If you're convicted of pedophilia (or rape) in a country, you should not be allowed to be alone with kids (or women) in another (like Polanski in the western world, but other examples exist). Should you?

But if you think that "passive" political action (i.e just being present at a rally, not being a speaker) outside a community should not have consequences inside the community, i think i agree with you (for now, i don't have put much thought into it, my opinion is not definitive).

The first part is a separate issue, that of forgiveness and redemption, and if they should be allowed in a society. The second part is about if judgements about smaller issues should spread beyond their original contexts.

I think for most people, the lines are determined by the magnitude of the crime, but where those lines lie is a personal and communal preference. At what point is an injustice so great that it cannot be overlooked even in different contexts? And at what point is it so great that it cannot ever be redeemed in thr future?

>If you're convicted of pedophilia (or rape) in a country, you should not be allowed to be alone with kids (or women) in another (like Polanski in the western world, but other examples exist). Should you?

No, but what does pedophila or rape have to do with software? You don't let convicted child molesters hang out with kids for obvious causal reasons but no such relationship exists with software.

I suspect the answer is not, in fact, that simple.

I encourage you to submit counterexamples. I'm about to get on a plane, though, I'll have to present my counterargument in a few hours.

The article contains counterexamples. You can start from those if you really think they're not reasonable (i.e. the answer is never)

You're mistaking a claim that a group of people based on their ethno-religious background is either worthless or to be blamed for multiple world issues (which historically led to killing them) with an opinion we can be respectful about.

I wouldn't expect you to be respectful of their opinion should it ever turn up in the course of your dealings with them as part of engaging in the community. But if it doesn't come up, you have no cause to be exclusive to such a person.

The pilot's opinions are a perfectly good example, must communities shun that airline as religiously impure if an individual pilot disagrees in any way with current authoritarian enforced doctrine?

Not really "never". I get where you're coming from, but sometimes, the behaviour outside the community does have consequences for the community; at least in those circumstances, it is appropriate - imperative, even - for the community to react and weigh in on the consequences. And you can easily imagine other cases, too (e.g. where behaviour outside community raises reasonable suspicions about behaviour inside the community - there should at least be the consequence of "increased oversight")

This comment appears carefully composed to provide a lot of words that look engaging without much I can actually respond to. How about some examples?

Let me give an example: Justine Sacco is one famous case of a person that was fired from InterActive Corp. for a completely-not-work-related tweet.

Setting aside the question of "should Internet have reacted like it did" - the reality is that her employer had little choice, given the circumstances. Yes, it was "outside-the-community behaviour", but the business impact was immediate & considerable, I argue that for the employer there was only one reasonable/rational way to handle the crisis.

[edit] Or to take a somewhat extreme hypothetical example - I presume that if you found out that, for whatever reason, a prominent Mozilla exec was secretly funding anti-Net-Neutrality lobby (i.e "out of the community behaviour"), you would expect Mozilla to talk about it and "handle the issue", not just say that "sorry, his own money, his own personal time, he can do whatever he wants to".

FOSS projects are usually not businesses and are not held to the same standards.

I'll bite. Let's say I'm in charge of a FOSS project to which you and I are both contributing to. If I find out you are posting white nationalist propaganda on Twitter, I'll kick you out of the project, simply because I don't like white nationalists and don't want the project to appear welcoming to them.

Your example is too easy.

What if you find out that the other other person supports strong enforcement of existing immigration laws? What if supporters of that policy are being labeled as a "white nationalists" by others? Is that really evidence of "white nationalism"? What if that person simultaneously supports significant changes to the immigration laws that would result in more legal immigration?

In those cases, I would still ask myself the same questions. Namely, am I fine with being associated with a person with these views? and am I fine with them being associated to my project?

If the answer is no, I would kick them out just the same and that's ok.

I guess kicking out one of the top contributors would hurt your FOSS project more than the indirect connection to white nationalists. And if it helps against white nationalists, I think that's debatable.

You probably wouldn't hire ex-cons either, because, you know, you don't want to appear welcoming criminals.

I believe in rehabilitation, so I would most definitely hire ex-cons trying to go straight.

People who are actively sharing white supremacist screed are not nearly in the same category.

That is a strained corollary.

Ex-cons have a shitty past. White supremacists are currently and actively shitty.

This is what is simple: people who have demonstrated a willingness to act in a deceitful or otherwise destructive way cannot be trusted, at least until they have demonstrated rehabilitation. Community does not complicate this simple fact.

This is precrime. And how do you rehabilitate them without giving them the opportunity to participate in the community? Deal with problems when they occur.

> This is precrime. ... Deal with problems when they occur.

Here's an example situation: you know that a person trying to join a project related to managing money has a history of defrauding employers, starting mlm/Ponzi schemes, scamming people, selling personal information. Do you let them get involved with the project and wait until any problem occurs, because all the problems so far were caused outside of this community?

Yes.

> This is precrime.

Exactly - a lack of trustworthiness can be demonstrated long before any crime has been committed.

> And how do you rehabilitate them without giving them the opportunity to participate in the community?

Your use of 'community' in this argument precludes there being an inside and outside, so it is not relevant to the question posed in the article's title. Furthermore, there is an answer - rehabilitation starts in environments where the risk is limited.

And when public opinion changes so that your political opinions are out of fashion, that same "precrime" argument will be used to lock you out of society.

Authoritarian liberals seem to forget that what goes around, comes around.

My mistake - I took 'precrime' to mean simply an act that does not or has not yet amounted to a criminal act, but I see it is a term of art for punishing people on the basis of what they might do. There is nothing very wrong, IMHO, in choosing who you put your trust in and with who you associate on the basis of what they have already done. The first three words of the article are "free software communities...": its not about society as a whole, or any situation where exclusion could reasonably be considered punishment.

Precrime is the best crime. An ounce of prevention is worth a pound of cure.

I don't think this holds up. If you take any crime organization they are almost built on substantially differen behaviors vs group members over non-group members.

That is so, but I would not trust a member of a crime organization to necessarily follow that code in a circumstance where they thought they could get away with it.

This is rich coming from someone who has been banned from as many communities as you have. I've seen at least 3 cases of you joining a community and then getting banned for poor behavior and would think no less of any community choosing to prevent you from joining in the first place.

Ah, the classic ad hominem attack from an old member of the cancerous TI community. Never gets old.

It's very easy to not read the article, isn't it? Then drop in a sweeping generalisation that says it's completely fine to have a murderer write your filesystems.

Why do you care if a murderer wrote your filesystems?

I care about the security and correctness of the code. I only care about the author who wrote it if they are someone known for low-quality, insecure, or malicious code.

If Linus Torvalds is convicted of genocide and child abuse tomorrow I'm going to continue using Linux as usual.

That's fine for you. But other people can have objections to it as is their right to.

If you're part of a group and a chunk of them decide to leave, there's no point saying "why do you care about X? It doesn't affect the group."

It's their right to leave.

The other side is that who you associate with defines that group. So if it was a murderer that wrote a file system, then the software project gets defined by that.

It becomes hard to attract contributors when the project gets defined by the actions of one of its participants. Project leaders then have to make a decision since inaction is also a decision.

It is their right to leave, but is it their right to shame unrelated people who do not want to leave?

There is a point where the shaming and shunning stops being useful and becomes bullying.

We see this all the time in politics worth people liking "their team" too much and denigrating normal citizens just for their opinions and choices.

"It becomes hard to attract contributors when the project gets defined by the actions of one of its participants."

I'm unaware of anyone ever making a decision about contributing to a software project based on secret police level surveillance of current team members political or religious opinions. Even classified DoD stuff I've been involved in isn't that creepy.

Its important to focus discussion on extremes such as murders when the actual goal is to make sure Republicans are unemployable.

You're changing the contents of the article though; it's about "communities", not software products. It's much easier to separate code from persons; strip off the committer name / email and you're left with code which rarely contains anything behavioural besides maybe inappropriate jokes / puns which are usually easily fixed. Not so with communities, which are much more about people and interactions.

For context: https://en.wikipedia.org/wiki/Hans_Reiser

I read the article, thank you. It is completely fine to have a murderer write your filesystems. Accepting patches from someone who writes good code and treats everyone involved with respect is the right approach.

Devil's advocate on this - what if the general population of your customers don't want to support a company that pays the salary of a murderer? Then it affects your bottom line. Would you still be ok with it?

This is about FOSS projects, which are generally unpaid.

What about accepting non trivial patch from someone who smuggled backdoor for lulz to another project 3 years ago?

Fraud is very different from murder, and I understand why someone would be worried about accepting contributions from a known fraudster.

I would not give their contributions extra attention (you should be suspect of all changes, regardless of the author) and I would not ban them from contributing unless they became disruptive or subversive to the project.

They served their time; you don't need to punish them further. They are probably even less likely to commit fraud when their employer is aware of a previous fraud conviction.

The worst fraudsters don't come with a "convicted of fraud" warning—they have evaded being caught and will seem just like any other contributor.

> They served their time; you don't need to punish them further.

It is not about punishing them, it is about reducing the risk of others. Having served time is, at best, no indication of whether a person will revert to their former behavior.

> The worst fraudsters don't come with a "convicted of fraud" warning—they have evaded being caught and will seem just like any other contributor.

This is no reason for not using what information you do have.

Note: I see that you have edited your original post to address these points, but I think they still stand, as expanded on in the continuing discussion below. Your statement "they are probably even less likely to commit fraud when their employer is aware of a previous fraud" seems to be in agreement with what I have been saying.

It's a reason to be equally suspicious of all code changes regardless of the publicly known reputation of a contributor, as it always comes down to the code itself.

You are still arguing against using the available evidence. You never have the time and resources to fully validate anything of use, so you have to use your judgement as to how best to go about it. If you learn that a person responsible for some aspect of security has been found guilty of defrauding his church's charity drive, it would be prudent to take a second look at his code.

Absolutely. Then again, code review is never perfect and it is easy to miss hard to see cosequence of something subtle. Especially if I tentionally hidden. So, trust matters. If you have track record of doing such things, then accepting your pull request comes with higher risk.

This is a good example, I agree that such a person probably isn't welcome - with a few caviats:

- Small (and well scrutinized) patches from this person are fine

- At some point forgiveness is due, maybe 3 years is at that point depending on the severity of their backdoor