there would be an explosion of discussion
> elsewhere, huge uptake of the discussion in other places over which Debian
> has no control (LWN, for instance), and alternative forums being
> repurposed or newly created all over the place.
 
> This is a community full of people entirely capable of setting up a new
> mailing list or forum on the fly in an afternoon.  Debian doesn't have a
> monopoly on the press, or any realistic ability to suppress discussions.
> We couldn't be more unlike a government.
> 
> It's sadly common for people who want to fight about something on project
> forums to claim that they're being censored and unable to get their
> message out.  It's also quite dubious.  People love controversy and free
> software developers tend to be a suspicious and anti-establishment lot.
> Actual controversies with even a hint of credibility spread like wildfire.
> If no one is willing to pick up on a controversy and amplify it, it's
> worth considering the possibility that's because everyone who looked at it
> seriously has decided it's bullshit.


While I agree that there are usability aspects of email driven workflow that 
are far from being perfect, Discourse, as well as any other web browser 
focused solution is a step in wrong direction.

I much more like what https://sourcehut.org is doing. They are working on 
improving email workflows without forcing users into web browsers and I think 
this is something we should do to.

Thanks
-- 
Ihor Antonov
https://useplaintext.email

Re: Testing Discourse for Debian

[Russ Allbery]

Russ Allbery  writes:

> There does indeed appear to be some sort of problem (I haven't received
> the list copy of your message either), but your message was approved two
> minutes after you sent it, so I don't think it's with the moderation.

Ah, apologies, I was also confused by a change we made in how the messages
were processed and thought it was approved when it wasn't.

-- 
Russ Allbery (r...@debian.org)  

Re: Testing Discourse for Debian

[Russ Allbery]

Ihor Antonov  writes:

> Well, now I notice, thank you very much.

> Apr 12 21:43:38 mail.antonovs.family smtpd[46138]: bcb7c45eb6e6a5bf mta 
> delivery evpid=95394d1f34ea1dd5 from= to= proj...@lists.debian.org> rcpt=<-> source="10.193.1.100" relay="82.195.75.100 
> (bendel.debian.org)" delay=6s result="Ok" stat="250 >

> Apr 12 21:43:48 mail.antonovs.family smtpd[46138]: bcb7c45eb6e6a5bf mta 
> disconnected reason=quit messages=1

> 2 hours later it is still not in the list
> As far as I can tell my message was dropped after MTA accepted it.

There does indeed appear to be some sort of problem (I haven't received
the list copy of your message either), but your message was approved two
minutes after you sent it, so I don't think it's with the moderation.

-- 
Russ Allbery (r...@debian.org)  

Re: Testing Discourse for Debian

[Stephen Frost]

Greetings,

* Ihor Antonov (ihor@antonovs.family) wrote:
> On Sunday, April 12, 2020 1:15:23 PM PDT Russ Allbery wrote:
> > Ihor Antonov  writes:
> > > On Sunday, April 12, 2020 11:51:27 AM PDT Russ Allbery wrote:
> > >> The forum to which you sent this message is already moderated and has
> > >> been for months.  I suspect you didn't even notice.
> > > 
> > > So how then you need more moderation possibilities with Discourse?
> 
> Well, now I notice, thank you very much.
> 
> Apr 12 21:43:38 mail.antonovs.family smtpd[46138]: bcb7c45eb6e6a5bf mta 
> delivery evpid=95394d1f34ea1dd5 from= to= proj...@lists.debian.org> rcpt=<-> source="10.193.1.100" relay="82.195.75.100 
> (bendel.debian.org)" delay=6s result="Ok" stat="250 >
> 
> Apr 12 21:43:48 mail.antonovs.family smtpd[46138]: bcb7c45eb6e6a5bf mta 
> disconnected reason=quit messages=1
> 
> 2 hours later it is still not in the list
> As far as I can tell my message was dropped after MTA accepted it.

No, just held up in moderation due to, I believe, a bit of confusion
about how moderation is being done now that we have a dedicated list
alias.  I *think* the one you mentioned has now been released and is now
included- if not, please let me know.  If you see any others not
included, please also feel free to speak up, I'm fairly confident that
any which were missed from moderation were not done so intentionally.

> So much for freedom, huh?

I don't think that's terribly constructive.

Thanks,

Stephen


signature.asc
Description: PGP signature

Re: Testing Discourse for Debian

[Ihor Antonov]

On Sunday, April 12, 2020 1:15:23 PM PDT Russ Allbery wrote:

> 1. A database-driven discussion system that supports updates lets you go
>beyond the moderation that you're worried about (rejecting messages)
>and do other forms of moderation that help improve the quality of
>discussion without removing messages.  Examples include splitting
>threads that have digressed from the original topic to create more
>focused discussions, pinning important summaries so that people see the
>current status of the discusison quickly, closing old threads so that
>people properly open a new discussion instead of replying to some
>resolved discussion with a different problem, and even just sorting,
>classifying, and tagging threads so that people can find the
>discussions they care about more easily.
> 
> 2. You can indicate agreement with a proposal or message without adding
>more words that everyone has to read.  The +1 reply in email is clunky
>and adds a lot of noise.  Often it's useful to be able to get a quick
>count of participants who agree with an idea but don't want to write
>their own extended message about it.

The usability concerns that you outlined are legitimate. And some usability 
perks are 
indeed nice to have. But the price is too high:

1. I am now limited to Web Browser with JavaScript enabled. On mobile I am 
limited to the 
browser or centrally owned and developed app.

Here is what is wrong with this:

 - You are making a God-like judgement call that everyone must have graphical 
environment running, with a hardware powerful enough to run a browser with  
JavaScript. 

This line of thinking is very much alike to racial and gender inclusion 
problems. Why do 
you think you can make this call for everyone?

You can run email client on a much weaker and non-mainstream hardware.
On top of that try feeding HTML into a TTS and put yourself in a position of 
people with 
limited abilities. 

- There are only 2 browsers out there in existence (Firefox and Chrome 
variants) and 
duopoly in browser market is already alarming enough. There are much more email 
clients available.

2. I can't now use email the way I did. Discord's email interface is subpar in 
spite of what 
sales people tell you. So If I want "a first-class citizen" experience I am 
stuck with option 1 

> 3. There is some age correlation with the type of communication mechanism
>one is comfortable with, and reason to believe that younger people skew
>towards being more comfortable with forums than with email.  If you
>didn't have to learn email client skills (particularly the type that
>Debian demands, which are drastically different than how email is used
>in most jobs), it's not very welcoming to have to learn those skills in
>order to participate in the project.  

It is similar to saying that learning language, etiquette and how to be polite, 
how to listen 
to others is too hard and not welcoming to those barbarians toddlers that don't 
know 
how to talk. If all they want to eat is sugar and candy it doesn't mean that it 
the right 
thing to do.

>They're a lot less trivial than I
>think people who have been using email for a long time realize.  I've
>had nearly 30 years to hone my ability to quickly sort through huge
>quantities of email and reply in a readable way, which means it's easy
>for me to forget how much work that took, how much effort I've put into
>customizing and learning a top-end email client, and how many of the
>rules are inobvious and arcane.

Not everyone is like you.

> And yet the Internet is full of successfully moderated forums that create
> very little drama because they're just quietly more usable.

The definition of success is disputable here. "Heroin is so cool because there 
are so many 
junkies! Lets give Debian users some too"

> You have to trust the moderators, 

So far I am not convinced that I can trust you to moderate. 

> and you have to have some mechanism to
> evaluate that trust and to discuss it and possibly revoke it if something
> goes horribly awry. 

Prevention should always be the first step. Something WILL go wrong but you are
too blinded by the immediate sugar candy in front of you.

> I think it's also worth pointing out that Debian users currently trust
> Debian developers with the security of their computers, which I think is a
> higher bar than trusting other Debian developers with the moderation of
> our discussions.  > These discussions often strike me as being weirdly
> disproportional and inconsistent about how we extend trust. 

Nothing disproportionate. I can inspect their work in source code. How will I 
inspect the 
results of moderation (especially with the "Ask forgiveness not permission" 
kind of 
attitude that you are advocating)

Re: Testing Discourse for Debian

[Ihor Antonov]

On Sunday, April 12, 2020 1:15:23 PM PDT Russ Allbery wrote:
> Ihor Antonov  writes:
> > On Sunday, April 12, 2020 11:51:27 AM PDT Russ Allbery wrote:
> >> The forum to which you sent this message is already moderated and has
> >> been for months.  I suspect you didn't even notice.
> > 
> > So how then you need more moderation possibilities with Discourse?

Well, now I notice, thank you very much.

Apr 12 21:43:38 mail.antonovs.family smtpd[46138]: bcb7c45eb6e6a5bf mta 
delivery evpid=95394d1f34ea1dd5 from= to= rcpt=<-> source="10.193.1.100" relay="82.195.75.100 
(bendel.debian.org)" delay=6s result="Ok" stat="250 >

Apr 12 21:43:48 mail.antonovs.family smtpd[46138]: bcb7c45eb6e6a5bf mta 
disconnected reason=quit messages=1

2 hours later it is still not in the list
As far as I can tell my message was dropped after MTA accepted it.

So much for freedom, huh?

-- 
Ihor Antonov
https://useplaintext.email

Re: Testing Discourse for Debian

[Michael Lustfield]

On Sun, 12 Apr 2020 13:15:23 -0700
Russ Allbery  wrote:

> Ihor Antonov  writes:
> > On Sunday, April 12, 2020 11:51:27 AM PDT Russ Allbery wrote:  
> 
> [...]
> So, I should be clear that I personally have only a small amount of
> experience with Discourse and haven't looked into the details of its
> features.  But there are a lot of reasons for investigating that sort of
> forum software, more generically.  Here are a few.
> [...]

+1

Obligatory: https://xkcd.com/1782/

[I really wanted to just leave it at that, but...]

I think being able to easily indicate a +/-1 would be a huge benefit for
debian-style conversations. There are four distinct long-winded discussions
that I can immediately recall over the last year where people have reached out
to me or others over IRC to express frustration/agreement with a topic/email,
but they never mentioned it on the mailing list. These same people (myself
included) would likely have added a simple indication of approval/disagreement,
especially knowing it is not an entirely new email to be read by every reader.

I haven't used discourse yet, but if it's able to send me an email for new
conversations and updates for conversations/categories I'm subscribed to, that
means an infinitely smaller inbox, less noise, and more time/attention on the
things I care about. ... I'm sure it can, those seem like standard features.

Speaking of more recent events, I can see where certain longer-lived topic
categories would be helpful, such as a help-needed (or team-needs-help)
category. Rather than the FTP-Masters team firing off periodic emails hoping
that someone this round reads it and bites, they could create the topic in that
help-needed category and leave it for people interested in seeing how they can
help Debian.

I'm sure that same logic applies to many teams, where burn-out and and serious
demotivation happens long before anyone external to the team is aware of the
problem, which exasperates simpler problems. Continuing to pick on my favorite
team... this is applies ftp-masters, where the training process itself is
extremely demotivating simply because of the lack of manpower available for
reviewing our reviews.

A lot of these supposed benefits are speculation, since I haven't used the
service yet, but it's probably time to check out this new-fangled forum stuff.
At a glance, it looks like these features (and other subscription refinements)
are available. They sound like they could (possibly) drastically improve how we
communicate, raise concerns, gather consensus, etc.

Cheers,
-- 
Michael Lustfield

Re: Testing Discourse for Debian

[Russ Allbery]

Ihor Antonov  writes:
> On Sunday, April 12, 2020 11:51:27 AM PDT Russ Allbery wrote:

>> The forum to which you sent this message is already moderated and has
>> been for months.  I suspect you didn't even notice.

> So how then you need more moderation possibilities with Discourse? 

So, I should be clear that I personally have only a small amount of
experience with Discourse and haven't looked into the details of its
features.  But there are a lot of reasons for investigating that sort of
forum software, more generically.  Here are a few.

1. A database-driven discussion system that supports updates lets you go
   beyond the moderation that you're worried about (rejecting messages)
   and do other forms of moderation that help improve the quality of
   discussion without removing messages.  Examples include splitting
   threads that have digressed from the original topic to create more
   focused discussions, pinning important summaries so that people see the
   current status of the discusison quickly, closing old threads so that
   people properly open a new discussion instead of replying to some
   resolved discussion with a different problem, and even just sorting,
   classifying, and tagging threads so that people can find the
   discussions they care about more easily.

2. You can indicate agreement with a proposal or message without adding
   more words that everyone has to read.  The +1 reply in email is clunky
   and adds a lot of noise.  Often it's useful to be able to get a quick
   count of participants who agree with an idea but don't want to write
   their own extended message about it.

3. There is some age correlation with the type of communication mechanism
   one is comfortable with, and reason to believe that younger people skew
   towards being more comfortable with forums than with email.  If you
   didn't have to learn email client skills (particularly the type that
   Debian demands, which are drastically different than how email is used
   in most jobs), it's not very welcoming to have to learn those skills in
   order to participate in the project.  They're a lot less trivial than I
   think people who have been using email for a long time realize.  I've
   had nearly 30 years to hone my ability to quickly sort through huge
   quantities of email and reply in a readable way, which means it's easy
   for me to forget how much work that took, how much effort I've put into
   customizing and learning a top-end email client, and how many of the
   rules are inobvious and arcane.

Not everyone cares about this sort of thing, but I would wager that Debian
is currently skewed towards people who cope well with email because we
have good email skills as a bar to entry.  Expanding the set of people who
can effectively contribute requires looking outside our own comfort zone.

> I do not advocate for free-for-all. It is just the ability to decide on
> who gets to say what should not be in the hands of a single person /
> small group, it is way to easy to get corrupted/biased/controlled.

And yet the Internet is full of successfully moderated forums that create
very little drama because they're just quietly more usable.

You have to trust the moderators, and you have to have some mechanism to
evaluate that trust and to discuss it and possibly revoke it if something
goes horribly awry.  This is work that should be done, but it's work
that's very doable.

I think it's also worth pointing out that Debian users currently trust
Debian developers with the security of their computers, which I think is a
higher bar than trusting other Debian developers with the moderation of
our discussions.  These discussions often strike me as being weirdly
disproportional and inconsistent about how we extend trust.  We trust each
other with hugely important and critical things, and then are full of
mistrust about minor and often quite trivial things, such as whether or
not one gets to have the final word in some war of words that nearly
everyone will have forgotten by next month.

> Coming from a corrupted-to-the-bone post USSR country I speak from
> personal experience of being on receiving end of that situation. You may
> think that it is for the best, but it is not.

This is a common argument, but I find it entirely unpersuasive.
Censorship is highly concerning when done by a government because the
government can use force to prevent any other form of discussion except
the one the government controls.  The idea that Debian could do this is
absurd.

If moderation of Debian forums suppressed some problem that a lot of
people really cared about, there would be an explosion of discussion
elsewhere, huge uptake of the discussion in other places over which Debian
has no control (LWN, for instance), and alternative forums being
repurposed or newly created all over the place.

This is a community full of people entirely capable of setting up a new
mailing list or forum on the fly in an afternoon.  Debian doesn't have

Re: Testing Discourse for Debian

[Charles Plessy]

Le Sat, Apr 11, 2020 at 03:05:12PM -0700, Sean Whitton a écrit :
> 
> For any technical topic (including DEPs) it is important that we can
> find old discussions in the future, easily, and without there being too
> many entrypoints into the search.

Hi Sean,

in my experience of DEP driver and Policy editor, long discussion
archives, especially when they spread over multiple years, are a barrier
to contribution.  Not only they are increadibly noisy (think for
instance of discussion archives in the BTS mostly made of quotes of the
previous messages), but also they are not even comprehensive (for
instance when part of the discussion happens on IRC or at Debconf).

In that sense, I would expect structured discussion systems such as
Discourse to be a potential time saver, and therefore lower the barrier
for contribution to everybody: those who contribute their point of view,
and those who summarise them.

Have a nice day,

Charles

-- 
Charles Plessy
Akano, Uruma, Okinawa, Japan

Re: Testing Discourse for Debian

[Ihor Antonov]

On Sunday, April 12, 2020 11:51:27 AM PDT Russ Allbery wrote:
> Ihor Antonov  writes:
> > And separately, I got interested in Debian because it was using mailing
> > lists in the first place.  Mail is decentralized by design and this is
> > why it is so important for freedom of speech.
> 
> I don't understand this comment.  Mailing lists are inherently centralized
> by design.
> 
> > Now you suggest a centralized platform for communication, because it is
> > easier to moderate (oppress freedom of speech). To me it sounds like:
> > "Yes you can talk, but only if you do it on my terms, on my territory".
> > Moderation is a slippery slope, using centralized communication platform
> > is one step closer to dictatorship.
> 
> The forum to which you sent this message is already moderated and has been
> for months.  I suspect you didn't even notice.

So how then you need more moderation possibilities with Discourse? 

> That said, I will argue that "yes, you can talk, but only if you do it on
> my terms, on my territory" is a message that the Debian project should
> send about its own communication channels.  (Obviously people can go
> create their own and that's no business of ours.)  That's how we create a
> community that can get things done together, rather than a 4chan
> free-for-all full of abuse and trolling.

> We should think carefully about both the terms and the territory and be
> both gentle and understanding, but we will not successfully create a free
> Linux distribution (the actual point, after all) within the noise of
> complete freedom from consequences in communication.
> 
> I don't believe Debian is or should be a welcoming home for people who
> care more about the ability to say anything they want whenever they want
> in project forums than about making a free software distribution together.
> And yes, these two goals do sometimes come into conflict (although we can
> try to minimize how often that happens).

I do not advocate for free-for-all. It is just the ability to decide on who 
gets to say 
what should not be in the hands of a single person / small group, it is way to 
easy to 
get corrupted/biased/controlled.

Coming from a corrupted-to-the-bone post USSR country I speak from personal 
experience of being on receiving end of that situation. You may think that it 
is for the 
best, but it is not.


-- 
Ihor Antonov
https://useplaintext.email

Re: Testing Discourse for Debian

[Russ Allbery]

Ihor Antonov  writes:

> And separately, I got interested in Debian because it was using mailing
> lists in the first place.  Mail is decentralized by design and this is
> why it is so important for freedom of speech.

I don't understand this comment.  Mailing lists are inherently centralized
by design.

> Now you suggest a centralized platform for communication, because it is
> easier to moderate (oppress freedom of speech). To me it sounds like:
> "Yes you can talk, but only if you do it on my terms, on my territory".
> Moderation is a slippery slope, using centralized communication platform
> is one step closer to dictatorship.

The forum to which you sent this message is already moderated and has been
for months.  I suspect you didn't even notice.

That said, I will argue that "yes, you can talk, but only if you do it on
my terms, on my territory" is a message that the Debian project should
send about its own communication channels.  (Obviously people can go
create their own and that's no business of ours.)  That's how we create a
community that can get things done together, rather than a 4chan
free-for-all full of abuse and trolling.

We should think carefully about both the terms and the territory and be
both gentle and understanding, but we will not successfully create a free
Linux distribution (the actual point, after all) within the noise of
complete freedom from consequences in communication.

I don't believe Debian is or should be a welcoming home for people who
care more about the ability to say anything they want whenever they want
in project forums than about making a free software distribution together.
And yes, these two goals do sometimes come into conflict (although we can
try to minimize how often that happens).

-- 
Russ Allbery (r...@debian.org)  

Re: Testing Discourse for Debian

[Ihor Antonov]

On Friday, April 10, 2020 11:59:59 AM PDT Neil McGovern wrote:
> 
> What about forums.debian.net?
>   I have no interest in interacting with a community of users and
>   moderators who allow blatent Code of Conduct violations to go
>   unchecked.

As a newcomer I am genuinely interested to understand this. 

Readings this it looks like there is a split in Debian community.
And Instead of fixing problems with people who moderate forums Debian
just decides to throw in another tool into the mix? And part ways with Debian 
Forum 
community? 
Sorry, makes little sense to me.

And separately, I got interested in  Debian because it was using mailing lists 
in the first 
place.  Mail is decentralized by design and this is why it is so important for 
freedom of 
speech.  Now you suggest a centralized platform
for communication, because it is easier to moderate (oppress freedom of 
speech). To me 
it sounds like: "Yes you can talk, but only if you do it on my terms, on my 
territory". 
Moderation is a slippery slope, using centralized communication platform is one 
step 
closer to dictatorship.


-- 
Ihor Antonov
https://useplaintext.email

Re: Testing Discourse for Debian

[Enrico Zini]

On Sat, Apr 11, 2020 at 03:05:12PM -0700, Sean Whitton wrote:

> Right now I can rely on my notmuch database to pull basically any Debian
> discussion, because it includes the BTS, lists, and mail which I was
> CCed on or received through an alias like ftpmaster@.  And one can
> easily incorporate mboxes from master.d.o or bugs.d.o to get any missing
> context.[1]

I think archival's a very good point, especially for a DEP-like
discussion. You also implicitly propose an archiveal format that I like,
namely some kind of email mailbox.

I'd say that having a mailbox for archival would not be necessarily
needed during a discussion, and would make sense once the discussion is
declared closed.

Discourse has some email gatewaying, which as far as I understand loses
some metainformation like reactions or polls. It would be something I
thing should be preserved from an archival point of view.

Does Discourse have some kind of export feature, that one could
postprocess to get for example a mailbox of annotated emails?


> Could you say more about how you think Discourse would have changed how
> the discussion went?

Things that the current list discussion doesn't easily give:

 - +1 kind of feedback, or simple agreement, tends to unexpressed:
   people only reply if they have a problem with things, and shut up
   otherwise.
   
   For example, the recent Salsa as OIDC provider discussion had a
   relatively small amount of people contributing: does it mean that a
   lot of people just agree, or does it mean that only few people care?

   Silent assent and only negative feedback is a very demotivating
   process to go through putting a proposal up for discussion.

 - Some kind of weighting of posts. Sometimes I wonder: "is it just me,
   or this objection is not that relevant?", and I have no real way to
   know, besides maybe polling my social bubble, which could be biased.

   Ranking of perceived importants of topics or aspects discussed might
   have helped me manage the energy I put into the whole discussion,
   going into more detail where I could see there was more interest or
   concern.


> I am concerned that the problem is basically a social one, and so cannot
> be solved just by using a different software stack to host discussions.

Ish. I think there are may social aspects involved, and the same time
the process that we currently use has technical or traditional limits
which filter against various kinds of feedback which people would
socially be happy to give.

I follow list discussions and some messages make me go "yay! Standing
ovation!" and some messages I skip after reading part of the first line,
and some messages make me furious. Socially we might able to express
that in a way that feeds into the quality and direction of discussions,
but technically, we currently cannot.


Enrico

-- 
GPG key: 4096R/634F4BD1E7AD5568 2009-05-08 Enrico Zini 


signature.asc
Description: PGP signature

Re: Salsa as authentication provider for Debian

[Enrico Zini]

On Sat, Apr 11, 2020 at 09:47:39PM +0200, Tollef Fog Heen wrote:

> We quite regularly have upstreams getting access for weird architecture
> failures.  There's no particular reason for those people to have salsa
> accounts.

I understand those are temporary accounts. Do those cases need an
arbitrary name from the LDAP namespace?

Several places I worked with use a pool of time-limited accounts from a
guestNNN namespace, for example: that could address your use case
without overlapping with anything else.


> It does to me, since suddenly we have to care about what's on salsa,
> something we've never had to care about before.

As I said in 20200409181701.3qqsn5sqq3xbu...@enricozini.org, no, you
don't need to care about anything: you keep doing what you want, and we
deal with it.


So far, I only received requests to keep the status quo as it is
indefinitely, and very little in terms of counterprosals actionable now,
besides theoretical new software solutions to be explored, that would
address the problems I am having.

I want to be very clear on this: I have no intention of keeping the
status quo as it is now: either it becomes something that I can manage,
or I'll stop managing it.


Enrico

-- 
GPG key: 4096R/634F4BD1E7AD5568 2009-05-08 Enrico Zini 


signature.asc
Description: PGP signature

Re: Salsa as authentication provider for Debian

[Luca Filipozzi]

On Sun, Apr 12, 2020 at 08:21:49AM +0300, Andrei POPESCU wrote:
> On Sb, 11 apr 20, 19:27:53, Julien Cristau wrote:
> > On Sat, Apr 11, 2020 at 10:04:55AM +0300, Andrei POPESCU wrote:
> > > 
> > > I must be missing something so I'm asking: what is the *benefit* of 
> > > avoiding collisions with Debian accounts?
> > > 
> > f...@salsa.debian.org and f...@debian.org both existing and referring to
> > different people risks causing confusion.  I'd like to understand why
> > we're going that way.
> 
> If I understand correctly, then, using the -guest suffix would allow for 
> foo-gu...@salsa.debian.org and f...@debian.org both existing and 
> referring to different people.
> 
> In my opinion this still doesn't significantly reduce the risk of 
> confusion while also being quite unfriendly should the foo-guest user 
> ever wish to become a Debian Member.

This is why having a central approach to account creation, rather than
distributed, is worth considering. I'm in favour of usernames not
changing because one's role changes but that does not mean I'm favour of
divergent namespaces.

-- 
Luca Filipozzi


signature.asc
Description: PGP signature

Re: Salsa as authentication provider for Debian

[Tollef Fog Heen]

]] Sam Hartman 

> > "Tollef" == Tollef Fog Heen  writes:
> 
> Tollef> ]] Enrico Zini
> >> For guest accounts opened by DSA directly, it can be pretty much
> 
> First, at this point in time I would be very skepticle of someone
> contributing to Debian enough to need porter box access but not having a
> salsa account.
> It's possible, but  that would be a yellow flag for me in evaluating
> such a request.

We quite regularly have upstreams getting access for weird architecture
failures.  There's no particular reason for those people to have salsa
accounts.

> However, as I read the guest account process, it has a number of manual
> steps where people are processing tickets.
> I suspect that DSA actually has a script or set of scripts that go
> create the guest account.

That varies.  It's LDAP, people sometimes use the ud-* suite of tools,
sometimes ldapvi.  Is salsa also going to check for debian.org accounts
when creating and renaming accounts on its side?

> Having these scripts check to see if the name is registered at salsa and
> requiring manual override to create an account if it conflicts with
> salsa and appears to belong to a different user is not, in my mind,
> making DSA's ldap subservient to the salsa LDAP.

(Salsa doesn't use LDAP, afaik)

It does to me, since suddenly we have to care about what's on salsa,
something we've never had to care about before.  It also breaks the
invariant people have been able to trust so far, that foo@salsa.d.o is
also foo@d.o (assuming both exist).  This will no longer hold true, and
I think we'll run into security problems down the line because of it.

-- 
Tollef Fog Heen
UNIX is user friendly, it's just picky about who its friends are