How private is debian-private? [LWN.net]

How private is debian-private?

Posted Dec 9, 2005 3:52 UTC (Fri) by piman (subscriber, #8957)
In reply to: How private is debian-private? by thompsot
Parent article: How private is debian-private?

debian-private is a horrible name. The list isn't really private, or secure, or anything. It's just only available to a subset of Debian developers (the subset that has @debian.org email). There are what, like 3000 of us now? And anyone can apply, so you have no guarantees about who will read it.

debian-private isn't for super-secret information. It's for information the project doesn't want to be public. Almost all of that is time-sensitive, "I'll be at location X on day Y, anyone want to hang out?" or "Here's a sample press release, any comments before we send it?"

On the other hand, it contains a wealth of useful information, because all the discussion about the formation of the Social Contract and DFSG happened there -- because there wasn't yet an SC to say we should be discussing things in public. That kind of stuff should be public! It's important to free software history, and to aid people in interpreting the SC and DFSG now.

The "now anyone can read it!" argument is bogus. Anyone could read it before, if they took the time to become a DD. And when you become one, you don't have to sign an NDA. It's just an informal "don't pass this stuff around, okay?"

Heck, half the posts on -private lately have been "Why is this discussion on -private? Move it to -foo." (Oh no, did I just leak something private?)

(Log in to post comments)

How private is debian-private?

Posted Dec 9, 2005 14:53 UTC (Fri) by thompsot (guest, #12368) [Link]

If it is truly all strictly time-sensitive in nature and anyone could read it anyway, then an expiration on the "non-public" part would work. If there is truly "private" information sprinkled around in there though, possibly due to "over trust", then at least that information needs to be trimmed out I think. I thought there was an "official" understanding that this list would be private so I took my cues from that and from reading the article and only a few links from it. Not being a Debian developer (but an avid Debian user), I have never looked at the list. Thanks for clearing that up.