[DECISION] Authorize Florian to sign Eclipse membership agreement on behalf of TDF

Board Discuss
#1

Hello,

the following decision, which was taken in private on 2024-06-08, is now made public in accordance with our statutes.

Florian Effenberger wrote on 03.06.24 at 15:53:

with the new board composition, here is the vote again:

  1. The board agrees to enter the membership agreement with Eclipse Foundation, as shared by Italo, as associate member.

  2. The board authorizes Florian to sign the agreement on behalf of TDF.

The vote runs 72h from now.

The Board of Directors at the time of voting consists of 7 seat holders (not including deputies). In order to be quorate, the vote needs to have 1/2 or more of the Board of Directors members, which gives 4.

A total of 5 Board of Directors members have participated in the vote.

The vote is quorate.

A quorum could be reached with a simple majority of 3 votes.

Result of vote:
5 approvals: Sophie, Italo, Simon, Laszlo, Eliane; deputy Paolo supports the motion as well. Also Osvaldo supported the motion, but the two votes overlapped, so not counting him here.
0 abstain
0 disapprovals

Decision: The proposal has been accepted.

Florian

#2

@floeff , @elianedomingos :

  1. Why does the board not publish planned agenda items and preparatory material beforehand for trustees to comment on?
  2. What does “associate member” in the Eclipse foundation entail?
  3. What is the rationale for the membership?
  4. Please consider using the vote result listing scheme I suggested.
  5. Why include so much boilerplate information and redundant text, e.g. when Florian wrote a message, or the fact that the vote runs for 72h, or three lines of text regarding vote quorum threshold where “vote quorum threshold: 4”
  6. If a vote runs for 3 days starting on June 3rd, how can the decision be taken on June 8th?
  7. Why does it first say that the quorum requirement is 4, and then that the requirement is 3? Which of the two statements is false?
  8. What does it mean that “two votes overlapped”?
#3
  1. What does “associate member” in the Eclipse foundation entail?

In this specific case, participation in a project led by Eclipse Foundation

  1. What is the rationale for the membership?

Contributing to the CRA Standardization Project, which is specific for
Europe where the CRA (Cyber Resilience Act) will be enforced in the next
few years. The plan is to present a cybersecurity standardization
methodology for open source software, which allows to avoid reinventing
the wheel every time we will have to talk about security in developing
free open source software.

  1. Why include so much boilerplate information and redundant text, e.g.
    when Florian wrote a message, or the fact that the vote runs for
    72h, or three lines of text regarding vote quorum threshold where
    “vote quorum threshold: 4”

This is what the German authorities ask in order to have a valid vote.

  1. If a vote runs for 3 days starting on June 3rd, how can the decision
    be taken on June 8th?

The decision has been taken after 3 days, but sometimes you do not have
the time to report immediately.

  1. Why does it first say that the quorum requirement is 4, and then
    that the requirement is 3? Which of the two statements is false?

The quorum requirement is 4 out of 7 board members with voting rights,
but as just 5 board members with voting rights have voted the quorum in
this specific case was 3.

The number of board members with voting rights changed during the vote
because of Bjoern resignation and the process to change the status of
Osvaldo from deputy to full board member.

Eike voted and approved, but after the 72 hours, so his vote was not
considered.

  1. What does it mean that “two votes overlapped”?

When the vote started Osvaldo was a deputy, but during the vote he
become a full member because of Bjoern resignation. So, his vote could
have been interpreted in both ways, and to avoid any misunderstanding
Florian did not count it (as it was not necessary, with 5 approvals from
board members with voting rights).

1 Like
#4

Thanks, @italovignoli , for the clarifications…

In this specific case, participation in a project led by Eclipse Foundation

So, this brings me to an example of what I’ve been complaining about elsewhere. Surely, that project is not secret. And surely, the BoD got some document with an overview of the project, and some kind of letter inviting the TDF to join. These should have been (and should be) disclosed to the trustees. For example, the hierarchy of files in the NextCloud instance could be a place where such documents are routinely filed - by category, date, whatever - as they are received or created as the case may be, and when there is no decision to embargo their disclosure…

… and if we had a link to the relevant documents, we would have been able to read more about what this paragraph means. e.g. the extent to which this methodology applies to LibreOffice, or whether this is a Europe-specific thing or just happens to be worked on in Europe; etc.

I’m guessing that would be true for the full version of the session minutes with all the decisions, and doesn’t have to be the case for the discourse post. But - I won’t nitpick this, I suppose it’s easier for Florian to just copy-paste from the full session minutes, and I’d rather see the post in longer form earlier than in shorter form later.

#5

Hello Eyal,

Not all board meetings had preparatory material so far. Regarding the agenda items, there is always the community section, so topics could even be added last minute during the call, or of course as request via e-mail beforehand. That’s why the agenda is published both to the public as well as to the members beforehand.

We already had quite some offlist discussion around this. I considered it, but for the moment, the current scheme both lowers administrative overhead to have different templates, but at the same time gives all information. What is missing from the current way to present the votes?

Florian

#6 
In this specific case, participation in a project led by Eclipse
Foundation

So, this brings me to an example of what I’ve been complaining about
elsewhere. Surely, that project is not secret. And surely, the BoD got
some document with an overview of the project, and some kind of letter
inviting the TDF to join. These should have been (and should be)
disclosed to the trustees. For example, the hierarchy of files in the
NextCloud instance
https://nextcloud.documentfoundation.org/apps/files/?dir=/ could be a
place where such documents are routinely filed - by category, date,
whatever - as they are received or created as the case may be, and when
there is no decision to embargo their disclosure…

In this case, this is the result of my involvement - on behalf of TDF -
in the Cyber Resilience Act discussions and activities. I have presented
the situation at the LibreOffice Conference. There isn’t any document as
all the activities have been carried out during video conferences and in
person meetings in Brussels, which is typical of these activities with
political institutions.

italovignoli:

The plan is to present a cybersecurity standardization
methodology for open source software, which allows to avoid reinventing
the wheel every time we will have to talk about security in developing
free open source software.

… and if we had a link to the relevant documents, we would have been
able to read more about what this paragraph means. e.g. the extent to
which this methodology applies to LibreOffice, or whether this is a
Europe-specific thing or just happens to be worked on in Europe; etc.

When there will be an official document (and not just a number of draft
working papers), it will be shared. At the moment, we are in the process
of setting up the standardization project, which is not a trivial task.
The methodology will be based on several inputs, including those from
the LibreOffice security team, and will be used by FOSS projects when in
the future there will be discussions about cybersecurity. If it will be
used outside Europe, it’s probably too early to know.

In my personal opinion, the CRA Standardization Project is a key step in
the direction of a more cohesive FOSS ecosystem, as much as the CRA was
the episode that allowed us to realize that the divisions - which have
been considered a plus by many - were a blocker for FOSS.

So, it will be definitely used in Europe, but it will be available for
every project in the FOSS ecosystem. Adopting the standard will allow a
FOSS project to provide a recognized framework for development security,
which - in turn - will not allow political institutions to think that
FOSS is inherently insecure (which is what happened with the CRA).

#7

I just looked at the session page, and did not see a slide deck or accompanying document, nor a video. No video on PeerTube either.

This is the unacceptable approach of this (and the last) board: Default to non-disclosure, then at some point disclose something actively decided as worthy of disclosure. The BoD did not take this decision based merely on oral communication. I’m sure the TDF (through you or otherwise) exchanged emails or letters with the Eclipse project and the relevant European Commission bodies. I’m (almost) sure that BoD members got links to reading material about the CRA and the standardization project, before voting on the proposal. I’m sure they saw a document detailing the obligations and privileges of an associate member. But we never got to see any of those, nor do we see them even now after the BoD has decided. And I’m not asking for a (new) explanation from you, @italovignoli , I’m asking that the BoD “shall assure public knowledge through express publication … with regard to the processes [and] discussions… of the foundation… [and] the Board of Directors”. And this is not happening.

#8

Dear Eyal, I have been extremely patient trying to explain all things as far as I can, but your attitude doesn’t seem to be that of a contructive community member. I have even added you to the private marketing list, a decision that I now regret.

The slide deck of the session and the associated video have not been published, and will never be published, because they contain sensitive information and materials about a process which has involved politicians and employees at EU level.

The CRA was heavily sponsored by proprietary software companies (the political relator was an Italian member of the EU parliament belonging to a party whose leader is a well know Microsoft lobbyist), and all FOSS activities were targeted to inform politicians and employees at EU level about the real situation of security of FOSS software.

All these conversations were under Chatam House Rule to guarantee the confidentiality of both the source and the receiver. Big tech spend over 30 million euro in lobbying at EU level, and one of the objectives is to reduce to a minimum the number of people supporting FOSS inside the EU organizations.

I do not know the inner situation at the EU to make examples, but I know well enough what has happened in Italy when the Microsoft lobbyist was a member of the Italian government:

  1. The innovation manager of the city of Rome, a well know FOSS advocate and a good friend of LibreOffice, was made redundant, the migration to FOSS was stopped and a multi million euro contract with Microsoft was signed.

  2. The FUSS project in South Tyrol, a Linux distribution optimized for schools, and used in all Italian schools in the province of Bolzano, was put under scrutiny and heavily questioned, and at the end survived just because the students and their parents refused to switch to Microsoft.

  3. The city of Pesaro was forced to abandon OpenOffice/LibreOffice and switch back to Microsoft based on questionable documents. The guy responsible for the migration was made redundant before the decision.

  4. Regione Emilia Romagna was forced to switch back to Microsoft with a similar process. The guy responsible for the migration was moved to a different role.

Because of this situation, all the public administration using FOSS in Italy - and there are quite a few - try not to publicize the adoption of FOSS, to avoid issues.

Referring to the specific case of the Eclipse Foundation, you can find all the public documents here:
Eclipse Membership | The Eclipse Foundation.

We have just received a pointer to the same page, so now you have all the documents you have asked.

Best regards, Italo

Impressum (Legal Info) | Datenschutzerklärung (Privacy Policy)   Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.