Slacker is an attempt to organize and systematize our developer/customer support use cases into something that is easy to manage and measure, and also is welcoming of newcomers wanting to help participate on projects.
16
stars
19
forks
source link
Slacker should support privacy as a first-class feature #129
I propose we add a "private" boolean configuration option to projects' configs. There are use cases recently discussed that require strict discretion such that sensitive topic matters do not leak publicly. One step that has recently been taken is to make the #slacker-activity slack channel private - but there are other things that would need to be modified when this new feature is enabled, as enumerated here below:
### Tasks
- [ ] AIs from private projects should not be `/slacker list`-able - they should always be filtered out
- [ ] Private projects should not be `/slacker snoozed`-able
- [ ] Private projects should not be gimmeable/reopenable by non-maintainers at all - i.e. disable the 'first good issue' feature.
- [ ] It should be *impossible* to assign an AI of a private project to a non-maintainer, and it should be *impossible* for a non-maintainer to mutate an AI in any way
- [ ] Maintainers removed from projects should have all of their issues immediately unassigned (or add a banning feature cutting off slacker access entirely) - careful w/ this one
- [ ] Private projects' ES docs should contain NO text (slack message content, notes, etc) that could provide insight into that project's AIs
- [x] It might be the case we also don't want data published #slacker-activity, even...
- [ ] Encryption of data might even be a thing
- [ ] We should do an audit of the data trail left by all slacker operations and ensure we log with appropriate verbosity to support privacy use cases.
- [ ] The slacker service should be hardened against external threats that could look to expose data from its exposed APIs
I propose we add a "private" boolean configuration option to projects' configs. There are use cases recently discussed that require strict discretion such that sensitive topic matters do not leak publicly. One step that has recently been taken is to make the #slacker-activity slack channel private - but there are other things that would need to be modified when this new feature is enabled, as enumerated here below: