Module Proposal: Mozilla Communities Web Services

[Majken Connor]

I have been working with Tom Farrow (tad) and some other community members
to put together a proposal for better delivering Web Services to
Communities.This would restructure the delivery of services like hosting,
domains and emails which are currently provided to communities. Creating a
module would provide clear authority around these services, as well as
allowing communities to be equal stakeholders in what services are
delivered, and how.

The module also creates accountability on the part of communities which
will allow for better communication between resource owners and the groups
that provide them (eg Community Ops), faster problem solving (eg downtime
recovery), and impact (better supported sites are better quality sites).

This document is what we think is realistic plan for implementing the
module.
https://docs.google.com/a/mozilla-community.org/document/d/1zXuNp8dwyLOW-UqZ4FqcRVxhszHWYqgjClDKZ5kYrTQ/edit?usp=sharing

This document is a our vision of what the module could become once fully
implemented:
https://docs.google.com/document/d/1YdNWOy7QNc1xXcnHGN5IW4HhRgRJCjOdKMu_gHFjUM4

We are proposing that the module be called Mozilla Communities Web
Services, that Tom Farrow be the module owner, and that myself and Michael
Kohler be peers. Suggestions for additional peers are welcome, but the
intention for now is to add people as they take on leadership roles.

Questions and suggestions are of course welcomed.

[Benjamin Kerensa]

I'd encourage that a peer be from the Mozilla InfoSec Team to audit and vet
the accesses to user data that volunteers are being given access too.

If a security issue arose on any of these community hosted platforms
Mozilla would take a PR hit for not having vetted the processes and access
to user data.

> _______________________________________________
> governance mailing list
> gover...@lists.mozilla.org
> https://lists.mozilla.org/listinfo/governance
>

[David Ascher]

Good to see a proposal.

I think it'd be good to articulate a bit more of the plan and its purpose,
before diving into the details of module structure, which feel a bit
premature to me.

In particular, I'd like to understand:

- what kinds of websites does Mozilla offer / underwrite, and for what
purpose? Same for domains and email services.
- how does someone ask for such services, what are the criteria we use, etc?
- why does it make sense for Mozilla to provide these services on hardware
we control (virtualized or not) as opposed to underwriting/managing hosted
services run by people who do this at scale?
- to bkerensa's point, how do we mitigate the various risks associated with
hosting content on behalf of someone else
- how does this relate with other community-facing and community-managing
activities across Mozilla, especially those that are focused on local and
regional -- Reps, Mozilla Clubs, campus campaigns, etc.

I'd also like to understand a bit of a roadmap -- what's the state of
affairs now, where are we trying to go, by when, etc.

--david

[Majken Connor]

I'll take a first go at answering these questions, but Pierros or Tom might
have important info to add:

On Tue, Feb 16, 2016 at 12:25 PM, David Ascher <d...@mozillafoundation.org>
wrote:

> Good to see a proposal.
>
> I think it'd be good to articulate a bit more of the plan and its purpose,
> before diving into the details of module structure, which feel a bit
> premature to me.
>
> In particular, I'd like to understand:
>

There is some context that applies to many of these questions in that
several years Mozilla decided to support community sites with resources,
both financial and technical. The group providing the technical resources
is almost entirely volunteers (Community IT which became Community Ops).
The idea was not to obtain any *control* over the sites, though
centralizing some resources, like domains, creates a much better
experience. We've been providing these services under the umbrella of
Community Ops, even though they aren't all Ops tasks. That is one of the
issues that would be solved through the creation of a module.

>
> - what kinds of websites does Mozilla offer / underwrite, and for what
> purpose? Same for domains and email services.
>

Mostly regional community sites, though we have also managed project
related sites, like the Firefox 10 site and the community Discourse. This
proposal is meant to cover the decentralized community sites. Experiments
like Discourse fit under the new Participation Software Lab (ParSoL).

> - how does someone ask for such services, what are the criteria we use,
> etc?
>

Currently it's a Reps request which is reviewed by at least one member of
Reps council. This was because Reps better know the communities and could
make sure the request is coming from the right place. The criteria have
evolved a bit, but generally they have tried to make sure the resource has
a reliable owner (Rep or staff because of official commitment to Mozilla)
and an existing project - the community has needed to exist for 6 months.
So a single person can't say hey, I want to *start* a community, give me
resources.

Part of the purpose of this module is that we'd have the mandate to review
this process and improve it. Reps Council is too busy.

> - why does it make sense for Mozilla to provide these services on hardware
> we control (virtualized or not) as opposed to underwriting/managing hosted
> services run by people who do this at scale?
>

Not all communities have the resources to run their own website. Many
communities are only running a WordPress blog. Also many communities are
much more idealistic and don't trust these other organizations as much as
they trust Mozilla.

Also, and this is a big deal to us, open can't just be about writing
websites. To keep it open, people need to also be able to publish. If we
provide these services on resources that we manage, we are providing our
volunteers with a place to develop skills necessary to maintaining an open
internet. At least two of us have gotten jobs out of our contributions to
Community Ops.

> - to bkerensa's point, how do we mitigate the various risks associated
> with hosting content on behalf of someone else
>

This is a good question. We're doing it already, I'm not sure what
difference a module would make. I don't know if it makes a difference that
this is a volunteer managed project. However, supporting this group of
people who wish to develop these skills would provide more oversight than
exists now. We're Mozillians, we care about privacy and we want to do it
right. As you can see from the proposal we do want support from different
functional areas to provide expertise so that these sites are effective and
kept to a high standard.

> - how does this relate with other community-facing and community-managing
> activities across Mozilla, especially those that are focused on local and
> regional -- Reps, Mozilla Clubs, campus campaigns, etc.
>

I suppose the same way that Reps relates to Participation Infrastructure.
This is specifically about providing the web services to these groups.

>
> I'd also like to understand a bit of a roadmap -- what's the state of
> affairs now, where are we trying to go, by when, etc.
>

Short version is, again creating a module gives us a mandate to answer
these questions. I think the only other alternative is to decide we're not
providing these resources at all. However if they're being provided then we
need clear authority and accountability to do a good job.

Happy to provide a longer version with specifics, but I have a meeting now
and want to send this off.


>
> --david
>
>

[David Ascher]

Thanks Kensie --

I wholeheartedly support the general idea of trying to bring some cohesion
to the systems that still allow decentralized expression by volunteers of
Mozilla in their local context. We can and should make it easier for
people to create web presences and collaborative spaces where they can
communicate with each other, publish, build software, advocate, etc.

Ideally this happens in a way that combines local customization and deep
localization while neither requiring that everyone develop all of the
skills needed to make world-class websites, and while providing
coordination support so that activities in one location are effectively
cut-off from activities elsewhere.

Ideally this is also a system that makes it easy for there to be multi-way
coordination between staff and volunteers, between locations, between
people interested in a topic regardless of location or staff status.

If this is the kind of thing you're talking about, I'm 100% in support, and
I think the scope is broader than just technical website support.

I suggest we separate the skills training benefits from the service
definition and delivery models. The "what" of the service should be
determined by a crisp analysis of what community activities make sense to
encourage & facilitate -- it could be websites, it could be other things --
and the skills needed to implement those could range from design frameworks
to security auditing, ops or even social media management and marketing.
Regardless, I'm sure there will be opportunities for skills development to
happen as part of service delivery.

With that frame, it feels to me like defining a module isn't the obvious
next step. I'd be more keen in an approach that, without needing a priori
"authority", gathers a set of stakeholders who can articulate a vision &
plan, identify "business needs" (including the needs of the local
communities), and deliberately ignores how things are happening today. We
can then map those needs to systems that we have and may want to adapt
(including the current community websites and community ops, and the
systems that IT are currently providing), or systems we need to build anew.

I'm happy to help.

--david

[Majken Connor]

On Tue, Feb 16, 2016 at 4:04 PM, David Ascher <d...@mozillafoundation.org>
wrote:

I have some objections here. First of all is the scope creep. It would be
great to do more, but just because it would be great to do more doesn't
mean that all of it should be done as a whole. We have real resources that
we're providing to real communities that frankly have been provided very
poorly for the past year because of the lack of structure and authority. I
don't see why this module can't exist, and then be swallowed up by a larger
module as such a program expands. As it is the scope here is pretty broad.
I'm sure everyone reading this understands that more than webdev goes into
a good website. We have included things like security audits, and branding
updates in our proposals. Branding tasks are left off of the initial
roadmap because consulting with Branding, they're in the midst of some
reorganizing and can't at the moment tell us what sorts of standards they
would suggest for sites.

Also, a priori authority is necessary. Especially with volunteers. A staff
member has a place in the org chart and the authority structure is built
in, even if it's not explicit for a specific project. This is lacking for
volunteers and as I said, has been blocking those of us managing the
delivery of these resources from doing the kind of job we'd be proud of. If
you have a suggestion for providing us the authority to do this planning
work besides a module that would be worth considering. We can redesign what
services should happen, but we also can't ignore the ones that already
exist. One of the first tasks we plan to undertake is documenting a
definitive list of the stakeholders on the communities side, necessary work
if we're going to revisit entirely what value decentralized community sites
provide, and how they should exist.

Basically it feels like this - we've been providing a product, with an
entirely volunteer team, and we're asking to officially be made owners of
the product, and you're suggesting that before that happens, the product
should be entirely revisited and reevaluated. Can we not do that as owners
of the product?

I would be interested in discussing this more and better understanding what
you have in mind, but we'd also want assurances that formulating a new
approach will actually progress, and that we'd be given real authority in
these discussions, and to improve the services that are currently being
provided until such a time as they're being replaced.

[David Ascher]

I may be missing some background. Can you explain what you would do as
module owners that you can't do today, and/or whose code or actions you
seek to influence as module owner?

[Michael Kelly]

I think approving a module for Mozilla Communities Web Services would be
a great low-cost way to support the community sites that we're already
providing resources for. That this is just writing down a process that's
already happening is a good sign for it's viability, I think.

I also really like the proposal to start with a single module and
experiment with what structure works for your purposes. We should
totally do this!

- Mike Kelly

[Tom Farrow]

Having a module would provide us with a formal, designated home, and
documented ownership structure that complies with the rest of Mozilla.

Organisationally at this point, the work we are doing fits under MCS, but
it's really unclear where MCS "formally" exists. This is about writing down
what's already happening.

I absolutely don't see a need for us to reevaluate our work before the
module exists, and in fact this might harm us. With no formal entity that
we can assign things to within Mozilla, over the years, ownership and
authority has become unclear. We're now working in line with our planning
that Kensie referred to earlier on, and a module will allow us the
formality of such authority being assigned to a real structure within
Mozilla.

(quoting because in-line isn't ideal with gmail)

"Can you explain what you would do as
module owners that you can't do today, and/or whose code or actions you
seek to influence as module owner?"

Kensie might want to add to this, but this is largely about our own work,
not about other people's work. We manage the review/triage process for
these sites, and we handle service provision. There's no clarity or
documentation on who specifically "we is", and that's what I'd be excited
about correcting here.

--
*Tom Farrow*
* Participation Volunteer*
Mozilla

[Majken Connor]

On Tue, Feb 16, 2016 at 11:53 PM, David Ascher <d...@mozillafoundation.org>
wrote:

> I may be missing some background. Can you explain what you would do as

> module owners that you can't do today,
>

Make decisions.

> and/or whose code or actions you seek to influence as module owner?
>

Firstly, the communities who are receiving the resources - we need to
document ownership of these resources (which could be done without a
module) but having a module serves these communities by establishing a
formal process for designating ownership and for changing ownership of
these assets. Having a module for this also empowers communities to have a
say in who maintains this list and makes decisions when there is conflict.
If we are not maintaining the list, or if we're are choosing sides in a way
these communities object to, this list and the module structure gives them
tangible recourse.

After that we want to have fair, enforceable standards for how these
resources are used (this is all covered in the proposal). We want a plan
for inactive sites, and authority to enact those plans. We want communities
to commit to assigning owners that are responsive when contacted. Again,
using a module gives communities recourse if they disagree with the plans,
or how they are being enforced. Not only by making it clear who are making
these decisions, but again to appeal to the module governance structure if
they feel ownership should be changed.

Next, there are several groups who have wanted to provide resources to
communities and have no idea how - at least because of the lack of
documented ownership of these sites. Bugs are filed in bugzilla against
community sites, for example for security issues. This module, and the
clear authority structure and communication channel it would provide will
make it very simple for functional teams to communicate with site owners.
It could be security wanting to help patch a vulnerability, WebDev wanting
to help improve a theme, branding wanting to help replace outdated logos.
There are also the Community X groups including, but not only, Community
Ops that could have a great impact servicing sites and growing skills, that
will also rely at least on the documentation of ownership of these sites.

We also would like to have at least some control over budget. We have had a
plan to move to cheaper options for hosting for over a year now. We're only
now practically looking at moving things over. We don't pretend that we can
just ask teams for money and be able to determine how much we get and use
it without consultation, but right now we aren't even given a number that
we need to stick to. Maybe it's not that we as the owners get control over
budget at all, but at least that there is a clear item on someone's budget
for our things and we're invited to the table to discuss how much is needed
and if it's being well used.

[David Ascher]

Thanks Kenzie. This set of reasons makes sense to me.

My offer to help if/when scope changes stands.
--David

[Majken Connor]

We'd love help. Let's try and find some time later to talk about where
you'd like to see this go? A lot of the work we need to do around improving
what already exists would lay very good groundwork for expanding
relationships and projects. For example, we need to do some formal
analytics to understand what impact these sites are having, and what impact
sites could aspire to. There is definitely a marketing component here, and
doing this work can build a relationship between the interested communities
and marketing, which could then be expanded to supporting the communities'
marketing efforts in other ways.

Also I just want to add emphasis to *willing* communities. It is our belief
that if our ideas are good, then people will buy into them. If they don't
buy into them at first, then they will after we prove the positive impact
with early adopters, or they will be proven right when the impact we
imagined doesn't materialize. It will be our responsibility to make sure we
are serving the communities, and not forcing communities to serve us. We
share a common goal, supporting Mozilla's mission and doing the best job we
can. Naturally there will sometimes be strings attached in the cases where
we are providing resources to the community, not just structure, but we are
committed to making sure those strings are fair for the communities
receiving them and for the groups providing them. Activities that enable
communities to reach that goal should sell themselves. Sometimes this will
be hard, but we are prepared for that.

On Wed, Feb 17, 2016 at 11:14 AM, David Ascher <d...@mozillafoundation.org>

[Rubén Martín]

Hello,

Historically the Mozilla Reps Program has been in charge of most
decisions concerning local communities and volunteer resources (and we
still are).

I have a major flag here since it's unclear to me the authority this
module would have to decide on them. Authority and accountability that
currently the Reps Council has and it's widely recognized as a
governance body representing the core volunteers population.

To whom this module would be accountable to? Should it take decisions
without review from a body that represent the community? Why?

I will run this also with the Reps Council because just recently learned
that certain decisions we are already accountable for will be under this
module and I feel we don't agree with that.

Cheers.

El 16/02/16 a las 16:41, Majken Connor escribió:

--
Rubén Martín [Nukeador]
Mozilla Reps Mentor
http://www.mozilla-hispano.org
http://twitter.com/mozilla_hispano
http://facebook.com/mozillahispano

[Majken Connor]

We actually proposed this module with guidance from other council members
and with Pierros' blessing.

The services provided by this module have never been provided through Reps.
We only used Reps Council to verify the "authority" of the people making
the requests to make the requests. That wasn't working well and Reps
Council doesn't have time to maintain this responsibility.

If you read the previous messages in this thread, you'll see that David and
I did discuss accountability.

This proposal has been accessible to you for a long time. If you reach out
to us, we would be more than happy to explain the module and the program in
more detail.

On Fri, Jun 17, 2016 at 3:58 PM, Rubén Martín <nuke...@mozilla-hispano.org>
wrote:

[Rubén Martín]

Hi,

I disagree, Reps Council has been a body with the authority to decide on
resources and deal with possible conflicts for communities since day
zero and Reps Council has an already recognized authority.

I don't understand what was not working well in your opinion and also I
don't agree on the part that Council doesn't have time for that. I've
been personally taking that responsibility for reviews from Council side
for years and never expressed a lack of time.

I raise this concern now because I've just received and email telling me
that Council is not longer in charge of certain decisions that I
understand that were not part of this module description when we first
read it.

Cheers.

El 17/06/16 a las 16:05, Majken Connor escribió:

> We actually proposed this module with guidance from other council
> members and with Pierros' blessing.
>
> The services provided by this module have never been provided through
> Reps. We only used Reps Council to verify the "authority" of the
> people making the requests to make the requests. That wasn't working
> well and Reps Council doesn't have time to maintain this responsibility.
>
> If you read the previous messages in this thread, you'll see that
> David and I did discuss accountability.
>
> This proposal has been accessible to you for a long time. If you reach
> out to us, we would be more than happy to explain the module and the
> program in more detail.
>
> On Fri, Jun 17, 2016 at 3:58 PM, Rubén Martín

> <nuke...@mozilla-hispano.org <mailto:nuke...@mozilla-hispano.org>>

> > gover...@lists.mozilla.org <mailto:gover...@lists.mozilla.org>

[Majken Connor]

I want to address publicly that we know you've been doing this task for
years. Deb took over from me and you took over from Deb. We have also been
having issues with you not understanding your scope in this role the entire
time.

We are not denying reps council role in dispute resolution and we did run a
plan past council to get their opinion that it wouldn't cause undue
disputes and to give reps council a heads up that their dispute resolution
services may be necessary. You should have seen this and several other
emails to council. We also included a council member as a peer.

As I said, if you reach out to us we would be happy to clear up any other
misunderstandings.
On Jun 17, 2016 4:13 PM, "Rubén Martín" <nuke...@mozilla-hispano.org>
wrote: