Isn't Arch BBS already providing list of usernames? In general, though, I'd say follow the principle of least effort. Why just not publish the list of usernames and that's all? This way, new users can easily grep for them and don't need scrapers, and "researchers" can have fun... On Mon, Mar 06, 2017 at 12:36:35AM +0100, Ralf Mardorf wrote:

Giving away any data is bad, period. I hate this fashion that nowadays every "expert" holding a share is granted access to data, that even the NSA isn't getting that easy. Starting to give away such data to "researchers" is evil, let alone that all that "serious" statistics are just bullshit. No exceptions in regards to privacy! An "exceptions" is a violation of privacy. Why not giving away telephone numbers? Everybody anyway could dial each available number, so it doesn't matter to give away the numbers, right? ;)

Oh, please. Not the usual NSA crap again. Cheers, -- Leonid Isaev

I was under the impression that the AUR git interface is just one big git repo. Yes it checks out only the package you clone but the references contain all packages (and commits). Am I mistaken to this? Regards, -- Leonidas Spyropoulos A: Because it messes up the order in which people normally read text. Q: Why is it such a bad thing? A: Top-posting. Q: What is the most annoying thing on usenet and in e-mail?

On Sun, 5 Mar 2017 18:14:02 -0700, Leonid Isaev wrote:

Isn't Arch BBS already providing list of usernames?

In general, though, I'd say follow the principle of least effort. Why just not publish the list of usernames and that's all? This way, new users can easily grep for them and don't need scrapers, and "researchers" can have fun...

On Mon, Mar 06, 2017 at 12:36:35AM +0100, Ralf Mardorf wrote:

...

Giving away any data is bad, period. I hate this fashion that nowadays every "expert" holding a share is granted access to data, that even the NSA isn't getting that easy. Starting to give away such data to "researchers" is evil, let alone that all that "serious" statistics are just bullshit. No exceptions in regards to privacy! An "exceptions" is a violation of privacy. Why not giving away telephone numbers? Everybody anyway could dial each available number, so it doesn't matter to give away the numbers, right? ;)

Oh, please. Not the usual NSA crap again.

I did not wrote about the NSA. I only pointed out that even the NSA doesn't get all the data as a gift. Why should a researcher get such data as a gift? You are seemingly already that used to data mining and offended privacy, that it's good and natural from your point of view, if data is misused and any concerns are just crap in your opinion. That usernames are used in public and maybe even a list might be already published, is different to actively give the same data away to "researchers" and to formally allow them to use the data. You seem not to understand the principle of privacy. If you don't lock the street door, this does not automatically indicate that you want people to come into your house and take away your property. Btw. what is the aim of the research and how could the research be used or possibly misused? We don't need to care about such questions, if data isn't given away as a matter of principle.

I guess I'll be the devil's advocate. I see no privacy issues in handing over a list of already public information You could deny it for practical reasons though, if you simply could not be bothered to scrape/export such a list yourself. Denying or allowing won't stop anyone from obtaining the list. If users were concerned about their usernames being public, they shouldn't have submitted them publicly. Public information is public, deal with it and stop being so paranoid, they're gonna get you anyway. ;)

2017-03-06 11:18 GMT+01:00 Ralf Mardorf :

Privacy is a principle. You seem not to understand the difference between giving somebody data with the formal permission to use this data and data that simply is available for everybody, but not explicitly handed over to somebody. Paranoia isn't involved in my concern.

My standpoint is that privacy does not apply to this kind of public information, simply because it's not private and by no means sensitive (people freely chose the username and other visible info they posted, no?). Thus, no, I see no difference and really no point in even considering trying to keep such information private. What anyone does with the freely available information posted in the AUR is up to them ("mining" it or handing it over to someone else included), we could not do anything about it anyway, nor would I even care if I was in that list or not, since there seems to be no ToS between the one submitting that information and the one publishing it. Since it was freely submitted without any terms, I can simply not find any restrictions on its usage. Yes, we should have a ToS to at least keep the principle of privacy alive. But let's face it, real privacy online has been dead for long, if it ever existed. If there was a ToS, the situation would perhaps have been different, at least legally. I'm no legal expert of course, but to me it makes perfect sense that if you posted something on the internet, in a very public space, you can have no expectations of keeping any of that information private in any way, nor any information easily associated with. No, I don't see that as a problem, at least not if you never explicitly agreed that information would not be shared. What I really want to keep private I don't post anywhere.

On Mon, 6 Mar 2017 11:53:34 +0000, Mauro Santos via arch-general wrote:

I think the point here is not so much privacy, as I believe everyone recognizes that the information that was asked for (the full list of usernames) is public

It's not per se forbidden to take a photo of a public location, it's even allowed to take the photo and to publish the photo, if a girl randomly is on that photo, too. It is forbidden to provide a collection of such photos to somebody else, who needs such photos for a porn website. Now "research" isn't "porn", but subtleties could make it hard to decide how to handle something like this. That something is public, doesn't mean that privacy could be ignored.

2017-03-06 12:53 GMT+01:00 Mauro Santos via arch-general < arch-general@archlinux.org>:

On 06-03-2017 11:20, Henrik Danielsson via arch-general wrote:

...

2017-03-06 11:18 GMT+01:00 Ralf Mardorf :

...

Privacy is a principle. You seem not to understand the difference between giving somebody data with the formal permission to use this data and data that simply is available for everybody, but not explicitly handed over to somebody. Paranoia isn't involved in my concern.

My standpoint is that privacy does not apply to this kind of public information, simply because it's not private and by no means sensitive (people freely chose the username and other visible info they posted, no?). Thus, no, I see no difference and really no point in even considering trying to keep such information private.

What anyone does with the freely available information posted in the AUR is up to them ("mining" it or handing it over to someone else included), we could not do anything about it anyway, nor would I even care if I was in that list or not, since there seems to be no ToS between the one submitting that information and the one publishing it. Since it was freely submitted without any terms, I can simply not find any restrictions on its usage.

Yes, we should have a ToS to at least keep the principle of privacy alive. But let's face it, real privacy online has been dead for long, if it ever existed.

If there was a ToS, the situation would perhaps have been different, at least legally. I'm no legal expert of course, but to me it makes perfect sense that if you posted something on the internet, in a very public space, you can have no expectations of keeping any of that information private in any way, nor any information easily associated with. No, I don't see that as a problem, at least not if you never explicitly agreed that information would not be shared. What I really want to keep private I don't post anywhere.

I think the point here is not so much privacy, as I believe everyone recognizes that the information that was asked for (the full list of usernames) is public and can be scraped.

The point here is handing over the full list of usernames on request. Do note that in their research proposal[1] they specifically mention scraping information from github. That information is public, github does have an API to query that information, but they still have to scrape it, I suppose that implies github does not hand it over wholesale on request, why should we? This might be due to their ToS or they know something we don't.

It would be rather interesting to see what they could come up with from that correlation. I think, perhaps a bit cynically, the reason github may not hand over that data directly is likely that they don't want to do some of the work of the researchers for them. As you said, the data is there, the format matters less if they're going to massage it into something else later anyway, so why bother with the effort of compiling it on their [github] own time? We could simply deny the AUR username request it for the same reason, or no reason at all. Since some people seem uncomfortable about what could be derived from a potential correlation of publicly available data, that's most likely the safest way to go.

2017-03-06 14:36 GMT+01:00 Mauro Santos via arch-general :

On 06-03-2017 12:45, Henrik Danielsson via arch-general wrote:

...

2017-03-06 12:53 GMT+01:00 Mauro Santos via arch-general < arch-general@archlinux.org>:

...

On 06-03-2017 11:20, Henrik Danielsson via arch-general wrote:

...

2017-03-06 11:18 GMT+01:00 Ralf Mardorf :

...

Privacy is a principle. You seem not to understand the difference between giving somebody data with the formal permission to use this data and data that simply is available for everybody, but not explicitly handed over to somebody. Paranoia isn't involved in my concern.

My standpoint is that privacy does not apply to this kind of public information, simply because it's not private and by no means sensitive (people freely chose the username and other visible info they posted, no?). Thus, no, I see no difference and really no point in even considering trying to keep such information private.

What anyone does with the freely available information posted in the AUR is up to them ("mining" it or handing it over to someone else included), we could not do anything about it anyway, nor would I even care if I was in that list or not, since there seems to be no ToS between the one submitting that information and the one publishing it. Since it was freely submitted without any terms, I can simply not find any restrictions on its usage.

Yes, we should have a ToS to at least keep the principle of privacy alive. But let's face it, real privacy online has been dead for long, if it ever existed.

If there was a ToS, the situation would perhaps have been different, at least legally. I'm no legal expert of course, but to me it makes perfect sense that if you posted something on the internet, in a very public space, you can have no expectations of keeping any of that information private in any way, nor any information easily associated with. No, I don't see that as a problem, at least not if you never explicitly agreed that information would not be shared. What I really want to keep private I don't post anywhere.

I think the point here is not so much privacy, as I believe everyone recognizes that the information that was asked for (the full list of usernames) is public and can be scraped.

The point here is handing over the full list of usernames on request. Do note that in their research proposal[1] they specifically mention scraping information from github. That information is public, github does have an API to query that information, but they still have to scrape it, I suppose that implies github does not hand it over wholesale on request, why should we? This might be due to their ToS or they know something we don't.

It would be rather interesting to see what they could come up with from that correlation.

Probably nothing meaningful. As I've said before you have no way of knowing if user foo on github is the same as user foo on the AUR.

True, but you could make a decent guess based on how many coincidences there are surrounding those names. Relations between names could be interesting even if the people behind them are not the same.

...

I think, perhaps a bit cynically, the reason github may not hand over that data directly is likely that they don't want to do some of the work of the researchers for them. As you said, the data is there, the format matters less if they're going to massage it into something else later anyway, so why bother with the effort of compiling it on their [github] own time?

We could simply deny the AUR username request it for the same reason, or no reason at all. Since some people seem uncomfortable about what could be derived from a potential correlation of publicly available data, that's most likely the safest way to go.

-- Mauro Santos

On Mon, 6 Mar 2017 13:45:37 +0100, Henrik Danielsson wrote:

...

We could simply deny the AUR username request it for the same reason, or no reason at all. Since some people seem uncomfortable about what could be derived from a potential correlation of publicly available data, that's most likely the safest way to go.

Even if all users would agree to hand out a username list, why risking a possible issue for some research, that seems to gain nothing for the Arch community and as far as I can see even not for human kind? To be honest, I can't name a real issue, I only could imagine very abstract issues. I don't understand that research at all. Much likely nothing bad would happen by handing out a list, but to avoid a "Now, why didn't I think of that?"-issue the easiest solution seems to reject such requests in general, at least as long as it's not obviously that the research is "good" (what ever this means) for the Arch community and/or human kind or the universe in general. Well, there's probably a lot of research results we did not know the

2017-03-06 15:01 GMT+01:00 Ralf Mardorf : positive [or any] effects of beforehand. I also doubt we'll find some drastically new improved way of life because of this, but not all research aims for that. Satisfying curiosity would be enough reason for most research IMHO. Learning there is nothing there is also learning.

On Mon, 6 Mar 2017 15:18:43 +0100, Martin Kühne via arch-general wrote:

On Mon, Mar 6, 2017 at 3:01 PM, Ralf Mardorf wrote:

...

Much likely nothing bad would happen by handing out a list, but to avoid a "Now, why didn't I think of that?"-issue the easiest solution seems to reject such requests in general, at least as long as it's not obviously that the research is "good" (what ever this means) for the Arch community and/or human kind or the universe in general.

So you're admitting that you can't come up with a real concern and are opposing just for the sake of opposing.

Wrong! Protection of privacy is something that requires much thinking and much weighting. Abstract imagination of issues is reason enough to deny such a request, as long as the researcher doesn't plausibly explains the benefit of the research. If somebody wants to hand out the requested data, this person should provide more easy to understand information, that isn't too long to read. On Mon, 6 Mar 2017 15:07:53 +0100, Henrik Danielsson wrote:

I also doubt we'll find some drastically new improved way of life because of this, but not all research aims for that. Satisfying curiosity would be enough reason for most research IMHO. Learning there is nothing there is also learning.

Curiosity about what? How many equal nicknames were used on AUR and github and what kind of software is related to those nicknames? A researcher is seriously interested in this information? Not in something else? How do you know that this research is about learning something positive? We, the Internet and/or phone home app users already suffer from much misused data. It's reasonable to be sceptic in regards to protection of privacy. Has got somebody the slightest idea about the aim of this research? "anonymized statistics" and "establish connections" are abstract phrases. Not abstract is that those claims are contradictory, without the need of much abstract concerns or paranoia. In the end I don't care, since I more or less have given up that nowadays people are interested in really thinking about protection of privacy, hence I'll op out, I only wanted to point out my doubts. Done. Regards, Ralf

Hi, ok a last reply to this topic. Since the usernames are anyway public, there is a reason to ask for a list. - politeness? - laziness? - something related to laws? - ?? Perhaps the research has nothing to do with AUR and github, but e.g. with a method, maybe an algorithm to "establish connections", perhaps for manipulation purpose? I've got much fantasy about a lot of "good" but as well "evil" reasons. On Mon, 6 Mar 2017 16:06:30 +0100, Martin Kühne via arch-general wrote:

On Mon, Mar 6, 2017 at 3:53 PM, Ralf Mardorf wrote:

...

Has got somebody the slightest idea about the aim of this research?

good question.

...

"anonymized statistics" and "establish connections" are abstract phrases. Not abstract is that those claims are contradictory, without the need of much abstract concerns or paranoia.

none of these are crimes. and xxxjavaturtle69xxx actually writes vectorgraphics in java.

Researchers sometimes misuse real records, not to harm those who originally own those records, they just want to test processes that later should be used for something that isn't related to those "test" records.

...

In the end I don't care, since I more or less have given up that nowadays people are interested in really thinking about protection of privacy, hence I'll op out, I only wanted to point out my doubts. Done.

Your approach kind of reminds me about how statistics is a much misunderstood field. It doesn't matter what or how you record statistics, you will always going to get rid of most of the data for the sake of having a general overview, and nothing keeps you from misinterpreting the results you get. That *still* doesn't make the tools completely useless, as it's great for grouping many data points into individual sectors. Of course it's not a simple topic, but you can't fit a one-opt-out-fits-all-opt-outs approach to the problem domain and think you're done?

No, as already pointed out, we don't know what this research is for. Who says that the target of the research are statistics? This statistic thingy perhaps is just to test or train something, that later should be used for something completely different. Now I'll use my fantasy for continuing a music project done with Linux. Regards, Ralf

On Mon, Mar 6, 2017 at 11:26 AM, Guus Snijders via arch-general wrote:

Op 6 mrt. 2017 10:52 schreef "Henrik Danielsson via arch-general" < arch-general@archlinux.org>:

...

I guess I'll be the devil's advocate. I see no privacy issues in handing over a list of already public information You could deny it for practical reasons though, if you simply could not be bothered to scrape/export such a list yourself. Denying or allowing won't stop anyone from obtaining the list.

Gaetan's criticism applies to you here, now. please designate paragraphs of text which you reply to.

I know it's not directly an privacy issue, but I find it scary nonetheless... (especially since they expressed the wish to consolidate the data with other websites such as github).

This is exactly for the argument I was struggling to come up with. As far as I followed the discussion, this was the first time (I realized?) someone clearly disconnected the argument from the privacy discussion. Put this way, it makes sense to me, too. For the practical implications we'd hand over along, with a note of "do whatever you want with it we don't care". Turns out we do care what someone else does with the data. cheers! mar77i

2017-03-06 11:39 GMT+01:00 Martin Kühne via arch-general < arch-general@archlinux.org>:

Gaetan's criticism applies to you here, now. please designate paragraphs of text which you reply to.

I was not replying to anyone in particular. Gaetan? Sorry, you lost me there.

2017-03-06 12:58 GMT+01:00 Martin Kühne via arch-general :

On Mon, Mar 6, 2017 at 12:21 PM, Henrik Danielsson via arch-general wrote:

...

I was not replying to anyone in particular. Gaetan? Sorry, you lost me there.

It may not have appeared in the same thread for you, but here we go [0] context, and the mail I was replying to was [1], for which the former applies.

cheers! mar77i

[0] http://www.mail-archive.com/arch-dev-public@archlinux.org/msg25123.html [1] http://www.mail-archive.com/arch-general@archlinux.org/msg43113.html

You are right, those did not show up as a thread for me, or even in my inbox. Thank you for that. I suppose I should have quoted part of the original message, but it was not on a list I'm not a subscriber on and the quote in Mauro's mail did not render as a quote normally does in Gmail, hence I was not sure it would render correctly if I messed up the copying it (HTML entities and all). I've never been able to make heads or tails of what mailing lists actually consider new or continued threads, or even navigating archives. :(

On Mon, 6 Mar 2017 22:46:14 -0500, Eli Schwartz via arch-general wrote:

Let us emulate the forums, and provide a username list only accessible to logged-in AUR users.

So you recommend that AUR should deviate from the Arch related mailing lists. Note, mailman mailing list could be set up to "The subscribers list is only available to the list members" as done for https://lists.archlinux.org/listinfo/aur-general and then the members could decide on their own, if they are visible by this list [1]. However, https://lists.archlinux.org/listinfo/arch-general is set up to "The subscribers list is only available to the list administrator". So it was always the default and still is the default, not to provide such lists. There are sane reasons why those options are available, but we are at a point were nobody cares anymore about privacy and you recommend that providing such a list is appropriate. For what reason? Why not keeping what always was and still is default for Arch, simply to respect privacy? [1] "Conceal yourself from subscriber list? When someone views the list membership, your email address is normally shown (in an obscured fashion to thwart spam harvesters). If you do not want your email address to show up on this membership roster at all, select Yes for this option."

Eli Schwartz via arch-general writes:

On 03/06/2017 10:08 PM, YANG Ling via arch-general wrote:

...

Hi all, Shall we focus on Lukas's questions?

Yes, let's.

[skipped - pointlessly quoted and then repeated questions]

...

2. The second question: Would it make sense to even make this data publicly available? No, it is not OK. Please check this wiki [1]. Login name or nickname is Personally identifiable information (PII).

Okay... firstly, thanks for the strange Wikipedia proxy.... Oops, I forgot to paste the original wiki link. Wikiwand is a tool which can beautify Wikipedia page. If that bothers you, here is the original

Sorry, I'm not familiar with the rules here. I thought it is necessary to keep all original text. link: https://en.wikipedia.org/wiki/Personally_identifiable_information

tl;dr Let us emulate the forums, and provide a username list only accessible to logged-in AUR users.

Actually I am not *strongly* against it. I just feel it is not necessary to do it. Here is my logic: If one thing can make Archlinux better, then we do it. If one thing can make Archlinux worse, then we don't do it. If we cannot tell one thing make Archlinux better or worse, then it is not necessary to do it. In this case, what does Archlinux or its community gain from sharing usernames with researchers? I cannot see merits. Well, I am not Archlinux expert, nor Trust User. Maybe you can see merits which are not obvious to me. If most Trust Users feel it is OK to share usernames, I am fine with it. Don't get me wrong. I just simply hope Archlinux become better and better. -- Allen Yang

On 8 March 2017 at 20:57, Neven Sajko wrote:

This discussion is pointless without legal advice. Without it disclosing user information (even if it is public) does not seem like such a good idea.

Not that I advocate paying a lawyer just for this issue, it would be simpler to let her scrape AUR ;) ... But there probably should be some TOS ...

On Wed, Mar 08, 2017 at 09:02:24PM +0100, Neven Sajko via arch-general wrote:

... But there probably should be some TOS ...

Why? Would a ToS be a legally binding document? If yes, it will constrain Arch, which is not good. If no, then it's just a meaningless text. I understand that companies have ToS because they want to cover their back legally, but Arch is different in this regard... Cheers, -- Leonid Isaev