Policy-Discussion

[Bernhard Fröhlich <bernhard AT cacert.org>]

Am 29.10.2019 um 14:33 schrieb Jan Dittberner:
> On Tue, Oct 29, 2019 at 02:05:26PM +0100, Matthias Lohr wrote:
> > Hey,
> >
> > as a reply of Jan's mail about open tasks, I want to start a new thread
> > regarding IRC discussion. Couple of years ago, I was co-operator of an
> > IRC network, so I think i might be able to help you here.
> >
> > But first of all: Sure, that CAcert still wants to operate an own IRC
> > server? Currently, there are 41 users and only 20 channels. Maybe it
> > would be easier to migrate that to e.g. Freenode? Is there a need for a
> > dedicated IRC network for CAcert?
> Hello Matthias,
>
> this is a very good question, that I cannot answer fully.
>
> There are few use cases for IRC that are required:
>
> - board meetings via a private channel
> - AGM and SGM of CAcert Inc.
> - voting during AGMs/SGMs. We have a vote bot ([1], [2]) that tracks votes in 
> a
>    special #vote channel and takes care of the results
>
> [1] https://git.cacert.org/gitweb/?p=cacert-votebot.git;a=summary
> [2] https://infradocs.cacert.org/systems/ircserver.html#votebot
>
> I'm not sure whether irc.cacert.org / dedicated CAcert infrastructure is
> really required for these use cases by any of the CAcert policy documents.
>
> @policy group: what is your view on this topic?
>
> I think all of these use cases could be implemented on a different IRC
> network from a technical point of view if private channels and the bot
> connection are possible there.

Hi Jan,

I would not consider the question of the IRC network something that 
policy list has to decide...

If you just want my personal view on the topic, I won't insist on our 
own server as long as the named use cases can be implemented and the 
chosen network can be trusted on some reasonable level.

> [...]
> To get access to the system a background check is required.

According to https://wiki.cacert.org/SecurityManual#Channels the IRC 
server is currently not considered a critical system. So, if there are 
no other rules or policies requiring it, a formal background check, the 
thing we usually call Arbitrated Background Check ("ABC"), which is 
currently blocked by unavailability of Arbitrators, is not necessary.

Of course some kind of check and a personal meeting make very much 
sense, but we are not required to use the ABC procedure.

[...]

Hope this helps,
Ted
;)

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature