On 4/21/23 15:25, Christopher Klooz wrote:
Just a slight addition about "archaic email" and related comments:
Email and its capability for being used in conjunction with OpenPGP
ensures two major institutions in kernel development and elsewhere:
"Trusting the developers, not infrastructure" [1], and, assume "any part
of the infrastructure can be compromised at any time" [1]. This avoids
single points of failure, and complements the chain of trust.
I am not sure if Discourse is capable to be used in conjunction with
OpenPGP if it reformats contents or if it removes attachments (maybe
someone knows?). This leads to the possibility that discourse introduces
a single point of failure (or, single point of vulnerability), which
breaks the above institutions.
Having said that, as far as I follow our devel mailing list, I think the
argument above is of minor relevance, because I think this mailing list
is not used to forward code or to do reviews. Signatures seem to be not
omnipresent at the moment anyway.
From security or impersonation point of view our current mailing list
is actually the worst. Both Matrix and Discourse are at least tied to
FAS account. And while it can be considered a single point of failure,
it is at least the one which exists and is properly maintained by the
project.
We had the issue with impersonation over e-mail before, and that was not
nice.
However, I just wanted to remind that the issue is a little more complex
than just assuming "email is old and has to be replaced by modern":
there is another consideration, too. And we have to be aware that if
discourse does not support OpenPGP signatures practically, we loose the
possibility to ensure "security of integrity" in the mailing list in
cases WHEN it is necessary - IF there are such cases (which I cannot
determine).
I think we really try hard to not oversimplify the conversation to the
point of "old" vs "new", or "us" vs "them" approach, though many of the
replies in this thread are pulling us into that direction.
Matthew's mail in my opinion does a good job to highlight that there is
no single "we want a new shiny thing for newbies" driver behind the
switch. There are multiple reasons for it. And making discussions more
secure and better maintained is on that list too.
And like, hey, e-mail is a still a thing. Use it where you need it, and
where it fits. There is no fight against the technology.
But for this particular purpose within this particular environment the
mailing list just doesn't work(*), and we see it.
(*) Works = provides shared space where old and new Fedora contributors
can discuss changes and other project-related topics in a collaborative
way to advance the project.
This is the problem which we must solve. And it won't go away on its own
if just wait for it.
Again, the goal is not to fight against Fedora contributors using the
e-mail technology. The goal is to find a solution.
And if the requirement for that solution is to improve the Discourse
mail interface, can we at least try to look into it with open mind and
actually list what needs to be done to make it work.
We are a group of FOSS developers using FOSS tools, and we have a year
long plan to make the tool working for us and everyone else.
Let's maybe work on it?
Just some thoughts :)
[1]
https://www.kernel.org/doc/html/latest/process/maintainer-pgp-guide.html
Chris
--
Aleksandra Fedorova
bookwar
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
