Call for seconds: Delegate to the DPL

[Bill Allombert]

Dear Developers,

I offer the following ballot option for your consideration.

----- GENERAL RESOLUTION STARTS -----

The Debian developers delegate to the Debian Project Leader the task of issuing
a Public Statement about the 'EU Cyber Resilience Act and the Product Liability
Directive' that addresses Debian interests in the matter.

----- GENERAL RESOLUTION ENDS -----

Respectfully submitted,
Bill.

[Jonathan Carter]

Hi Bill

On 2023/11/24 19:14, Bill Allombert wrote:
> I offer the following ballot option for your consideration.
>
> ----- GENERAL RESOLUTION STARTS -----
>
> The Debian developers delegate to the Debian Project Leader the task of issuing
> a Public Statement about the 'EU Cyber Resilience Act and the Product Liability
> Directive' that addresses Debian interests in the matter.
>
> ----- GENERAL RESOLUTION ENDS -----

I follow your logic in proposing this, although my interpretation of
¶5.1.4[0] in our constitution leads me to believe that the DPL does not
need any delegation for this, so perhaps the intention becomes more of
"Let the DPL decide".

In February I posted[1] about the CRA to debian-project[1]. My intention
was to get a few good people to spend some time to focus on this, since
my available bandwidth for this was low (and continued to be since then).

I'm not sure that it's a good idea to leave it as a DPL task, it might
delay an actual public statement by a month or even more. That said, I'm
not completely against the idea, if this ends up happening I would
likely combine the best current ideas in an etherpad and invite everyone
to list and hammer out any remaining issues.

-Jonathan

[0] https://www.debian.org/devel/constitution
[1]
https://lists.debian.org/msgid-search/1b2aee43-cea0-2fa8...@debian.org

[Bill Allombert]

Le Fri, Nov 24, 2023 at 07:38:40PM +0200, Jonathan Carter a écrit :
> Hi Bill
>
> On 2023/11/24 19:14, Bill Allombert wrote:
> > I offer the following ballot option for your consideration.
> >
> > ----- GENERAL RESOLUTION STARTS -----
> >
> > The Debian developers delegate to the Debian Project Leader the task of issuing
> > a Public Statement about the 'EU Cyber Resilience Act and the Product Liability
> > Directive' that addresses Debian interests in the matter.
> >
> > ----- GENERAL RESOLUTION ENDS -----
>
> I follow your logic in proposing this, although my interpretation of

> ś5.1.4[0] in our constitution leads me to believe that the DPL does not need

> any delegation for this, so perhaps the intention becomes more of "Let the
> DPL decide".

I agree with you on that point, but note that what matters
constitutionaly is that the DDs via the GR process has authority to do
it, and so have also the authority to delegate it, even to someone who
would otherwise have this authority.

The point of this ballot option is to differentiate from 'NOTA' which
can be interpreted as precluding from issuing a statement.

> In February I posted[1] about the CRA to debian-project[1]. My intention was
> to get a few good people to spend some time to focus on this, since my
> available bandwidth for this was low (and continued to be since then).
>
> I'm not sure that it's a good idea to leave it as a DPL task, it might delay
> an actual public statement by a month or even more. That said, I'm not
> completely against the idea, if this ends up happening I would likely
> combine the best current ideas in an etherpad and invite everyone to list
> and hammer out any remaining issues.

My view is that when drafting such statement, we should always keep in
mind what is its purpose. If it is to be read by the EU regulators, it
should be written by someone knowing their legal languages.

Cheers,
--
Bill. <ball...@debian.org>

Imagine a large red swirl here.

[Gunnar Wolf]

Bill Allombert dijo [Sat, Nov 25, 2023 at 10:33:34AM +0000]:

> > > I offer the following ballot option for your consideration.
> > >
> > > ----- GENERAL RESOLUTION STARTS -----
> > >
> > > The Debian developers delegate to the Debian Project Leader the task of issuing
> > > a Public Statement about the 'EU Cyber Resilience Act and the Product Liability
> > > Directive' that addresses Debian interests in the matter.
> > >
> > > ----- GENERAL RESOLUTION ENDS -----
> >
> > I follow your logic in proposing this, although my interpretation of

> > ¶5.1.4[0] in our constitution leads me to believe that the DPL does not need

> > any delegation for this, so perhaps the intention becomes more of "Let the
> > DPL decide".
>
> I agree with you on that point, but note that what matters
> constitutionaly is that the DDs via the GR process has authority to do
> it, and so have also the authority to delegate it, even to someone who
> would otherwise have this authority.
>
> The point of this ballot option is to differentiate from 'NOTA' which
> can be interpreted as precluding from issuing a statement.

I understand your reasoning here, and to an extent, it makes
sense. But I guess the right verb (for the Debian project to...) would
not be "delegate", but rather "request" or something in that line
(might be harder, as in "demand", or softer, as in "ask"...?)

> > In February I posted[1] about the CRA to debian-project[1]. My intention was
> > to get a few good people to spend some time to focus on this, since my
> > available bandwidth for this was low (and continued to be since then).
> >
> > I'm not sure that it's a good idea to leave it as a DPL task, it might delay
> > an actual public statement by a month or even more. That said, I'm not
> > completely against the idea, if this ends up happening I would likely
> > combine the best current ideas in an etherpad and invite everyone to list
> > and hammer out any remaining issues.
>
> My view is that when drafting such statement, we should always keep in
> mind what is its purpose. If it is to be read by the EU regulators, it
> should be written by someone knowing their legal languages.

Right. This ball was already in our DPL's court, but the DPL has to
dance many dances. And we have only one DPL, who decided to spend his
energy in a different way.

The current GR followed some antecedents that (surprise, surprise, we
are Debian!) were not time-bound.

As I understand, the EU legislative process is quite advanced now, and
I doubt we have the time to build "the perfect response". And the
answer from the EU legislative body will not be to read and consider
each bullet point we make --- While they are all important mostly *for
people quoting and making press releases* in the technical community,
the European legislative bodies will just see "oh, a biggish project
opposes CRA".

We want to communicate the reasoning as clearly as possible to our
peers and to journalists. But we want *something* to be issued while
we are still in the due time for the legislative process.

[Bill Allombert]

On Sat, Nov 25, 2023 at 09:59:16AM -0600, Gunnar Wolf wrote:
> As I understand, the EU legislative process is quite advanced now, and
> I doubt we have the time to build "the perfect response". And the
> answer from the EU legislative body will not be to read and consider
> each bullet point we make --- While they are all important mostly *for
> people quoting and making press releases* in the technical community,
> the European legislative bodies will just see "oh, a biggish project
> opposes CRA".

Or maybe "yet another volunteer project does not understand EU language law and
misunderstand the CRA, just ignore". This is what we should avoid.
The EU is more sophisticated than what you seems to imply. They see the
political advantage they can obtain by having a FLOSS policy. Whether this
FLOSS policy is favorable to Debian is a different issue.

> We want to communicate the reasoning as clearly as possible to our
> peers and to journalists. But we want *something* to be issued while
> we are still in the due time for the legislative process.

Let us be honest, the majority of peers and journalists do not understand EU
language law.
Writing for them and writing for the EU are two very different things.
We should not just put out a statement just because others have done so, because
we might inadvertently propagate FUD.

[Jonathan Carter]

On 2023/11/26 21:24, Bill Allombert wrote:
> We should not just put out a statement just because others have done so, because
> we might inadvertently propagate FUD.

Yep, it's a minefield. Anything we say can be used by a manipulative
politician to make it seem that we support their cause.

-Jonathan

[Roberto C. Sánchez]

In the same way that our silence can also be used.

Regards,

-Roberto
--
Roberto C. Sánchez

[Bill Allombert]

Much less, because there have been other laws proposal that could affect
us and we have never put out a similar statement so nobody should expect
Debian to make one now.

[Russ Allbery]

Bill Allombert <ball...@debian.org> writes:

> Much less, because there have been other laws proposal that could affect
> us and we have never put out a similar statement so nobody should expect
> Debian to make one now.

Yes. Debian is organized around producing a free software distribution,
not around legal or policy advocacy. It is normal that organizations that
are not involved in politics (particularly transnational volunteer
organizations like Debian) don't try to comment on legislation in
particular jurisdictions. This is not something that I think we should
normally do. We should have exceptional clarity about our position and a
clear alignment between the legislation and Debian's interests before we
consider making a statement.

I think it's *possible* that condition applies here, but I'm dubious.
I've previously supported Debian making other essentially political
statements and was subsequently convinced that I was probably wrong to do
so.

Given that, if we say anything at all, I would prefer to make as minimal
and focused of a statement as possible, staying well within our area of
direct expertise and not getting into analysis of the meaning of
legislation. While there are people within the Debian Project who are
qualified to do that, the *project* is not, and there are other advocacy
organizations that do this type of lobbying regularly who are
better-positioned to analyze the legislation in detail and provide
feedback from a free software perspective.

I'm not seconding Bill's proposed ballot option because I don't want to
delegate this to the DPL either. I'm currently inclined to either vote
only Luca's more limited statement above none of the above, or vote none
of the above over all options.

--
Russ Allbery (r...@debian.org) <https://www.eyrie.org/~eagle/>

[Gunnar Wolf]

Russ Allbery dijo [Mon, Nov 27, 2023 at 12:39:50PM -0800]:

> Bill Allombert <ball...@debian.org> writes:
>
> > Much less, because there have been other laws proposal that could affect
> > us and we have never put out a similar statement so nobody should expect
> > Debian to make one now.

Yes. We did discuss on the comparison between the movement that many
of our free software-affilliated European nationals carried out ~18
years ago, when software patents were discussed.

I agree back then Debian didn't produce a "project statement", and the
level of involvement from many of us was way higher. Of course, we
cannot directly compare -- many of us currently in our mid-to-late 40s
were... (counting with my fingers...) roughly in our mid-to-late 20s
and had more time and energy. And, again, I can only judge as an
outsider, as I am neither an European citizen, nor lived close to any
place where I could attend a swpat demonstration (although did
participate in some local when SOPA/PIPA lookalike laws were
discussed).

Anyway, I'm sidetracking...

> Yes. Debian is organized around producing a free software distribution,
> not around legal or policy advocacy. It is normal that organizations that
> are not involved in politics (particularly transnational volunteer
> organizations like Debian) don't try to comment on legislation in
> particular jurisdictions. This is not something that I think we should
> normally do. We should have exceptional clarity about our position and a
> clear alignment between the legislation and Debian's interests before we
> consider making a statement.
>
> I think it's *possible* that condition applies here, but I'm dubious.
> I've previously supported Debian making other essentially political
> statements and was subsequently convinced that I was probably wrong to do
> so.
>
> Given that, if we say anything at all, I would prefer to make as minimal
> and focused of a statement as possible, staying well within our area of
> direct expertise and not getting into analysis of the meaning of
> legislation. While there are people within the Debian Project who are
> qualified to do that, the *project* is not, and there are other advocacy
> organizations that do this type of lobbying regularly who are
> better-positioned to analyze the legislation in detail and provide
> feedback from a free software perspective.

This is also something we discussed before sending this call for
votes. But how can we gauge whether the project is OK with issuing
political statements or not? The only tool we were able to find is a
GR.

This, however, _is_ something I want to insist on: I don't think we
should fear GRs. I am of the opinion that we should hold more GRs,
that they should guide and aid more of our project decisions -- GRs
should not be divisive or "nuclear", but a tool for gauging project
acceptance of an idea.

And, while quite expectedly, I intend to vote our (Santiago's)
original proposed text as the first option, I will also be happy if
the outcome is "further discussion": I prefer for the project to
decide "this is not something our project will engage in" than to do
so by omission.

[Russ Allbery]

Gunnar Wolf <gw...@debian.org> writes:

> This is also something we discussed before sending this call for
> votes. But how can we gauge whether the project is OK with issuing
> political statements or not? The only tool we were able to find is a GR.

To be very clear, I have absolutely no objections to the GR being held,
and I agree with this analysis. That I am currently leaning against it in
no way is intended to imply that I am unhappy that it was proposed. I was
slow to comment in part because it took me a couple of weeks to figure out
what I thought, and that to me implies that this is a good GR. The
outcome is not obvious and this is not something that we've settled on as
a project.

> This, however, _is_ something I want to insist on: I don't think we
> should fear GRs. I am of the opinion that we should hold more GRs, that
> they should guide and aid more of our project decisions -- GRs should
> not be divisive or "nuclear", but a tool for gauging project acceptance
> of an idea.

I completely agree.

[Bill Allombert]

On Tue, Nov 28, 2023 at 09:25:17AM -0600, Gunnar Wolf wrote:
> This is also something we discussed before sending this call for
> votes. But how can we gauge whether the project is OK with issuing
> political statements or not? The only tool we were able to find is a
> GR.

The less we know about the political opinion of each others, the better for
the project. After all we only agreed to uphold the SC and nothing else.

We are a technical entity. We do not need to know other developers opinions on
issues unrelated to FLOSS to work together, and let us face it, it is easier to
work together if we ignore whether we have major political disagreement.

And it is quite difficult discussing a ballot option without revealing such
opinions. We have enough topics for flamewar already. This will only leads
to more fracturation of the project.

But this GR is not about issuing political statements in general, it is about
issuing a particular statement, which leads directly to the second issue, are
GR (with the time limit, the amendment process, etc) the best medium to draft
political statement that correctly addresses the issue while furthering Debian
goal ?

[Gunnar Wolf]

Bill Allombert dijo [Tue, Nov 28, 2023 at 10:07:29PM +0100]:

> On Tue, Nov 28, 2023 at 09:25:17AM -0600, Gunnar Wolf wrote:
> > This is also something we discussed before sending this call for
> > votes. But how can we gauge whether the project is OK with issuing
> > political statements or not? The only tool we were able to find is a
> > GR.
>
> The less we know about the political opinion of each others, the better for
> the project. After all we only agreed to uphold the SC and nothing else.
>
> We are a technical entity. We do not need to know other developers opinions on
> issues unrelated to FLOSS to work together, and let us face it, it is easier to
> work together if we ignore whether we have major political disagreement.

Yet, my belief is that all human interactions are political in
nature. In some aspects of politics, you and I will not be the least
aligned. But I believe our project is _first and foremost_ a political
statement (that produces a first-grade technological artifact).

> And it is quite difficult discussing a ballot option without revealing such
> opinions. We have enough topics for flamewar already. This will only leads
> to more fracturation of the project.
>
> But this GR is not about issuing political statements in general, it is about
> issuing a particular statement, which leads directly to the second issue, are
> GR (with the time limit, the amendment process, etc) the best medium to draft
> political statement that correctly addresses the issue while furthering Debian
> goal ?

I do not know. But I think that's something that can, and ought, be
put to the table.

[Bdale Garbee]

Gunnar Wolf <gw...@debian.org> writes:

> But I believe our project is _first and foremost_ a political
> statement (that produces a first-grade technological artifact).

I understand your position, but I see this exactly in the opposite way.

Bdale

[Bart Martens]

I'm a bit in between. Free Software may have originally started as an anti- big
companies movement, but nowadays it has matured, and those big companies are
now migrating their critical businesses to it.

Cheers,

Bart

[Bill Allombert]

On Tue, Nov 28, 2023 at 04:36:29PM -0600, Gunnar Wolf wrote:
> Bill Allombert dijo [Tue, Nov 28, 2023 at 10:07:29PM +0100]:
> > On Tue, Nov 28, 2023 at 09:25:17AM -0600, Gunnar Wolf wrote:
> > > This is also something we discussed before sending this call for
> > > votes. But how can we gauge whether the project is OK with issuing
> > > political statements or not? The only tool we were able to find is a
> > > GR.
> >
> > The less we know about the political opinion of each others, the better for
> > the project. After all we only agreed to uphold the SC and nothing else.
> >
> > We are a technical entity. We do not need to know other developers opinions on
> > issues unrelated to FLOSS to work together, and let us face it, it is easier to
> > work together if we ignore whether we have major political disagreement.
>
> Yet, my belief is that all human interactions are political in
> nature. In some aspects of politics, you and I will not be the least
> aligned. But I believe our project is _first and foremost_ a political
> statement (that produces a first-grade technological artifact).

One major risk for Debian continued existence is that we start to become
suspicious of each other political views outside FLOSS, that we start to see
"collaborating with someone as part of our Debian activity" as "associating"
with them, and that "associating" with them start to become socially
problematic. There is a precedent for that.

That is why I am quite against the whole 'community' view of Debian.

In practice, it is very hard to participate in such GR without revealing
political views, as you can see by reading the discussion.

> > And it is quite difficult discussing a ballot option without revealing such
> > opinions. We have enough topics for flamewar already. This will only leads
> > to more fracturation of the project.
> >
> > But this GR is not about issuing political statements in general, it is about
> > issuing a particular statement, which leads directly to the second issue, are
> > GR (with the time limit, the amendment process, etc) the best medium to draft
> > political statement that correctly addresses the issue while furthering Debian
> > goal ?
>
> I do not know. But I think that's something that can, and ought, be
> put to the table.

It seems like you are underestimating the risks and overestimating the rewards.
Such statement is only useful if written by people that understand enough of
EU law terminology to address the issue. I asked whether the lawyer that drafted
it was familiar with EU law and it does not seem to be the case. We should not
make a statement that can be used against us.

[Bart Martens]

On Sat, Dec 02, 2023 at 01:07:21AM +0100, Bill Allombert wrote:
> On Tue, Nov 28, 2023 at 04:36:29PM -0600, Gunnar Wolf wrote:
> > Bill Allombert dijo [Tue, Nov 28, 2023 at 10:07:29PM +0100]:
> > > On Tue, Nov 28, 2023 at 09:25:17AM -0600, Gunnar Wolf wrote:
> > > > This is also something we discussed before sending this call for
> > > > votes. But how can we gauge whether the project is OK with issuing
> > > > political statements or not? The only tool we were able to find is a
> > > > GR.
> > >
> > > The less we know about the political opinion of each others, the better for
> > > the project. After all we only agreed to uphold the SC and nothing else.

One of the proposal texts puts the focus on that SC.

I think we're fine if the GR states what Debian already continuously states.

>
> Cheers,
> --
> Bill. <ball...@debian.org>
>
> Imagine a large red swirl here.
>

--

[Santiago Ruano Rincón]

El 02/12/23 a las 01:07, Bill Allombert escribió:

> On Tue, Nov 28, 2023 at 04:36:29PM -0600, Gunnar Wolf wrote:
> > Bill Allombert dijo [Tue, Nov 28, 2023 at 10:07:29PM +0100]:
> > > On Tue, Nov 28, 2023 at 09:25:17AM -0600, Gunnar Wolf wrote:
> > > > This is also something we discussed before sending this call for
> > > > votes. But how can we gauge whether the project is OK with issuing
> > > > political statements or not? The only tool we were able to find is a
> > > > GR.
> > >
> > > The less we know about the political opinion of each others, the better for
> > > the project. After all we only agreed to uphold the SC and nothing else.
> > >
> > > We are a technical entity. We do not need to know other developers opinions on
> > > issues unrelated to FLOSS to work together, and let us face it, it is easier to
> > > work together if we ignore whether we have major political disagreement.

Yet, one of the goals of the proposed text is to minimize the negative
impact of this particular EU policy on FLOSS projects and the related
technical work.

> > Yet, my belief is that all human interactions are political in
> > nature. In some aspects of politics, you and I will not be the least
> > aligned. But I believe our project is _first and foremost_ a political
> > statement (that produces a first-grade technological artifact).

+1!

>
> One major risk for Debian continued existence is that we start to become
> suspicious of each other political views outside FLOSS, that we start to see
> "collaborating with someone as part of our Debian activity" as "associating"
> with them, and that "associating" with them start to become socially
> problematic. There is a precedent for that.

On the other hand, I have experience successfully working in a
professional level with people that I would place in the other side of
the one-dimensional political spectrum.

> That is why I am quite against the whole 'community' view of Debian.

We are a large community, and it is obvious we disagree at different
points, political and technical. And that doesn't prevent us to keep
working together, with obvious obstacles and etc. But that is still part
of the "working together". This is not saying we have to think in the
same way, of course. The only common ground is that we all agreed (at
least "new" new members) to uphold the Social Contract (which, as its
name state, **social**) the DFSG, et al.

> In practice, it is very hard to participate in such GR without revealing
> political views, as you can see by reading the discussion.
>
> > > And it is quite difficult discussing a ballot option without revealing such
> > > opinions. We have enough topics for flamewar already. This will only leads
> > > to more fracturation of the project.
> > >
> > > But this GR is not about issuing political statements in general, it is about
> > > issuing a particular statement, which leads directly to the second issue, are
> > > GR (with the time limit, the amendment process, etc) the best medium to draft
> > > political statement that correctly addresses the issue while furthering Debian
> > > goal ?
> >
> > I do not know. But I think that's something that can, and ought, be
> > put to the table.
>
> It seems like you are underestimating the risks and overestimating the rewards.
> Such statement is only useful if written by people that understand enough of
> EU law terminology to address the issue. I asked whether the lawyer that drafted
> it was familiar with EU law and it does not seem to be the case.

What makes you state this? As far as I case, the lawyer who drafted the
statement knows well the EU regulations and legislation proceedings.