linux-kernel - RE: [Ksummit-discuss] [PATCH 6/7] Code of Conduct: Change the contact email address

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ECADFF3FD767C149AD96A924E7EA6EAF80528627@USCULXMSG01.am.sony.com>
Date:   Sat, 20 Oct 2018 19:24:38 +0000
From:   <Tim.Bird@...y.com>
To:     <gnomes@...rguk.ukuu.org.uk>, <gregkh@...uxfoundation.org>
CC:     <ksummit-discuss@...ts.linuxfoundation.org>, <mishi@...ux.com>,
        <linux-kernel@...r.kernel.org>
Subject: RE: [Ksummit-discuss] [PATCH 6/7] Code of Conduct: Change the
        contact email address

> -----Original Message-----
> From: Alan Cox
> 
> > +to the circumstances. The Code of Conduct Committee is obligated to
> > +maintain confidentiality with regard to the reporter of an incident.
> > +Further details of specific enforcement policies may be posted
> > +separately.
> 
> Unfortunately by ignoring the other suggestions on this you've left this
> bit broken.
> 
> The committee can't keep most stuff confidential so it's misleading and
> wrong to imply they can.

I disagree with this assessment.  We have managed to keep most stuff
confidential to the general public in the past, to the point where it has been
argued that the TAB have not been transparent enough.  We're trying to
address that issue with the section about quarterly anonymized reports.

> Data protection law, reporting laws in some
> countries and the like mean that anyone expecting an incident to remain
> confidential from the person it was reported against is living in
> dreamland and are going to get a nasty shock.

OK - you seem to be talking about keeping the incident and reporter
confidential from the person reported against.
Certainly the  person reported against has to have the incident
identified to them, so that part is not confidential.  Many legal
jurisdictions require that the accused can know their accuser.
But these things come into play mostly when items have veered
into legal territory.  Most violation reports are not in the territory.
There's no legal requirement that the Code of Conduct committee
tell someone who it was that said they were rude on the mailing list.

> At the very least it should say '(except where required by law)'.

That might be a good to add.  It would be helpful, IMHO, to
re-visit the patch that's been floating around and see if it
can be added on top of this.

> There is a separate issue that serious things should always go to law
> enforcement - you are setting up a policy akin to the one that got the
> catholic church and many others in trouble.
> 
> You should also reserving the right to report serious incidents directly
> to law enforcement. Unless of course you want to be forced to sit on
> multiple reports of physical abuse from different people about
> someone - unable to tell them about each others report, unable to prove
> anything, and in twenty years time having to explain to the media why
> nothing was done.

The scope of the code of conduct basically means that it covers
online interactions (communication via mailing list, git commits
and Bugzilla).  Not to be flippant, but those are hardly mediums
that are susceptible to executing physical abuse.  Also, they are
all mediums that leave a persistent, public trail.  So I don't think the
comparison is very apt here.
 -- Tim