 Hi I'm Molly it's nice to see so many familiar faces in the room. I don't know why but every time I come to FOSDEM I give a community talk in the legal and policy track but it works out for me because I still get to come and talk to a bunch of people. My name is Molly I'm the Campaigns Manager at the Free Software Foundation. I'm on the board of directors of the open source initiative and I'm a Debian developer so I'm gonna be talking a little bit about Debian. It's important to recognize that I am not speaking on behalf of the project. I'm just speaking on behalf of me. A few other points. I am not an expert in enforcing your community guidelines. It's it's something I do at Libra Planet the Free Software Foundation's conference. It's something I've done at DEBCOMF the Debian conference and I'm on the anti-harassment team for Debian but this doesn't mean I'm an expert. It just means I have some experience. I've also had training with Sage Sharp from OtterTech at Incident Response for Events. So what is a community policy? Communities are free as in kittens. Free Software communities are free as in kittens. There are gonna be a lot of kitten slides so if you content warning kittens. So in order to maintain and manage your free software community you know it's like a pile of kittens. It looks great. It looks welcoming. It looks fuzzy. It's fun to play with but it also requires a lot of work it turns out and it might require more work than you anticipate. So we've created community policies things like codes of conduct anti-harassment policies in order to manage in order to manage how people are interacting with each other and to help them create a welcoming place. So these are some things that Debian has. Debian has quite a few community policies. There's the DEBCOMF code of conduct which covers the Debian conference. I believe it also covers many DEBCOMFs and bug squashing parties which are the range of Debian events. There's the Debian code of conduct which is for communication channels mailing lists and IRC. There are also community guidelines which aren't so much an official policy as they are guidance tools for how you can be a better member of a community how you can interact more effectively and how you can make it a more welcoming and inclusive place. There's also the diversity statement and the social contract. The diversity statement and social contract aren't so much explicit community guidelines around behavior and communication as they are like guidance points for that help shape the other policies within the community. Negative behavior takes on many forms. There are a lot of different ways that we behave within communities that can make people feel unwelcome that can make people feel unsafe. I'm going to be talking about a few of them but the range goes from things like actual physical contact with someone to simply talking with them in a way that makes them uncomfortable. Here's an excerpt from the DEBCOMF code of conduct. I'm going to read it in case anyone here has vision issues so apologies for those of you who see it already. Offensive verbal or written remarks related to gender, sexual orientation, disability, physical appearance, body size, race or religion, deliberate intimidation, stalking or following, unwelcome sexual attention, sexist, racist and other exclusionary jokes. Codes of conduct vary project to project but are generally based around the same principles. A good code of conduct or it's considered that a good code of conduct talks about like focuses on what kind of behavior is inappropriate rather than talking mostly about what kind of behavior is appropriate. This enables people to, these are non-exhaustive lists, they are examples of some things. This enables people to have a thing that they can point at which is super helpful because when somebody communicates in an inappropriate way it's easy to say well it wasn't an inappropriate communication really but when you have an example and you can say well it actually fits into this kind of box of thing that happened like it was kind of a sexist to joke actually. It's easier to make that comment but it's also easier to bring the comment up because you have something to point at as an example. Good codes of conduct also have who you should be speaking with, should somebody be violating it, should somebody be making you feel unsafe. Generally the goal of Debian, well I think one of the goals of free software communities in general is to be friendly to one another, to create a friendly environment and to be professional. Don't act towards someone as you wouldn't act towards a colleague. This doesn't mean that these people aren't your friends, you know. I would say that the majority of my friends at this point are people I know from free software but we still need to when working look at our relationships in this particular way. And nobody's perfect, nobody's perfect. This is really important to remember. We all make mistakes. I have made mistakes that I'm going to talk about. I'm not proud of them but even I have done this. So the goal is as like somebody interacting with a community your goal is not necessarily to be perfect. Your goal is to try hard and if you make a mistake apologize for your behavior and work on moving forward with your behavior to try to do a better job in the future. So here are some examples from my experience with Debian. So what does the anti-harassment team do? In a perfect world what we do is we make recommendations to other teams when incidents come in, when incidents have been reported to us. Occasionally we take action ourselves. I'm going to be very honest during this section of the talk. Taking action ourselves is a pretty divisive issue as far as I know we've only done it directly once and it did not make everybody very happy. But it was the decision we made. This is what our operating procedure is like. We have reports that come into us and then we respond to those reports fortnightly every other week. We have a meeting that's usually 90 minutes to 2 hours where we discuss what's been going on. We look over the reports. We talk about what we think are proper responses. We spend a lot of time writing responses together and collaboratively because we want to have clear, concise, consistent communications from the team to the rest of the project. The most common thing we get as a comment is somebody was mean to someone else. That might not mean someone was mean to me but someone was mean to someone else. This is most consistent in terms of people saying little things on mailing lists. For example something that somebody said once was this conversation is pathetic and you're stupid. That's not nice. Were they acting with bad faith? Did they have negative intentions? I see someone nodding. I like to hope that they didn't and they were just like not thinking about what they were saying. I personally give everyone the benefit of the doubt with the thought that they're not doing this intentionally. They're just not thinking about what they're doing. Most of the reports we get are people casually, incidentally being mean or using inappropriate language or inappropriate tones with people. What would I do in this situation? Generally the thing to do in my opinion is to contact the person. The first thing you do in all cases if you can and are on point enough to do this is you contact the person who sent in the report and you say thank you for telling us this. We'll get back to you if necessary and we'll examine the situation and respond as is appropriate. That's the first thing to do. The second thing to do is to email the person or contact the person. First you want to assess what the person said and make a decision over whether you should say anything about it and then contact the person who said the inappropriate thing or was inappropriate and tell them hey this thing you did wasn't great. It would be cool if you could do a little bit better. Maybe you want to point out some things, give some specific examples of things that they did and how they could do better. So that's one thing. It turns out that in general across the internet it turns out that when you point out to somebody something you did wasn't the best thing that you could have done. They apologize for it and we can't. So what happens when this comes up? Actually pretty close to that. It's just simple communication with people saying hey this thing came up and it wasn't great. So photo privacy incidents. This is where I talk about a thing that I did. Somebody once said at a conference I was at I don't want anyone to take photos of me and I was a much younger version of myself. I was much younger than I am now and I thought it would be really clever to take a photo of them and to sneak like to sneakily do that. I wasn't going to do anything with the photo but it felt like a challenge and they saw me and I felt like a total jerk and they made me feel like a total jerk. They didn't report me to anyone but they asked me to delete the photo which I did. So in the Debcombe code of conduct there's actually there's actually a note against unwanted photography or recording of people. So if at a Debcombe somebody takes a photo of somebody else for example and they don't want that photo taken that's against the code of conduct. So what would I do in the situation? Well you now know what I did when I was the perpetrator of a photo policy violation and this one is a little complicated because it's a case where somebody can cause issues if they disagree with your decision or statement. You want to have a conversation with both people. You want to ask the person whose photo is taken. Do you want us to do anything about it? Do you want us to ask them to delete the photo? Do you want us to bring up a conversation? Do you want to have a conversation with them with us present especially if they ask to apologize what would make you comfortable here? And then you go to the person who took the photo and you ask them to delete the photo. So this is where it gets complicated because what if they say no I'm not going to delete the photo and it turns out you can't really force people to delete photos and once you're in a public space at least in the United States you kind of give up a certain right to privacy. So if somebody refuses that's when you might want to ask them hey you know this is like really inappropriate it turns out. If you don't delete the photo it might be good if you took a break from the conference. If you stopped taking photos for the rest of the day we don't really want to ask you to leave the conference permanently but we might have to in the events like in the event that you continue to do this. So those are like not the most fun conversations but they are necessary ones to have sometimes. So what actually happened when somebody took a photo of somebody else? I can't tell you and that's why I think this is a really great example because it was handled privately that people involved asked us to not tell anybody I like to not tell anyone the details of it and so it was it was managed internally. So that's why I like this because it's really important to remember that sometimes you can't tell everybody else about what's going on. Incidentally after the event somebody did make a public post to a public mailing list about photography at events and what kind of photo policy should be used what kind of photo policy should be necessary and this also became a very divisive conversation because the people involved you know the people who take photos were like well here are things I'm comfortable with but if you do this and this and this that would mean I basically couldn't take any photos. There were discussions about using lanyards or name tag stickers name tag stickers are great but they can be hard to see. Lanyards are easier to see but then you have to buy a bunch of lanyards of different colors which it turns out is expensive. There is the idea of banning photography in certain locations as well as actually just like banning photography in general. I don't know what will be incorporated into the photo policy in the future so stay tuned for that it'll be exciting and new. Here's a there was a package renaming thing where there was a package with the name that some people didn't like. I'm comfortable talking about this because it became very public. What I would do in the situation is I would say hey this package name is inappropriate and it turns out there were actually also a lot of inappropriate comments within the package. So in that case I'd say hey by the way this isn't great would it be possible for you to like start an initiative to clean it up a little bit that would be great. So what actually happened okay 10 minutes left thanks. So what actually happened well we asked let's see I can't see my notes I have an exact quote on this. We asked upstream to make a request to rename the package if possible and to remove it if that can't be done before the freeze which means in case you don't understand that asking the people who maintain stable additions of the operating system to do something about the situation unless it's not possible before we stop making new additions to Debian and fix all the bugs before we release a new stable version of it. So the other thing that happened is the internet briefly exploded. There were hundreds of comments hundreds only hundreds only hundreds of comments on Reddit on a Reddit post and hacker news post no I don't know about hacker news but on slash dot definitely slash dot was involved in this. I felt kind of bad about myself for a little bit even though I hadn't necessarily been involved very heavily with making the decision and then I felt pretty good after I got myself a mocha so I recommend doing that if people are mean to you even indirectly on the internet. Sometimes you also have to suspend or expel people. Suspension is when you ask someone to temporarily leave a project. You might do something something that happens in Debian specifically is demotion where somebody will go from being a Debian developer having official status in the project to being a maintainer where they still have the ability to contribute technically but different rights and privileges. When you expel someone you ask them to permanently leave. Both of these things have happened with Debian both of these things have happened with events that I've been at and helped work on and it's never fun to expel someone but sometimes it is necessary. This is a lot of hard work. Most of your labor is hidden and invisible and that's actually how you want it to be. You don't want people to see what you're doing because you don't necessarily want to draw a tent. It's good to be honest and open but you don't want to be drawing attention to everybody's like little mistakes. You want to have conversations that make people feel comfortable and safe because if you feel unsafe when somebody makes a like if you feel unsafe making a report and if you feel unsafe when somebody makes a report about you you're not going to want to continue to contribute and be involved. There's also another reason why you want your labor to be hidden. When your label that labor is visible people get really upset it turns out and they start milling the threads they get very long or they write you hate mail. We get hate mail. We get legitimate hate mail both for specific things we've done but also for in general working as an anti harassment team. Also consensus is hard. We try to consents on issues we're a small team and that's not easy to do and like I said we want to have clear concise consistent communication to make it clear that we agree with one another and to present a united front. So overall goals of enforcing your community guidelines are to make your community a safe welcoming place where people feel included where people feel like they can be included and can participate earnestly and honestly and I like to think that's a thing that we accomplish and that's a thing that you can accomplish within your own work. So I would like to thank the legal and policy dev room for inviting me here to speak FOSDEM for putting together this great event Debbie and for letting me be involved the Free Software Foundation for helping me come here. They're great. I love them. That's where I work. Good job. We're hiring. Shameless plug. Sorry. I knew for listening to me. Do we have any time for questions? Thank you, Mara. And there are the assumption that social norms within a project drift. Do you think teams like NT harassment should be at the forefront or leaning back to that social norms progress? Do you think like you should be going towards more progressive or enforcing more progressive norms than the project currently has? Or do you think you should be following back on wherever the project social norms are evolving to? That's a really interesting question. I don't have a simple answer to it because it's really hard and I think that's a great conversation to have with someone who's also making these decisions. I am personally all for becoming more progressive, having more inclusive language, doing the kinds of things that I think are right in community building. Is that the right thing to do? I don't know. I especially encourage questions from people who are women, non-binary or people of color. And I know that asking questions can be kind of intimidating. Yeah, go for it. May I? Yeah. Sorry. Well, I know there's a lot of misbehavior that needs to be corrected. I'm a little bit more interested. So that is important. But when I see this discussion trying to find an environment where there isn't any offensive behavior, what I think I would like to see to know your opinion is how do you deal with the fact that these are global communities? There are people with many different cultural backgrounds and very often the offensive behavior was not intended. So I think it's a bit impossible to get it completely non-offensive. I think this is always going to happen. What I've learned from working in a multicultural environment for many years is that I learned to be more tolerant actually to the university because sometimes what I thought was offensive actually was not intended. So I'm actually curious to see how... Is this an issue for you or are you really... Yeah, no, it's totally an issue cultural norms differing across cultures. But it's like I said, nobody's perfect. So one of the things you really want to do is you want to point out to people, especially like in my opinion, my opinion, you want to point out to people especially quietly, like hey this thing you did wasn't the best thing based on community norms, based on the policies that we're trying to implement and based on the way we're trying to build our communities. Rhonda, did you have a question? So what do you think about enforcement across communities? There is a problem happening in one community and somebody do something bad, move to another community and then start again and move from community to community to do that because if the report are private, well you cannot communicate but if you don't, the person just go again and again. So do you have some opinion on that? You guys are asking hard questions, I don't have quick answers to. I think it's really unfortunate when something like that happens. I don't think there's necessarily anything to do per se in social situations especially when dealing with somebody who's a sexual harrass. Like a consistent sexual harasser, you lean on the whisper network which is people sharing information amongst one another. I'm not going to say that that's appropriate in free software communities especially if you're looking to have a more professional context in your interactions but that's certainly something some people do in some situations. But your question, something that you also mentioned very early about when something is brought up, there is always this kind of fear to make mistakes but mistakes do happen and the important part is how you react to being pointed out that you have made a mistake. And like you said, most often after time it's just, okay I wasn't aware of that, thanks for letting me know and move on from there and that's the most appropriate reaction to being pointed out that you've done a mistake and that's in most of the times the cases, it works just like that and that's the way to work with other people. Yeah, totally. I'd like to ask if anyone here has something pointed out to them that they handle it with aplomb, that they're calm about it, that they take feedback constructively. I see another question, Aran Schert. Well, WN is a pretty large project. Yes. How would you go about organizing all this for a small project or event? I would suggest actually doing basically the same kinds of things you want to have a team of people, especially you want to have a diverse team because if a woman is sexually harassed she might not be comfortable talking to a woman. If a man is, or she might be more comfortable talking to a woman than a man, if a man is sexually harassed, he might be more comfortable talking to a man than talking to a woman. So you want to have a diverse team, it's fine if your team is small. You want them to be empowered to talk with people. You want them to take in incidents in the same way. You'll just be dealing with a much smaller community of people and a smaller pool of who will be involved on both sides. I really, really strongly recommend talking to Sage Sharp for your events especially if you're looking to have training on incidents response. They do an amazing job and I learned so much from them. Is that it? Time? Time?