UPDATE: they have dropped Persona!

[poohlaga@mastodon.social]

@liaizon and again, it's the user's choice, and they can always opt out.

[li@tech.lgbt]

@poohlaga demanding users verify themselves by 'other means' is not "opting out", its asking them to choose if they want to be shot with a shotgun or a pistol, either way their still shot- where is the option to _not_ "verify my identity"

[li@tech.lgbt]

@sef @nullagent @liaizon @scan big FOSS developers have no problem actively maintaining and contributing to mass survailence and fascism, its been shown time and time again at this point

like yknow i feel like we all got the gist of how these things will go.. we all say 'hey what the fuck why are you doing "identity verification" let alone with fucking surveillance state company

they give some speil about """safety""" and [insert scapegoat here].. and basically ends up with 'fuck you were doing it anyway' ..

this is how it goes every fucking time

[poohlaga@mastodon.social]

@seabass @liaizon Happy to discuss. I've tried to respond to questions directly in this thread, but I want to make sure any user/hosted collective's concerns are addressed. If it's easier, we'll be at FOSS Backstage next week, and we can always be reached directly at hello@oscollective.org

[li@tech.lgbt]

@Betree @opsocket @liaizon

oh boy i sure cant wait for the next round of 'we heard your concerns and we totally understand.. and listening to feedback .. anyway here is some spiel about ""safety"" and [insert scapegoat here] .. so fuck you were doing it anyway.'

[solonovamax@tech.lgbt]

@liaizon @scan hey, uh, @OpenSourceCollective, what the fuck?

[poohlaga@mastodon.social]

@wcbdata @liaizon @scan Thanks, we agree. We recognize that identity verification raises legitimate privacy concerns, especially in the open source ecosystem.

If you know of identity verification providers that operate outside the US, and align with strong privacy standards, we would love suggestions.

Handling funds responsibly while respecting the privacy of contributors and maintainers is a balance we take very seriously.

[abekonge@venner.network]

@liaizon @jowek @ukrudt @tak @ruben @magnus

Yes haven't checked out the state of petition-software lately.

One low effort/complexity way of doing it would be to write a letter in ukrudt's hedgedoc and just ask projects to sign it if they agree - sign it by way of writing their name in the bottom: https://hedgedoc.ukrudt.net/ - we can then create a public read-only link and share that.

[betree@framapiaf.org]

@nextgraph @liaizon @OpenSourceCollective On encryption: it's not accurate to say all data is stored unencrypted. Sensitive documents like tax forms uploaded to S3 are encrypted before upload (https://github.com/opencollective/opencollective-api/blob/main/server/lib/tax-forms/index.ts#L44), as are certain sensitive fields in the database (https://github.com/opencollective/opencollective-api/blob/5e374c160750fc259ee4163230c764956efda36f/server/graphql/v2/mutation/LegalDocumentsMutations.ts#L126).

[betree@framapiaf.org]

@nextgraph @liaizon @OpenSourceCollective On self-hosting: it's true that it's harder than it should be. The platform wasn't built with self-hosting in mind, and over the years we've added layers of business logic tightly coupled to our own instance. On top of that, our primary users are fiscal hosts. The platform's features are therefore oriented around these organizations which operate at a much larger scale. This is part of why self-hosting at the collective level feels so out of reach.

[andres4ny@social.ridetrans.it]

@sef I mean, probably the most famous example:
https://lwn.net/Articles/131657/

However, note that we're discussing building services for _ourselves_, not other people. We can throw together something that's extremely rough around the edges that scratches our itches, but isn't ready for the rest of humanity!

@nullagent @liaizon @scan

[betree@framapiaf.org]

@nextgraph @liaizon @OpenSourceCollective On GDPR: it does apply to us. Yes, we're a US-based non-profit (though most of our team is based in Europe), but several of the fiscal hosts on the platform are European. We take that obligation seriously. We'd like to get to a place where European users have their data stored in separate regional instances; this is on our roadmap.

[betree@framapiaf.org]

@nextgraph @liaizon @OpenSourceCollective We've applied for decentralization grants to help make it happen. We're a small team and prioritizing this alongside everything else is genuinely difficult.

All that said, we've already made real progress over the past few years: white-labeling work, consolidated data import/exports, and we're currently refactoring our ID system in a way that will also support better decentralization.

[betree@framapiaf.org]

@nextgraph @liaizon @OpenSourceCollective On infrastructure: yes, we run primarily on Heroku, which relies on AWS. This is a legacy decision the engineering team inherited, and moving away from it is non-trivial at our scale. Here again, the work we're doing around decentralization will hopefully help us spin up separate instances in Europe and progressively migrate what needs to be migrated.

[abekonge@venner.network]

@liaizon @jowek @ukrudt @tak @ruben @magnus

With an network of protesting collectives there are ways to escalate, one way could be:

* Write to all your collectives supporters and ask them to share the story.

[abekonge@venner.network]

@liaizon @jowek @ukrudt @tak @ruben @magnus

I wonder if there is a strategic consideration here:

1) Reach out to Open Collective & Open Source Collective in good faith with the letter and give them a chance to do something without a lot of fuss.

2) And then go more public.

---

[abekonge@venner.network]

@liaizon @jowek @ukrudt @tak @ruben @magnus

In general I would love to have a network of grassroots OC/OSC to pressure for stuff. e.g.

* Getting another payment processor than Stripe

[magnus@venner.network]

@abekonge @liaizon @jowek @ukrudt @tak @ruben I like escalation strategies like that. It gives Open Collective time to react before the shit hits the fan and then it gives us room for increasing the pressure if they don't

[abekonge@venner.network]

@liaizon @jowek @ukrudt @tak @ruben @magnus

Another issue is the whole governance issue - their 2022 stated goal for "Exit to Community" has resulted in:

"That vision became reality in 2024, when stewardship of the platform transitioned to a new nonprofit: the Open Finance Consortium Inc. (OFiCo), a U.S. 501(c)(6) association created by and for the fiscal hosts and communities who rely on it.

OFiCo now governs the platform collectively, while its subsidiary OFi Technologies (OFiTech) operates the platform. Together, they continue the original Open Collective mission: enabling transparent, collaborative finance for communities everywhere."

What does "govern the platform collectively" mean?

The OFi Consortium site says they are "community governed", and then later, that they are formed by 5 organisations including Open Collective Europe and Open Source Collective, that "represent thousands of Collectives and guide our strategic direction".

I'm in several collectives that are fiscally hosted by Open Collective Europe, and I have never been asked to "guide their strategic direction" in any real governance sense. And looking through their (OCE) site - there is nothing I can find about hosted collectives having governance. For me "exit to community" means that the community, in this case, the collectives, have governance - but I don't see it.

Am I missing something?

This is probably next-step stuff. But it is a lingering question I have had for a while. I have a good relationship with OCE, and I believe they are well-meaning. My worry is that if there is no real community governance, then it becomes "community-washing" instead of "community-governance".

[abekonge@venner.network]

@jowek @ukrudt @tak @ruben @magnus

Your original thread @liaizon, would be a good starting point for a letter draft I think ...