Re: Jenkins Elections Process Question

2020-09-24 Thread Oleg Nenashev 
Hi all,

The draft voting form is available 
here: 
https://docs.google.com/forms/d/e/1FAIpQLSffkarKvwsK0mc21-SmLzEoGsp_uyvloXQeqHzLxvdkMvXiNg/viewform?usp=sf_link

Changes summary from yesterday:

   - I have documented the alternate sign-up flow 
   here: https://github.com/jenkins-infra/jenkins.io/pull/3762
   - I have enabled it in the sign-up form for now, but I am ready to 
   rollback if there are concerns. 
   - I also enforced sending the form confirmation to responders, it might 
   be an additional safety net preventing email tampering.  

Best regards,
Oleg








On Wednesday, September 23, 2020 at 5:44:49 PM UTC+2 Oleg Nenashev wrote:

> Unfortunately it is too late to create new service. Its future is also 
> unclear taking the identity management discussions in the infrastructure 
> team.
> For now I am going to proceed with creating a new mailing list as a second 
> sign-up way and adjusting the process documentation accordingly.
>
> On Wednesday, September 23, 2020 at 10:07:45 AM UTC+2 Olblak wrote:
>
>> We are using a Google Form for the sign-up and it provides a mechanism to 
>> collect email addresses, but it requires users to login to a Google account 
>> when using the Google Forms mechanism. It does allow us to reduce the 
>> possibility of duplicate voting.
>>
>> It hurts me to say that but we already ask contributors to use a google 
>> account to follow discussion happening here so asking people to use their 
>> google account to vote shouldn't be a major concerned. But we would have no 
>> way to match a google account with a jenkins account...
>>
>> Otherwise we already have oauth-proxy integrated with our ldap database, 
>> so we could write a small application that read the username field from the 
>> oauth token generated once we go to something like 'register.jenkins.io'.
>>
>> IMHO asking people to register to a mailing list like 
>> jenkinsci...@googlegroups.com seems the easier and more sustainable 
>> solution. We could by default block new registrations during the pre- 
>> election period, several weeks before  and we would only accepted people 
>> who can show a contribution done before the pre-election period.   
>>
>>
>>
>> On Wed, Sep 23, 2020, at 12:11 AM, Oleg Nenashev wrote:
>>
>> It would make sense, though I am not sure how another email domain would 
>> make a difference there. Sending emails to Google addresses is not blocked 
>> in China from what I know. CDF might be able to set up an email for us, but 
>> I am not sure about timing. If we want to start the sign-up process on Sep 
>> 24 as planned, it would be quite a challenge to get the email in time. 
>>
>> Any thoughts from others?
>>
>> On Tue, Sep 22, 2020 at 8:12 PM 'Gavin Mogan' via Jenkins Developers <
>> jenkin...@googlegroups.com> wrote:
>>
>> > jenkins-2020-elections@googlegroup
>> > It will definitely help contributors in areas where Google services are 
>> blocked 
>>
>> Wouldn't it make sense for the fallback email to be something other than 
>> google then?
>>
>> cd.foundation is using mailgun (according to MX records), so maybe they 
>> could setup jenkins-202...@cd.foundation that forwards to google/the board, 
>> so there's no issues.
>>
>> Gavin
>>
>> On Tue, Sep 22, 2020 at 11:01 AM Oleg Nenashev  
>> wrote:
>>
>> As an additional mitigation, we can also add a "send a sign-up email to 
>> jenkins-2020-elections@googlegroups" fallback process to the announcement. 
>> It will definitely help contributors in areas where Google services are 
>> blocked
>>
>> On Tue, Sep 22, 2020, 19:00 Mark Waite  wrote:
>>
>>
>>
>> On Tue, Sep 22, 2020 at 4:28 AM Oleg Nenashev  
>> wrote:
>>
>> >   it requires users to login to a Google account when using the Google 
>> Forms mechanism. It does allow us to reduce the possibility of duplicate 
>> voting.  
>>
>> Apart from duplicate voting, it also prevents from submitting voting 
>> sign-up forms for other individuals. If we do not use a Google account or 
>> any other authentication service, anyone will be able to submit a form for 
>> anyone else, including doing submissions for participants who may not want 
>> their emails to be stored and who do not want to receive communications 
>> from the Jenkins project. It increases the risk of abuse for the voting 
>> sign-up system.
>>
>> We do not want to rely solely on Jenkins LDAP, but I think we need some 
>> kind of identity management. Google Auth could bridge the gap, as one of 
>> the options we can rollout quickly. We de-facto require it for many other 
>> contribution areas.
>>
>>
>> I think we should use Google Auth to bridge the gap as you've suggested.
>>  
>>
>>
>> Best regards,
>> Oleg
>>
>>
>> On Monday, September 21, 2020 at 10:15:23 PM UTC+2 Richard Bywater wrote:
>>
>> Personally I don't think we should be forcing people to sign up for 
>> third-party services just to be able to vote on Jenkins related matters. 
>> There may be good reasons that people have for not wanting to create a 
>>

Re: Jenkins Elections Process Question

2020-09-23 Thread Oleg Nenashev 
Unfortunately it is too late to create new service. Its future is also 
unclear taking the identity management discussions in the infrastructure 
team.
For now I am going to proceed with creating a new mailing list as a second 
sign-up way and adjusting the process documentation accordingly.

On Wednesday, September 23, 2020 at 10:07:45 AM UTC+2 Olblak wrote:

> We are using a Google Form for the sign-up and it provides a mechanism to 
> collect email addresses, but it requires users to login to a Google account 
> when using the Google Forms mechanism. It does allow us to reduce the 
> possibility of duplicate voting.
>
> It hurts me to say that but we already ask contributors to use a google 
> account to follow discussion happening here so asking people to use their 
> google account to vote shouldn't be a major concerned. But we would have no 
> way to match a google account with a jenkins account...
>
> Otherwise we already have oauth-proxy integrated with our ldap database, 
> so we could write a small application that read the username field from the 
> oauth token generated once we go to something like 'register.jenkins.io'.
>
> IMHO asking people to register to a mailing list like 
> jenkinsci...@googlegroups.com seems the easier and more sustainable 
> solution. We could by default block new registrations during the pre- 
> election period, several weeks before  and we would only accepted people 
> who can show a contribution done before the pre-election period.   
>
>
>
> On Wed, Sep 23, 2020, at 12:11 AM, Oleg Nenashev wrote:
>
> It would make sense, though I am not sure how another email domain would 
> make a difference there. Sending emails to Google addresses is not blocked 
> in China from what I know. CDF might be able to set up an email for us, but 
> I am not sure about timing. If we want to start the sign-up process on Sep 
> 24 as planned, it would be quite a challenge to get the email in time. 
>
> Any thoughts from others?
>
> On Tue, Sep 22, 2020 at 8:12 PM 'Gavin Mogan' via Jenkins Developers <
> jenkin...@googlegroups.com> wrote:
>
> > jenkins-2020-elections@googlegroup
> > It will definitely help contributors in areas where Google services are 
> blocked 
>
> Wouldn't it make sense for the fallback email to be something other than 
> google then?
>
> cd.foundation is using mailgun (according to MX records), so maybe they 
> could setup jenkins-202...@cd.foundation that forwards to google/the board, 
> so there's no issues.
>
> Gavin
>
> On Tue, Sep 22, 2020 at 11:01 AM Oleg Nenashev  
> wrote:
>
> As an additional mitigation, we can also add a "send a sign-up email to 
> jenkins-2020-elections@googlegroups" fallback process to the announcement. 
> It will definitely help contributors in areas where Google services are 
> blocked
>
> On Tue, Sep 22, 2020, 19:00 Mark Waite  wrote:
>
>
>
> On Tue, Sep 22, 2020 at 4:28 AM Oleg Nenashev  wrote:
>
> >   it requires users to login to a Google account when using the Google 
> Forms mechanism. It does allow us to reduce the possibility of duplicate 
> voting.  
>
> Apart from duplicate voting, it also prevents from submitting voting 
> sign-up forms for other individuals. If we do not use a Google account or 
> any other authentication service, anyone will be able to submit a form for 
> anyone else, including doing submissions for participants who may not want 
> their emails to be stored and who do not want to receive communications 
> from the Jenkins project. It increases the risk of abuse for the voting 
> sign-up system.
>
> We do not want to rely solely on Jenkins LDAP, but I think we need some 
> kind of identity management. Google Auth could bridge the gap, as one of 
> the options we can rollout quickly. We de-facto require it for many other 
> contribution areas.
>
>
> I think we should use Google Auth to bridge the gap as you've suggested.
>  
>
>
> Best regards,
> Oleg
>
>
> On Monday, September 21, 2020 at 10:15:23 PM UTC+2 Richard Bywater wrote:
>
> Personally I don't think we should be forcing people to sign up for 
> third-party services just to be able to vote on Jenkins related matters. 
> There may be good reasons that people have for not wanting to create a 
> Google account.
>
> Richard. 
>
>
> On Tue, 22 Sep 2020, 3:15 AM Slide,  wrote:
>
> Hi Everyone,
>
> The Jenkins Governance Board Elections Committee is currently implementing 
> the process which has been defined for Governance Board and Officer 
> Elections. As part of this, we are creating the form that will be used for 
> signing up to participate in the elections. We need to collect email 
> addresses as part of the process. We are using a Google Form for the 
> sign-up and it provides a mechanism to collect email addresses, but it 
> requires users to login to a Google account when using the Google Forms 
> mechanism. It does allow us to reduce the possibility of duplicate voting. 
> We will not keep the data after the voting. Another option would be to

Re: Jenkins Elections Process Question

2020-09-23 Thread 'Olblak' via Jenkins Developers 
> We are using a Google Form for the sign-up and it provides a mechanism to 
> collect email addresses, but it requires users to login to a Google account 
> when using the Google Forms mechanism. It does allow us to reduce the 
> possibility of duplicate voting.
It hurts me to say that but we already ask contributors to use a google account 
to follow discussion happening here so asking people to use their google 
account to vote shouldn't be a major concerned. But we would have no way to 
match a google account with a jenkins account...

Otherwise we already have oauth-proxy integrated with our ldap database, so we 
could write a small application that read the username field from the oauth 
token generated once we go to something like 'register.jenkins.io'.

IMHO asking people to register to a mailing list like 
jenkinsci-electi...@googlegroups.com  seems the 
easier and more sustainable solution. We could by default block new 
registrations during the pre- election period, several weeks before  and we 
would only accepted people who can show a contribution done before the 
pre-election period.   



On Wed, Sep 23, 2020, at 12:11 AM, Oleg Nenashev wrote:
> It would make sense, though I am not sure how another email domain would make 
> a difference there. Sending emails to Google addresses is not blocked in 
> China from what I know. CDF might be able to set up an email for us, but I am 
> not sure about timing. If we want to start the sign-up process on Sep 24 as 
> planned, it would be quite a challenge to get the email in time. 
> 
> Any thoughts from others?
> 
> On Tue, Sep 22, 2020 at 8:12 PM 'Gavin Mogan' via Jenkins Developers 
>  wrote:
>> > jenkins-2020-elections@googlegroup
>> > It will definitely help contributors in areas where Google services are 
>> > blocked 
>> 
>> Wouldn't it make sense for the fallback email to be something other than 
>> google then?
>> 
>> cd.foundation is using mailgun (according to MX records), so maybe they 
>> could setup jenkins-2020-elections@cd.foundation that forwards to google/the 
>> board, so there's no issues.
>> 
>> Gavin
>> 
>> On Tue, Sep 22, 2020 at 11:01 AM Oleg Nenashev  
>> wrote:
>>> As an additional mitigation, we can also add a "send a sign-up email to 
>>> jenkins-2020-elections@googlegroups" fallback process to the announcement. 
>>> It will definitely help contributors in areas where Google services are 
>>> blocked
>>> 
>>> On Tue, Sep 22, 2020, 19:00 Mark Waite  wrote:
 
 
 On Tue, Sep 22, 2020 at 4:28 AM Oleg Nenashev  
 wrote:
> >   it requires users to login to a Google account when using the Google 
> > Forms mechanism. It does allow us to reduce the possibility of 
> > duplicate voting.  
> 
> Apart from duplicate voting, it also prevents from submitting voting 
> sign-up forms for other individuals. If we do not use a Google account or 
> any other authentication service, anyone will be able to submit a form 
> for anyone else, including doing submissions for participants who may not 
> want their emails to be stored and who do not want to receive 
> communications from the Jenkins project. It increases the risk of abuse 
> for the voting sign-up system.
> 
> We do not want to rely solely on Jenkins LDAP, but I think we need some 
> kind of identity management. Google Auth could bridge the gap, as one of 
> the options we can rollout quickly. We de-facto require it for many other 
> contribution areas.
> 
 
 I think we should use Google Auth to bridge the gap as you've suggested.
  
> 
> Best regards,
> Oleg
> 
> 
> On Monday, September 21, 2020 at 10:15:23 PM UTC+2 Richard Bywater wrote:
>> Personally I don't think we should be forcing people to sign up for 
>> third-party services just to be able to vote on Jenkins related matters. 
>> There may be good reasons that people have for not wanting to create a 
>> Google account.
>> 
>> Richard. 
>> 
>> 
>> On Tue, 22 Sep 2020, 3:15 AM Slide,  wrote:
>>> Hi Everyone,
>>> 
>>> The Jenkins Governance Board Elections Committee is currently 
>>> implementing the process which has been defined for Governance Board 
>>> and Officer Elections. As part of this, we are creating the form that 
>>> will be used for signing up to participate in the elections. We need to 
>>> collect email addresses as part of the process. We are using a Google 
>>> Form for the sign-up and it provides a mechanism to collect email 
>>> addresses, but it requires users to login to a Google account when 
>>> using the Google Forms mechanism. It does allow us to reduce the 
>>> possibility of duplicate voting. We will not keep the data after the 
>>> voting. Another option would be to just have a short text input that 
>>> accepts an email address and we would collect it that way. We

Re: Jenkins Elections Process Question

2020-09-22 Thread Oleg Nenashev 
It would make sense, though I am not sure how another email domain would
make a difference there. Sending emails to Google addresses is not blocked
in China from what I know. CDF might be able to set up an email for us, but
I am not sure about timing. If we want to start the sign-up process on Sep
24 as planned, it would be quite a challenge to get the email in time.

Any thoughts from others?

On Tue, Sep 22, 2020 at 8:12 PM 'Gavin Mogan' via Jenkins Developers <
jenkinsci-dev@googlegroups.com> wrote:

> > jenkins-2020-elections@googlegroup
> > It will definitely help contributors in areas where Google services are
> blocked
>
> Wouldn't it make sense for the fallback email to be something other than
> google then?
>
> cd.foundation is using mailgun (according to MX records), so maybe they
> could setup jenkins-2020-elections@cd.foundation that forwards to
> google/the board, so there's no issues.
>
> Gavin
>
> On Tue, Sep 22, 2020 at 11:01 AM Oleg Nenashev 
> wrote:
>
>> As an additional mitigation, we can also add a "send a sign-up email to
>> jenkins-2020-elections@googlegroups" fallback process to the
>> announcement. It will definitely help contributors in areas where Google
>> services are blocked
>>
>> On Tue, Sep 22, 2020, 19:00 Mark Waite  wrote:
>>
>>>
>>>
>>> On Tue, Sep 22, 2020 at 4:28 AM Oleg Nenashev 
>>> wrote:
>>>
 >   it requires users to login to a Google account when using the
 Google Forms mechanism. It does allow us to reduce the possibility of
 duplicate voting.

 Apart from duplicate voting, it also prevents from submitting voting
 sign-up forms for other individuals. If we do not use a Google account or
 any other authentication service, anyone will be able to submit a form for
 anyone else, including doing submissions for participants who may not want
 their emails to be stored and who do not want to receive communications
 from the Jenkins project. It increases the risk of abuse for the voting
 sign-up system.

 We do not want to rely solely on Jenkins LDAP, but I think we need some
 kind of identity management. Google Auth could bridge the gap, as one of
 the options we can rollout quickly. We de-facto require it for many other
 contribution areas.


>>> I think we should use Google Auth to bridge the gap as you've suggested.
>>>
>>>
 Best regards,
 Oleg



 On Monday, September 21, 2020 at 10:15:23 PM UTC+2 Richard Bywater
 wrote:

> Personally I don't think we should be forcing people to sign up for
> third-party services just to be able to vote on Jenkins related matters.
> There may be good reasons that people have for not wanting to create a
> Google account.
>
> Richard.
>
> On Tue, 22 Sep 2020, 3:15 AM Slide,  wrote:
>
>> Hi Everyone,
>>
>> The Jenkins Governance Board Elections Committee is currently
>> implementing the process which has been defined for Governance Board and
>> Officer Elections. As part of this, we are creating the form that will be
>> used for signing up to participate in the elections. We need to collect
>> email addresses as part of the process. We are using a Google Form for 
>> the
>> sign-up and it provides a mechanism to collect email addresses, but it
>> requires users to login to a Google account when using the Google Forms
>> mechanism. It does allow us to reduce the possibility of duplicate 
>> voting.
>> We will not keep the data after the voting. Another option would be to 
>> just
>> have a short text input that accepts an email address and we would 
>> collect
>> it that way. We would like the opinions of those on this list to 
>> determine
>> whether this is acceptable or not. We need the email addresses in order 
>> to
>> communicate if there are issues in the contribution information as well 
>> as
>> to add the folks to the Condorcet vote.
>>
>> Please let us know ASAP your thoughts on this.
>>
>> Regards,
>>
>> Alex Earl
>>
>>
>> --
>> Website: http://earl-of-code.com
>>
>> --
>>
> You received this message because you are subscribed to the Google
>> Groups "Jenkins Developers" group.
>> To unsubscribe from this group and stop receiving emails from it,
>> send an email to jenkinsci-de...@googlegroups.com.
>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/jenkinsci-dev/CAPiUgVer2x2iug%2BCFNoJkyQDmPoQt_BZyTukijGTnSjezJp2eA%40mail.gmail.com
>> 
>> .
>>
> --
 You received this message because you are subscribed to the Google
 Groups "Jenkins Developers" group.
 To unsubscribe from this group and stop receiving emails from it,

Re: Jenkins Elections Process Question

2020-09-22 Thread 'Gavin Mogan' via Jenkins Developers 
> jenkins-2020-elections@googlegroup
> It will definitely help contributors in areas where Google services are
blocked

Wouldn't it make sense for the fallback email to be something other than
google then?

cd.foundation is using mailgun (according to MX records), so maybe they
could setup jenkins-2020-elections@cd.foundation that forwards to
google/the board, so there's no issues.

Gavin

On Tue, Sep 22, 2020 at 11:01 AM Oleg Nenashev 
wrote:

> As an additional mitigation, we can also add a "send a sign-up email to
> jenkins-2020-elections@googlegroups" fallback process to the
> announcement. It will definitely help contributors in areas where Google
> services are blocked
>
> On Tue, Sep 22, 2020, 19:00 Mark Waite  wrote:
>
>>
>>
>> On Tue, Sep 22, 2020 at 4:28 AM Oleg Nenashev 
>> wrote:
>>
>>> >   it requires users to login to a Google account when using the Google
>>> Forms mechanism. It does allow us to reduce the possibility of duplicate
>>> voting.
>>>
>>> Apart from duplicate voting, it also prevents from submitting voting
>>> sign-up forms for other individuals. If we do not use a Google account or
>>> any other authentication service, anyone will be able to submit a form for
>>> anyone else, including doing submissions for participants who may not want
>>> their emails to be stored and who do not want to receive communications
>>> from the Jenkins project. It increases the risk of abuse for the voting
>>> sign-up system.
>>>
>>> We do not want to rely solely on Jenkins LDAP, but I think we need some
>>> kind of identity management. Google Auth could bridge the gap, as one of
>>> the options we can rollout quickly. We de-facto require it for many other
>>> contribution areas.
>>>
>>>
>> I think we should use Google Auth to bridge the gap as you've suggested.
>>
>>
>>> Best regards,
>>> Oleg
>>>
>>>
>>>
>>> On Monday, September 21, 2020 at 10:15:23 PM UTC+2 Richard Bywater wrote:
>>>
 Personally I don't think we should be forcing people to sign up for
 third-party services just to be able to vote on Jenkins related matters.
 There may be good reasons that people have for not wanting to create a
 Google account.

 Richard.

 On Tue, 22 Sep 2020, 3:15 AM Slide,  wrote:

> Hi Everyone,
>
> The Jenkins Governance Board Elections Committee is currently
> implementing the process which has been defined for Governance Board and
> Officer Elections. As part of this, we are creating the form that will be
> used for signing up to participate in the elections. We need to collect
> email addresses as part of the process. We are using a Google Form for the
> sign-up and it provides a mechanism to collect email addresses, but it
> requires users to login to a Google account when using the Google Forms
> mechanism. It does allow us to reduce the possibility of duplicate voting.
> We will not keep the data after the voting. Another option would be to 
> just
> have a short text input that accepts an email address and we would collect
> it that way. We would like the opinions of those on this list to determine
> whether this is acceptable or not. We need the email addresses in order to
> communicate if there are issues in the contribution information as well as
> to add the folks to the Condorcet vote.
>
> Please let us know ASAP your thoughts on this.
>
> Regards,
>
> Alex Earl
>
>
> --
> Website: http://earl-of-code.com
>
> --
>
 You received this message because you are subscribed to the Google
> Groups "Jenkins Developers" group.
> To unsubscribe from this group and stop receiving emails from it, send
> an email to jenkinsci-de...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/jenkinsci-dev/CAPiUgVer2x2iug%2BCFNoJkyQDmPoQt_BZyTukijGTnSjezJp2eA%40mail.gmail.com
> 
> .
>
 --
>>> You received this message because you are subscribed to the Google
>>> Groups "Jenkins Developers" group.
>>> To unsubscribe from this group and stop receiving emails from it, send
>>> an email to jenkinsci-dev+unsubscr...@googlegroups.com.
>>> To view this discussion on the web visit
>>> https://groups.google.com/d/msgid/jenkinsci-dev/cef9e1d2-f7a0-4e1e-bc04-00756c164eecn%40googlegroups.com
>>> 
>>> .
>>>
>> --
>> You received this message because you are subscribed to a topic in the
>> Google Groups "Jenkins Developers" group.
>> To unsubscribe from this topic, visit
>> https://groups.google.com/d/topic/jenkinsci-dev/pzDc62So6xM/unsubscribe.
>> To unsubscribe from this group and all its topics, send an email

Re: Jenkins Elections Process Question

2020-09-22 Thread Oleg Nenashev 
As an additional mitigation, we can also add a "send a sign-up email to
jenkins-2020-elections@googlegroups" fallback process to the announcement.
It will definitely help contributors in areas where Google services are
blocked

On Tue, Sep 22, 2020, 19:00 Mark Waite  wrote:

>
>
> On Tue, Sep 22, 2020 at 4:28 AM Oleg Nenashev 
> wrote:
>
>> >   it requires users to login to a Google account when using the Google
>> Forms mechanism. It does allow us to reduce the possibility of duplicate
>> voting.
>>
>> Apart from duplicate voting, it also prevents from submitting voting
>> sign-up forms for other individuals. If we do not use a Google account or
>> any other authentication service, anyone will be able to submit a form for
>> anyone else, including doing submissions for participants who may not want
>> their emails to be stored and who do not want to receive communications
>> from the Jenkins project. It increases the risk of abuse for the voting
>> sign-up system.
>>
>> We do not want to rely solely on Jenkins LDAP, but I think we need some
>> kind of identity management. Google Auth could bridge the gap, as one of
>> the options we can rollout quickly. We de-facto require it for many other
>> contribution areas.
>>
>>
> I think we should use Google Auth to bridge the gap as you've suggested.
>
>
>> Best regards,
>> Oleg
>>
>>
>>
>> On Monday, September 21, 2020 at 10:15:23 PM UTC+2 Richard Bywater wrote:
>>
>>> Personally I don't think we should be forcing people to sign up for
>>> third-party services just to be able to vote on Jenkins related matters.
>>> There may be good reasons that people have for not wanting to create a
>>> Google account.
>>>
>>> Richard.
>>>
>>> On Tue, 22 Sep 2020, 3:15 AM Slide,  wrote:
>>>
 Hi Everyone,

 The Jenkins Governance Board Elections Committee is currently
 implementing the process which has been defined for Governance Board and
 Officer Elections. As part of this, we are creating the form that will be
 used for signing up to participate in the elections. We need to collect
 email addresses as part of the process. We are using a Google Form for the
 sign-up and it provides a mechanism to collect email addresses, but it
 requires users to login to a Google account when using the Google Forms
 mechanism. It does allow us to reduce the possibility of duplicate voting.
 We will not keep the data after the voting. Another option would be to just
 have a short text input that accepts an email address and we would collect
 it that way. We would like the opinions of those on this list to determine
 whether this is acceptable or not. We need the email addresses in order to
 communicate if there are issues in the contribution information as well as
 to add the folks to the Condorcet vote.

 Please let us know ASAP your thoughts on this.

 Regards,

 Alex Earl


 --
 Website: http://earl-of-code.com

 --

>>> You received this message because you are subscribed to the Google
 Groups "Jenkins Developers" group.
 To unsubscribe from this group and stop receiving emails from it, send
 an email to jenkinsci-de...@googlegroups.com.
 To view this discussion on the web visit
 https://groups.google.com/d/msgid/jenkinsci-dev/CAPiUgVer2x2iug%2BCFNoJkyQDmPoQt_BZyTukijGTnSjezJp2eA%40mail.gmail.com
 
 .

>>> --
>> You received this message because you are subscribed to the Google Groups
>> "Jenkins Developers" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to jenkinsci-dev+unsubscr...@googlegroups.com.
>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/jenkinsci-dev/cef9e1d2-f7a0-4e1e-bc04-00756c164eecn%40googlegroups.com
>> 
>> .
>>
> --
> You received this message because you are subscribed to a topic in the
> Google Groups "Jenkins Developers" group.
> To unsubscribe from this topic, visit
> https://groups.google.com/d/topic/jenkinsci-dev/pzDc62So6xM/unsubscribe.
> To unsubscribe from this group and all its topics, send an email to
> jenkinsci-dev+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/jenkinsci-dev/CAO49JtFVHGcagjz9ejMMwP027_30bjfQ_XUV6UZVXY-ASriamg%40mail.gmail.com
> 
> .
>

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to

Re: Jenkins Elections Process Question

2020-09-22 Thread Mark Waite 
On Tue, Sep 22, 2020 at 4:28 AM Oleg Nenashev 
wrote:

> >   it requires users to login to a Google account when using the Google
> Forms mechanism. It does allow us to reduce the possibility of duplicate
> voting.
>
> Apart from duplicate voting, it also prevents from submitting voting
> sign-up forms for other individuals. If we do not use a Google account or
> any other authentication service, anyone will be able to submit a form for
> anyone else, including doing submissions for participants who may not want
> their emails to be stored and who do not want to receive communications
> from the Jenkins project. It increases the risk of abuse for the voting
> sign-up system.
>
> We do not want to rely solely on Jenkins LDAP, but I think we need some
> kind of identity management. Google Auth could bridge the gap, as one of
> the options we can rollout quickly. We de-facto require it for many other
> contribution areas.
>
>
I think we should use Google Auth to bridge the gap as you've suggested.


> Best regards,
> Oleg
>
>
>
> On Monday, September 21, 2020 at 10:15:23 PM UTC+2 Richard Bywater wrote:
>
>> Personally I don't think we should be forcing people to sign up for
>> third-party services just to be able to vote on Jenkins related matters.
>> There may be good reasons that people have for not wanting to create a
>> Google account.
>>
>> Richard.
>>
>> On Tue, 22 Sep 2020, 3:15 AM Slide,  wrote:
>>
>>> Hi Everyone,
>>>
>>> The Jenkins Governance Board Elections Committee is currently
>>> implementing the process which has been defined for Governance Board and
>>> Officer Elections. As part of this, we are creating the form that will be
>>> used for signing up to participate in the elections. We need to collect
>>> email addresses as part of the process. We are using a Google Form for the
>>> sign-up and it provides a mechanism to collect email addresses, but it
>>> requires users to login to a Google account when using the Google Forms
>>> mechanism. It does allow us to reduce the possibility of duplicate voting.
>>> We will not keep the data after the voting. Another option would be to just
>>> have a short text input that accepts an email address and we would collect
>>> it that way. We would like the opinions of those on this list to determine
>>> whether this is acceptable or not. We need the email addresses in order to
>>> communicate if there are issues in the contribution information as well as
>>> to add the folks to the Condorcet vote.
>>>
>>> Please let us know ASAP your thoughts on this.
>>>
>>> Regards,
>>>
>>> Alex Earl
>>>
>>>
>>> --
>>> Website: http://earl-of-code.com
>>>
>>> --
>>>
>> You received this message because you are subscribed to the Google Groups
>>> "Jenkins Developers" group.
>>> To unsubscribe from this group and stop receiving emails from it, send
>>> an email to jenkinsci-de...@googlegroups.com.
>>> To view this discussion on the web visit
>>> https://groups.google.com/d/msgid/jenkinsci-dev/CAPiUgVer2x2iug%2BCFNoJkyQDmPoQt_BZyTukijGTnSjezJp2eA%40mail.gmail.com
>>> 
>>> .
>>>
>> --
> You received this message because you are subscribed to the Google Groups
> "Jenkins Developers" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to jenkinsci-dev+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/jenkinsci-dev/cef9e1d2-f7a0-4e1e-bc04-00756c164eecn%40googlegroups.com
> 
> .
>

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-dev+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-dev/CAO49JtFVHGcagjz9ejMMwP027_30bjfQ_XUV6UZVXY-ASriamg%40mail.gmail.com.

Re: Jenkins Elections Process Question

2020-09-22 Thread Oleg Nenashev 
>   it requires users to login to a Google account when using the Google 
Forms mechanism. It does allow us to reduce the possibility of duplicate 
voting.  

Apart from duplicate voting, it also prevents from submitting voting 
sign-up forms for other individuals. If we do not use a Google account or 
any other authentication service, anyone will be able to submit a form for 
anyone else, including doing submissions for participants who may not want 
their emails to be stored and who do not want to receive communications 
from the Jenkins project. It increases the risk of abuse for the voting 
sign-up system.

We do not want to rely solely on Jenkins LDAP, but I think we need some 
kind of identity management. Google Auth could bridge the gap, as one of 
the options we can rollout quickly. We de-facto require it for many other 
contribution areas.

Best regards,
Oleg



On Monday, September 21, 2020 at 10:15:23 PM UTC+2 Richard Bywater wrote:

> Personally I don't think we should be forcing people to sign up for 
> third-party services just to be able to vote on Jenkins related matters. 
> There may be good reasons that people have for not wanting to create a 
> Google account.
>
> Richard. 
>
> On Tue, 22 Sep 2020, 3:15 AM Slide,  wrote:
>
>> Hi Everyone,
>>
>> The Jenkins Governance Board Elections Committee is currently 
>> implementing the process which has been defined for Governance Board and 
>> Officer Elections. As part of this, we are creating the form that will be 
>> used for signing up to participate in the elections. We need to collect 
>> email addresses as part of the process. We are using a Google Form for the 
>> sign-up and it provides a mechanism to collect email addresses, but it 
>> requires users to login to a Google account when using the Google Forms 
>> mechanism. It does allow us to reduce the possibility of duplicate voting. 
>> We will not keep the data after the voting. Another option would be to just 
>> have a short text input that accepts an email address and we would collect 
>> it that way. We would like the opinions of those on this list to determine 
>> whether this is acceptable or not. We need the email addresses in order to 
>> communicate if there are issues in the contribution information as well as 
>> to add the folks to the Condorcet vote. 
>>
>> Please let us know ASAP your thoughts on this.
>>
>> Regards,
>>
>> Alex Earl
>>
>>
>> -- 
>> Website: http://earl-of-code.com
>>
>> -- 
>>
> You received this message because you are subscribed to the Google Groups 
>> "Jenkins Developers" group.
>> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to jenkinsci-de...@googlegroups.com.
>> To view this discussion on the web visit 
>> https://groups.google.com/d/msgid/jenkinsci-dev/CAPiUgVer2x2iug%2BCFNoJkyQDmPoQt_BZyTukijGTnSjezJp2eA%40mail.gmail.com
>>  
>> 
>> .
>>
>

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-dev+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-dev/cef9e1d2-f7a0-4e1e-bc04-00756c164eecn%40googlegroups.com.

Re: Jenkins Elections Process Question

2020-09-21 Thread Richard Bywater 
Personally I don't think we should be forcing people to sign up for
third-party services just to be able to vote on Jenkins related matters.
There may be good reasons that people have for not wanting to create a
Google account.

Richard.

On Tue, 22 Sep 2020, 3:15 AM Slide,  wrote:

> Hi Everyone,
>
> The Jenkins Governance Board Elections Committee is currently implementing
> the process which has been defined for Governance Board and Officer
> Elections. As part of this, we are creating the form that will be used for
> signing up to participate in the elections. We need to collect email
> addresses as part of the process. We are using a Google Form for the
> sign-up and it provides a mechanism to collect email addresses, but it
> requires users to login to a Google account when using the Google Forms
> mechanism. It does allow us to reduce the possibility of duplicate voting.
> We will not keep the data after the voting. Another option would be to just
> have a short text input that accepts an email address and we would collect
> it that way. We would like the opinions of those on this list to determine
> whether this is acceptable or not. We need the email addresses in order to
> communicate if there are issues in the contribution information as well as
> to add the folks to the Condorcet vote.
>
> Please let us know ASAP your thoughts on this.
>
> Regards,
>
> Alex Earl
>
>
> --
> Website: http://earl-of-code.com
>
> --
> You received this message because you are subscribed to the Google Groups
> "Jenkins Developers" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to jenkinsci-dev+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/jenkinsci-dev/CAPiUgVer2x2iug%2BCFNoJkyQDmPoQt_BZyTukijGTnSjezJp2eA%40mail.gmail.com
> 
> .
>

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-dev+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-dev/CAAy0hwdm_gN2cmCz%3DWCHX6q97%2Brp6B7LGMKbnbL5VuxQYgqrMg%40mail.gmail.com.

Re: Jenkins Elections Process Question

2020-09-21 Thread Slide 
Just to clarify, the two options are

1) Use Google Forms built-in method for collecting email addresses, this
requires a Google Account
2) Use a short text input in the Google Form to collection email addresses,
this does NOT require a Google Account

On Mon, Sep 21, 2020 at 8:17 AM Marky Jackson 
wrote:

> I am +1 for google form
>
> On Sep 21, 2020, at 8:15 AM, Slide  wrote:
>
> Hi Everyone,
>
> The Jenkins Governance Board Elections Committee is currently implementing
> the process which has been defined for Governance Board and Officer
> Elections. As part of this, we are creating the form that will be used for
> signing up to participate in the elections. We need to collect email
> addresses as part of the process. We are using a Google Form for the
> sign-up and it provides a mechanism to collect email addresses, but it
> requires users to login to a Google account when using the Google Forms
> mechanism. It does allow us to reduce the possibility of duplicate voting.
> We will not keep the data after the voting. Another option would be to just
> have a short text input that accepts an email address and we would collect
> it that way. We would like the opinions of those on this list to determine
> whether this is acceptable or not. We need the email addresses in order to
> communicate if there are issues in the contribution information as well as
> to add the folks to the Condorcet vote.
>
> Please let us know ASAP your thoughts on this.
>
> Regards,
>
> Alex Earl
>
>
> --
> Website: http://earl-of-code.com
>
> --
> You received this message because you are subscribed to the Google Groups
> "Jenkins Developers" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to jenkinsci-dev+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/jenkinsci-dev/CAPiUgVer2x2iug%2BCFNoJkyQDmPoQt_BZyTukijGTnSjezJp2eA%40mail.gmail.com
> 
> .
>
>
> --
> You received this message because you are subscribed to the Google Groups
> "Jenkins Developers" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to jenkinsci-dev+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/jenkinsci-dev/2657FEA1-B54B-4B77-9B8D-2DCCA9F3BCC8%40gmail.com
> 
> .
>


-- 
Website: http://earl-of-code.com

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-dev+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-dev/CAPiUgVeQH8-k_1pLEh47Dy_B%3DhK3k_wYSu-AFx81ntN2zeMrkw%40mail.gmail.com.

Re: Jenkins Elections Process Question

2020-09-21 Thread Marky Jackson 
I am +1 for google form

> On Sep 21, 2020, at 8:15 AM, Slide  wrote:
> 
> Hi Everyone,
> 
> The Jenkins Governance Board Elections Committee is currently implementing 
> the process which has been defined for Governance Board and Officer 
> Elections. As part of this, we are creating the form that will be used for 
> signing up to participate in the elections. We need to collect email 
> addresses as part of the process. We are using a Google Form for the sign-up 
> and it provides a mechanism to collect email addresses, but it requires users 
> to login to a Google account when using the Google Forms mechanism. It does 
> allow us to reduce the possibility of duplicate voting. We will not keep the 
> data after the voting. Another option would be to just have a short text 
> input that accepts an email address and we would collect it that way. We 
> would like the opinions of those on this list to determine whether this is 
> acceptable or not. We need the email addresses in order to communicate if 
> there are issues in the contribution information as well as to add the folks 
> to the Condorcet vote.
> 
> Please let us know ASAP your thoughts on this.
> 
> Regards,
> 
> Alex Earl
> 
> 
> --
> Website: http://earl-of-code.com 
> 
> --
> You received this message because you are subscribed to the Google Groups 
> "Jenkins Developers" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to jenkinsci-dev+unsubscr...@googlegroups.com 
> .
> To view this discussion on the web visit 
> https://groups.google.com/d/msgid/jenkinsci-dev/CAPiUgVer2x2iug%2BCFNoJkyQDmPoQt_BZyTukijGTnSjezJp2eA%40mail.gmail.com
>  
> .

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-dev+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-dev/2657FEA1-B54B-4B77-9B8D-2DCCA9F3BCC8%40gmail.com.


signature.asc
Description: Message signed with OpenPGP

Jenkins Elections Process Question

2020-09-21 Thread Slide 
Hi Everyone,

The Jenkins Governance Board Elections Committee is currently implementing
the process which has been defined for Governance Board and Officer
Elections. As part of this, we are creating the form that will be used for
signing up to participate in the elections. We need to collect email
addresses as part of the process. We are using a Google Form for the
sign-up and it provides a mechanism to collect email addresses, but it
requires users to login to a Google account when using the Google Forms
mechanism. It does allow us to reduce the possibility of duplicate voting.
We will not keep the data after the voting. Another option would be to just
have a short text input that accepts an email address and we would collect
it that way. We would like the opinions of those on this list to determine
whether this is acceptable or not. We need the email addresses in order to
communicate if there are issues in the contribution information as well as
to add the folks to the Condorcet vote.

Please let us know ASAP your thoughts on this.

Regards,

Alex Earl


-- 
Website: http://earl-of-code.com

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-dev+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-dev/CAPiUgVer2x2iug%2BCFNoJkyQDmPoQt_BZyTukijGTnSjezJp2eA%40mail.gmail.com.