How private is debian-private?
In accordance with principles of openness and transparency, Debian will seek to declassify and publish posts of historical or ongoing significance made to the Debian Private Mailing List."
The debian-private
mailing list is for "Private discussions among developers: only
for issues that may not be discussed on public lists.
" So why open
the archives?
Discussion on the debian-vote mailing list begins with this post from Anthony Towns.
This list has hosted a number of significant discussions over the years, including most of the discussion inspiring the original statement of Debian's Social Contract and the Debian Free Software Guidelines, the reinvention of the new-maintainer process, debate on the qmail to exim/postfix transition for Debian mail servers and more. This trend continues today, with the six months just past have averaged around 190 posts per month.
Some of the amendments favor opening up posts if author consent can be obtained. This may or may not extend to all authors in cases of quoted text within a post. Also if the author(s) don't respond, is that implicit permission, or not? Others favor the idea that only future content be opened, posts made after a vote changes the nature of debian-private. There were a few more labor intensive suggestions on the creation of a declassification team which could determine which posts should remain private and which should be made public. Perhaps everything more than five years old should be declassified, since much of the truly personal information should be obsolete by then.
The discussion continues. No time has been set for a vote. The latest is
a counter
proposal from Daniel Ruoso that attempts to bridge the gap between the
need for openness and the private nature of debian-private.
Posted Dec 8, 2005 6:16 UTC (Thu)
by mepr (guest, #4819)
[Link] (1 responses)
Posted Dec 8, 2005 14:15 UTC (Thu)
by kleptog (subscriber, #1183)
[Link]
It's not the same, I know, because the information in debian-private was not always related to how the project was run. And parliament has always known that these papers would be released at some stage. Not being able to read debian-private I really don't know whether any of it is relevent...
Posted Dec 8, 2005 19:19 UTC (Thu)
by thompsot (guest, #12368)
[Link] (2 responses)
I think it's fine to stop the "understanding" or "agreement" and start a new list with new rules, but the old list should retain it's current properties because some people may have posted certain ideas or information to it based on it's current properties.
This is not a national government or tightly regulated entity where there is already an understanding that decades later information will be opened, it's a developers list for free software. I don't see any reason to blow up the trust of the people who entered one agreement/understanding and are suddenly told the agreement/understanding is proactively null and void.
'Let your "yes" be yes and your "no" be no'
Posted Dec 9, 2005 3:52 UTC (Fri)
by piman (guest, #8957)
[Link] (1 responses)
debian-private isn't for super-secret information. It's for information the project doesn't want to be public. Almost all of that is time-sensitive, "I'll be at location X on day Y, anyone want to hang out?" or "Here's a sample press release, any comments before we send it?"
On the other hand, it contains a wealth of useful information, because all the discussion about the formation of the Social Contract and DFSG happened there -- because there wasn't yet an SC to say we should be discussing things in public. That kind of stuff should be public! It's important to free software history, and to aid people in interpreting the SC and DFSG now.
The "now anyone can read it!" argument is bogus. Anyone could read it before, if they took the time to become a DD. And when you become one, you don't have to sign an NDA. It's just an informal "don't pass this stuff around, okay?"
Heck, half the posts on -private lately have been "Why is this discussion on -private? Move it to -foo." (Oh no, did I just leak something private?)
Posted Dec 9, 2005 14:53 UTC (Fri)
by thompsot (guest, #12368)
[Link]
Two sides of the coin are:How private is debian-private?
1. opening the past contents of the list violates the covenant
under which the posters posted. Most of it will be innocuous. But,
even if all messages are not left, it's still not private to those whose
messages are redacted, since context is a powerful teacher.
2. We are (almost) all glad now about the FOIA.
Which side wins?
Mark
I liken it to the annual opening of cabinet papers of the government from 30 years ago (in Australia anyway). It's facisnating to read what people thought back then, particularly as this is all around the time of the Vietnam war.How private is debian-private?
If they posted under the understanding that it is a private list, then all their posts live in a private list. If there is a desire to open it up for the public to read, then an announcement of the change in policy should be given and anything posted after that will be open, but the old lists are still private. These particular archives would not even exist except for the fact that they were set up as a non-public exchange.How private is debian-private?
debian-private is a horrible name. The list isn't really private, or secure, or anything. It's just only available to a subset of Debian developers (the subset that has @debian.org email). There are what, like 3000 of us now? And anyone can apply, so you have no guarantees about who will read it.How private is debian-private?
If it is truly all strictly time-sensitive in nature and anyone could read it anyway, then an expiration on the "non-public" part would work. If there is truly "private" information sprinkled around in there though, possibly due to "over trust", then at least that information needs to be trimmed out I think. I thought there was an "official" understanding that this list would be private so I took my cues from that and from reading the article and only a few links from it. Not being a Debian developer (but an avid Debian user), I have never looked at the list. Thanks for clearing that up.How private is debian-private?