Critical infrastructure II
summary of things discussed on the previous session
whats critical infra to you?
organized postits
how we can be fill gaps collectively? solidarity, backing up each others
backups and humans are the most critical sticky notes
where do we store backups, do we host each others? policies
what are the challenges for small teams? burnout, training, mentorship
continue raising these questions and what we need to do together as a network
coffee and tea as critical infra
take a look at the other categories. there's a random column for things that didn't fit yet
funds, dns, comms internal / external
what's the goal of this session?
the outcome is to have clarity of blockers for each category so we can take these conversations online
is it storage or a computation abstract?
it's easier to look into technical issues, but human and legal matters its harder for us.
it'd be better to focus on what's harder for us now
do we want to think in terms of threat models? technical threats and humans wear out
the most common threat model we've seen is malicious third parties attacking individual members
it's hard to build day to day governance with spread out networks
education is different matter from legal and mental health
do we keep on the human matters? show of hands
the human element is emergency preparedness like having an accident and how we respond to it
what are the bottlenecks let's identify them
two big categories from the human issues are mental health and...
moving sticky notes to more specific sub categories
[...]
add self care (eating, resting) to the incident response policy / plans
the longer you go without a break the longer will the issue be solved. common understanding that we need breaks to be responsive
who's isolated, who has a partner, a pet, what's their support network
meal train!
check on (ask or talk beforehand), ping me.
order pizza
when someone's on call let them go to sleep, even if some things are down
one subject matter expert. have an accountability buddy even from another organization.
channels that are always on (irc) where you can pop in
take advantage of timezone differences
calling is more instant than email
have checklist templates, including wellness checks, so you don't have to add it during the incident
it's hard to come up with a checklist when it's not your area of expertise. don't ask chatgpt!
can we have common templates?
when several people are passionate about a topic, start a working group so they can document for others. otherwise we don't have time.
creative commons baseline
there's corporate experience in this even
sometime it's volunteer time so be mindful of it
blockers on skill sharing
we're very good at offering skill sharing but they often go undocumented
start a small low stakes projects to build trust
notes are documentation too but not everyone takes them and it's invisible gendered work
staff for taking care of steps, minute taking, scheduling, checking in, should be paid labor
a coordinator is a secretarial role and lightweight governance, things get done. stewardship. what's the cost of it. let's think concretely how many hours it'll take, and think it as a cost for participating. some clock the time of participating.
stewardship / secretarial vs benevolent dictatorship. good willed people how's going to burn out or power hungry assholes. who's attracted to these roles.
diverse working groups (who are stakeholders)
it's a lesson of the last eight years that we're trying to put a bunch of structure before starting the work. and the work has been started already. low stakes projects don't need the funding that we didn't yet get, and it helps build trust.
who's just starting from version zero?
quick small scale thing to prototype trust and governance
term limits to avoid power concentration and burn out
build best practices lists
have a two person team so we have rotation and mentorship. we don't need to follow the model of the non profit industrial complex. think differently like an apple commercial.
resources and knowledge are decentralized, everyone's doing their own thing. corporate does it centrally. on a network like this we need shared perspectives.
find a baseline of collectivism before starting a (governance) conversation
there's a survey of the stack each organization is using. who can help with a specific technology.
remote model and management (rmm)
we're already have some collectivism within infrared how can we formalize it beyond the mailing list
standardization could get weird. we share information about the things we use or are custom made in the most minimal way they could serve their communities. some collectives are doing totally differently. corporate standards are very heavy
embrace that we do things differently
enable a lightweight model to support each other on what we can share
not a particular software but you have a policy on backups, monitoring, etc. take stock of how we deal with this.
not standardization of tools, but the principles
also enable skill sharing on common things
standardization also means we have the same vulnerabilities
some level of interoperability
sharing of the abstract and the mutual support. the mailing lists has an archive we can go back to.
start doing things concurrently
can we find a channel that used to be irc?
we talked about a discourse instance.