From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mp1.migadu.com ([2001:41d0:403:4876::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by ms13.migadu.com with LMTPS id 4IkhM9ImeWaPsAAA62LTzQ:P1 (envelope-from ) for ; Mon, 24 Jun 2024 07:57:06 +0000 Received: from aspmx1.migadu.com ([2001:41d0:403:4876::]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) by mp1.migadu.com with LMTPS id 4IkhM9ImeWaPsAAA62LTzQ (envelope-from ) for ; Mon, 24 Jun 2024 09:57:06 +0200 X-Envelope-To: larch@yhetil.org Authentication-Results: aspmx1.migadu.com; dkim=none ("invalid DKIM record") header.d=msavoritias.me header.s=20210930 header.b=fpKZqzXA; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org"; dmarc=fail reason="SPF not aligned (relaxed)" header.from=msavoritias.me (policy=none) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=yhetil.org; s=key1; t=1719215826; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:list-id:list-help: list-unsubscribe:list-subscribe:list-post:dkim-signature; bh=AbFUxYMZG4Qe3Dn3YqYXEI+XEOAUFhMAofZK+cKDTqs=; b=nCel9Vxq8F7T7xcK5W9g7ju3dwh2+hty/SDe2DOgbpsoAGH31X4QqP7vCQtcq4HCVoiywv PvyN+0Cfo2kyr34zHHMvwqLTVocQ/9EppituAuy1M9L+vtYQrqUn7ujJdF2aftk4Vbk0FN bfLL01tGantZHBc2cKwavUwKvzTRhzr8GB7XHC5get9PsIOSadB4bJ0kU8FUboHs+ps5bv HchI6C8zSqM87qv5RXsr68oitVfpa31iT82CREGgoEEHv5TY3+CguzFRPycFuoaa6lDrsd zqyBpRUYqODbQHHuMJKP0yDYlXmfFiDPnVHdmQpVtXGGAru8xw0D4BakZunEBQ== ARC-Authentication-Results: i=1; aspmx1.migadu.com; dkim=none ("invalid DKIM record") header.d=msavoritias.me header.s=20210930 header.b=fpKZqzXA; spf=pass (aspmx1.migadu.com: domain of "guix-devel-bounces+larch=yhetil.org@gnu.org" designates 209.51.188.17 as permitted sender) smtp.mailfrom="guix-devel-bounces+larch=yhetil.org@gnu.org"; dmarc=fail reason="SPF not aligned (relaxed)" header.from=msavoritias.me (policy=none) ARC-Seal: i=1; s=key1; d=yhetil.org; t=1719215826; a=rsa-sha256; cv=none; b=sJ5z1eFsnqZTTSlCq4coLWBwEUWwgRq3E6HNcltPYqXgFh7XK088pRqmuUX0YxFIRbpCDS i/o4DVftYwe1sryiKyt8xGVi+PmjjzMN/4RLByXe1Y9QswXyQarK+HX93C41fc9q5lh9Cm DirjlcwW19ReZr6pO4g5YbVQOHXrv+dZIY8h2ewAHGlzwgvypBtFJTXn2EczuzPN/tFveK IRc60XXbobOimjbiBb61QcyH5XzrBQv6VitnBfhcO/1EnQmskyv+TFrR7Mbtq5gP70WxIo sqkqozXXMF6gyzfB7AzrnnTG2SxArqFye9K590bJ/BlbtAMVBNf8uSkxq98shw== Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by aspmx1.migadu.com (Postfix) with ESMTPS id 9FD8CDF39 for ; Mon, 24 Jun 2024 09:57:06 +0200 (CEST) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1sLeYj-0003NM-UN; Mon, 24 Jun 2024 03:56:17 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sLeYi-0003NB-Ic for guix-devel@gnu.org; Mon, 24 Jun 2024 03:56:16 -0400 Received: from mail.webarch.email ([81.95.52.48]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1sLeYf-0005uA-E6 for guix-devel@gnu.org; Mon, 24 Jun 2024 03:56:15 -0400 Received: from [127.0.0.1] (localhost [127.0.0.1]) by localhost (Mailerdaemon) with ESMTPSA id 86B781A82F29; Mon, 24 Jun 2024 08:55:58 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=msavoritias.me; s=20210930; t=1719215771; h=from:subject:date:message-id:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:references; bh=AbFUxYMZG4Qe3Dn3YqYXEI+XEOAUFhMAofZK+cKDTqs=; b=fpKZqzXA/WoFKfXH+ATYpkzCgQruTSfiHo5sOz7J23N9pakqoYxD1jCHGPi0y3EDX1rOrQ eefcoRmJBe88IvYM8i3kZGUORvCHE7H8UCPa4qEqmAErmYN7OUFt3lrB/I2ny2YSRnKPj/ Wvtzw5yctsJS1G7BZal39FU4pLneH0qUYT0cp/4b48zjwaqEhm/kRUkt6EXuVBnq9TeiZD AKqvJMCEVHhNRHif69zKtt5Cc4I7rk9dTAr8ktK76sJ8knOUAEi3ZydLoGfW2H5bHcPTX7 EHOkuS6PSKDi5yT6ANluWZ4EWW/kchmAmMHUS2QOb1uIHT8V68mC7Q/9hCu6jg== Date: Mon, 24 Jun 2024 10:55:56 +0300 From: MSavoritias To: Ricardo Wurmus Cc: Richard Sent , Andreas Enge , guix-devel@gnu.org Subject: Re: About SWH, let avoid the wrong discussion Message-ID: <20240624105556.7e92bc20@fannys.me> In-Reply-To: <87cyo8zrd4.fsf@elephly.net> References: <20240618113717.4a6bad2b@fannys.me> <87msnebsfd.fsf@gmail.com> <20240621121213.419da774@fannys.me> <20240621134439.5bc324b4@fannys.me> <87zfrdazzn.fsf@freakingpenguin.com> <20240622174242.7e1a18d5@fannys.me> <87cyo8zrd4.fsf@elephly.net> X-Mailer: Claws Mail 4.1.1 (GTK 3.24.41; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Last-TLS-Session-Version: TLSv1.3 Received-SPF: pass client-ip=81.95.52.48; envelope-from=email@msavoritias.me; helo=mail.webarch.email X-Spam_score_int: -16 X-Spam_score: -1.7 X-Spam_bar: - X-Spam_report: (-1.7 / 5.0 requ) BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: guix-devel@gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+larch=yhetil.org@gnu.org Sender: guix-devel-bounces+larch=yhetil.org@gnu.org X-Migadu-Country: US X-Migadu-Flow: FLOW_IN X-Spam-Score: -2.27 X-Migadu-Queue-Id: 9FD8CDF39 X-Migadu-Scanner: mx10.migadu.com X-Migadu-Spam-Score: -2.27 X-TUID: CQoRCnDd/blb On Sat, 22 Jun 2024 21:53:27 +0200 Ricardo Wurmus wrote: > MSavoritias writes: > > >> To clarify. I am specifically opposed to a change in official Guix > >> packages that allows for this statement: > >> > >> "Do not upload automatically to software heritage, and no one else can > >> either." > > > > Let me put this more clear Richard, the statement above that archiving should be off by default means: > > > > - Guix respects the consent of the person using guix lint and their expectations. (that lint actually lints) > > - Respects their privacy > > - Respects their autonomy. > > User autonomy is not curtailed by informing an aligned service's crawler > that an update has occurred. You have a first class option to disable > whatever checks you don't want to run. That's autonomy. It is in the sense that you haven't gotten the consent of the person running the linter on something that happens outside the context of "linting code". I have posted this elsewhere but see https://www.consentfultech.io/ Its about not assuming things on behalf of the person running the tool. Specifically for stuff that are more "sensitive" like operations that don't involve linting code. > Since time immemorial "guix lint" has done more than strictly checking > that code is formatted correctly. "guix lint" is a contributor's tool. > Its features encode values that "we" want to preserve as new packages > are added. The intended purpose of "guix lint" is to encourage "high > quality" packages. We arrived at this meaning of "high quality" (as > approximated by the workings of "guix lint") through years of collective > work on packages. Since we've seen source code disappear, which negates > Guix reproducibility guarantees by robbing users of Guix of their > practical freedoms to the software, the modules of "guix lint" include > discouraging the use of volatile URLs (like generated tarballs), > suggesting the use of mirrors, and relatedly notifies SWH that the Guix > software collection is about to change to increase your chances of > getting identical source code years from now. All that because software > freedom is void without source code. Maybe then the tool needs to be renamed? Or more ideally a new subcommand `guix lint contribute` should be added. Because from the places I asked in xmpp and here it seems everybody that is not reading the docs or knee deep in guix project, assumes it just lints and is surprised it does more things. > Here is a list of other checks that talk to the internet: > > --8<---------------cut here---------------start------------->8--- > - home-page: Validate home-page URLs > - source: Validate source URLs > ... > - cve: Check the Common Vulnerabilities and Exposures (CVE) database > - refresh: Check the package for new upstream releases > - archival: Ensure source code archival on Software Heritage > --8<---------------cut here---------------end--------------->8--- > > Are these all privacy leaks? Are they in opposition of the goals of > "guix lint"? In opposition to the goals of those who use "guix lint"? > If so: why? This has actually been mentioned yeah. In the xmpp room I have there were a lot of people surprised that a linter was added and would like to see it being opt-in. Lets be honest here irc is a tech place exclusively these days so you will rarely find new arguments. Maybe putting a poll in activitypub/masto would help :) > > Now if you want to disagree that people should have privacy or > > expectations then I fear we are becoming the next Google. > > This is jumping the shark, and I think it is a statement that is > (unintentionally?) rather insulting to those of us who have been > contributing to Guix for a long time and have spent many excess calories > wringing their brains to make sure Guix is not your average tech bro > project. > > It is disappointing to see the levity with which statements of this > severity are dropped here. The Guix community that I choose to remember > was less prone to making inflammatory statements when disagreements > became apparent. > You are right I did assume things about your opinions when I shouldn't. I apologize. I am glad that you and others have been trying to make this into a welcoming project, its one of the reasons I joined after all :D Of course that doesn't mean we can't do better, and this thread has made that pretty apparent. In a whole set of different terms that is. I would say also that as the Guix community becomes larger its going to be necesserily less homogenous. Especially if we (the Guix Project) are doing our it right. As a counterpoint I know a lot of people who choose not to join the mailing lists specifically due the culture so to speak. Seeing how this thread has devolved I am wondering what the next steps would be to address this. Seeing as diversity and a welcoming environment wasn't kept. Open to suggestions of course :) MSavoritias