New Website: State of the review / pending issues
Hi to all, We've had quite an intense debate regarding the proposed new website. I've tried to extract the main technical comments expressed in the ML to to determine the current state, fix any misunderstanding and try to establish a constructive thread: ------------------------- ------------------------- 1) Repository: the website code was hosted in cppalliance's github. It was transferred to boostorg. I understand this as an improvement as it's in the same level as other boost libraries. 2) License: Before transferring it to boostorg, a request to change the license to BSL was made. The license change was announced on February 21, and boost.io says it's BSL, so I guess it's solved now. Source files in the repo (https://github.com/boostorg/website-v2) have no copyright notice, I don't think it's something that is required, but usually all Boost source files have the notice and point to the license. I'm not a lawyer, but if the site is open source, anyone can fork and improve it, and ownership and copyright of the source code follows the standard Boost practices (BSL). Anyone with enough technical expertise can put up a server with the original or forked code and re-run the site in case of cpp.al goes away or if there are disagreements. 3) Privacy Policy: There was a comment about information from third parties and the use of Google Analytics, location data... AFAIK there is a new privacy policy page (https://www.boost.io/privacy/), which does not mention any location data and says a notification will be sent to registered users on any change. There is a issue to implement account deletion (https://github.com/boostorg/website-v2/issues/965) opened by Vinnie, so it should be implemented soon. 4) Terms of use: It was suggested that there needed to be a page like "Terms of Use" composed with help of a lawyer. AFAIK there is a new page (https://www.boost.io/terms-of-use/) that is much simpler and easier to read than the original. I'm not sure if Andrey's comments are addressed with the new TOU. Andrey, it's ok now? 5) GDPR: A issue was filed (https://github.com/boostorg/website-v2/issues/960), and there was a discussion in the ML about not having any analytics tool to avoid cookie banners or a couple of analytic tools that were compliant with GDPR. The github issue was resolved stating that: - Google Analytics was removed and Plausible was deployed (e.g. no cookies. IP addresses are anonymized with a hash function and rotating salt value), - YouTube Embed on the homepage was changed to an external link to the video. I understand that with those changes the site is GDPR-compliant. Is that right? 6) Moderation: We had a discussion about how moderation should be performed in the site (mainly as an anti-spam mechanism) and how it's implemented now in the mailing list (volunteers). My understanding is that the new website has some moderation tools so that anyone can submit news, etc... and that the same ML method (volunteers blessed in the ML) should be used to appoint the moderators for the site (not necessarily the same people that moderate the ML). ------------------------- ------------------------- I don't know if this summary is accurate, the aim was synthesize several ML threads into a single post, certainly I could be wrong on several points, please correct me in that case. Now the next question is: *What's missing technically so that the new website can to live?* If technically we have an agreement or we are near that, then we can: - Know if there are non-technical aspects that need to be ironed out. - Know if there is any alternative to be discussed and compared with the proposed website. If so, let's put it on the table, review and compare it. - Schedule a plan so that Boost can have a new modern website soon. Does this make sense? Best, Ion
On 3/4/24 15:50, Ion Gaztañaga via Boost wrote:
4) Terms of use: It was suggested that there needed to be a page like "Terms of Use" composed with help of a lawyer. AFAIK there is a new page (https://www.boost.io/terms-of-use/) that is much simpler and easier to read than the original. I'm not sure if Andrey's comments are addressed with the new TOU. Andrey, it's ok now?
The relevant issue is: https://github.com/boostorg/website-v2/issues/956 Yes, the updated TOU resolves the issues I had with it originally.
6) Moderation: We had a discussion about how moderation should be performed in the site (mainly as an anti-spam mechanism) and how it's implemented now in the mailing list (volunteers). My understanding is that the new website has some moderation tools so that anyone can submit news, etc... and that the same ML method (volunteers blessed in the ML) should be used to appoint the moderators for the site (not necessarily the same people that moderate the ML).
At this point, it's not clear what is going to be moderated. Vinnie has announced that the forum idea has been cancelled, and no support for comments is planned. I'm not sure what will be the mechanism for submitting news items. If it's through PRs, as with the current website, then moderation is the natural part of that process. In relation to this, it's not clear what's the purpose of user registration. What does it offer to the user?
I don't know if this summary is accurate, the aim was synthesize several ML threads into a single post, certainly I could be wrong on several points, please correct me in that case.
I believe, the most important issue left unresolved is regarding IP ownership and control over the new website. David posted that Boost Foundation will have a meeting about it mid-March. There are also a number of technical issues reported on GitHub. Some of them that I consider important for adequately replacing the current website are: https://github.com/boostorg/website-v2/issues/1000 https://github.com/boostorg/website-v2/issues/996 https://github.com/boostorg/website-v2/issues/951 https://github.com/boostorg/website-v2/issues/946 https://github.com/boostorg/website-v2/issues/945 https://github.com/boostorg/website-v2/issues/943 https://github.com/boostorg/website-v2/issues/939 https://github.com/boostorg/website-v2/issues/932 https://github.com/boostorg/website-v2/issues/786
Now the next question is: *What's missing technically so that the new website can to live?*
It is already "live" as it is accessible through boost.io. If you mean switching boost.org to the new website then the IP and control issue I mentioned is blocking it.
On 3/4/24 17:38, Andrey Semashev wrote:
On 3/4/24 15:50, Ion Gaztañaga via Boost wrote:
4) Terms of use: It was suggested that there needed to be a page like "Terms of Use" composed with help of a lawyer. AFAIK there is a new page (https://www.boost.io/terms-of-use/) that is much simpler and easier to read than the original. I'm not sure if Andrey's comments are addressed with the new TOU. Andrey, it's ok now?
The relevant issue is:
https://github.com/boostorg/website-v2/issues/956
Yes, the updated TOU resolves the issues I had with it originally.
6) Moderation: We had a discussion about how moderation should be performed in the site (mainly as an anti-spam mechanism) and how it's implemented now in the mailing list (volunteers). My understanding is that the new website has some moderation tools so that anyone can submit news, etc... and that the same ML method (volunteers blessed in the ML) should be used to appoint the moderators for the site (not necessarily the same people that moderate the ML).
At this point, it's not clear what is going to be moderated. Vinnie has announced that the forum idea has been cancelled, and no support for comments is planned.
I'm not sure what will be the mechanism for submitting news items. If it's through PRs, as with the current website, then moderation is the natural part of that process.
In relation to this, it's not clear what's the purpose of user registration. What does it offer to the user?
I don't know if this summary is accurate, the aim was synthesize several ML threads into a single post, certainly I could be wrong on several points, please correct me in that case.
I believe, the most important issue left unresolved is regarding IP ownership and control over the new website. David posted that Boost Foundation will have a meeting about it mid-March.
There are also a number of technical issues reported on GitHub. Some of them that I consider important for adequately replacing the current website are:
https://github.com/boostorg/website-v2/issues/1000 https://github.com/boostorg/website-v2/issues/996 https://github.com/boostorg/website-v2/issues/951 https://github.com/boostorg/website-v2/issues/946 https://github.com/boostorg/website-v2/issues/945 https://github.com/boostorg/website-v2/issues/943 https://github.com/boostorg/website-v2/issues/939 https://github.com/boostorg/website-v2/issues/932 https://github.com/boostorg/website-v2/issues/786
And as soon as I wrote that, I went ahead and created a few more: https://github.com/boostorg/website-v2/issues/1004 https://github.com/boostorg/website-v2/issues/1001 I should probably stop inspecting the new website or I'll overflow the issue tracker and The C++ Alliance members will start cursing me on their lunch breaks. If they haven't started already. :)
Now the next question is: *What's missing technically so that the new website can to live?*
It is already "live" as it is accessible through boost.io.
If you mean switching boost.org to the new website then the IP and control issue I mentioned is blocking it.
On Mon, Mar 4, 2024 at 7:05 AM Andrey Semashev via Boost
I should probably stop inspecting the new website or I'll overflow the issue tracker and The C++ Alliance members will start cursing me on their lunch breaks. If they haven't started already. :)
Quite the opposite, I greatly appreciate your activity. Let's speak plainly: going through all the pages on the new website, operating the controls and forms, and reporting problems by opening GitHub issues is work, and you've been doing it. This is precisely the community work that is needed to bring the website up to the standards that the Boost community expects. It is also what I am referring to when I say that the launch of the new website is a process not a finish line. Building a new site especially at this level of quality is not a small endeavor and the truth is that everyone will find some issue or another with it for at least a year if not more. We don't want to hold it up until everyone thinks its "perfect." Instead we want to ensure that we have a well-staffed process for tracking and triaging issues, assigning work, testing, and giving stakeholders a mechanism to follow the changes to keep things on track and moving. Robust community involvement is the key to getting this done so by all means, please continue to overflow the issue tracker :) Thanks
El 04/03/2024 a las 15:38, Andrey Semashev via Boost escribió:
There are also a number of technical issues reported on GitHub. Some of them that I consider important for adequately replacing the current website are:
https://github.com/boostorg/website-v2/issues/1000 https://github.com/boostorg/website-v2/issues/996 https://github.com/boostorg/website-v2/issues/951 https://github.com/boostorg/website-v2/issues/946 https://github.com/boostorg/website-v2/issues/945 https://github.com/boostorg/website-v2/issues/943
https://github.com/boostorg/website-v2/issues/932 https://github.com/boostorg/website-v2/issues/786
Great.
Now the next question is: *What's missing technically so that the new website can to live?*
It is already "live" as it is accessible through boost.io.
If you mean switching boost.org to the new website then the IP and control issue I mentioned is blocking it.
Ok, I'd like to understand what the IP issue is. ---- Code ---- Every Boost library has a copyright assignment to someone that wrote that code. Should the website code different? Current website says: Copyright Beman Dawes, David Abrahams, 1998-2005. Copyright Rene Rivera 2004-2007. Distributed under the Boost Software License, Version 1.0. Then the new website code should be assigned to whoever wrote the code as long as is under BSL. People doing pull requests can add new files with their name to the copyright part in existing or new files if the contribution is important. So I have the impression that the IP status of the new website is the same as the old one. ---- Images ---- I certainly don't know much about image and logo IP, so take this with a grain of salt. Regarding images, most images in the website (if not all) can be under a permissive license so there shouldn't be a problem with that. Then we have the logo. I'm trying to understand what the status of the current logo is and unfortunately I can't find much information on that. I see: https://en.wikipedia.org/wiki/File:Boost.png https://github.com/boostorg/Artwork "They were created by Zoltan Juhasz, and are licensed under the Boost Software License." Then Zoltan Juhasz is the first (and maybe only?) owner of the copyright. I can't find any additional information, so the logo status seems similar to the code, there is a copyright owner (the author) and the logo is used by the community. I'm not sure about the use of BSL for images as I understand that BSL is designed for software. If that's the case with the old logo, then nothing changes if anyone creates a new logo, puts it in a sensible license and provides some terms of use agreed with the community (maybe we should only allow the logo strictly to activities related to Boost libraries). Finally, IMHO (surely not shared with other here), if the logo is an issue we can just remove the logo from the website to avoid any blocking issue. The logo doesn't write code. Best, Ion
On Tue, Mar 5, 2024 at 6:43 AM Ion Gaztañaga via Boost < boost@lists.boost.org> wrote:
El 04/03/2024 a las 15:38, Andrey Semashev via Boost escribió:
Now the next question is: *What's missing technically so that the new website can to live?*
If you mean switching boost.org to the new website then the IP and control issue I mentioned is blocking it.
The IP issue is the logo and, indeed, removing it or replacing it with something the Boost Foundation can enforce the copyright of would be sufficient. The bigger technical issue is governance/ownership of the server. Putting key pieces of infrastructure under control and charity of a single individual has worked out very poorly for us in the past. My serious concerns about the particular individual are actually besides the point. The technical obstacle here is to get some Boost Foundation servers up and running with the new site. This will be discussed at the Boost board meeting next week.
El 06/03/2024 a las 17:37, David Sankel via Boost escribió:
On Tue, Mar 5, 2024 at 6:43 AM Ion Gaztañaga via Boost < boost@lists.boost.org> wrote:
Andrey Semashev via Boost wrote:
Now the next question is: *What's missing technically so that the new website can to live?*
If you mean switching boost.org to the new website then the IP and control issue I mentioned is blocking it.
The IP issue is the logo and, indeed, removing it or replacing it with something the Boost Foundation can enforce the copyright of would be sufficient.
Hi David, I'm not sure I follow the issue. I might lack some information, I have the impression that past experiences and interactions are deeply affecting this new website process. Let me please at least express my concerns as a long-time boost contributor. AFAIK current logo is not owned by the foundation, and we have no serious problems with that. Why is an important problem now? IMHO the important points wrt the logo are the license and terms of use, we should focus on that first. Just like we focused on the license/TOU/privacy parts of the proposed website. In the Boost tradition, decisions are made by developers, not by users, Steering Committee, Foundation, or any other organization that contributes (CppAlliance, github). The last time the foundation tried to make a "Boost decision" it didn't work for this very reason. If CppAlliance or any other entity tries to interfere it simply won't work if developers don't like the idea. If CppAlliance does anything that irritates the community, website code will be forked and put in a new server if needed or the old website will be resurrected. That's why we requested a license change.
The bigger technical issue is governance/ownership of the server. Putting key pieces of infrastructure under control and charity of a single individual has worked out very poorly for us in the past. My serious concerns about the particular individual are actually besides the point. The technical obstacle here is to get some Boost Foundation servers up and running with the new site. This will be discussed at the Boost board meeting next week.
IMHO, by definition, the ownership of the server is not a technical issue, but a governance/trust issue. Boost libraries and tools are hosted in Github, and they are certainly more important than the website. BSL is what protects us from anyone "owning" anything. My proposal is to follow the tradition and appoint trusted individuals (more than one) in the developer community to have admin access to that infrastructure, just like we have trusted individuals on other key services (Github, mailing list moderation, review/release managers...). As I said in previous posts, I'm grateful to all past and present members of the Foundation for their time, work, money and effort. But with all due respect, the Boost board's mission is not to govern the boost project, including the website, but to seek community-driven leadership, and I wholeheartedly agree with that. The developer community can and should decide if the requested actions were satisfactory and pointing boost.org to the boost.io server is the appropriate/mature/recommendable solution. We have an issues list that can be tracked to judge if the new website is serving well. If not, the developer community can decide to rollback that decision. We have requested several changes including license, code hosting, etc. to minimize risks and to treat the new proposed website in the boost tradition. Until now, folks from C++ Alliance have been responsive to community requests. License, repository, TOU and Privacy policies have been effectively changed. So I'm optimistic about the process, it's working. We historically don't request any IP/copyright reassignments (e.g. we don't endorse something like FSF's copyright assignment program) because we like to honor creators and because BSL plays nice with non-free software. Honestly, we should continue along that path. The best decision for the Boost project is to reach an agreement between developers, Foundation and Cpp Alliance, taking into account the consensus-building tradition and federated nature of Boost. I hope we can solve this discussion soon and then concentrate our efforts in our next challenge. Best, Ion
People have been asking me to reply to this, but I don't know what I could say that I haven't already said earlier in this thread. Ion, maybe you would consider attending the next Foundation meeting. Rene, the invitation extends to you too, and anyone else who has participated in this thread. Ion wrote:
In the Boost tradition, decisions are made by developers, not by users, Steering Committee, Foundation, or any other organization that contributes (CppAlliance, github). The last time the foundation tried to make a "Boost decision" it didn't work for this very reason.
This is true. As I have said before, the role I see of the Foundation is to provide support and resources. Not to control anything. If Boost developers want something, the question we can answer is "How can we provide it?". Some things are not affordable, and we can show you the answers why. e.g. Cost of running a particular website. Costs of a CDN so that we don't lose downloads.
IMHO, by definition, the ownership of the server is not a technical issue, but a governance/trust issue. Boost libraries and tools are hosted in Github, and they are certainly more important than the website. BSL is what protects us from anyone "owning" anything.
To reassure anyone that needs to hear it, the Foundation does not exert any such control over the Boost Github. More than one person has asked me to restate this. I did not dismiss the concern that some in the community have raised privately that especially certain Foundation members should not suddenly be given rights to manage the boostorg Github repositories.
As I said in previous posts, I'm grateful to all past and present members of the Foundation for their time, work, money and effort. But with all due respect, the Boost board's mission is not to govern the boost project, including the website, but to seek community-driven leadership, and I wholeheartedly agree with that.
Things will become easier once everyone sees that both: - This is the current state of things - There is no desire to change it Glen
On Thu, Mar 7, 2024 at 3:36 AM Glen Fernandes via Boost
People have been asking me to reply to this, but I don't know what I could say that I haven't already said earlier in this thread. Ion, maybe you would consider attending the next Foundation meeting. Rene, the invitation extends to you too, and anyone else who has participated in this thread.
Thank you Glen. I'll take you up on that invitation. I should also make my position clear ahead of time. With my personal experience of solely redesigning the Boost website twice (1) I wholeheartedly want this new website. If I had the experience, time, and the Boost community was willing the decade and half ago when I implemented the current web site I would have wanted a site like the one C++ Alliance created. (1) Yes, I did that twice over the span of a handful of years. Including doing the maintenance and admin of the Apache web server and Trac and subversion as it all ran in the same machine. -- -- René Ferdinand Rivera Morell -- Don't Assume Anything -- No Supone Nada -- Robot Dreams - http://robot-dreams.net
Le 2024-03-04 13:50, Ion Gaztañaga via Boost a écrit :
5) GDPR: A issue was filed (https://github.com/boostorg/website-v2/issues/960), and there was a discussion in the ML about not having any analytics tool to avoid cookie banners or a couple of analytic tools that were compliant with GDPR. The github issue was resolved stating that:
- Google Analytics was removed and Plausible was deployed (e.g. no cookies. IP addresses are anonymized with a hash function and rotating salt value),
- YouTube Embed on the homepage was changed to an external link to the video.
I understand that with those changes the site is GDPR-compliant. Is that right?
I can't give a definitive (ie, legal) answer on that. But it does look good enough, yes. Good enough in the sense that if a GPDR non-conformity arise, good faith can be claimed. Especially given that most sites, including european ones, have very lower standards. Regards, Julien
Hi Ion, Ion Gazta?aga wrote:
We've had quite an intense debate regarding the proposed new website.
In the previous thread I asked "whose website is it?", by which I mean, who is in legal terms the "Data Controller"? Imagine that there were some kind of data leak, or it turned out that the site were (unintentionally) slurping data that it shouldn't be, or someone posts CSAM on the forum. Who gets sued? Where does the buck stop, legally? My feeling is that if C++ Alliance are in practice in control of the website then they need to take responsibility for it legally. The legal risk should not be transferred to the Boost Foundation. The current boost.io site is reasonably clear that the site belongs to C++ Alliance in this sense, which is good. That needs to not change, IMO, if/when it is adopted as an "official" Boost site. BTW, I've just had a very quick look at the current Terms of Use and I see that they say "You agree that by accessing the Services, you have read, understood, and agreed to be bound by all of these Legal Terms. IF YOU DO NOT AGREE WITH ALL OF THESE LEGAL TERMS, THEN YOU ARE EXPRESSLY PROHIBITED FROM USING THE SERVICES AND YOU MUST DISCONTINUE USE IMMEDIATELY.". That's clearly nonsense as it is not presented as an unavoidable popup, but rather as a page linked in the footer. Anyway I haven't read all the terms, so I've discontinued as instructed. Regards, Phil.
participants (8)
-
Andrey Semashev -
David Sankel -
Glen Fernandes -
Ion Gaztañaga -
Julien Blanc -
Phil Endecott -
René Ferdinand Rivera Morell -
Vinnie Falco