Remove private email option from moderation policy

[bnoordhuis]

From https://github.com/nodejs/node/pull/5107/files#r52125372:

Isn't an email to report@nodejs.org the way to go? Individual TSC members may have different ideas on how to deal with an issue so contacting one individually may lead to a certain level of arbitrariness.

Proposal: make report@nodejs.org the official way to contact TSC members for moderation purposes.

[mikeal]

What does "official way" mean?

Isn't it already an official way?

[nebrius]

I think that this email should be the preferred way, sure, but it shouldn't be the only way. If someone needs to report a TSC member for moderation purposes, knowing that that TSC member will receive the moderation request will most likely prevent that person from reporting at all.

I think the ability to send a moderation report that doesn't go to all TSC members is necessary. Right now, that way is to email individual TSC members directly. I don't think this is ideal either, and I would love to have a discussion on other ways to do these kinds of reports, but we absolutely need something.

[bnoordhuis]

Isn't it already an official way?

The official way.

[mikeal]

We're also about to be administering multiple orgs, and not all TSC members will be in those orgs.

It may be worth taking a subset of the TSC and making them responsible for moderation.

[zkat]

How should community members address sensitive issues without needing to involve the entire TSC? What should happen if one of the people being reported is, in fact, a TSC member and the victim is afraid to reveal their own identity to the entire group, including the violator in question? I'm not sure how enforcing an all-or-nothing contact method for TSC members will address this particular (and important) case.

[mikeal]

TBH, the actual administration setup of "how we moderate" is kind of a mess. I would stay away from any "all or nothing" rules until that is straightened out because we can't actually assess the impact of that kind of a rule.

[Fishrock123]

Can we just designate a bunch of people to handle moderation and be done with it?

The TSC is totally overloaded and none of us can really also keep an eye out.

I don't know if giving people org ownership is good though (security, etc.) so that group would still have to contact us if someone needs blocking. (Also we should probably bug GitHub support about that..)

Also we could probably make an anon form on the website; that seems like a good idea. Reporting can be/feel like a double-edged sword.

[ashleygwilliams]

i think this is a great moment to reintroduce the idea for a moderation work group.

[mikeal]

Also we could probably make an anon form on the website; that seems like a good idea. Reporting can be/feel like a double-edged sword.

Can we just link to http://www.sendanonymousemail.net/ and give out the report@ email address?

[ghost]

i agree with @ashleygwilliams, perhaps said WG can consist of TSC, inclusivity and other members alike?

[nebrius]

i think this is a great moment to reintroduce the idea for a moderation work group.

+1, I think the TSC shouldn't be the ones to deal with day to day infractions because, as @Fishrock123 said, it's not a great use of the TSC member's time (with the caveat that moderation escalation still goes to the TSC). We should expand on this in nodejs/inclusivity#79.

Can we just link to http://www.sendanonymousemail.net/ and give out the report@ email address?

I still think it's really important that when someone reports a TSC member, that said TSC member doesn't get to see the reports until an official complaint is lodged. Does this approach allow for this behavior?

[ashleygwilliams]

re: that site @mikeal, i'm not sure it really encourages the attitude we'd like it to and would be a potential avenue for abuse:

[MylesBorins]

I think the idea of a moderation WG with delegates from Inclusivity + TSC + collaborators is a strong one.

Having transparency of the individuals involved is imho very important.

[ghost]

@ashleygwilliams http://send-email.org/ might pose as a better alternative. it's also less cluttered

[rvagg]

What if someone wants to report a member of the moderation group? These arguments are kind of circular and probably argue for a more nuanced approach where we can provide multiple avenues that can reporters can select from along with a more official-ish one with some guarantees of a response in a similar way to security@.

[ashleygwilliams]

noting that circularity is super important @rvagg and i 💯 agree. a plurality of options is definitely the way to solve this. i also like that this is aligned with another (somewhat similarly sensitive) process, i.e. security@.

i thought a WG might be a good idea just to ensure that we have people dedicated to working on and documenting and communicating the process. in lieu of a working group, is there another avenue to pursue this?

[mikeal]

@ashleygwilliams sorry, that was the first google result for "anonymous email" :)

[mikeal]

few quick things:

• Since any org owner has access to the security group any member of moderation will need to have 2fa turned on (a requirement of the security WG).
• Because we have to manually add and remove these members from various orgs the fewer people doing the moderation the better, even if the overall WG is larger the WG may want to designate just a few people strategically placed across timezones to do the actual moderation.

[jasnell]

The key reason to allow for email to individual TSC members is to allow for the possibility that (a) the complaint in question may involve another TSC member or (b) the reporter may feel that the matter requires more sensitive handling.

[ChALkeR]

@mikeal

Can we just link to http://www.sendanonymousemail.net/ and give out the report@ email address?

I don't think it even works.

@sup

http://send-email.org/ might pose as a better alternative. it's also less cluttered

That one works, but emails get to the Spam folder on Gmail.

[Starefossen]

For reference these free and supposedly "anonymously" email services are shady business in my opinion – one day they are here and the next day they are gone. I would not recommend that we start pointing users to any of those without doing some serious digging around in their track record.

And for the record I do not support removing the ability to contact individual members for the reasons mentioned above by @nebrius, @jasnell and @rvagg.

[Fishrock123]

I think it would probably be simpler and more reliable to have a form on the website.

[jasnell]

Closing given that there's been no further discussion in over a year.