Beitrag · Bonfire community

@liaizon@social.wake.st · vor 4 Monaten

RE: https://social.wake.st/@liaizon/116206925371202010

UPDATE: they have dropped Persona!
---
I didn't want to be break this story over here but since no one else seems to be posting about it here I am sharing a screenshot from the other side with @scan's post.

"I find it funny how @oscollective.org says "dedicated to creating a healthy ecosystem to sustain open source technology for the future" in their bio, yet they have the balls to tell a maintainer of an MIT license project to complete a KYC process using Persona..

Yes, that Persona..." — "I find it funny how @oscollective.org says "dedicated to creating a healthy ecosystem to sustain open source technology for the future" in their bio, yet they have the balls to tell a maintainer of an MIT license project to complete a KYC process using Persona.. Yes, that Persona..."

40

4

Wouter Tebbens ⁂

@Wtebbens@social.coop · vor 4 Monaten

OpenCollective responded to our collective concerns about identity verification and halted their use of Persona. I'm really happy to see this reaction by @opencollective -
https://opencollective.com/opensource/updates/on-kyc-checks-and-persona

Thanks to @liaizon to raise the alarm bells and so many who spoke up in this rather sensitive matter - people do need the money for their communities, but we need to have more control over the process. OpenCollective and @Liberapay are important actors here for the ecosystem.

Of course much concern remains for the reliance on US law (OpenCollective) and all credit card payment providers are under US control. Recall what happened to the ICC judges? So we need to work towards more reliable systems under our control.

To be continued. The @fkinstitute and the DemocraticTech.Fund will be working with these concerns in mind.

On KYC checks and Persona - Open Source Collective

As a nonprofit fiscal host, OSC supports over 2,500 open-source projects worldwide. Last year, as part of ongoing improvements to our risk and compliance processes, we began verifying the identity of users requesting payments when: When we...

@Gina@fosstodon.org · vor 4 Monaten

@liaizon @scan happy to read the update 😊🎉

@liaizon@social.wake.st · vor 4 Monaten

@Gina @scan thanks for the message! yeah its like the tiny bit of positive news slipping thru the cracks today!

@fbinin@mastodon.fbin.in · vor 4 Monaten

@liaizon @Gina @scan
They have "halted" and not dropped them per their sentence.

@ProcessParsnip@mastodon.ie · vor 4 Monaten

Hans-Christoph Steiner

@eighthave@social.librem.one · vor 4 Monaten

@liaizon @scan Persona probably makes it really easy to integrate. OpenCollective needs to solve a real problem. The best approach here is to help find and integrate better systems since they seem open to other options.

@ohir@social.vivaldi.net · vor 4 Monaten

@liaizon @scan
> you can see directly how much @OpenSourceCollective is paying to use Persona

I am more interested in the reverse flow. As I just can not imagine someone within the FLOSS environment did not due dilligence about "third party contribution". The first page of nojs DDG search is full of "persona" warnings so it flashes.

@poohlaga@mastodon.social · vor 4 Monaten

@liaizon @scan Hi, Lauren here. I'm the ED of OSC and happy to chat. In this expense, the payee was presented with options that would not require a KYC with Persona; they confirmed, so we will be able to pay them through this method. KYC's are a rare edge case for us and are not issued on all expenses.
I will publish a general statement on the OSC updates page - but yes. We started using Persona before the news broke. We are currently looking for non-US providers and are open to suggestions.

@liaizon@social.wake.st · vor 4 Monaten

@poohlaga hi Lauren, sorry to make your acquaintance on such an unpleasant matter. While I am glad to hear that you are using them only in "rare edge cases" it seems that their API is getting directly integrated into Open Collective's code base (https://github.com/opencollective/opencollective-frontend/pull/11988)

I think for the present moment there needs to be a very clear statement about *exactly* how you are using Persona and what data and what edge cases would end up triggering you to initiate sending *any data* to their API.

@poohlaga@mastodon.social · vor 4 Monaten

@liaizon Regarding edge cases, the most common are when we are unable to verify the payee's identity or when they are in a jurisdiction flagged by US sanctions. Roughly .005% of expenses each month are flagged. Additionally, for each flagged expense, we communicate what is blocking us from moving the payment forward and offer alternatives so we can resolve the issue in a way the payee also feels comfortable with.

@poohlaga@mastodon.social · vor 4 Monaten

@liaizon Yes, I have a draft response on how we intend to use the platform connection, but I'd like the engineers to review it for accuracy, as the feature is still in development.
I will say it was fundamental for us that any personal data entered in Persona remain in Persona and any user information on the platform remain on the platform. We are not passing any user data from the platform to Persona. And if a user elects not to do our KYC with Persona, then we do our best to find another way.

@liaizon@social.wake.st · vor 4 Monaten

@poohlaga the statement "We are not passing any user data from the platform to Persona" makes no sense in this context. You are integrating Persona's API into the platform. You are paying money to Persona to process the personal data of people on Open Collective. Why are you even considering using Persona at all? Using them is antithetical to every point that Open Source Collective lists in your "Values"

1 weitere Antworten

Larven fra helvede

@abekonge@venner.network · vor 4 Monaten

@liaizon Ok let's talk strategies for push back - we gotta stop this! @jowek @ukrudt @tak @ruben @magnus

Making an angry github issue?

Making a petition signed by a lot of collectives?

?? what else?

@liaizon@social.wake.st · vor 4 Monaten

@abekonge @jowek @ukrudt @tak @ruben @magnus
the chair of the board of directors of F-Droid just responded to my tag here seemingly in agreement
https://social.seabass.systems/@seabass/statuses/01KKHX2849AKSRJSVSN5C04TXP

I would say that the MAJORITY of 2714 collectives that OSC fiscal host has would be entirely opposed to being subjected to having to have their personal data sent to Persona. A large majority of them have a presence right here so tagging projects seems like it would definitly stir shit up.

@liaizon@social.wake.st · vor 4 Monaten

@abekonge @jowek @ukrudt @tak @ruben @magnus

An open letter where people can sign their project names about their disapproval of this would probably be a good start though you are right. I wonder what the best way to host that would be?

Larven fra helvede

@abekonge@venner.network · vor 4 Monaten

@liaizon @jowek @ukrudt @tak @ruben @magnus

Yes haven't checked out the state of petition-software lately.

One low effort/complexity way of doing it would be to write a letter in ukrudt's hedgedoc and just ask projects to sign it if they agree - sign it by way of writing their name in the bottom: https://hedgedoc.ukrudt.net/ - we can then create a public read-only link and share that.

1+ weitere Antworten

@havchr@mastodon.gamedev.place · vor 4 Monaten

@liaizon @scan The First Person project is needed quickly. TLDR , proof of identification without breaching privacy. Linux Foundation is the first test case for it to avoid Jia-Tan-like attacks. Why OpenCollective needs the identity verification provider in the first place though, what are they using it for?

@nullagent@partyon.xyz · vor 4 Monaten

I work with an NPO which currently uses Open Collective and likely would vote to stop using Open Collective if this level of corporate doxxing is required to interact with their platform.

Don't dare open source hackers, we can switch/build services in a heartbeat.

We are not trapped like teenagers hooked on discord, we can simply leave and never look back if forced.

@mosttoast@bostonmusic.online · vor 4 Monaten

@nullagent @liaizon @scan wait, is that Open Collective, or Open Source Collective? Are those the same?

@liaizon@social.wake.st · vor 4 Monaten

@mosttoast @nullagent @scan
They are different. Open Collective is the software, Open Source Collective is the US based fiscal host of many projects in OC but not the only host. There is also Open Source Europe which is the other big fiscal host that is on OC.

@liaizon@social.wake.st · vor 4 Monaten

Open Collective is adding KYC from Peter Thiel backed Persona. If you are not familiar with Persona: https://www.openrightsgroup.org/press-releases/roblox-reddit-and-discord-users-compelled-to-use-biometric-id-system-backed-by-palantir-co-founder-peter-thiel

Here is the github issue where its being worked on:
https://github.com/opencollective/opencollective/issues/8609

an item on a list that says "Connect OSC with Persona" with a check mark. OSC is one of the biggest fiscal hosts on Open Collective

Open Rights Group

Roblox, Reddit and Discord users compelled to use biometric ID system backed by Palantir co-founder Peter Thiel

Following global pushes for age assurance by governments, Persona is increasingly being used by major online platforms to carry out biometric age checks.

@jdp23@neuromatch.social · vor 4 Monaten

@liaizon yikes! thanks for getting the word out about this!

@liaizon@social.wake.st · vor 4 Monaten

@jdp23 your welcome, I wish I didn't have to be in the position to be posting about this at all. But open collective is super important as a funding source and the one that so much of the fediverse relies on. I think we really need to convince them to change course on this.

@malte@anticapitalist.party · vor 4 Monaten

@liaizon what is kyc? kiloyardcentimeter?

@opsocket@mamot.fr · vor 4 Monaten

@liaizon what's up @Betree ?

Benjamin Piouffle

@Betree@framapiaf.org · vor 4 Monaten

@opsocket @liaizon copy-pasting the reply I've made on the Github issue:

We (opencollective.com) are agnostic to the KYC provider that fiscal hosts use. Our integration was built primarily as a manual KYC tool, and you can use any backend you want - or even run your own program.

Benjamin Piouffle

@Betree@framapiaf.org · vor 4 Monaten

@opsocket @liaizon

We're indeed adding a persona integration on the platform to help Open Source Collective manage their KYC program. It is not something we're forcing on anyone, just a bridge we're creating for fiscal hosts relying on this service.

For the rest, I'll let Open Source Collective comment.

They're aware of this thread and are preparing a reply as we speak.

Haelwenn /элвэн/ :triskell:

@lanodan@queer.hacktivis.me · vor 4 Monaten

@liaizon Kind of wonder if it'll be legal on the non-US side of things (like in regards to GDPR) as that could add legal backing to opposing it.

@liaizon@social.wake.st · vor 4 Monaten

@lanodan I can't imagine how all of this sort of sharing of personal data with "partners" would work in a legal sense but it sure seems like its common in Valley startups

Christine Lemmer-Webber

@cwebber@social.coop · vor 4 Monaten

@liaizon@social.wake.st · vor 4 Monaten

@cwebber for fucks sake I really don't want to be the one to be unloading this sort of horrible news on the fediverse. I would so much rather shitpost about the protocol wars. But no one was talking about this and its so so depressing and they need to change course...

@julian@fietkau.social · vor 4 Monaten

@liaizon Hold on – Open Collective and Open Source Collective are two different institutions, right? But they are both currently integrating Persona? Am I getting this right?

@liaizon@social.wake.st · vor 4 Monaten

@julian Yes. I am very very disappointed.

@liaizon@social.wake.st · vor 4 Monaten

This needs to be acted against NOW. If people on Discord managed to get up in arms enough to get them to chance course, we should be better prepared for then them to make them change course

Here is an @heisec article about Discord trying to distance themselves from this company that Open Collective is now integrating into their platform:
https://www.heise.de/en/news/After-user-protests-Discord-distances-itself-from-age-verification-partner-11188380.html

After user protests: Discord distances itself from age verification partner

The social media platform explains that a "limited test" by Persona in the UK for age verification has ended. Users had complained.

@liaizon@social.wake.st · vor 4 Monaten

I don't know what @opencollective and @OpenSourceCollective are thinking with this move, but this situation needs to be reconsidered. This is going to have a massive blow back when the actual users of Open Collective realize what's going on.

@liaizon@social.wake.st · vor 4 Monaten

I say this as someone who has been actively using Open Collective for many years. Both as a place to donate to projects that I care about, and as a place to collect donations to various projects I have been a member of.

1+ weitere Antworten

@brennen@federation.p1k3.com · vor 4 Monaten

@liaizon @opencollective @OpenSourceCollective yeah, i think i have a couple of donations going to projects this way that i'll probably be forced to reconsider.

@kjv@mastodon.gamedev.place · vor 4 Monaten

Is that red dwarf bluesky appview ?

@liaizon@social.wake.st · vor 4 Monaten

@kjv https://witchsky.app

@kjv@mastodon.gamedev.place · vor 3 Monaten

Are - ActivityPub, Atproto and Nostr the only social web protocols being actively developed ? Is Atproto the more mature/easy to work/use ?

You need to log in to see that page.