[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: What changes do you want in Debian?

Hi Raphaël

On 2021/03/19 11:13, Raphael Hertzog wrote:
> when I look back at my old platforms[1][2]3] I can already see a trend
> where we move from "concrete changes that we want to see in Debian" to
> "some vague idea of how we want to run the project" but this trend seems
> to have continued and amplified to the point that this year none of the
> platforms speak of any change that would affect something in how we build
> our operating system or how we collaborate together or of how we
> envision our role in the free software ecosystem!

I'm kind of surprised to see you say that, since I didn't think that my
platform was vague at all, and that it was quite focused on some very
important issues within the project.
> All the topics are around Debian (how we recruit, how we handle the
> money) but I see no desire to lead Debian in any direction and I find this
> particularly sad. The election time used to be a very active period where
> we would confront our ideas for the future, but this has fallen short
> as can be witnessed from the low-activity right now in debian-vote
> and as can be seen by the small number of candidates.

I also miss the more active discussion on -vote, and I value your
questions here. For the 2019 vote we had 4 candidates and the discussion
was especially lively and I think also useful.

In terms of Debian, I think it's important to differentiate between the
Debian project, and our products (just as you would differentiate
between say, Canonical and Ubuntu). Sometimes conversation get muddied
when we just refer to everything as Debian. Do I understand correctly
that you'd also want to see more technical leadership from the DPL? Or
do you mean that you'd like to see bigger project-wide changes being
enacted by the DPL?

> We're at the point where we congratulate ourselves because someone stepped
> up to be DPL and we're happy that the process has not yet stopped working
> entirely.
> With that said, there could be many questions to be asked but I will
> concentrate on three:
> 1/ Why have you all given up on the idea to lead Debian? It seems
>    to me that you are happy with the DPL being a super-intendant
>    and nothing more.

I think that's a rather presumptuous question. I also don't think that
I've given up on the idea of leading Debian at all.

My campaign for the last year was based on bringing stability and a
sense of "business as usual" and normality to the Debian project. I
believe that the project needed it. I read Sam's reply and agree with
his reasoning regarding COVID-19, but I think the project needed this
even if it wasn't for the pandemic. Overall, and personally speaking, I
feel satisfied that we've managed to accomplish that over the last year.

I know that might also sound somewhat self-congratulating, and it might
even sound like it was a very passive accomplishment, but I can assure
you that it was not. Behind the scenes I've dealt with many
inter-personal issues that have either been boiling over for a while, or
that was about to. In a few of these cases these issues have even been
resolved. In others, resolution was just not possible and the best we
could do was just to cool it down for a bit. Then there are some cases
where I could just say "we'll deal with this later please be patient"
and it's still on my todo list. I say we a lot here, because I don't
take the credit for all that work myself. At some points DAM was very
involved, in others the community team, in others a combination of
people from both, sometimes input from previous DPLs, outside legal
advisors, and other individual DDs.

I'm not particularly good with time tracking but the amount of hours put
in to dealing with inter-personal issues has been tremendous, and I
think it was all worth it, and I think a stable project is *absolutely*
critical in making fertile grounds for innovation. I think over the last
year I've also gotten our members to be more comfortable with spending
project money. I think we can improve that even further with some more
policy. I also want to make people more comfortable with doing new
things and taking risks, I know that you were a bit hesitant to post to
-project about funding Debian projects in Debian with money from
Freexian's LTS service, and surprised that there wasn't more opposition,
but that's one of the rewards that stability brings, when there's a
greater sense of stability, our members will feel more comfortable
taking on some risk and try something new. In an alternate universe I'd
be curious to see what would happen if that mail[1] arrived on -project
a year earlier.


Regarding "It seems to me that you are happy with the DPL being a
super-intendant and nothing more"...

Well, I agree that the DPL shouldn't just be an administrator that takes
out the trash and replaces the light bulbs for a year, but I want to
circle back a bit to the difference between the difference between the
Debian project and Debian GNU/Linux. On a technical basis, we have 100s
of people actively working on technical challenges within the project. I
think it's reasonable for the DPL to be hands-off when it comes to
technical problems unless it has escalated to that point. Also, while we
have 100s of technical people working on fixing issues and innovating in
bug reports, discussions, sprints, git repositories, etc. We really only
have the DPL who cares for the project over the breadth and depth that
the DPL does. I think with that comes an intrinsic responsibility to pay
attention to project-wide and systemic problems that affect the whole
community. Yes, often problems on that scale are really boring, come
with a lot of grunt work, is invisible, isn't very rewarding, comes with
a lot of baggage, etc etc, but that's where I think the DPL's primary
focus should be. I do think that it's great if the DPL can also help
steer technical and project ideas, and initiate more discussion. I've
done plenty to facilitate discussion over the last year, setting up
meetings in teams where people usually don't talk much to each other,
and I think some of our mini DebConfs wouldn't have happened either if I
didn't push or instigate more of that. I even set up our jitsi instance
that got plenty of usage outside of the mini DebConf events. I think the
DPL does better as an enabler than a driver. Remove the roadblocks for
innovation and give DDs the resources they need to push their agendas,
rather than just pushing the ideas of one person. The leader of the
project should address tough issues that no one else can, the innovation
should be up to the rest of the members, and the DPL should be
responsible for making sure that people are empowered to do so.

At least, that's my view, and I hope that that answers your question.

> 2/ What changes would you like to see happen in Debian? Say
>    your top 3 (or 5 if you are motivated) things that you would change if
>    you could do them with some magic.

1. Since there's magic involved, can I use my first wish to wish for a
thousand more wishes? (https://xkcd.com/1086/)

2. We really need to sort out Debian's organisational / legal existence.

The Debian project is an unincorporated association of volunteers[2].

There's a lot to unpack there.

Firstly, in legal terms, we're recognised differently depending on
country or state. In some regions (like California, Québec, England,
South Africa and others) an association of volunteers can put together a
constitution and membership and that's enough to be able to register a
bank account and even hire employees or sue someone (and in turn be
sued). I've been told (although haven't gotten solid legal advice on
this) that in some parts of the world an association of volunteers means
nothing unless it's registered/incorporated.

Probably a good time to point out that I'm not a lawyer, I'm working on
information that I've received from multiple sources and from people who
know a bit about the law. So instead of taking anything I say as gospel,
go do your own reading and/or talk to a legal expert.

When someone sues a corporation, the corporation is treated as a person
and when damages are paid, it's the corporation that pays that, the
personal funds owned by the shareholders/owners are safe. From what I
understand, this isn't true everywhere for an unincorporated association
of voluneteers. In our case, if someone wanted to sue Debian for some
reason they could go after individuals and the project couldn't offer
them much protection.

Our association worked in the early days because we considered SPI our
backing organisation. In many ways this was fine, SPI manages our funds,
when we need a contract they draw it up (or help draw it up) and sign it
on our behalf, and best of all they can accept tax-deductible charitable
donations on behalf of the project.

Probably a good time to mention that I say "we" a lot there meaning the
Debian members of the time, back in the mid 90's I didn't yet know what
Debian was, but I've had some good conversations with people that were
involved at the time which gave some good insight on the history.

Since then, we've grown to have more trusted organisations[3]. We've
even set a criterion selection of what a good TO should look like[4],
although, despite containing the name "Criteria" in its title, none of
those criteria is enforced. In fact, the Debian project doesn't have any
form of contract or legal agreement with our TOs whatsover. This raises
multiple red flags. To name just a few real-life problems, last year a
legal firm didn't want to work with us because they didn't recognise us
as an organisation, when we explained that we're working with SPI, they
saw us as a project of SPI and insisted that SPI should handle the case.
This was clearly a case that Debian should be taking care of and we
insisted on that. So the legal firm then asked for the agreement between
SPI and Debian. Unfortunately, such an agreement doesn't exist anywhere.
The agreements between the organisations are built on what's basically
"gentleman's agreements" where it's verbal and based on who was at the
conversation at a particular time. This also bit us last year when the
DebConf sponsors team (this is the team that works with the companies
who donate to DebConf, it's unrelated to bursaries or package
sponsoring) raised a concern about a 5% fee that SPI charges on incoming
DebConf donations. Apparently, there was an agreement made quite some
while ago that SPI would not charge this fee, and for some time until
recently, they didn't. The exact details is a bit fuzzy to me, but what
I have is that in one conversation, some people from SPI and some people
from DebConf agreed to the waiver of the fee at a talk over dinner at a
restaurant. Who exactly was there and what exactly was discussed is even
more fuzzy. SPI has also grown to not only doing what they do for
Debian, but also a bunch of other projects, and it is working to make
its services a bit more cookie-cutter and consistent across these
projects. So, with DebConf's 5% waiver being so inconsistent with the
way incoming donations work for Debian and the other SPI projects, they
wanted to fix this, so some SPI people spoke to a previous DPL along
with some other random DDs at DebConf and agreed to reverse the waiver
of the 5% fees. Meanwhile no one from the DebConf sponsors team got this
memo, and jumped through some hoops and effort to direct donations to
SPI from other TOs because they believed it would save DebConf / the
project some charges. Needless to say, there was some great unhappiness
about this issue. It's a huge problem when we have nothing on paper and
we really need to start working like grown ups here. A TO can basically
do whatever they want and there's nothing we can do about it. I'm not
giving permission there, just stating an unfortunate fact. For instance,
ffis has gone defunct, we're having trouble getting in touch with who
was key members, and we have no idea what happened to the money (few
thousand euros) that it had in its accounts on behalf of Debian. Since
it's a standalone organisation with no official ties to either Debian or
our other TOs, there's really nothing we can formally do about it. We've
tried to reach out to them because we care more about helping out the
individuals involved than about the money, but to no avail. We have a
similar situation with DebConf e.V. in Germany that was founded for
DebConf15. It's at risk of having to pay 8% GST backtaxes on all the
revenue it made because its paperwork isn't being filed (well, at least
according to our latest knowledge), but again, we don't have any say
there or any formal relationship.

That's quite a few real-life red-flags, but the potential risks that our
current setup exposes us too over the next few years are gargantuan. If
it won't be an external entity who wished to do harm to Debian, we could
even just end up imploding to our own general incompetence.

Please, tell me I'm not the only one who thinks that all of this is
incredibly reckless and stupid.

This is why, in my campaign, I started introducing the idea of an
incorporated non-profit for Debian. Something lightweight that will
match membership of the project, that we can use to officially represent
the project everywhere. An organisation that still leverages the idea of
TOs, but can also manage our relationships with our TOs better. I could
go on but for the purposes of the magical wish I think I've made my point.

Also to be clear: there's lots of value in the work that SPI and TOs do,
and I think we should continue to rely on them in the future.

[2] https://en.wikipedia.org/wiki/Voluntary_association
[3] https://wiki.debian.org/Teams/Treasurer/Organizations
[4] https://wiki.debian.org/Teams/DPL/TrustedOrganizationCriteria

3. Make it a lot easier to contribute to Debian

It's still too difficult and complicated to get involved in Debian. I
mentioned better onboarding in my previous campaign, and while the NM
process itself has improved significantly (not my work though), we still
need better onboarding because it's still difficult even for technical
people. For instance, I talked to several people at previous DebConf who
struggled with basic things like getting a wiki account, we have pages
like "How you can help Debian"[5] and "Contributing to the Debian
project"[6], but we could really need something with concrete starting
points like explaining how we use mailing lists, what salsa is, etc.
Perhaps with some nice illustrations and links to upstream tutorials.
Could perhaps make a nice little booklet.

[5] https://www.debian.org/intro/help
[6] https://www.debian.org/doc/manuals/debian-faq/contributing.en.html

4. Remove more technical hurdles and barriers to using Debian GNU/Linux

There was a pretty good discussion on debian-devel recently about
firmware inclusion on official images. Also potentially about splitting
off firmware into a seperate repository from non-free and including that
on at least some official media. Unfortunately, more and more devices
are getting more and more complicated and need to load firmware from
disk. Also unfortunately, these tend to be universally non-free. If I
really had some magic to spare, I'd make all the firmware available as
free software, in the meantime I think we might have to consider making
some sacrifices on some media, like the Debian live media, since even
many newer sound cards are starting to depend on non-free firmware
packages. At the same time I'm concerned of a slippery slope that it
could produce, and about compromising our values. Alternatively, we
could also start lobbying companies for more free firmware, it doesn't
seem that the FSF or OSI is doing much to campaign for those unfortunately.

There are also some lower hanging fruit where I felt we could do better.
Last year I installed plain Debian (as apposed to raspbian) on a
raspberry pi, and was surprised to see some large obvious bugs. I
encouraged people from the raspberry pi team to get some more hardware
that Debian will cover, and it did help, I think getting more hardware
in the hands of DDs will nearly always improve hardware enablement and
in turn the experience of our end users.

> 3/ There seems to be some consensus that we should be better at embracing
>    changes. But what can we do to be better at this?

My wishlist #5 would be for more support, but since that ties in with
this question I'll put it here. It's really common for people to say
that it's hard to change things and that it's difficult moving things
forward, but whenever someone proposes a new idea it's almost those same
people who want to rip that idea apart by playing a devil's advocate. I
think that if someone has a new idea and they're enthusiastic about it,
we should support it. Sure we could point out some pitfalls and risks,
but it should be in the context of supporting the person and their
project, especially if it's to low risk to the project and especially if
they could ultimately end up learning more from the effort.

> [1] https://www.debian.org/vote/2002/platforms/raphael

"""In my opinion, the main tasks of the leader are "organization" and
"communication".""" <- interesting :)

> [2] https://www.debian.org/vote/2007/platforms/hertzog
> [3] https://www.debian.org/vote/2008/platforms/hertzog

The DPL boards seem to still come up every year, I think it's not a bad
idea but I still think it's good having one person who can fast-track
decisions and approvals, especially if it's clear-cut. I see peb asked
about that in a separate mail while I was typing out this one, will
reply there tomorrow.


Reply to: