Healthy open-source communities usually include a wide range of people with very different ideologies, goals, values, and points of view; from anarchists to CEOs of major corporations. The normal approach for making decisions that affect the entire community should be an attempt to reach consensus through discussion. But what if you're attempting to make a decision which is critically important, but for which you know there are irreconcilable differences in the community? The XenProject community had such a decision to make in the wake of the XSA-7 security issue. This talk will cover the approach we took which (we think) allowed us to find a "center of gravity" for the community, and allowed everyone to feel that their viewpoint was considered, in the spite of the lack of any option with clear consensus. We hope this will help other communities navigate similarly difficult waters.

1. Making community decisions
in the absence of consensus
George Dunlap
XenProject Committer

2. [thinking ahead]

4. The Issue

5. XenProject Security Process
• A well-known place to report vulnerabilities
• A structured way of announcing vulnerabilities to users
• A pre-disclosure list

6. Pre-disclosure

7. XSA-7: Intel SYSRET

9. Discussion goals
• Find the best solution
• Do it in a way which everyone felt their voice was heard

10. ONE
Make sure you have a fall-back
in case consensus can’t be reached

12. Process isn’t necessary —
until it is

13. ONE
Make sure you have a fall-back
in case consensus can’t be reached

14. TWO
Have an online discussion
but don’t stop there.

15. Online discussions are great for…
• Identifying important factors
• Clarifying thinking
• Exploring possible solutions
• Understanding implications, pros and cons of different
options

16. Online discussion: Weaknesses
• Favor people who…
• Like to argue
• Are articulate, have a high command of English, or type quickly
• Sociological: Favor people who…
• Feel like they’re in the “in” crowd
• Think their opinion will be popular
• Hide silent agreement

17. Social factors and silent argument :
Debian systemd discussion

19. TWO
Have an online discussion
but don’t stop there.

20. THREE
Summarize the major positions
and hold a five-point survey

21. Four options
• No pre-disclosure
• Pre disclosure to software providers only
• Pre disclosure to software providers and a small number of
public cloud providers
• Pre disclosure to software providers most public cloud
providers

22. Five-point survey
• Based on “Identify the Champion”
• For each option, ask people to rate it:
• This is a great idea, and I would argue for it
• I am happy with this idea, but I would not argue for it
• I am not happy with this idea, but I would not argue against it
• This is a terrible idea, and I would argue against it
• No opinion

23. Further details
• “Other options / comments” box
• Anonymous or named?
• Allow anonymous votes but say votes with a name
attached would be given more weight
• Two-week survey window, announced publicly

24. Outcome
• 33 survey responses
• Only 4 anonymous votes
• Other 29 were a good mix:
• Developers
• Distributions
• Both large and small cloud providers

25. FOUR
Look for the “center of gravity”

26. Things to look for
• Good: Total approval vs total opposition
• Bad: Polarized options, particularly divided by sub-group
• Good: Options that are opposed for opposite reasons

27. No pre-disclosure
This is a great idea
Happy with this idea
Not happy with this idea
This is a terrible idea
No opinion
0 5 10 15

28. Software providers only
This is a great idea
Happy with this idea
Not happy with this idea
This is a terrible idea
No opinion
0 5 10 15

29. Software and large cloud providers
This is a great idea
Happy with this idea
Not happy with this idea
This is a terrible idea
No opinion
0 5 10 15

30. Software and all cloud providers
This is a great idea
Happy with this idea
Not happy with this idea
This is a terrible idea
No opinion
0 5 10 15

31. FIVE
Write up a concrete proposal

32. Recap
• Make sure you have a fall-back if consensus fails
• Have on online discussion, but don’t stop there
• Summarize the major options and run a five-point survey
• Analyze the data to find the “center of gravity”
• Make a concrete proposal based on the findings

33. Questions
Comments / criticism:
George Dunlap <george.dunlap@citrix.com>
References:
XenProject Security Policy (including pre-disclosure list)
https://www.xenproject.org/security-policy.html
Identify the Champion
http://scg.unibe.ch/download/champion/