Handling attacks on a community

A recent message to the debian-project mailing list by Debian project leader (DPL) Sam Hartman is about a proposal to moderate the mailing list. There have been repeated attacks on various project members and the distribution itself posted to the list over the last few years, many from sock-puppet, throwaway email accounts, which spawned a recent discussion on the debian-private mailing list; Hartman was summarizing that discussion for those who are not on the private list. But the problems on debian-project (and other Debian public lists) are kind of just the tip of the iceberg; there is an ongoing, persistent effort to roil the distribution and its community.

The discussion on debian-private happened while Hartman was taking a vacation; his summary was partly from catching up with his email and also a continuation of the consensus building work he has done during his DPL term. The debian-private discussion led to a bug report that asked for debian-project to become a moderated list "for the time being", which is where Hartman suggested the technical discussion on how to do the moderation should go. In parallel with the private discussion, there was also a thread on the project list about how distributed moderation of a mailing list might work. The idea is that multiple moderators could help filter out messages from new subscribers to the list.

Moderating a mailing list can be controversial in free-software communities, but Hartman's summary and the thread on how to actually go about doing it indicate that there is a fairly strong consensus that the problems need to be addressed. As he put it:

It is not hard to find examples of the kinds of messages that are being targeted (e.g. here, here, here, and here for fairly recent examples). It is also clear that many participants on the mailing list have concluded who is behind at least some of the anonymous/pseudonymous attacks: Daniel Pocock. In fact, Pocock was the subject of a different message from Hartman on debian-project; while he did not directly connect the dots between the messages and his action expelling Pocock from the Debian project entirely, it is hard not to come to the conclusion that the two are related.

Hartman's message was meant to explain why he felt his action as DPL was reasonable under the Debian Constitution but more detail on the expulsion was provided in Hartman's reply to an "intent to package" (ITP) bug filed by Pocock. Hartman noted that normally the project "avoids discussing expulsions in public", but that Pocock's use of the term "Debian Developer" and attempts to act as one after having that status revoked caused the project to make an exception. Hartman also described the expulsion in some detail:

It is also hard not to connect the dots between the moderation effort, expulsion, and Hartman's comments in his announcement that he would not be seeking a second consecutive term as DPL. That message, which is well worth reading in its entirety, is a sober reflection on how his term has matched up with his campaign platform. It is a balanced look at his successes and failures as DPL. Tucked into the end of that message, though, is a cautionary tale for his successor.

The damage wrought to the community is really the crux of the matter. Projects and their communities do have the right, and, some would say, the responsibility, to determine who is allowed to be a part of their community. Regardless of the merit of the accusations, a community can conclude that someone has stepped over the line and can no longer be associated with it. Freedom of association cuts both ways.

It is also worth noting that, so far at least, no one has thrown their hat into the ring to run for DPL. The call for nominations went out on March 7 and the nomination period ends March 14. If the current situation persists, the nomination period may need to be extended, as it was last year. Hartman's warning may be giving potential candidates pause.

Debian is not the only organization to have complained about Pocock's behavior. In May 2019, the list of subscribers to Free Software Foundation Europe (FSFE) mailing lists was obtained and used inappropriately, according to FSFE President Matthias Kirschner:

Said third-party is identified as "Daniel Pocock and/or Ready Technology (UK) Limited", but the message makes it clear that the FSFE believes that Pocock was, at a minimum, involved in this.

More background, at least from the FSFE side, can be found in a lengthy message from General Assembly member Florian Snow. There may well be legitimate concerns that Pocock has with the FSFE organizational structure, as noted in this message, for example, but his tactics are seemingly not welcome in that community. As Michael Kesper put it in response to a message from Pocock, where he pointedly does not deny the list-subscription manipulation: "We as a community want to communicate with respect to each other as otherwise no community can survive."

The situation is undoubtedly messy, but it is the case that several organizations have determined that the behavior is not something they want in their communities. Fedora also removed Pocock's blog from its Planet Fedora blog aggregator due to Code of Conduct violations. Clearly Pocock believes he is being unfairly treated by these projects, which is not surprising, but is also not really germane to the question at hand. Communities must set their own standards and individuals need to either stay within the bounds—or go elsewhere. Continuing to engage, or attack, communities that have, wrongly or rightly, excluded you is as clearly wrong as it is counterproductive. On the flipside, communities must try to ensure that they are even-handed and reasonable; sometimes reputations and even employment can be seriously affected by actions of this sort.

Dissent within a community is to be expected and should be welcomed—as long as the manner of dissenting stays within the community bounds. Opinions and complaints, even if they are not shared widely, are typically not "censored" or otherwise hindered so long as they are respectfully presented. Personal attacks, veiled threats, innuendo, and the like, however, are generally seen as "not respectful" even in a community as notoriously fractious as Debian. Dissent is important, but so is community. There is a balance to be struck and it is up to the community to do so for itself.