How private is debian-private? [LWN.net]

There is a general resolution currently under discussion by Debian Developers (DDs) on whether or not to declassify the archives of the Debian Private Mailing List. "In accordance with principles of openness and transparency, Debian will seek to declassify and publish posts of historical or ongoing significance made to the Debian Private Mailing List."

The debian-private mailing list is for "Private discussions among developers: only for issues that may not be discussed on public lists." So why open the archives?

Discussion on the debian-vote mailing list begins with this post from Anthony Towns.

One of the issues Debian often stands for is transparency and openness -- indeed, the openness of our bug tracking system is codified in the Social Contract's statement "We will not hide problems". However, one particular area of significance within the project is not open at all: the debian-private mailing list.

This list has hosted a number of significant discussions over the years, including most of the discussion inspiring the original statement of Debian's Social Contract and the Debian Free Software Guidelines, the reinvention of the new-maintainer process, debate on the qmail to exim/postfix transition for Debian mail servers and more. This trend continues today, with the six months just past have averaged around 190 posts per month.

Manoj Srivastava quickly pointed out that posters to debian-private have an expectation of privacy which should not be violated. Nonetheless the proposal received a number of seconds and a variety of amendments that would allow for part of the archive to be opened.

Some of the amendments favor opening up posts if author consent can be obtained. This may or may not extend to all authors in cases of quoted text within a post. Also if the author(s) don't respond, is that implicit permission, or not? Others favor the idea that only future content be opened, posts made after a vote changes the nature of debian-private. There were a few more labor intensive suggestions on the creation of a declassification team which could determine which posts should remain private and which should be made public. Perhaps everything more than five years old should be declassified, since much of the truly personal information should be obsolete by then.

The discussion continues. No time has been set for a vote. The latest is a counter proposal from Daniel Ruoso that attempts to bridge the gap between the need for openness and the private nature of debian-private.

to post comments

How private is debian-private?

Posted Dec 8, 2005 6:16 UTC (Thu) by mepr (guest, #4819) [Link] (1 responses)

Two sides of the coin are:
1. opening the past contents of the list violates the covenant
under which the posters posted. Most of it will be innocuous. But,
even if all messages are not left, it's still not private to those whose
messages are redacted, since context is a powerful teacher.
2. We are (almost) all glad now about the FOIA.
Which side wins?
Mark

How private is debian-private?

Posted Dec 8, 2005 14:15 UTC (Thu) by kleptog (subscriber, #1183) [Link]

I liken it to the annual opening of cabinet papers of the government from 30 years ago (in Australia anyway). It's facisnating to read what people thought back then, particularly as this is all around the time of the Vietnam war.

It's not the same, I know, because the information in debian-private was not always related to how the project was run. And parliament has always known that these papers would be released at some stage. Not being able to read debian-private I really don't know whether any of it is relevent...

How private is debian-private?

Posted Dec 8, 2005 19:19 UTC (Thu) by thompsot (guest, #12368) [Link] (2 responses)

If they posted under the understanding that it is a private list, then all their posts live in a private list. If there is a desire to open it up for the public to read, then an announcement of the change in policy should be given and anything posted after that will be open, but the old lists are still private. These particular archives would not even exist except for the fact that they were set up as a non-public exchange.

I think it's fine to stop the "understanding" or "agreement" and start a new list with new rules, but the old list should retain it's current properties because some people may have posted certain ideas or information to it based on it's current properties.

This is not a national government or tightly regulated entity where there is already an understanding that decades later information will be opened, it's a developers list for free software. I don't see any reason to blow up the trust of the people who entered one agreement/understanding and are suddenly told the agreement/understanding is proactively null and void.

'Let your "yes" be yes and your "no" be no'

How private is debian-private?

Posted Dec 9, 2005 3:52 UTC (Fri) by piman (guest, #8957) [Link] (1 responses)

debian-private is a horrible name. The list isn't really private, or secure, or anything. It's just only available to a subset of Debian developers (the subset that has @debian.org email). There are what, like 3000 of us now? And anyone can apply, so you have no guarantees about who will read it.

debian-private isn't for super-secret information. It's for information the project doesn't want to be public. Almost all of that is time-sensitive, "I'll be at location X on day Y, anyone want to hang out?" or "Here's a sample press release, any comments before we send it?"

On the other hand, it contains a wealth of useful information, because all the discussion about the formation of the Social Contract and DFSG happened there -- because there wasn't yet an SC to say we should be discussing things in public. That kind of stuff should be public! It's important to free software history, and to aid people in interpreting the SC and DFSG now.

The "now anyone can read it!" argument is bogus. Anyone could read it before, if they took the time to become a DD. And when you become one, you don't have to sign an NDA. It's just an informal "don't pass this stuff around, okay?"

Heck, half the posts on -private lately have been "Why is this discussion on -private? Move it to -foo." (Oh no, did I just leak something private?)

How private is debian-private?

Posted Dec 9, 2005 14:53 UTC (Fri) by thompsot (guest, #12368) [Link]

If it is truly all strictly time-sensitive in nature and anyone could read it anyway, then an expiration on the "non-public" part would work. If there is truly "private" information sprinkled around in there though, possibly due to "over trust", then at least that information needs to be trimmed out I think. I thought there was an "official" understanding that this list would be private so I took my cues from that and from reading the article and only a few links from it. Not being a Debian developer (but an avid Debian user), I have never looked at the list. Thanks for clearing that up.