Release 0.45

[Graeme Porteous]

Hi all,

I've created a release branch for the next Alaveteli release
(release/0.45.0.0)[1]. We plan to merge this into master and release
it early the new year - probably in the week commencing 6th Jan.

This is quite a big release as its been a whole year since 0.44. After
this release we will be trying to get 0.46 out fairly quickly which
should contain upgrades to Rails and Ruby.

Highlighted Features [2] and Upgrade Notes [3] are available in the changelog.

Please get in touch via this mailing list if you have questions or
concerns with any of these changes.

As ever, a huge thanks to everyone who contributed.

Cheers,

[1] https://github.com/mysociety/alaveteli/tree/release/0.45.0.0
[2] https://github.com/mysociety/alaveteli/blob/release/0.45.0.0/doc/CHANGES.md#highlighted-features
[3] https://github.com/mysociety/alaveteli/blob/release/0.45.0.0/doc/CHANGES.md#upgrade-notes

--
Graeme Porteous
gra...@mysociety.org

[Laurent Savaëte]

Hello!

Just taking a quick look at the changelog, there's a lot in there! You mention switching from thin to puma. We use passenger, is there any issue to be expected with that?

Thanks for keeping alaveteli going!

Laurent

[Graeme Porteous]

No issues with sticking with Passenger. It's what we use at mySociety too.

--
Graeme Porteous
gra...@mysociety.org

> --
> You received this message because you are subscribed to the Google Groups "Alaveteli Dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to alaveteli-de...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/alaveteli-dev/78374c8f-2558-4a68-8a88-39e39f4ecb2a%40gmail.com.

[Oliver Lineham]

Just a note for other operators that you might want to re-implement this feature that was, sadly, removed in 0.45:

* Remove ability to publicly view authority contact email addresses to prevent harvesting (Gareth Rees)

On our site I expect this would cause an annoying increase in volunteer workload answering questions from agencies and users.

Adding it back by theme means copying three views from core, and patching PublicBodyController and routes.

I'm not sure why it was removed, maybe Gareth can say? I don't recall any discussion of a problem. The only explanation in PR 8263 https://github.com/mysociety/alaveteli/pull/8263 was "to prevent harvesting." However, virtually all of these addresses are published already on agencies' own websites without obfuscation. In over 13 years we've never had a complaint - or even heard anything at all - about this feature causing spam problems.

Beyond that, I feel users have a moral right to know where we are sending their requests anyway.

I actually plan to make the feature more prominent as we are sometimes still asked.

(There's a proposed alternative in issue #8264 but I don't think it's quite adequate and has been closed as not planned anyway.)

Oliver

--
You received this message because you are subscribed to the Google Groups "Alaveteli Dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to alaveteli-de...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/alaveteli-dev/CAD%3D4AygGUN5A%2B-_dcrbtKTjyZDxtsaEEM8OX2nrp9PzEbgm4Pw%40mail.gmail.com.

[Graeme Porteous]

Hi Oliver,

Thanks for raising your concerns about this feature removal.

We did have an instance where this feature was being abused on WDTK,
and we took quick action to prevent email addresses from being
harvested. While we do publish the WDTK authorities [1], we don't
publish their email address as the WDTK authorities have taken our
volunteers years to build and keeping up-to-date it is a significant
undertaking.

Also, here in the UK, we list both large authorities who, as you say,
might publish their dedicated email address, but we also list much
smaller authorities such as primary schools or parish councils. We
find these are often either addresses directed to a member of staff or
even personal email addresses.

Looking at our logs at the time, I recall it wasn't even often used,
and with the code itself being outdated, the decision was made to
remove the feature. We would like to reintroduce it in some form, but
current funding constraints mean we aren't able to right now, so
adding it back in via the theme would be the best approach.

It is also worth noting requesters are able to see where their
requests are being sent via the green tick in the correspondence
header [2].

Hope you understand,

[1] http://pages.mysociety.org/wdtk_authorities_list/
[2] https://www.mysociety.org/2016/07/29/the-small-symbol-that-tells-you-all-is-well/

--
Graeme Porteous
gra...@mysociety.org

> To view this discussion visit https://groups.google.com/d/msgid/alaveteli-dev/CAOPSvnAf99HkCs3A%3D3sMOq7pE-kDZUQW-DZiKYzjWyNDnqhC%2BQ%40mail.gmail.com.

[Graeme Porteous]

Hi all,

This release has now been merged to master.

There was one additional highlighted feature and some extra dependency
updates. The full final list of changes can be read here [1].

Before upgrading please read and perform actions described in the
upgrade notes available in the Changelog [2].

Cheers,

[1] https://github.com/mysociety/alaveteli/releases/tag/0.45.0.0
[2] https://github.com/mysociety/alaveteli/blob/0.45.0.0/doc/CHANGES.md#upgrade-notes

--
Graeme Porteous
gra...@mysociety.org

[Oliver Lineham]

Thanks for the response, though I confess it still doesn't make much sense to me.

> we don't publish their email address as the WDTK authorities have taken our
> volunteers years to build and keeping up-to-date it is a significant
> undertaking.

I'm a bit surprised by this comment. We (here, at least) are an open society movement: open government, open source, open data.

> we also list much
> smaller authorities such as primary schools or parish councils. We
> find these are often either addresses directed to a member of staff or
> even personal email addresses.

As do we. Often the address for very small schools is a one board member or principal or admin person. Yet, our own Ministry of Education publishes many of these on their own site behind an API. The address is still "official information" (our law's term for information covered by FOI) since it is used for official purposes, so agencies can't expect it to stay secret. We put these addresses behind CAPTCHA as an anti-spam courtesy - but they're still public information anyone has a right to access.

> Looking at our logs at the time, I recall it wasn't even often used,

Ours seems to be used (I wonder why the difference).

> It is also worth noting requesters are able to see where their
> requests are being sent via the green tick in the correspondence
> header [2].

This is a good point, and I really must get on to coercing my outbound logs (Sendgrid -> AWS CloudWatch) into a form I can ingest into Alaveteli.

Oliver Lineham

To view this discussion visit https://groups.google.com/d/msgid/alaveteli-dev/CAD%3D4AyjKaJZ7x4oZqOGXP0aDT4PVZrOf0voFxz4-Vb2wZ%3D_ebw%40mail.gmail.com.

[Graeme Porteous]

Hi all,

Following on from the release last week, I've just made a release for
0.45.1 and intend to make more minor releases later this week. These
are only updates to the framework, and no new features will be
included. Nor will there be any new strings to translate.

Details are as follows:
0.45.1.0 - released today
Upgrading to Rails 7.1
Dropped support for Ruby 3.1
Dependency updates
and some minor updates to support the new Rails versions

0.45.2.0
Upgrading to Rails 7.2
Adding support for Ruby 3.3

0.45.3.0
Upgrading to Rails 8.0
Adding support for Ruby 3.4

When these are released, it will be announced here:
https://github.com/mysociety/alaveteli/releases

This will bring us back up-to-date with the latest versions of Ruby
and Rails. After these releases, focus will be switching to 0.46
(where we will drop support for Ruby 3.2, so please bear that in
mind). I'm hoping to release more often this year as it was 12 months
between 0.44 and 0.45, which isn't ideal.

Let me know if you have any questions.

--
Graeme Porteous
gra...@mysociety.org