Create code of conduct page

[tlaurion]

The past two days in matrix channel is now justifying this so that moderators have the tools to refer users to, and ban users if the code of conduct is not respected.

It seems that some users are changing alias and personas, and are now trolling the channel.

Heads would not be the first to enforce a code of conduct, which comes with responsibilities and requirements to keep things in order, without power abuse or dictatorship. I hope we do this well, building on top if prior giants, and not promoting status quo which now just doesn't work anymore.

An attempt was done in the past with push backs. Everyone has the right to free speech, but ignoring those users in a room used for collaboration is counter productive. It spams all other useful contributors and good will participants, actually chasing them away if nothing is done. And that thing is to be able to refer to the code of conduct. But to do so, such code of conduct should be well written, inclusive and setting sane boundaries, for the users, contributors, and also giving the rights to everyone to not have fatigue because too many notifications because of trolls. Banning trolls will make them come in more numbers. I don't know what are the best practices, but it's time to investigate.

It's a fist time to me needing that tool since 2017. People come and go, but now comes the time of trolls, and to have the tools to keep things clear and at worst case scenario: ban. If everyone is annoyed, without power trip involved, and user cannot self moderate itself, banning justifications are needed now. And this is a web page to refer to. Gently first, firm as second warning. And then banning should not be an issue. I'm no dictator. But I'm annoyed now.

A good example is https://www.qubes-os.org/code-of-conduct/

Others? Proper, known working processes from other communities? Heads is special in the sense that there are a lot of silent lurkers. Those leave when trolls arrive.

[tlaurion]

There was pushback before linuxboot/heads#1718

[tlaurion]

I was also against it, preferring free speech and auto moderation. That lead to CONTRIBUTION.md that is now under tree, merged at linuxboot/heads#1719

[ArrayBolt3]

tlaurion asked me to advise here since I mentioned I'm currently helping moderate Ubuntu's presence on Matrix.

I looked a bit at the earlier pushback mentioned to get some context. I didn't read the whole thing since my time is a bit short, but I see the primary concern was that codes of conduct lead to censorship, and censorship leads to project harm. I agree in general with both halves of this sentiment (yes, codes of conduct can lead to censorship, and yes, censorship can lead to project harm), but I don't think the sentiment as a whole is accurate, unless you do a bad job with your code of conduct and the enforcement thereof (and yes, projects have definitely done bad jobs at this in the past).

I'm currently helping out as a member of the Ubuntu Community Council, and help with enforcing Ubuntu's code of conduct. Ubuntu is a massive project at this point, so we put quite a bit of thought into how to keep the entire operation from spinning out of control. I'll try to share some of that here to see if we can come up with something that makes everyone happy.

---

First, a long bit of preamble. I'm not going to tackle the question of censorship at all here, I'm mainly just wanting to lay some groundwork and see if a CoC is even needed at this point.

First off, there are at least three different kinds of CoC-like rulesets that can be useful for a project - a proper Code of Conduct, a technical policy, and rules for communication channels. None of these should overlap, they all have very different uses. Generally, a CoC is used to specify social rules - how should members of the project treat each other and others when working with or representing the project? Technical policies are used for specifying technical rules - what coding style should be used, do I sign Git commits or not, how are the Git repos organized and how are the branches in them organized, etc. Communication channel rules are mostly just an etiquette guide - do we use Matrix or IRC for chat, should I wrap my emails at 72/75/78/80/whatever characters, what topic does each room have or do we even care, etc. Of these, the CoC is the trickiest to get right because it attempts to control how people behave in general.

The incidents that inspired this issue to be filed by tlaurion was specifically a rather intense case of what appeared to be trolling in the Matrix room. This is a combination of social and communication channel issues. It was a type of general behavior that was undesirable and damaging to the project (the social aspect), and it made the Matrix room difficult to use for others (the communication channel aspect). Right now there aren't strict rules for the Matrix room, and Heads has no code of conduct, so while it was pretty obvious to some that what was happening was bad, there wasn't any objective way to say "what's happening is bad because it broke this particular rule".

So that's the background for what happened, and the tools that can be used for keeping this kind of thing from happening so easily in the future. Now for actually talking about how to implement something that will make things work.

The first question that comes to my mind is "this was just one trolling event, do we really need to make an entire code of conduct just because one troll came in and messed things up once?" This is a really good question, because if a project makes a big move in response to an insignificant event, it can be more damaging to the project than just dismissing the insignificant event. IMO, the answer here hinges on four things:

• How bad is the event that triggered us to think about this,
• How often is it happening and do we foresee it happening more in the future, and
• Who's going to do the hard work of preventing it from happening again?
• Are people going to care when bans start happening?

If an event isn't that bad, or if it's a fluke, it may be worth just ignoring. If there's just one person doing all the moderating, a CoC also might not be needed since whatever the one moderator decides should happen is what does happen. Where a CoC comes in really handy is when you have multiple people in charge of moderation - if not everyone agrees on what should and shouldn't be allowed, there is going to be trouble when someone inevitably stops a behavior someone else would have allowed. Another situation they've very useful for is when the community is prone to question one's decision to ban or otherwise take disciplinary action against problematic users - it gives something objective to point to so users don't get too upset when actions have to be taken, and also allows users to give concrete feedback if someone misuses power.

Currently the answers to the above four questions are:

• As far as trolling-related issues go, the events that happened on Matrix were about as bad as they can get. It was two back-to-back instances of what I like to call "stealth trolling" - two different people came into the room with what sounded like a legitimate problem, and exhibited a pattern of behavior that was extraordinarily difficult to work around or avoid getting upset when witnessing, but was just reasonable enough to make one doubt if they should really be stopped from engaging in the room. Quoting myself from near the end of the exchange (link for those who are interested: https://matrix.to/#/!pAlHOfxQNPXOgFGTmo:matrix.org/$_NbFVD-tchVWVblmRkH8-N0wIYPNlZaqD354g6FFfOw?via=matrix.org&via=nitro.chat&via=tchncs.de):

• you can't follow the instructions and flash without breaking the device
• you didn't read and understand the license
  *you aren't able to use hardware carefully enough to not break a reflasher device

but you're using Heads. This is beyond ridiculous. tlaurion: I know you want to avoid banning people, but I would encourage you to do so (I moderate a pretty large open-source community on Matrix and have seen this kind of thing quite a bit).

• For the question of how often it's happening, so far there have been two users who came into the room and caused problems similar in severity to the one linked to above. These users came into the room in quick succession, suggesting they may be the same user. Two instances of severe trolling in quick succession is frequent enough to warrant thinking about some action, especially if the user(s) turn(s) out to be persistent enough for this to become an ongoing battle.
• For the question of how many people are doing the moderation, right now I see only two moderators in the Heads room on Matrix, those being tlaurion and flx. I don't know whether they agree on moderation philosophy or not.
• For the question of if people will care, I don't know for sure the answer to that. tlaurion probably does.

With all the above in mind, do I think Heads would benefit from a code of conduct? I would say yes, but with some qualifiers:

• There's no need for some sort of "read this and sign it before you contribute" thing at the moment. Ubuntu's CoC does require one to sign it before becoming a member of the project, but that's because the project is massive and there are disagreements frequently enough that we need a set of guidelines for arbitrating those.
• The CoC is not the only thing that's needed. Communication etiquette rules for the Matrix room should be added alongside a CoC. Some of the things tlaurion would like to enforce (i.e. use threads on Matrix) do not belong in a CoC that governs social interactions in general.

Whew, that was a lot of preamble. Now, with all of the above in mind:

---

What would a good CoC for Heads look like?

First off, we already know what it should NOT look like: as per @SergiiDmytruk it should NOT be a list of things to discriminate users for. Sergii used this as an argument against codes of conduct in general, but I would use it as an argument against two things:

• A CoC that allows or encourages policing the activity of Heads contributors outside of the context of Heads. People should only be required to adhere to the CoC when they are working with or actively representing the project. What someone does in their day-to-day lives or with their own projects isn't something we should care about. Projects that have failed to do this are also projects that have caused serious drama in the past.
• A CoC that leans too heavily into the "diversity" side of things, if it mentions them at all. If you aren't explicitly discriminatory, you're welcoming by default. Many code of conducts have an entire "be welcoming" section, but I don't think this is needed. Ubuntu takes a different approach - it leaves almost everything about diversity out of the CoC, and then has a separate diversity policy that lays a general expectation but isn't a rule in and of itself. If someone does something that would be unwelcoming, they're going to have violated the CoC in some other way too, and if they aren't violating the CoC, then they almost certainly aren't doing something that would reasonably be considered unwelcoming. Specifying "be welcoming" outright can, in extreme cases, lead to the kinds of censorship Sergii was worried about. Heads is small enough I don't think it needs a diversity policy at all (again, it's welcoming by default), and I think a properly made CoC will provide the same level of protection in this regard without offering people a weapon that they can use against others (which I have seen happen before).

So, that's what the CoC probably shouldn't look like - what should it look like then? In essence, a good CoC is something that defends the mission that a project stands for. Heads as a project has the mission of providing "slightly better physical security and protection for data on the system." It does this though a firmware that is intended for power-users. This is the mission that a good CoC for Heads needs to defend. If something is threatening that significantly enough to be a worry, it should be discouraged.

That's really broad though. What should that look like in practice? We can come up with a list of things that would damage the project if they happened:

• Contributor burnout and/or discouragement. If the maintainers stop maintaining the project, Heads dies or has to be picked up by new maintainers who may not be as trustworthy as the original ones. If contributors don't come and help, the maintainers will be left with too much to do. If things are happening that make people's life as a maintainer or contributor horrible, those things should be discouraged.
• User annoyance to the point of leaving the Heads project or reducing interaction with it. As tlaurion mentioned, "Heads is special in the sense that there are a lot of silent lurkers. Those leave when trolls arrive."
• Willful or grossly negligent ignorance of communication channel rules and/or technical policy. People are going to accidentally break these kinds of rules once in a while, but if someone breaks them on purpose because they just disagree with them, or if they break them over and over again, they're harming the project.
• Lack of free speech. This may sound totally silly since a CoC's entire point is arguably to restrict free speech, but it's not really if you think about it - total free speech in an online context is mostly equivalent to free speech only for those who don't mind horribly crude, offensive, damaging, and even illegal content. I've seen rooms on Matrix where this is the case, they were total chaos and got people in trouble. We want free speech specifically in the context of Heads, we don't want people stopping others from talking about, getting help with, and contributing to Heads. If someone's behavior is threatening that, they need to stop.

All of this probably sounds like it's really obvious and shouldn't need to be said outright. That's because it's really obvious and shouldn't need to be said outright. Codes of conduct, if done right, should be something any reasonable user follows without thinking about it or even knowing the CoC exists in normal circumstances. People who violate a CoC, under normal circumstances, will almost always be people who wouldn't have followed it even if they knew it by heart. Rules that have to be kept in mind and that are unexpected should be technical policy or communication channel rules in almost all instances. (Note the emphasis on "under normal circumstances" - a big project where people have lots of disagreements is one where reasonable people may violate a CoC if they aren't careful, however I don't foresee this being a problem in the short term for Heads since it's not the size of Ubuntu or similar.) If something is being added to the CoC that is unexpected enough it needs to be said outright, it probably shouldn't be in the CoC. It's probably either a bad idea, or should be categorized as a communication rule or technical policy. This doesn't necessarily hold true for large multi-community projects, but I think it will hold true here.

tlaurion mentioned wanting to use someone else's CoC as a starting point. It should come as no surprise that I'd suggest Ubuntu's CoC as a good starting point (https://ubuntu.com/community/ethos/code-of-conduct). Much of it isn't needed for Heads, I would grab just the "We strive to" section. From that section, I would do the following with each point:

• Be considerate
  • Keep it. Trolling is a form of work that is inconsiderate of other people's work - it damages their ability to work. This is the primary point that would have been useful against the trolls from today.
• Be respectful
  • Keep it. This will be handy if an angry fight breaks out.
• Take responsibility for our words and actions
  • Keep it. This leaves room for people who do things that are out of line to right the wrong.
• Be collaborative
  • Drop it. This is helpful for a project the size of Ubuntu, but Heads doesn't have that much internal collaboration to do (it's pretty small), and I don't think it's likely that "we work closely with upstream projects.... we prefer to work transparently and involve interested parties as early as possible" is really needed here. In particular, Heads might not have anywhere near as much reason to work with upstreams as Ubuntu does (we have to work with A TON of upstreams), and the only real "interested parties" I can think of here are OEMs (which Heads naturally will collaborate with) and Qubes OS (which again Heads naturally collaborates with).
• Value decisiveness, clarity and consensus
  • ??? I don't know to do with this point. It's useful in Ubuntu and for other big projects, but is it just unneeded fluff for Heads? It might be, it might not be, not sure.
• Ask for help when unsure
  • Drop it. "Those who are asked should be responsive and helpful" could backfire badly for a small project like Heads, and because the project is small, people will naturally ask for help if they need it.
• Step down considerably
  • Keep it. If you have a mod team, this will be useful and potentially important.

I would also add the examples of unacceptable behavior and the scope section from the Contributor Covenant Code of Conduct, those are very useful. Finally, I would add some stuff about how the CoC is intended to be enforced at the end (I don't really like the Contributor Covenant's enforcement guidelines, in particular the "Warning" section could cause more trouble than it's worth with restricting people's ability to communicate).

There's probably a bit more fleshing out that could be done, but those are my ideas so far. And, wow, this comment got long.

[tlaurion]

Not sure if this should belong in heads-wiki (to be referred to https://osresearch.net rendered static pages) or under heads main repo as CODE_OF_CONDUCT.md under #1977

[Thrilleratplay]

@ArrayBolt3 I know I am late in saying but your comment is amazing. Thank you.

[hanetzer]

https://github.com/LadybirdBrowser/ladybird/blob/master/CODE_OF_CONDUCT.md
here's a COC that's worth a damn.