IRC office hours/Office hours 2012-07-18a

[4:30pm] siebrand: Welcome to the Wikimedia Foundation office hours on "The future of e-mail usage in Wikimedia projects" of July 18, 2012.
[4:30pm] siebrand: This meeting lasts about an hour and will end at 17:30 UTC.
[4:31pm] siebrand: We don't have too much structure prepared for this meeting.
[4:31pm] siebrand: I would like to ask you to ask questions to me using a private message; I'll make sure questions are dealt with "first in, first out".
[4:31pm] siebrand: Please resist the urge to make off-topic remarks, greetings, etc.
[4:31pm] thekaryn joined the chat room.
[4:31pm] siebrand: This will ensure we will have the most effective and focused discussion.
[4:31pm] siebrand: Thanks for your understanding.
[4:31pm] siebrand: I'm keeping some notes at http://etherpad.wikimedia.org/office-hours-email. You're welcome to join.
[4:31pm] • IShitowed raises an eyebrow
[4:31pm] siebrand: As we wrote in the invitation, the Wikimedia Foundation features, product, design and legal teams want to discuss with the community how they see they use of e-mail in the future.
[4:31pm] siebrand: This is because we expect that new features will increasingly make more use of e-mail as a way to contact and engage new, current and previously active users.
[4:31pm] siebrand: Two concrete recent developments sparked this office hours:
[4:32pm] siebrand: 1. Erik Moeller's presentation "The purpose-driven social network" at Wikimania (slides: http://wikimania2012.wikimedia.org/wiki/File:Wikimania_2012-WikiProjects.pdf )
[4:32pm] siebrand: and
[4:32pm] siebrand: 2. the recently developed TranslationNotifications extension that had some delay in deployment because of legal concerns (https://www.mediawiki.org/wiki/Extension:TranslationNotifications )
[4:32pm] Krinkle joined the chat room.
[4:32pm] siebrand: You probably all know how web sites like Facebook and Twitter engage users and pull them back in after some inactivity by sending them e-mails with information that may be relevant to them.
[4:32pm] siebrand: We think these feature are a must for the future of Wikipedia, and we recognise that some of our users may have strong reservations to these feature.
[4:32pm] siebrand: So we want to make sure that when we start implementing, we so that (a) within the limits of the law and (b) ensuring that users that do not want to get e-mail, or only want as little as possible of it, can indicate that in a clear and quick way.
[4:32pm] siebrand: we so -> we do
[4:33pm] siebrand: well, that's the introduction… How can we continue?
[4:33pm] jorm: Can we elaborate on the legal concerns?
[4:33pm] kkay: Hi, this is Kelly, the Deputy general counsel
[4:34pm] siebrand: kkay: can you tell a little more about e-mail and the law? :)
[4:34pm] kkay: I can try and provide a brief outline of the legal things we have thought about
[4:34pm] kkay: First we need to be clear with users when we collect email addresses how we may use them.
[4:35pm] Risker joined the chat room.
[4:35pm] kkay: Second, we need to have a process to collect and manage opt outs, should people change their minds
[4:35pm] kkay: We currently do not have a very clear policy on these things, since we usually do not collect/require emails.
[4:36pm] kkay: so any conversations here need to include a process to manage this int he future.
[4:36pm] kkay: that is about it as a base-line from legal
[4:36pm] schiste joined the chat room.
[4:37pm] aschmidt: I think you should ask for permission before sending such emails to inactive users.
[4:37pm] jorm: We already send email notifications to people when they have new messages in LiquidThreads, or when they have a modified talk page.
[4:37pm] siebrand: kkay: As far as I can tell, we "collect" e-mail addresses in two ways already at the moment:
[4:37pm] jorm: how is this different?
[4:37pm] JKL1234- left the chat room.
[4:37pm] pginer joined the chat room.
[4:37pm] siebrand: 1. In MediaWiki for notifications and password resets.
[4:37pm] siebrand: 2. In mailing lists.
[4:38pm] jorm: 3. Bugzilla
[4:38pm] siebrand: Both of these features have very little "legal babble" around them (indeed, jorm).
[4:38pm] Krinkle left the chat room. (Quit: Krinkle)
[4:38pm] Beria joined the chat room.
[4:38pm] kkay: So, mailing lists are governed by separate policies, they are not governed by the mediawiki privacy policy and mailman handles the opt out
[4:38pm] jorm: (I am extremely curious about this, because Project Echo will depend heavily on email notifications)
[4:39pm] Fajro joined the chat room.
[4:40pm] kkay: One point 1, these two items are administrative in nature.
[4:40pm] xlorm joined the chat room.
[4:40pm] jfelipe left the chat room. (Remote host closed the connection)
[4:40pm] Theo10011 joined the chat room.
[4:40pm] kkay: Depending upon what you might decide you want to use email addresses for, all we need to do is be clear with the users upfront so they have knowledge of what we intend to contact them about so it does not feel like SPAM.
[4:41pm] aschmidt: Yes, you should ask for permission before sending such emails to inactive users.
[4:41pm] aschmidt: Because we are not Facebook.
[4:41pm] jorm: So, we can do this with new users, but what about existing users, if we add functionality that emails?
[4:41pm] aschmidt: Switch it off by default.
[4:42pm] xlorm left the chat room. (Client Quit)
[4:42pm] kkay: We can work with the teams building this feature to develop a method to get consent from new users, which is of course easier then existing users.
[4:42pm] aschmidt: And give a hint in a site notice to the new feature. They can activate it if they like.
[4:42pm] tychay joined the chat room.
[4:42pm] DarTar joined the chat room.
[4:43pm] tychay: Sorry, this is tewwy. For some reason the cloak stuff is keeping my normal client from connecting :-)
[4:43pm] jorm: lern2irc, tychay
[4:43pm] kkay: Existing users we can look into different methods to ensure proper notice is provided and there are means of opting out.
[4:44pm] aschmidt: kkay: Sorry, the whole thing should be opt-in in the first place, for all users.
[4:44pm] jorm: That's not going to happen, though.
[4:44pm] siebrand: aschmidt: I don't think that will work...
[4:44pm] tychay: jorm: I'm still in the melvin center in D.C.
[4:44pm] kkay: I expect that opt in verses opt out is something to be part of this discussion.
[4:44pm] siebrand: aschmidt: we have to make it easy to disable, but we have to make certain that we provide useful info in the mails.
[4:45pm] siebrand was granted voice by ChanServ.
[4:45pm] kkay was granted voice by ChanServ.
[4:45pm] jorm: Yes. And email engagement is pretty necessary for several of our projects going forward. Especially with new users who don't even know they have a preferences system.
[4:45pm] Fajro: Hi. There is a wiki page with proposals about this subject?
[4:45pm] kkay: I am interested in what the community's expectations are.
[4:46pm] siebrand: Fajro: This topic is still very, very young. I organized an office hours about it, because I thought that not addressing it now, might lead to issues later.
[4:46pm] Theo10011: Hello.
[4:46pm] schiste: Why not sending a first informational email when a new functionnality is activated. It wouldn't, imo, be perceived as spam.
[4:46pm] Ironholds: I'd say, as an editor, that I don't particularly object to emails *as long as I find them relevant and useful*
[4:46pm] aschmidt: kkay: well, i am part of the community, and i say, it's a no-go to make such a feature opt-out.
[4:46pm] Maryana joined the chat room.
[4:46pm] Ironholds: but having said that it was a massive shock when the first "MediaWiki mail" message turned up in my inbox
[4:46pm] Fajro: +1 to a first email to all.
[4:46pm] Ironholds: I hadn't known that was going to happen
[4:46pm] siebrand: Fajro: There's an ether pad for this office hours. Content can of course be moved to wiki later if so desired: http://etherpad.wikimedia.org/office-hours-email
[4:47pm] Fajro: Add it to the topic please.
[4:47pm] siebrand: Also remember that we've only recently (mid last year?) enabled e-mail notifications for all Wikimedia wikis.
[4:47pm] Ironholds: siebrand: reading up I think that office hours is a great way of soliciting initial feedback but probably not a great way of trying to smoothe the way to acceptance, but that's a work thing ;p
[4:47pm] StevenW left the chat room. (Quit: AndroIRC - Android IRC Client ( http://www.androirc.com ))
[4:47pm] jorm: I'd say that we are all part of the community, btw.
[4:48pm] siebrand: Ironholds: I don't expect this to be resolvable in one hour.
[4:48pm] siebrand: kkay: There's a question from James_F: Does WMF have to deal with e-mail as a whole, or does each site count independently? E.g. if I click a link saying "never send me any e-mail again", does this legally apply just to the project or do we have to synchronize across all our wikis and non-wiki products (e.g. Bugzilla).
[4:48pm] StevenW joined the chat room.
[4:50pm] preilly joined the chat room.
[4:50pm] aschmidt: siebrand: in this regard, i think we should have both, a global switch and a switch for each project
[4:50pm] kkay: At this time, I do not believe opt outs are linked across software. People can opt out from individual non-wiki and wikis.
[4:50pm] • James_F nods.
[4:51pm] siebrand: kkay: That's not the question (if they are technically linked). SHOULD they be linked in a strictly legal sense?
[4:52pm] kkay: They do not need to be since users sign up for software separately and manage those interactions separately.
[4:52pm] siebrand: IIRC Wikia has a "get me off all your e-mail stuffs" button.
[4:52pm] siebrand: kkay: okay. Thanks.
[4:52pm] siebrand: James_F: Does that answer your question?
[4:53pm] siebrand: So for TranslationNotifications, with regards to e-mail, we've chosen the following approach:
[4:53pm] jorm: Okay. Say that we have a "do not email me again" switch. And I click it. And then I forget my password, and ask for a reset. Does that asking for a reset constitute permission to email me?
[4:53pm] James_F: Right, OK.
[4:53pm] siebrand: If you want to get e-mail, you can get that "all the time", once a week, once a month, or monthly/weekly digests.
[4:53pm] • James_F runs to a meeting (sorry).
[4:53pm] James_F is now known as James_F|Away.
[4:54pm] varnent left the chat room. (Quit: nighty nite)
[4:54pm] siebrand: jorm: sounds like a temporary opt-in to me...
[4:54pm] jorm: me too, but you never know.
[4:54pm] DarTar: siebrand: +1
[4:54pm] varnent joined the chat room.
[4:54pm] varnent left the chat room. (Changing host)
[4:54pm] varnent joined the chat room.
[4:54pm] xlorm joined the chat room.
[4:54pm] tychay: I don't think systems hold password reset requests under the same communication privs as the other stuff.
[4:54pm] kkay: One option that some companies use, is an opt out for non-admin emails. Meaning we can contact a user if they need to reset, or for mandatory admin notices like TOU updates….but not for other non-critical communications.
[4:55pm] jorm: i can just see us requiring a 17 paragraph legal notice on the password reset screen.
[4:56pm] kkay: I would try and make it simple :-)
[4:56pm] tychay: Normally they distinguished between user-generated and site-generated e-mail. I believe password reset requests are considered user-generaated (as would usage of Special:EmailUser
[4:56pm] thekaryn: I would think we'd want to offer email preferences by category so I can opt-in to emails useful to me (e.g. I like my watch list change emails)
[4:56pm] kkay: I like a preferences option as it allows an individual to control how and when we contact them.
[4:57pm] schiste: when you ask for your password to be reseted.. well you voluntarly ask for it. Opt-in / opt-out regards mail sent without you specificaly asking for it.
[4:57pm] Fajro: It seems ridiculous to me discuss about the password recovery emails now.
[4:57pm] schiste left the chat room. (Read error: Connection reset by peer)
[4:57pm] DarTar: I strongly support the idea of granular opt-in / opt-out - there's a serious risk that someone opting out globally because of a single, annoying type of email notifications will just stop receiving any notification
[4:58pm] aschmidt: DarTar: this would not be a risk, but his will, his choice. we have to respect that
[4:58pm] tychay: It's one thing to agree to support granularity in software and another to be tied to it by a legal requirement.
[4:58pm] siebrand: Okay, next controversial suggestion :).
[4:59pm] siebrand: kkay: StevenW asks: If we have a more robust opt-out system, possibly with selective opt-out by feature, would this make us more comfortable with requiring email addresses at registration?
[4:59pm] vbamba: What are the reasons one might want a global opt out?
[4:59pm] James_F joined the chat room.
[4:59pm] siebrand: StevenW is oncerned that the large number of accounts registered that never edit may partially be a product of not requiring email.
[4:59pm] kkay: Whether we collect email addresses is cultural issue, not a legal issue.
[5:00pm] James_F|Away left the chat room. (Ping timeout: 248 seconds)
[5:00pm] tychay: kkay: by law aren't we required to provide opt-out links in notification e-mails? If so, what level is required? (can we make the opt-out link granual for just that type of notification? or must we provide opt out for all notifications?)
[5:00pm] kkay: So long as we make it clear when and how we intend to use the email address, we can legally ask for it.
[5:00pm] aschmidt: siebrand: this is not the case. in any online community some 90 percent of accounts are indeed idle
[5:00pm] StevenW: Thanks Kelly.
[5:00pm] gwicke left the chat room. (Read error: Connection reset by peer)
[5:00pm] James_F left the chat room. (Remote host closed the connection)
[5:00pm] kkay: In certain circumstances you are required to provide for opt out links in emails. This is dependent upon the nature of the email.
[5:00pm] vbamba: So it would be a required field when you sign up?
[5:01pm] kkay: If is it a marketing related email, then yes.
[5:01pm] gwicke joined the chat room.
[5:01pm] James_F joined the chat room.
[5:01pm] kkay: If it is an administrative email you do not need to.
[5:01pm] DarTar: aschmidt: it all depends on how we frame the opt-in / opt-out message, we should definitely respect a decision to opt out globally, but not invite users to opt out globally when they really want to opt out of an individual feature (we had a similar discussion around the global "experimental feature" pref)
[5:01pm] siebrand: okay, we're half way the office hours. I'd like to continue discussion for about 20 mins more, and spend the last 10 minutes discussing follow-up (what, where, when, how, ...)
[5:01pm] kkay: In the most simple legal analysis. There are in between areas.
[5:01pm] tychay: kkay: Thanks! Makes sense.
[5:02pm] jorm: What about an email along the lines of "An article you created has been nominated for deletion."
[5:02pm] aschmidt: DarTar: i think if a user has made it to the preferences he will find out about the difference ;)
[5:02pm] Krinkle joined the chat room.
[5:02pm] Fajro: jorm +1
[5:02pm] jorm: because those are going to be coming.
[5:03pm] schiste joined the chat room.
[5:03pm] schiste left the chat room. (Changing host)
[5:03pm] schiste joined the chat room.
[5:03pm] Fajro: Technically, how you store the passwords so they are safe?
[5:03pm] Theo10011 left the chat room. (Quit: Leaving)
[5:03pm] Nikerabbit joined the chat room.
[5:03pm] Fajro: sorry.. I meant emails..
[5:03pm] siebrand: Fajro: passwords are hashed and salted.
[5:04pm] tychay: aschmidt: However, we should consider providing an "opt-out" from the bottom of a notification e-mail without requiring the user to navigate preferences. ;-)
[5:04pm] jorm: emails are plaintext, no?
[5:04pm] siebrand: Fajro: e-mail addresses are stored as plain text in the user table.
[5:04pm] vbamba: It the email meant to be an aggregate of all notifications?
[5:04pm] Fajro: and how secure is that?
[5:05pm] siebrand: vbamba: maybe, maybe not. Consider some of these Facebook notifications:
[5:05pm] aschmidt: tychay: indeed, you have to provide such a direct link for legal reasons
[5:05pm] jorm: as secure as anything else in the databases.
[5:05pm] jorm: we don't include email addresses in data dumps.
[5:05pm] tychay: vbamba: We haven't decided. In the spec so far, there is no plans to rollup all notifications, only notifications of a given type
[5:05pm] siebrand: 1. Friend's brays next week 2. unseen notifications waiting 3. X replied to your comment, ...
[5:05pm] thekaryn_ joined the chat room.
[5:05pm] jorm: tychay: vbamba is going to be working on project echo.
[5:05pm] tychay: aschmidt: Apparently we do not unless it is a marketing e-mail. But it is good to provide it.
[5:05pm] MelBee left the chat room. (Quit: Textual IRC Client: http://www.textualapp.com/)
[5:05pm] pginer: If restore password by email is possible, security depends also on the e-mail provider.
[5:06pm] HaeB joined the chat room.
[5:06pm] tychay: jorm: I would think vbamba would be doing a lot of Echo's UI/UX. (This web-based IRC client is terrible, not not so terribly that I can't use /whois ;-))
[5:07pm] Platonides joined the chat room.
[5:07pm] aschmidt: tychay: I recommend you provide a direct link to users in Germany as "marketing" and business etc. are understood very vaguely here
[5:08pm] thekaryn left the chat room. (Ping timeout: 240 seconds)
[5:08pm] thekaryn_ is now known as thekaryn.
[5:09pm] siebrand: (I have to move rooms; my connection may drop)
[5:09pm] tychay: aschmidt: I don't know German law, kkay can provide that reference (in the U.S. the term is defined in the CAN-SPAM act)
[5:09pm] aschmidt: tychay: try to search for the terms "geschäftsmäßig" and "werbung" in German, if you like
[5:10pm] aschmidt: tychay: the line of demarkation between a business website or service and a strictly personal one are rather vague and hard to figure out
[5:10pm] kkay: In this case, I do not think there will be a clear legal one, it is about people's expectations on how we will use their email when they provide it to us. I recommend we work out what we want to do technically, and work the legal requirements into it.
[5:10pm] tychay: aschmidt: Again, this is for kkay. For me, I'm just the engineer building this
[5:10pm] siebrand: aschmidt: I think it's probably not a good idea to flesh this out now. Being from NL, I understand where your questions are coming from.
[5:11pm] fabriceflorin joined the chat room.
[5:12pm] tychay: But there is a difference from my end between being legally required to do something and doing it because it's the right thing to do (I agree with you, opt-out inside e-mail is the right thing to do, btw)
[5:12pm] aschmidt: siebrand: thanks.
[5:14pm] kkay: I encourage you to talk to me as you design the program so we can do the "right thing" and also comply with the law. It does not make sense to build something that complies to the letter of the law, but upsets the community or does not meet our technical requirements.
[5:14pm] tychay: siebrand: I'm worried that the UI/UX for notification opt-out (especially in preferences) is a combinatorial explosion (type * endpoint (e-mail being one of them))
[5:14pm] siebrand: tychay: yes. We need great UI/UX design :)
[5:15pm] tychay: siebrand: I don't want to resort to the Facebook approach of overwhelming the user with options to create a situation of learned helplessness. :-)
[5:15pm] jorm: we need global preferences, actually.
[5:15pm] siebrand: jorm: that, too.
[5:15pm] jorm: afk a sec. cat puked.
[5:15pm] tychay: jorm: Yes, we'll need that at least to allow the user to manage these notifications.
[5:15pm] siebrand: kkay: does our legal scope with regards to e-mail in any way go outside of the of the US?
[5:15pm] tychay: siebrand: 15 minutes.
[5:16pm] vbamba: The preferences also have to feel easily manageable
[5:16pm] siebrand: kkay: I'm asking this because there are a lot of rules wrt to e-mail in European contries.
[5:17pm] kkay: It is a complex question. We have global users and we try and meet their expectations with regards to privacy, but we are a US based company.
[5:18pm] kkay: So thought US law governs we try and take into account international rules as well.
[5:18pm] kkay: sorry typo
[5:18pm] kkay: Although
[5:19pm] aharoni joined the chat room.
[5:19pm] siebrand: kkay: okay. Clear enough. It looks like the consensus may be that we add opt-out to all e-mails (per tychay), which I think satisfies the most requirements.
[5:20pm] siebrand: -/- the
[5:20pm] schiste left the chat room. (Ping timeout: 245 seconds)
[5:21pm] siebrand: Okay. We have 10 minutes left.
[5:21pm] siebrand: I think we should move on to "what's next".
[5:21pm] siebrand: Any proposals?
[5:21pm] schiste joined the chat room.
[5:21pm] schiste left the chat room. (Changing host)
[5:21pm] schiste joined the chat room.
[5:22pm] siebrand: A topic page with design accompanied by a discussion on meta seems the most standard way to move forward.
[5:22pm] siebrand: +1/alternatives?
[5:23pm] siebrand: The topic page should probably be curated by UI/UX designers and legal.
[5:23pm] Fajro: What format would the emails be?
[5:23pm] aschmidt: Fajro: plain text, of course
[5:23pm] siebrand: Fajro: plain text + HTML, probably.
[5:24pm] siebrand: but that can be discussed on-wiki.
[5:24pm] aschmidt: many new users do not provide e-mail addresses in the first place, so you cannot contact them at all
[5:25pm] jorm: The emails will be plain text + html, with a possible option for "plain text only"
[5:25pm] aschmidt: jorm: thx, please add this option for plain text only, would you?
[5:25pm] jorm: Now, can we bikeshed about which wiki to have the conversation on? Meta? Mediawiki?
[5:26pm] jorm: en.wikt?
[5:26pm] Fajro: meta
[5:26pm] aschmidt: jorm: all communities should be contacted on their own wiki
[5:26pm] aschmidt: and in their own language, please
[5:26pm] siebrand: https://meta.wikimedia.org/wiki/Future_e-mail_notifications ?
[5:26pm] jorm: We can't do that, aschmidt.
[5:26pm] aschmidt: only a small minority will get to meta wiki
[5:27pm] jorm: we can maybe ask local admins to run a site notice that points people to meta.
[5:27pm] siebrand: We can ask ComCom to mention this discussion in the Wikimedia highlights.
[5:27pm] jorm: but we cannot possibly have a legal conversation spread over 280 wikis.
[5:27pm] aschmidt: and only a minority is able to discuss this in English
[5:27pm] tychay: jorm: the irony is if we had notifications working, we could (Delta "in their own language") :-D
[5:27pm] tychay: meta is probably ideal
[5:27pm] jorm: inorite?
[5:28pm] gwicke left the chat room. (Read error: Connection reset by peer)
[5:28pm] mabdul joined the chat room.
[5:28pm] siebrand: I've created https://meta.wikimedia.org/wiki/Future_e-mail_notifications
[5:28pm] gwicke joined the chat room.
[5:28pm] siebrand: Not much content yet.
[5:29pm] jorm: afk to nominate siebrand's new page for deletion as "off topic"
[5:29pm] siebrand: Is there someone who can send me the IRC log?
[5:29pm] siebrand: Please respond here. One log will do :) ( siebrand AT wikimedia.org )
[5:30pm] siebrand: Okay, it's about time to end this.
[5:30pm] kkay: I am not sure this is a legal discussion. So we need to be careful to frame it correctly.
[5:30pm] siebrand: kkay: We'll try and make sure that's done. Keeping the legal paragraph clear will help with that.
[5:31pm] siebrand: kkay: So I'd like to ask you (as in "legal") to contribute that. Is that okay?
[5:31pm] kkay: sure
[5:31pm] siebrand: Thanks everyone for participating.