security team: Ryuno-Ki is not available at the moment #96

Ghost commented 2023年01月06日 19:13:05 +01:00

@Ryuno-Ki since you're currently busy, I propose that you temporarily step down from the security team. This is a demanding position where members are expected to respond quickly.

Is that ok with you? This is a newly formed team and the process is still fresh, feel free to disagree!

@Ryuno-Ki since you're currently busy, I propose that you temporarily step down from the security team. This is a demanding position where members are expected to respond quickly. Is that ok with you? This is a newly formed team and the process is still fresh, feel free to disagree!

Ryuno-Ki commented 2023年01月07日 09:30:30 +01:00

I disagree.

You see, we have vacation here. I set up my business this week.

If the expectation is that I have to prioritise Forgejo (an honorary office right now) higher than my family life or means to earn a living, than I have to step down.

That being said, I was responsive to direct messages (e.g. @circlebuilder contacted me). I told you on Mastodon, that I was unable to decrypt your emails. I could read encrypted mails from other senders.

If you feel an urgent need to reach me, you can now reach me by phone. Find the number at https://jaenis.ch/imprint/ (available since this week).

I admit that I did not look into Matrix channels since a few weeks. It's on my agenda for next week once the kids are back to school resp. kindergarten. I feel like I would serve the community better if I could focus on conversations instead of having them run on the side.

What are your expectations?

I disagree. You see, we have vacation here. I set up my business this week. If the expectation is that I have to prioritise Forgejo (an honorary office right now) higher than my family life or means to earn a living, than I have to step down. That being said, I was responsive to direct messages (e.g. @circlebuilder contacted me). I told you on Mastodon, that I was unable to decrypt your emails. I could read encrypted mails from other senders. If you feel an urgent need to reach me, you can now reach me by phone. Find the number at https://jaenis.ch/imprint/ (available since this week). I admit that I did not look into Matrix channels since a few weeks. It's on my agenda for next week once the kids are back to school resp. kindergarten. I feel like I would serve the community better if I could focus on conversations instead of having them run on the side. What are your expectations?

Ghost commented 2023年01月07日 09:51:41 +01:00

When it comes to security (and only to security), there are high expectations because Forgejo users rely on the security team to react on a timely manner.

I edited the title of the issue to clarify this is only related to the security team.

When it comes to security (and only to security), there are high expectations because Forgejo users rely on the security team to react on a timely manner. I edited the title of the issue to clarify this is only related to the security team.

caesar commented 2023年01月07日 10:13:49 +01:00

@Ryuno-Ki I'm very happy to see you're still around; I had also (perhaps unfairly) assumed that time constraints or other reasons had caused you to move away from Forgejo. But of course, like all (well, most) of us you are a volunteer and free to make your own schedule; absolutely no commitment is asked of any of us (except perhaps, as @dachary says, in the case of the security team). So just knowing that you're still around is great to know.

In the particular case of the security team, I guess expectations are different – though it seems from what you say that you are in fact available to respond quickly if needed for that kind of thing? I'm not on the security team, but I'd also assume that having at least some members with high availability is enough; maybe not every member needs to be always able to respond quickly? That's a matter for @forgejo/Security to debate I guess.

Either way, until we have some kind of elections I guess this kind of thing is "self-certified" – if you feel you are able to offer what is necessary to be a part of the team, that's good enough for me.

@Ryuno-Ki I'm very happy to see you're still around; I had also (perhaps unfairly) assumed that time constraints or other reasons had caused you to move away from Forgejo. But of course, like all (well, most) of us you are a volunteer and free to make your own schedule; absolutely no commitment is asked of any of us (except perhaps, as @dachary says, in the case of the security team). So just knowing that you're still around is great to know. In the particular case of the security team, I guess expectations are different – though it seems from what you say that you are in fact available to respond quickly if needed for that kind of thing? I'm not on the security team, but I'd also assume that having *at least some* members with high availability is enough; maybe not every member needs to be always able to respond quickly? That's a matter for @forgejo/Security to debate I guess. Either way, until we have some kind of elections I guess this kind of thing is "self-certified" – if you feel you are able to offer what is necessary to be a part of the team, that's good enough for me.

Ryuno-Ki commented 2023年01月07日 12:55:04 +01:00

@dachary Allow me to ask again: What are your expectations?

#37 did not mention any response time.
A reaction within 24 hours appears to be well within reasonable bounds to me. If you would like to have a faster response, hire staff. Keep in mind that the team here is very Europe-centric.

I'm disappointed that noone tried to reach out to me via DM before moving forward here.

@caesar Yes, I'm up and running. It's not unheard of me to go silent without prior notice in Open Source projects, though. My way to cope with information overload. I'm sorry if this raised a bad impression. I can not afford to have delays in the work related projects, because I have a family to feed.

Can you point me to the commitment that is expected from the security team? I must have missed the communication somehow.

@dachary Allow me to ask again: What are your expectations? https://codeberg.org/forgejo/meta/issues/37 did not mention any response time. A reaction within 24 hours appears to be well within reasonable bounds to me. If you would like to have a faster response, hire staff. Keep in mind that the team here is very Europe-centric. I'm disappointed that noone tried to reach out to me via DM before moving forward here. @caesar Yes, I'm up and running. It's not unheard of me to go silent without prior notice in Open Source projects, though. My way to cope with information overload. I'm sorry if this raised a bad impression. I can not afford to have delays in the work related projects, because I have a family to feed. Can you point me to the commitment that is expected from the security team? I must have missed the communication somehow.

Ghost commented 2023年01月07日 13:19:13 +01:00

@Ryuno-Ki I realize that this pull request has upset you and I apologize for that. Let me close it so that we can discuss how the security team is organized in a more relaxed context.

@Ryuno-Ki I realize that this pull request has upset you and I apologize for that. Let me close it so that we can discuss how the security team is organized in a more relaxed context.

Ghost commented 2023年01月18日 23:11:13 +01:00

Allow me to ask again: What are your expectations?

They are not defined at the moment.

> Allow me to ask again: What are your expectations? They are not defined at the moment.