XSF Discussion - 2021-02-05

Am I the only one who thinks that the stickers XEP could use BOB?

mathieui: Plausibly.

Maybe.

Ah right, BOB requires XHTML-IM, and we cannot have nice things anymore

Does it?

Couldn't you plausibly send a cid:-URI in OOB or anything?

That is technically allowed as far as I am aware

Obviously we can't have nice things tho.

although that makes yet another thing which is not end-to-end encrypted leading to a data leak, and we cannot have nice things

We’d have to migrate to OMEMO++ first.

Link Mauve, do we?

I think so?

FSE (full stanza encryption) is possible with OMEMO v0.7 IIRC ✏

Current deployed OMEMO doesn’t support it, as that’s 0.3 or something.

Link Mauve, but then we just need OMEMO vdeployed++, not OMEMO++

(which I read as "a replacement for OMEMO")

Link Mauve, that still does not cover the <iq/> file retrieval

mathieui, oh?

mathieui, XMPP over IBB over <message/>!

jonas’, my bad, that’s what I meant.

Link Mauve, or does it?

mathieui, <iq><omemo-encrypted><iq/></omemo-encrypted></iq>

oh yeah, in an hypothetical future that may work

uhh

also that is still some kind of leak

I’m sure that will work just fine.

mixmaster over XMPP?

or ... what was that email thing called?

> mathieui, <iq><omemo-encrypted><iq/></omemo-encrypted></iq> I tried to come up with a solution for encrypted <iq>s in sce

https://xmpp.org/extensions/xep-0420.html#use-case-iq

ha, it even uses BOB as example

;)

So if someone does some experiments with it, please share feedback

Good morning everyone

hi arc

Board meeting in 15 minutes. Do we have everyone this week?

o/

There's also the foss foundations virtual drink up after the board meeting. Which would normally be held at this time in Brussels

0. Welcome

Hi!

Who do we have today?

Here

Here

dwd, Seve?

Hi

That is technically quorum? Not ideal though

I see 4 out of 5

I typed that when we only had three 😋

Ok

I didn't see minutes, but I think we said we'd start with GSoC. Any other topics?

Are we as a board tackling the summit? That probably would have otherwise taken place this last week?

Actually right now.

FOSDEM is tomorrow

It does not seem that SCAM is active right now

Accurate. Last I looked, SCAM had no activity for months.

I think the last meeting was in October

I'm not criticizing, it happens to all of us. I'm just saying that we as a board should not be deferring to an inactive committee.

And I think that's understandable, with lockdowns and stuff.

We haven't actively asked SCAM to look into a virtual Summit

In any case, we should perhaps put that on the intended today. since we are virtual this year we can always tackle it next week or two weeks from now

https://mail.jabber.org/pipermail/scam/2020-October/000007.html

I'm personally not the biggest fan of online invents. The few events I attended last year haven't been very fun. I might attend a summit but I'm personally not super keen on organizing something I wouldn't really enjoy myself.

Saying this as a scam member

Not sure about my fellow team members

So feel free to send an official inquiry

This is the last meeting, where they explicitly stated that 2021 is not an in-person event and there was scepticism on having a virtual one. That said, I like the ideas presented last week and we should go ahead with them.

Observation: pep. left the XSF some time after that.

Daniel, I don't think you're alone, and I agree that online is far from ideal compared to in-person meetups

++

I get the impression that FOSDEM have struggled to find speakers, I believe interest has been lower

But we can't shut down as an organization just because we can't do in person events

But I also don't believe we can legitimately take a year off

I agree

Less than ideal is better than nothing

Suggestion (hat:xsf member): Postmortem for this would be good.

Last week it was pointed out that not having any type of gathering would leave us without concentrated discussions on protocol, as we usually have at the Summit.

I think, FWIW, FOSDEM’s appeal as a virtual event would be lower than the Summit’s. But I could be very wrong about how effectively we can have a 30/40 person remote Summit.

Kev, we could see it as a stress-test of online meeting things, then split into focus groups to argue about XEPs.

I think an online event would be better if we spread it out. Instead of everyone getting together for one day, split the topics up and have several focused meetings

arc, agreed

My experience with online events is there better when they're shorter

I don’t agree with that, FWIW. It’s much easier for me to block out one day that’s going to be an event to attend than work an hour here and there into my work week.

Shorter and more focused. I'm sure not going to hang around all day in a 40-person online video conference

Time zones will probably also put a limit on it

But not disagreeing to the point that I’m going to argue it shouldn’t happen.

Probably something in the European pm

Daniel, with your scam hat on, do you think your team would pick up planning / organising something like this?

If the team is just me then the honest answer to that is no

Well, officially SCAM is also Guus and nyco.

What's the amount of organzing you want to put into this

Like should we just pick a week day and have four weeks after each other with 2-3 hours each?

I think the logistics of organizing an online event (or multiple) are far lower than an in-person event

i.e. I don't really care if SCAM isn't going to do anything. Multiple community members do want to do something, and I hope we can self-organize.

Sure. Starting with a wiki page for collecting ideas seems prudent.

I would try help out with that, but the next few weeks will be difficult for me

Let's continue discussion after the meeting

We do have the agenda item of gsoc

right

1. GSoC

:-D

So, last time I remember, arc explained that payments by Google are lower and suggested the XSF compensates.

I would actually suggest that we compensate by shifting to outreachy this year

Lower, but the time is lower too isn’t it? Aren’t students expected to do half the work for half the pay?

Yep. But they also shut down several other programs, we may be looking at the last year, or years, of gsoc

It's not just that the payments are lower, the projects are also supposed to be _shorter_. So the payment per time stays the same. Google apparently wants to try and open gsoc to more people, and they think that shorter projects are beneficial for that goal.

For those here (including floor) who've mentored, are shorter projects expected to be effective (enough)?

I don’t want to shit on Google for making the change, they can do what they like with the programme. But a lot of the overhead for mentors and orgs is frontloaded.

Oh, don't take me wrong. I am just curious if the change would work *for us*.

So the amount of code produced is much lower relative to mentor/admin effort, and the change (I predict with no data) of integrating people into the community is lower (but there is a counter argument that it might be higher because it’s less mercenary).

I think it is still worth doing.

FWIW I had been thinking about trying to get my project into GSoC this year under the XSF organization. I haven't done it before, but smaller projects would actually fit in with the handful of ideas I had much better than the old larger ones.

I'm just suggesting we start to shift to outreachy. Because GSoC has always been a valuable program, and should it come to an end with this year, it would be ready to fully shift over

There's a GSoC for documentation, right? Anyone have any experience with that? May be closer to the core XSF thing of writing specifications, and FOSS projects are often struggling with keeping their docs up to date.

There is, but it is later

GSoC is about writing code, not "documentation"

I'm referring to Season of Docs

Ah.

I think, if they do it again, it will be announced in March

Indeed, so ignore me until then 🙂

I don't see an issue with smaller projects. Surely needs some adjustments to how we do things, but probably still worth it. At least for the projects that are not backed by companies

I understand (from last meeting) that arc would be happy to admin (if no one else is interested) and that Kev would be around to help if he has spare cycles. Arc also suggested shifting to outreachy but I haven't seem any response on that here.

seen

I have some response from there.

¿Por qué no los dos?

For both programs we mostly need an idea's list

SamWhited, I am not sure what the overhead is of running both

Organisationally, paying out is different. For Outreachy, we'd have to do this ourselves.

arc: can you start collecting ideas, while we figure this out?

Yep, happy to.

(i.e. do the wiki thing)

Thanks!

ralphm: I don't think we do the payouts with outreachy, we just provide the money.

That is true.

which is differnt from GSoC, I haven't looked at the specifics

We supply the funding, but the people in charge of outreachy do the payouts.

Good to know.

(And they charge a huge cut for the processing)

Next week, let's discuss if we want to do GSoC, Outreachy, or both and how. For now let's gather the ideas.

I think that's all the time we have today.

2. Date of Next

+1W

3. Close

Thanks all!

Thank you guys!

I think we should get this to the mailing list, because I'm missing inputs from flow, vanitasvitae and other previous gsoc mentors/admins

Since GSoC doesn't require the XSF to contribute money, I don't understand why the XSF doesn't just go with it as long as GSoC exists and there are project maintainers that want to make use of it.

Reading through the outreachy community guidelines and I really like how they structure this. Seems like it would be a lot more work for the XSF since we'd have to be the fiscal sponsor and we'd probably be able to sponsor fewer interns who would have to pick the project they want to work on from among all the people vying to be their mentor, but it seems like it would be a good fit

FWIW, I’m a little uneasy about the XSF using its limited funds to pay for development of some projects over others. If the money came from the projects themselves that concern goes away.

The XSF probably wouldn't pick the projects, projects would just apply and the interns would pick them I think. The XSF is just paying interns.

Well, surely the XSF chooses which internships get selected, like GSoC.

could just require all code written by XSF-funded interns to be AGPLv3 , then there is no conflict of interest problems if a company wants free labor :D

I think it would just pick the students though, give them a list of projects that applied for an intern, and the students would pick the project, but maybe not.

Kev, you've raised that issue in the past, and I have to say I think I increasingly dislike it as time goes on

And the XSF could just not vet the projects beyond "it meets the criteria defined by the program" (which is basically "OSI approved license"

I mean, dislike having that as a rule the XSF should follow

The issue seems to be that Outreachy targets open-source communities but the XSF isn't an open-source community but an open-standards organization.

The XSF would just be the fiscal sponsor acting as an umbrella like we do for GSoC, in my mind.

If the code funded by the XSF is open-source then I have no problem with the XSF funding projects

I *would* have issue with it funding closed-source projects

If the XSF doesn't want to directly fund projects, they could also create a pool that projects and individuals can donate too and just be the fiscal sponsor without using any of their own money

how do you define "is open-source" ? like I think SamWhited 's "OSI approved license" is correct, but that has to be the license it's submitted under too, ie, no CLA's ?

The XSF... or another organization (back into that loop :) )

(since we're a US 501(c)3 but projects likely aren't and don't have a legal entity they can use)

moparisthebest: they have a definition on their website, I don't think we need to care beyond whatever they say

MattJ: I share that opinion, but IIRC the XSF is believed to be neutral regarding open source vs closed source and this would be non-neutral...

MattJ: There is pragmatism in my reason, FWIW, not just dogma. Getting sponsors happy to give money to random projects rather than directly helping XMPP Standards Development seems questionable. Maybe I’m wrong. Although I do know that some sponsorship hasn’t happened in the past because one of Board was mouthing off about the XSF not supporting anyone who wanted to make money off XMPP.

*nods* any org would do

Zash, Snikket may be too opinionated for this particular case (despite having sponsored a bunch of open-source development in the past 12 months)

doesn't that assume projects don't directly help XMPP Standards Development? that seems wrong

Zash, OTOH maybe not, if it's a separate "fund the ecosystem" thing

moparisthebest, I agree, I think that's my thinking. Throwing money into standards development (??) is not what XMPP needs right now

(FWIW, while I don’t know how effective it is, I am glad Snikket is doing what Snikket is doing)

I would actually be open to filing paperwork to start a thing that just accepts donations on behalf of XMPP projects, acts as a fiscal sponsor on OpenCollective or somewhere, does things like this, etc. if anyone is interested

I'd argue helping fund development on these projects *is* throwing it directly into standards development

If the XSF wants to do Outreachy, why not try to get sponsors specifically for money to spend on Outreachy? That would render my concerns completely irrelevant.

"standards development" isn't anything anyone here has ever done, am I wrong on that?

That sounds reasonable too, I do think the XSF is already positioned to be a fiscal sponsor for projects, it doesn't have to necessarily put its own money towards it

instead, you have a need in a project/product/whatever, and standards come out of that

All standards work is mean to be writing standards for things that are needed, I’m not sure what that point is.

Certainly people here have written standards, and certainly before implementations (and even without needing to implement it themselves).

board people: is this something that could go on the board meeting next week to discuss? Ie. can the XSF act as a fiscal sponsor for projects (where it just keeps track of money for them)? If so, I'd volunteer to help with that. If not, I'd volunteer to start an organization specifically for that.

that process doesn't start out by writing standards though, it starts out by having a problem and thinking about how to solve it with code, in a project

That is demonstrably wrong. We have written Standards to solve problems, before thinking about the code to go with them.

so, funding code for project == funding standard development, in my opinion

moparisthebest: I think the best specs do that, but lots of them do it with no code written

hehe, yea that's how you get standards no one implements

MIX for example

Some of the worst specs come out of writing code before thinking about standardising too :)

that's also fair

so let's say "funding code for a project where standards are thought about from day 1" == "funding standard development"

moparisthebest, https://xkcd.com/844/

I think the worst specs come from *deploying* code before thinking about standardizing, not necessarily writing it :) writing it, then standardizing is sort of like writing unit tests before the code; you end up going back and forth and making changes, but it's good to have at least some basic unit tests to flush out the general shape of it first

also Kev

The worst code comes from writing code!

sorry, before it gets lost, /cc ralphm, arc, other board people see question above

So, to avoid any misunderstanding, I’m concretely in favour of the XSF gathering sponsorship to pay for some Outreachy interns, and doing Outreachy with it.

Although if we have reason to suspect this will be the last year of GSoC, there is a strong argument for trying to get money out of Google while we can :)

I am reading, SamWhited. And remember I've been talking about seeking outside funding for a while.

assuming board decides it wants to do this at all, sounds like they need to decide 1. if it can be funded "normally" or 2. if it needs special funding

arc: my question isn't necessarily about outside funding (although the XSF could help raise that too for things like Outreachy) but about if I as a project want to take donations in many places I need a legal entity. Some NGOs act as fiscal sponsors and take donations that they keep separated out for other projects, and if the XSF was willing to act that way for open source projects that would probably be a big help to the ecosystem

As a general rule, organizations that do things, are able to get funding to continue doing those things. We should not devolve into arguing about the distribution of those funds.

To be clear, the XSF wouldn't be distributing funds itself or deciding how they get distributed.

I would be in favor of that. Especially since most XMPP projects are fairly small with only a few developers, and it is a big overhead for them to serve as their own fiscal sponsors

For example, let's say my project (Mellium) wants to take donations. Right now those go to me, I am personally liable, they are not tax deductible, and most organizations that process donations won't touch me with a 10 foot pole.

If the XSF were my fiscal sponsor though, the donation button on my website would go to the XSF and they'd just put it in the "Mellium" account or whatever. Other projects could do the same.

I understand. I have served on the boards for a few fiscal sponsors.

I am in favor of that. It is really not that much work for the small number of organizations we have.

👍 (I've been specifically looking for one to use for some projects on OpenCollective and vaguely considering trying to start something, but at least for Mellium the XSF would be a logical place if it's something we have enough peopel to work on)

And I would volunteer since it's easier than starting a separate entity for me.

Actually this might be an ideal time for this conversation. The FOSS foundations online drink up just started

arc: link?

Which is literally the people that you should be talking to 😋

I looked for FOSS Foundation when you mentioned it earlier but couldn't find anything?

I'm curious about this though

https://video.eventyay.com/b/mar-rgt-jgy-zk0

Although it's only 1300 here, but meh, it's time for a beer somewhere

It is 10:00 a.m. here

arc: are you still in Portland?

Yep

Cool, a friend of mine is trying to move there right now (from Seattle)

Too much rain, 'eh?

Oh no, 'eh is vancouver. 😂

I would recommend South Portland. Close to downtown, not terribly expensive, but quiet and not so much crime

It's not one of the rich people's neighborhoods. But if you wanted to go boating, eg, I live about two blocks from a boat launch.

This is a great example for the need for better foss a/v meeting software. Of course, xmpp based! BigBlueButton has problems

Well you've got Zoom and Jitsi.

Zoom isn't foss?!

Nope. Touch of XMPP in there at least.

I didn't know that. Not the first time I've been shocked. But I'm not talking about another multichat clone

See the problem is that all the multi-chat software treats the room as if it were a stadium with a microphone. People step up on stage, speak into the microphone, sit down. Its slow and frustrating

Especially with these larger meetups.

I don't think I've ever seen a good system for managing that in real life either that we could take as a metaphore for software

And if someone were to work that out, AGPLv3 licensed, using xmpp, we win.

Because it was instantly become they go to for every social group in the world

arc, that is not true, jitsi meet does not do that

Wishing for something where you could, say, break off into smaller groups and talk more easily? Or whisper to whoever sits "next to you"?

Also, zoom actually has "breakout rooms" which let you do just that (and it is nice in quite a lot of scenarios)

I'd push back on the AGPLv3 thing, but the "using xmpp" part sounds good :)

I think this has breakout rooms too, but I haven't tried it

I'm thinking less formal. More like, groups in a room. Having two levels of microphone.

SamWhited: added to Trello

Less breakout rooms, more "circles". So you can wander through a room and talk to different circles. But everyone hears the person with the room microphone.

SamWhited I thought you liked the AGPLv3

2D location something and mic/speaker volume scaling?

I wouldn't use or emulate location. Just letting people join circles.

People have suggested using certain video games that do location based talking

So ad hoc backchannels

arc: I am very strongly against AGPL (or basically everything GNU does); maybe that should be my controversial opinion :)

Lol

Sam: You’re only allowed one.

Also, I don't think it is controversial

Ralphm yeah like adhoc breakout rooms. Which happen organically

(the opinion, not Sam)

arc: I can't remember what it's called, but have you used the virtual neighborhoods chat thing? You sort of walk around a map like it's a little 2d video game and when you walk up to people their videos and mics fade in as you get close. It sounds gimmicky, but I've found it works very well

People suggested that for this meeting. But here we are an hour on, still doing introductions

I don't think we should be limited to emulating the real world. I'm thinking, do better than real world

It’d be good to start by not being worse than the physical world :)

Lol true

Well it took an hour to mostly get through everyone's introductions 😂

arc, me and pep were the very pro AGPLv3 for everything ones :)

Chris DiBona sitting with Linux Torvalds convinced me that AGPLv3 is really the only way forward for FOSS.

After that talk, I started relicensing everything. in increasingly lost interest in working on anything that's not.

I basically want an XMPP client but when you click a room on the left you get a video call on the right (possibly with chat too, but the focus is video calling). Which I guess is also like saying: Mumble with video. Instead of how most video call things work where you have semi-permanent rooms and you're really just in one at a time and can't switch between them rapidly

Like, I haven't contributed to Gnome because all those contributions were LGPL.

I basically feel the same way about (A)GPL as I do about politics; my actual deep-blood-of-the-worker-red comrades just think I'm pinko scum because I prefer the less limiting BSD, MIT, Apache, etc.

Anything less is exploitive. I know too many housing challenged foss developers, many with some form of autism, working on foss because they love it. Many who's work is freely used my large corporations to make billions, and at best sometimes toss pocket change to those people. At best.

The only people who are really limited by copyleft are the ones exploiting the community's work for profit. A vast majority of end users don't care what the license is.

I agree with the desire to make large companies using open source pay their share, but I don't think licensing is the way to do it. It hurts me when there are more restrcitions in a license too even though I'm just also an open source dev who will try to use it correctly. Now I have to worry if I'm complying with every detail, what counts as linking and what doesn't and how that would be interpreted legally, do I have to change my license just because I want to use some sortware that has a ton of restrictions making it incompatible with it, etc.

I am paraphrasing here, but Chris DiBona was asked why code.google.com banned the AGPLv3. And his answer was shockingly honest: because AGPLv3 license would bankrupt them.

And here I just wanna do my thing and not worry about licensing.

There's also what Zash just said… I don't want to worry about it. Slapping a BSD like license on it and only using stuff that's slimilarly permissive lets me do that

SamWhited, that's why I offer commercial licenses. Or more specifically, licensed exceptions

arc, add this to the list of reasons: https://opensource.google/docs/using/agpl-policy/ (sounds same as yours but it written form)

I'd ad that to the list of reasons against :) I have the same fear as an OSS dev doing my best to respect the wishes of other software authors. I want to respect their wishes, but what if I accidentally trigger the viral provision?

I offer extremely competitively priced exceptions. The only discrimination is against military and military contractors.

I do like the idea of offering commercial license exceptions

Yeah then it's not exploitative anymore.

> here I just wanna do my thing and not worry about licensing. that's another reason, I can use code licensed almost anything in an AGPLv3 project, so it's also handier for me

meh, to be able to offer commercial exceptions you need CLAs which are equally sleazy

But fewer people can use my project, I don't want them to have to worry either. I just want it out there. Hopefully companies will toss me a couple of bucks on occasion, or I can have some other way to monetize it that doesn't also make OSS devs have to jump through hoops if they want to use it and aren't using something compatible

Lately I've been increasingly using a cooperative model. People who contribute code get a share of whatever comes from that code.

arc: I'd be really curious how you handle that? I like the co-op model a lot which is why I tend to split the copyright among all contributors, but I don't really make any money on anything I work on outside of <dayjob> so I'd love to know how it works when there's an actual big community rpoject

On a tagentially related note: would anyone with a GitHub account help me prove a point about why github stars are a bad metric for anything by starring a repo of mine? (I will not be making any benefit from this, it's just to prove a point that my project with no contributions from anyone except me can have a lot of stars)

https://github.com/mellium/xmpp if anyone is willing.

I also like the "high number of issues == low quality software" metric

can't fix stupid I guess ? :'(

Exactly, basically the same thing.

When I was in school I did an internship with a defense contractor that gave raises based on the number of lines of code written in a git blame for the year. As you can imagine, it was the most ridiculously bloated software. All the stupid tricks like putting one argument per line even in small function calls would get called out in code review, but people still did things in stupid round about ways.

I thought that kind of thing was a joke

at work we joke that the contractors must be getting paid by the line, even though we know they aren't...

Don't they know it's the inverse of that! Also popularity ≠ quality!!11! Aaaargh, how do you become a potato farmer?

npm install potato-farmer ?

In this case it's popularity ≠ robust community. I started talking to someone from Open Colletive befor the FOSDEM call ended, so we're emailing to have the converation about why I think stars aren't anywhere close to their metric and my small project shouldn't have to jump through more hoops than a project that's equally small but a trendy tech and more people bookmarked it

I thought stars were more like github-bookmarks

They are.

like I have a couple hundred line arduino code snippets that haven't been touched since 2012 that I think might come in handy one day starred

and, not things like curl, because I know where they are, and they are easy to find

> I thought stars were more like github-bookmarks I use them like that. 😃

I think a lot of people do, but a lot also use it to say thanks when someone makes something they use, which is I think where the "it obviously means it's popular" comes from.

yea I've never done that once, interesting

I must have missed the "github: how to use stars" class

I mean, I think that's fine, I just don't think that means other people should attribute meaning to "100 stars" or whatever

On a tagentially related note: would anyone with a PayPal account help me prove a point about why being rich is a bad metric for anything by sending me all their money? (I will not be making any benefit from this, it's just to prove a point ...)

Oh man, my scam just feels so armetureish now. Kev wins.

Kev, prince of Nigeria…

(but in all seriousness, I am trying to convince Open Collective to come up with some metric other than GitHub stars)

What would be a good metric?

There isn’t one? :)

Yah, I think it's got ot be something you determine individually, not by something specific to a code hosting service

Maybe a mix of unique contributors, activity over time (including having multiple people consitsently active), etc.?

It also depends what you’re trying to measure. Quality, or ease of access as a contributor?

If it’s the former, number of contributors isn’t a particularly good metric. If the latter, it may well be.

I think they're trying to measure the health of the community

Your suggestions sound like a reasonable way to think about that then, yes. I assumed it was something project-related.

Sorry, should have explained up front. Open Collective accepts projects into their fiscal host only if they have >100 stars on GitHub. I believe that is a bad metric. I said so as the "controversial opinion" question in a call earlier and someone form Open Collective reached out and asked if I was talking about them and why I thought it was a bad idea

So I thought before I sent an email I'd try and get my project with literally no community up to that number and link them to it and a few others I know that are at or close to that.

Afair I even got a star on github for a repo that was automatically cloned into my account when I just PRed something minor like a typo. 🙂