Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

maintainers-list: add a GDPR note, avoid unnecessary data collection #93343

Merged
merged 1 commit into from Jul 21, 2020

Conversation

Profpatsch
Copy link
Member

Add an optional pronouns field, some documentation on the content and my own pronoun.

@grahamc is there any extra care to be taken when adding a field, to make sure evaluation is not broken?

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

Copy link
Member

@grahamc grahamc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, I don't think any existing tooling will look very carefully at arbitrary new fields, though maybe the evaluation check will confirm it matches the spec. Let's see what the PR checks say. Nice!

maintainers/maintainer-list.nix Outdated Show resolved Hide resolved
maintainers/maintainer-list.nix Outdated Show resolved Hide resolved
maintainers/maintainer-list.nix Outdated Show resolved Hide resolved
@Profpatsch
Copy link
Member Author

I made the field into a list based on feedback.

@Profpatsch Profpatsch changed the title Add an optional pronoun field to maintainers-list.nix Add an optional pronouns field to maintainers-list.nix Jul 17, 2020
grahamc
grahamc previously approved these changes Jul 17, 2020
@infinisil
Copy link
Member

Needs a new option in lib/tests/maintainers.nix for eval to work :)

@edolstra
Copy link
Member

What's the use case for this? If we don't have tools that address maintainers by pronoun, then we shouldn't add it to maintainers.nix (since it's just another bit of info that can get outdated).

@edolstra
Copy link
Member

Also, from a GDPR perspective, it's probably a good idea to minimize the amount of PII stored in the nixpkgs repo.

@Profpatsch
Copy link
Member Author

It’s for manually looking up the pronouns of maintainers before addressing them on Github, not intended for tooling.

@Profpatsch
Copy link
Member Author

Use case that prompted this: I wanted to nominate @FRidh for an RFC maintainership but was unsure of how to address them.

@glittershark
Copy link
Member

it's just another bit of info that can get outdated

it's probably a good idea to minimize the amount of PII stored in the nixpkgs repo.

This is voluntary though, right? Anyone who wants their pronouns not to be known can omit them, and if someone's pronouns change they can update them.

@edolstra
Copy link
Member

Consent can be withdrawn (right to be forgotten and all that). Ideally maintainers-list.nix would be stored outside of the nixpkgs repo so we don't have to worry about that. But in the meantime it's better to only have essential information in that file.

@glittershark
Copy link
Member

it's better to only have essential information in that file

pronouns seem to me to be equally essential to "real name"

@glittershark
Copy link
Member

if not more essential, as you can talk about a person using their github information just fine, but talking about a person without knowing their pronouns is rather cumbersome

@puckipedia
Copy link
Contributor

Full name and github username are also non-essential information; are there any tools that make use of your full name, and you can look up a github username from the user ID, so why do we have that information in there?

Consent can be withdrawn (right to be forgotten and all that).

If I were to say, GDPR the nixpkgs repository to remove any references to my name, you would already have to forcefully rewrite history. Adding pronouns to that is not going to materially change the risk profile.

@edolstra
Copy link
Member

Removing the full name would certainly be a good idea since we're indeed not using it. But this file pre-dates the GDPR by many years...

In any case that's a slippery slope argument. Just because we already have some PII doesn't mean we have to make the problem bigger, especially when there is no compelling need.

@arianvp
Copy link
Member

arianvp commented Jul 17, 2020

Personally I would suggest people putting their preferred pronouns in their github profile. There they can add, edit and revoke this information without it being stored distributedly everywhere.

@infinisil
Copy link
Member

As much as I'd love to have pronouns for maintainers, I think @edolstra makes a valid point. Git repos can't reasonably comply with GDPR for name and email, even though that's totally personal information. By introducing pronouns into the git history we just add more personal information which can't ever be deleted.

@alyssais
Copy link
Member

What you are proposing here is keeping an irrevocable permanent history of people’s pronouns. It makes anybody would want to do bad things with it one small script away from a list of which Nixpkgs contributors are trans. Even looking at the history of name changes (which we probably also shouldn’t store) wouldn’t be nearly as reliable a source. While it might be tempting to say that participating in this would be optional, it would be establishing a de facto standard location for this information, that might make people feel compelled to participate or accept having the wrong pronoun used. Compounding this is the fact that the people who will be most comfortable using this field are the people who have never changed their pronouns. If they decide to in future, they now have to choose between permanently marking themselves as somebody who changed or deleted their pronouns (which is dangerous) or leaving the wrong pronouns up. Because of this, I think that over time this list would probably result in even more people being referred to by the wrong pronouns, because of outdated entries that are dangerous to correct.

This idea is extremely dangerous. If somebody wants to publish their pronouns, they can already do that on their website or GitHub profile, without having to include that information in a large public dataset with history tracking.

@grahamc grahamc dismissed their stale review July 17, 2020 15:18

@alyssais provides compelling context

@Profpatsch
Copy link
Member Author

This idea is extremely dangerous. If somebody wants to publish their pronouns, they can already do that on their website or GitHub profile, without having to include that information in a large public dataset with history tracking.

I didn’t think of it that way, that makes a lot of sense to me. Let’s not put more information than necessary then, and ask people to check the Github profiles of maintainers, or use they/them if they don’t know (maybe the maintainer would rather leave it unclear).

@alyssais
Copy link
Member

Can this be closed, then?

@Profpatsch
Copy link
Member Author

@alyssais I added a commit that removes the field, quoting your reply anonymously. If you are okay with that of course.

A second commit adds a note concerning GDPR.

@Profpatsch
Copy link
Member Author

I would like to add a note somewhere, encouraging maintainers to put their pronouns in their Github profile if they want people to use them, but unsure where this would fit.

@alyssais
Copy link
Member

I added a commit that removes the field, quoting your reply anonymously. If you are okay with that of course.

Well, it probably doesn’t make much sense to include a commit that adds a pronoun field, and another that immediately drops it. So probably you should just drop those commits.

A second commit adds a note concerning GDPR.

Technically I believe GDPR has an exception for data that would be difficult-to-impossible to remove, which I have seen theorised could include git. (IANAL.) I think bringing the law into it is probably unnecessary anyway.

I think a note that just says that we should be wary about storing personal information in Nixpkgs, and be mindful that git makes it easy to see changes in data, and near-impossible to ever remove it, would cover it just as well without risking tempting people into armchair lawyering.

@alyssais
Copy link
Member

I would like to add a note somewhere, encouraging maintainers to put their pronouns in their Github profile if they want people to use them, but unsure where this would fit.

I think it would be better to encourage people to look at GitHub profiles and websites if they’re not sure of people’s pronouns. I think that shifts the burden to the people using the pronouns without proscribing how people should publish them, which they might not want to do in any particular way for any number of legitimate reasons. This could go in the contributor documentation.

@Profpatsch
Copy link
Member Author

Well, it probably doesn’t make much sense to include a commit that adds a pronoun field, and another that immediately drops it. So probably you should just drop those commits.

It’s useful for the commit history, since github issues are going to be lost sooner or later.

@alyssais
Copy link
Member

It’s useful for the commit history, since github issues are going to be lost sooner or later.

By that argument all proposed changes should go into the git history. I think it’s presence in the git history would imply that at some point it happened.

@Profpatsch
Copy link
Member Author

By that argument all proposed changes should go into the git history. I think it’s presence in the git history would imply that at some point it happened.

That’s reductio ad absurdum, but we can squash of course.

This change was preceded by the idea of adding a pronoun field to the
file, which we determined to be a bad idea:

* maintainers-list: add pronoun to the optional fields

I often do not know how to address maintainers, so giving them the
ability to specify their pronouns is helpful for communication
purposes.

* maintainers-list: add pronoun for Profpatsch

maintainers-list: make the pronoun field into a list

Some people have a set of pronouns they are fine with, so let’s make
that possible.

Based on feedback by somebody With An Idea™ of the topic.

* maintainers-list: remove the pronouns field

The discussion around the field raised a good point, quoting:

> What you are proposing here is keeping an irrevocable permanent
> history of people’s pronouns. It makes anybody would want to do bad
> things with it one small script away from a list of which Nixpkgs
> contributors are trans. Even looking at the history of name
> changes (which we probably also shouldn’t store) wouldn’t be nearly
> as reliable a source. While it might be tempting to say that
> participating in this would be optional, it would be establishing a
> de facto standard location for this information, that might make
> people feel compelled to participate or accept having the wrong
> pronoun used. Compounding this is the fact that the people who will
> be most comfortable using this field are the people who have never
> changed their pronouns. If they decide to in future, they now have
> to choose between permanently marking themselves as somebody who
> changed or deleted their pronouns (which is dangerous) or leaving
> the wrong pronouns up. Because of this, I think that over time this
> list would probably result in even more people being referred to by
> the wrong pronouns, because of outdated entries that are dangerous
> to correct.
>
> **This idea is extremely dangerous**. If somebody wants to publish
> their pronouns, they can already do that on their website or GitHub
> profile, without having to include that information in a large
> public dataset with history tracking.

So let’s remove it again.
@infinisil
Copy link
Member

This looks good to me if the PR title is adjusted as well

@Profpatsch Profpatsch changed the title Add an optional pronouns field to maintainers-list.nix maintainers-list: add a GDPR note, avoid unnecessary data collection Jul 17, 2020
@worldofpeace
Copy link
Contributor

What you are proposing here is keeping an irrevocable permanent history of people’s pronouns. It makes anybody would want to do bad things with it one small script away from a list of which Nixpkgs contributors are trans. Even looking at the history of name changes (which we probably also shouldn’t store) wouldn’t be nearly as reliable a source. While it might be tempting to say that participating in this would be optional, it would be establishing a de facto standard location for this information, that might make people feel compelled to participate or accept having the wrong pronoun used. Compounding this is the fact that the people who will be most comfortable using this field are the people who have never changed their pronouns. If they decide to in future, they now have to choose between permanently marking themselves as somebody who changed or deleted their pronouns (which is dangerous) or leaving the wrong pronouns up. Because of this, I think that over time this list would probably result in even more people being referred to by the wrong pronouns, because of outdated entries that are dangerous to correct.

This idea is extremely dangerous. If somebody wants to publish their pronouns, they can already do that on their website or GitHub profile, without having to include that information in a large public dataset with history tracking.

Indeed, I was thinking the exact same thing, and because of those exact reasons I would never publish this information into the nixpkgs repository. That thing would be as annoying as a gender marker on a birth certificate 🤣

@worldofpeace
Copy link
Contributor

Thanks for raising this compelling point very quickly @alyssais 👍

@Profpatsch
Copy link
Member Author

So if there is no further input, I’m gonna merge the half-line change ;)

@worldofpeace worldofpeace merged commit 8316e0c into NixOS:master Jul 21, 2020
@worldofpeace
Copy link
Contributor

Thanks @Profpatsch

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

9 participants