Regarding the real-name-only contribution policy

[Arınç ÜNAL]

After the xz backdoor incident, I don't think it would be very wise to
start allowing usernames. Not just that, anyone with a full name that
cannot be tied to a real person through either public knowledge on the
internet, or information privately provided to the maintainers of the
project is a potential infiltrator in my eyes.

But, I think usernames should be allowed for submissions, and the
submissions must be reviewed thoroughly. Becoming a maintainer or a member
of the project on the other hand, must not be possible unless the person's
real life identity is privately provided.

Arınç

On 18/06/2024 21.01, sudobash418 wrote:
> Hello everyone,
> 
> I am new to contributing to OpenWrt, and have recently opened a couple of PRs against the openwrt repo:
> - https://github.com/openwrt/openwrt/pull/15684
> - https://github.com/openwrt/openwrt/pull/15695
> 
> I have authored and signed-off on each commit using my username, `sudoBash418`, as I have for all my OSS contributions in the past.
> At the time, the wiki page on submitting patches stated that using a "known identity" was permitted [1].
> 
> [1]: https://openwrt.org/submitting-patches?rev=1704903503#submission_guidelines
> 
> However, I have since been informed that the official project policy requires a "real name", and that a known identity such as my username does not qualify [2].
> The wiki has since been updated to reflect this policy.
> 
> [2]: https://github.com/openwrt/openwrt/pull/15684#issuecomment-2172752403
> 
> I've now read through:
> - The history of the submitting-patches page on the OpenWrt Wiki [3]
> - The "Real name vs. known identity in contributions" thread on openwrt-adm, started 2023-02-27 [4]
> - A revival of that thread on openwrt-devel, started 2024-01-10 [5]
> - The "here we are again: real name 'discussion'" thread on openwrt-devel, started 2024-03-26 [6]
> - Numerous PRs across the OpenWrt project, including:
>      - openwrt/openwrt#14380 ("ci: no longer require real name") [7]
>      - openwrt/packages#23084 ("ci: no longer require real name") [8]
>      - openwrt/packages#17993 ("[21.02] Bump yggdrasil to 0.4.3") [9]
>      - openwrt/packages#23072 ("yggdrasil-jumper: add new package") [10]
> 
> [3]: https://openwrt.org/submitting-patches?do=revisions
> [4]: https://lists.openwrt.org/pipermail/openwrt-adm/2023-February/002358.html
> [5]: https://lists.openwrt.org/pipermail/openwrt-devel/2024-January/042058.html
> [6]: https://lists.openwrt.org/pipermail/openwrt-devel/2024-March/042472.html
> [7]: https://github.com/openwrt/openwrt/pull/14380
> [8]: https://github.com/openwrt/packages/pull/23084
> [9]: https://github.com/openwrt/packages/pull/17993#issuecomment-1059783673
> [10]: https://github.com/openwrt/packages/pull/23072#issuecomment-2023805052
> 
> As I understand it, the question of whether OpenWrt should change its policy on names to match the Linux kernel's has never been *formally* answered (via a vote), despite being raised over 15 months ago.
> 
> Therefore, I would like to request that the OpenWrt committers hold a formal vote in accordance with the OpenWrt rules [11], and that they do so in a timely manner (i.e. not stalling for months without cause).
> 
> [11]: https://openwrt.org/rules
> 
> Thank you from hopefully a future contributor,
> sudoBash418
> 
> 
> _______________________________________________
> openwrt-devel mailing list
> openwrt-devel at lists.openwrt.org
> https://lists.openwrt.org/mailman/listinfo/openwrt-devel