2026

2025

2024

2023

2022

2021

2020

2019

2018

Idpy-board

idpy-board@lists.sunet.se

74 discussions

Start a nNew thread

Incident response draft updates

by ivan.kanak＠gmail.com

Hello, I've added two small sections regarding the topics we discussed on the call for the incident response document. * Add section about storage policy https://github.com/IdentityPython/Governance/pull/3/files * Add acknowledgement for security researchers https://github.com/IdentityPython/Governance/pull/4/files Kind regards, -- Ivan c00kiemon5ter Kanakarakis >:3

7 years, 6 months

1
0
0 0

Doodle Poll: idpy Board call for January 2019

by hlflanagan＠sphericalcowgroup.com

Hola a todos! It's time for our favorite activity: meeting scheduling! https://doodle.com/poll/q43ttxvy497w9a4f If we can make progress on the CLA discussion on the list, that will help make the call itself more efficient. I'll send out a note shortly with further information regarding the number of committers, etc, to help inform the discussion. Thanks, Heather

7 years, 6 months

2
3
0 0

Attending TIIME?

by hlflanagan＠sphericalcowgroup.com

Hola a todos! How many of you are planning to attend the TIIME meeting in Vienna (https://tiimeworkshop.eu/)? Would it be worth adding a governance session at the close of the idpy developers meeting on Monday, 11 February (at the end so that people who might not otherwise be in Vienna could dial in)? -Heather

7 years, 6 months

4
3
0 0

To CLA or Not to CLA

by hlflanagan＠sphericalcowgroup.com

Hola a todos! At this point, I think we've come full circle on the question of whether or not to require a CLA for code committers. Just to get all the information in one place, let me recap/summarize: Arguments in favor: 1. CLAs can be stronger legal protection in case of IPR related issues. 2. Commons Conservancy (our probable home for IPR) recommends a CLA (and has a template we can use for one). Arguments opposed: 1. GitHub Terms of Service are considered by some (both within and independent of idpy) to be more than adequate, particularly after the February 2017 ToS update. 2. Getting a CLA from some committers will be impossible either due to an inability to contact them OR impediments with their employers. 3. Requiring a CLA will (possibly) discourage some committers from continuing participation in the project. 4. Code will likely have to be redone in order to work around third-party code that comes from developers who cannot/will not sign an CLA. A few additional details * There are 108 code committers who have submitted code to an idpy repository BEFORE the Feb 2017 GitHub ToS. This number hasn't significantly changed since then. * In April 2018, I sent email to these individuals letting them know that a CLA might be required at some point. If I missed anything, please chime in. If you have any other questions at all that you need answered before you can vote on this ([Yes|No] to requiring a CLA) please let me know. I'd like to have a final vote on this during our January call. -Heather

7 years, 6 months

1
0
0 0

Very Informal Notes: idpy Board call, 12 December 2018

by hlflanagan＠sphericalcowgroup.com

Attending: Heather, Chris, Leif Regrets: Christos, Roland, Mike, Ivan 0. Agenda bash Given the level of attendance, we’ll likely reuse this agenda for our next call. Heather to send out a doodle poll to find a time in January. 1. IPR - GÉANT and IPR (What is the relationship between IPR and the GEANT project? The default clause in the consortium agreement is that GEANT holds the IPR on behalf of the consortium. Need to see how that would play out if that means handing the IPR over to a third party. Action item for Christos to follow up on.) From Christos: Regarding the IPR, I have discussed this in GÉANT. Unfortunately I cannot provide a final response yet. The topic is in the hands of the GÉANT Execs at the moment. I am nagging them to get it resolved as soon as possible. - Draft Note Well (see email sent 11 December 2018) From Christos: Regarding the draft note, it looks fine to me. Point 3 looks like a very high level code of conduct. [It] is good that we something like this. - Next steps? 2. Review the criteria for bring in new projects to idpy (Practical use case: evolution of pyFF) - https://github.com/IdentityPython/IdentityPython.github.io/wiki/Adding-and-… From Christos: Regarding the criteria for bringing new project to idpy, I do not see mentioning anywhere that the software has to be open source. Are all open source licenses OK? and what about the topic of IPR? 3. TIIME? - idpy Developers meeting @ TIIME, Monday, 11 February 2018 4. AOB Offering a junior developer- Chris has a junior developer who will start on January 15 assigned to work exclusively on idpy project. Discuss tagging releases to make this more acceptable for people who are looking for mature products

7 years, 6 months

3
3
0 0

Agenda: idpy Board call, 12 December 2018

by hlflanagan＠sphericalcowgroup.com

BlueJeans link: https://bluejeans.com/840642655 Date/Time: Wednesday, 12 December 2018 @ 19:00 UTC Agenda 0. Agenda bash 1. IPR - GÉANT and IPR (What is the relationship between IPR and the GEANT project? The default clause in the consortium agreement is that GEANT holds the IPR on behalf of the consortium. Need to see how that would play out if that means handing the IPR over to a third party. Action item for Christos to follow up on.) - Draft Note Well (see email sent 11 December 2018) - Next steps? 2. Review the criteria for bring in new projects to idpy (Practical use case: evolution of pyFF) - https://github.com/IdentityPython/IdentityPython.github.io/wiki/Adding-and-… 3. TIIME? - idpy Developers meeting @ TIIME, Monday, 11 February 2018 4. AOB

7 years, 7 months

1
0
0 0

DRAFT: idpy Note Well

by hlflanagan＠sphericalcowgroup.com

To discuss on our call tomorrow... ---- DRAFT Identity Python Note Well This is a reminder of Identity Python policies in effect on various topics such as patents or other IPR. * By participating (e.g., submitting code, attending in conference calls or meetings, posting to project mailing lists) in Identity Python projects, you agree to follow Identity Python processes and policies as defined in the Identity Python governance pages and in the GitHub Terms of Service. * If you are aware that any code component or idea within an Identity Python project is covered by patents or patent applications that are owned or controlled by you or your sponsor, you must disclose that fact, or not participate in the discussion. * As a participant or attendee, you agree to work respectfully with other participants; please contact the Identity Python board (board at idpy.org) if you have any questions or concerns about this.

7 years, 7 months

1
0
0 0

Doodle poll: next idpy board call

by hlflanagan＠sphericalcowgroup.com

Hola a todos! I've put together a doodle poll to help us find a time for our next call: https://doodle.com/poll/p3rcfmipfte9mhpw If you would take a few moments to fill that out, we can get that on the calendar. Thanks! Heather

7 years, 7 months

1
1
0 0

Legal review - idpy board statutes

by hlflanagan＠sphericalcowgroup.com

Hola a todos (and my last idpy email for the day, I think) One of the items from our call yesterday was making sure that board members have an opportunity to have their respective legal teams review anything before signing. The only item we have for signature is the board statutes: https://github.com/IdentityPython/Governance/blob/master/DRAFT-idpy-statute… The board statutes do presume we go with Commons Conservancy, and we haven't explicitly made that decision. So we have a bit of a Catch 22. What I propose is to make an informal decision as to whether we're ok with going ahead with CC, then allow time for board members to get a legal review of this document, and finally adjust and sign as needed. So, for that first step: does anyone need additional information regarding potential IPR homes, or specific questions about Commons Conservancy? Thanks! Heather

7 years, 7 months

1
0
0 0

Notes: idpy board call, 13 November 2017

by hlflanagan＠sphericalcowgroup.com

Notes: 0. Agenda bash 1. Introductions - Heather Flanagan - Ivan Kanakarakis (SUNET, lead architect for Satosa, pySAML) - Leif Johansson (SUNET) - Roland Hedberg (independent, original developer and architect) - Christos Kanellopoulos (GÉANT) - Chris Whalen (individual contributor) - Mike Jones (Director OIDF, author of OIDC and JWT and OAuth) 2. Governance documents - https://github.com/IdentityPython/Governance 3. Discussing and possibly approving the use of Commons Conservancy as our IPR home - https://drive.google.com/drive/folders/1h2mFQHGhJualJWTwtt-ivpkJvUZP960f?us… Why do we want an IPR home? Today, all the code is copyrighted at various organizations. If we want to have other organizations rely on it, it might help if the copyright notices are at an organization that is demonstrated to be neutral, not affiliated with any commercial interest, and hard to take over. We (probably) would need to reassign copyright to them. We also might want the ability to take donations and hire more developers. Ivan is on staff, paid for by GÉANT, but we might want additional resources at some point (e.g., students, developers, other). Commons Conservancy offers a separate service that supports the financial end of things, and while we don’t need that right now, we might in the future. Can the Conservancy defend IPR in court for a project? They have a network of volunteer lawyers who would be interested in taking on pro bono work. Note that it is really hard to bring a lawsuit for something based in The Netherlands. This is a difference between some of the Foundations out there (e.g., OIDF, Free Software Foundation, Linux Foundation). Note that organizations like Linux Foundation will charge a much higher overhead. The Apache Foundation leaves you locked to a specific license model. So, there are pros and cons for all the above. Donating money to Commons Conservancy/NLNet gets you some tax advantages. Note that Commons Conservancy hasn’t been around all that long, so some of their assertions re: “unlikely to be sued” might be naive. What is the relationship between IPR and the GEANT project? The default clause in the consortium agreement is that GEANT holds the IPR on behalf of the consortium. Need to see how that would play out if that means handing the IPR over to a third party. Action item for Christos to follow up on. Procedural note: board members need to have an opportunity to have their legal team(s) review anything that requires a signature. 4. The pros/cons for requiring a CLA (and possibly making a decision on that) An initial discussion around CLAs had taken place on the mailing list: https://lists.sunet.se/pipermail/idpy-discuss/2018-April/000146.html https://lists.sunet.se/pipermail/idpy-discuss/2018-June/000188.html and, the related discussion for the criteria for new projects: https://lists.sunet.se/pipermail/idpy-discuss/2018-February/000098.html Ivan: Given the current GitHub terms, we are probably covered. But the terms take place from a certain date; before that date all contributions made are under a different state. We need to figure out whether we want to bring these changes up to our current license agreements, and whether or not we’ll need CLAs for everyone from now on. Roland: When did the GitHub terms change? Need to verify. Leif: Originally was on the side of needing CLAs, but after reviewing the arguments, decided against it. This is more like the IETF Note Well. By being in the room and contributing, you’re acknowledging what you need to do. That’s slightly different than saying “can I commit this code/write this draft/be in this meeting” and having to bring this to a company lawyer that has no interest in understanding whether this is ok or not. Roland: Also not in the camp of doing CLAs. The sheer amount of work to track everyone down is very high. Leif: will need to do some background work - are there any contributions we’re unsure of? (e.g., if a project pulled in an external dependency that had an incompatible license). Perhaps we want to formulate our own Note Well/Terms of Service? Chris: what kind of guidance do organizations have for their employees? It varies significantly Mike: for contributing to Google projects and OIDF you have to sign CLAs. Leif: in some organizations, developers are explicitly kept away from lawyers. We should not put people into a situation where they have to bring lawyers into it. We should create something “here’s what we think you should have the right to do. If you don’t, go away.” Christos: There are two aspects here, one is about the past, one about the future. Leif: we have to do something for the past. Some sort of transfer of authority to Commons Conservancy. Ivan: Need to decide what to do with contributors for people who contributed before 2017; we have a list of who has contributed as a whole, just need to figure out which among those contributed before 2017. Christos: If we’re going to use something like Commons Conservancy, does this become their problem? No, because we have to transfer the license over to them. Action items: Determine list of contributors from before 2017 GitHub term changes; create a Note Well 5. review the criteria for bring in new projects to idpy - https://github.com/IdentityPython/IdentityPython.github.io/wiki/Adding-and-… Practical use case: evolution of pyFF Holding topic to next call 6. Administrivia * Call frequency? More frequent calls to start; next call in 2-3 weeks * Publicly posted meeting agenda, meeting notes? Heather will post to the board mailing list; items that shouldn’t be public (which should be exceedingly rare) shouldn’t be noted. OK to make the mailing list archives. 7. AOB

7 years, 8 months

1
0
0 0