Project:Infrastructure/Infrastructure Guidelines

General Summary
General guidance to infra members is to take actions that avoid impropriety (actual, implied, or perceived). With great infra power comes a responsibility to users to use that power in a positive way.

Disciplinary Action
Disciplinary Action typically involves permission removal as an reaction to behavior by community members.

Disciplinary action should be driven by Comrel. Comrel will file bugs; the bugs should have clear instructions as to the content of the action and its vote status. Please ensure the bugs follow the [|Comrel Policy]

These actions should NOT be taken unilaterally by infrastructure members.

The actions taken might include:

* Bans from mailing lists * Bans from Bugzilla * Permission removal from various code repositories * Removal from 'Gentoo' (aka. Retirement)

Legal Matters
Legal Action involves various infrastructure changes that are made from time to time at the request of the Gentoo Foundation to ensure the Foundation acts within the law. These changes should be driven by the Foundation board and have a bug with attached resolution and minutes.

An audit trail is crucial for showing compliance without unreasonable delays as required by some legal statutes (e.g. DMCA [17 U.S.C. § 1201-1205] states "expeditiously", but does not define the term).

Examples: * DMCA requests * Court order compliance * Privacy-related requests * GDPR * Record preservation, due to court orders

Service Defense
From time to time the infrastructure team may need to defend Gentoo services from spam or other abuse. Unlike other actions, the infrastructure team is responsible for of all portions of this activity: investigation of the abuse, remediation of the abuse, communication of the abuse. We provide this guidance:

* Take the minimum amount of action to restore service to users. So avoid banning broad IP ranges. * If individuals are identifiable, please contact them first if their abuse is 'minor' and the service is still functional. * If service is not functional (e.g. individual people are causing service failure) it is permissible to block them and then follow up with contact. * For IP bans, avoid banning IPs forever. Folks move providers and someone new might land on that IP range and they should be able to access our services. If banning a swath of IP space, consider a temporary ban (1-2 weeks) as often abuse tapers off after some time. * Consider other ways to detect bans; often web crawlers have HTTP headers set that are effective and transcend IP space.