I have 100% faith in jmakin - and I’ve met him (very briefly) irl and expect/hope to see him again.
2 Likes
Re: what could go wrong. Speaking hypothetically (i.e., I am not speculating that jmakin would do any of this), I can think of some things:
- The admin could completely destroy the site, including the backups, so that restoration would be impossible.
- The admin could extract email addresses and any other identifying or otherwise valuable information from the site database and do anything they wanted with it.
- The admin could do anything on the site, including banning or deleting users, making fake users, forging posts, editing/tampering with posts, and probably other stuff I’m not thinking of.
- In other words, complete and total control of the site, including all the site data (posts and user data), how the site works, who can use the site, what the site looks like, etc.
I’m speaking on a purely technical basis, disregarding any policies, norms, scruples, etc. that might be in place. But as you can see the potential for “bad things” is real.
Note: I want to be clear that I’m not trying to be obstructionist. I understand that zz wants to hand off the site admin responsibilities, and I would like for him to be able to do that. It’s just that the admin role, as I understand it to be structured, is an incredibly powerful one, so we should understand that and be appropriately careful.
2 Likes
As a bulwark against this, some higher up people, like I’m pretty sure ggoreo, know my IRL identity. If not I will share it. It would be professionally damaging to me if I were to cause a problem here, and would likely follow me around.
Agree with all this, but if anything I expect Jmakin to take the responsibility too seriously. I think that is a real danger for him. Anyway, if it ever becomes something that is negatively impacting his life, I expect to be here and willing to do it.
3 Likes
Both of your bullet points are correct. 99% of the time the admin doesn’t need to do anything at all except be on call in case something goes wrong. To date, the only time anything has gone wrong was over a year ago when a certificate failed to renew automatically, which took me about 30 minutes to troubleshoot and fix.
The only two frequent admin tasks are rebooting the server to install updates, which requires typing sudo shutdown -r now; and installing forum updates, which can be done by clicking a button and watching text rapidly scroll by for 10 minutes.
In the event of significant traffic changes or something in the future there may be additional work to accommodate that, or possibly a more involved forum software update. I have had to do both of those and they took a bit more time, but the majority of that time was again just watching text scroll by in a command prompt. The server distro we use (Ubuntu) is very widely used and well maintained, as is the Discourse software itself. There is very little real work to do.
One anticipated change is the need for more block storage which is not difficult, but I can do it a bit earlier than required and before I step down if desired. With that configuration I’d expect no need for any other significant system changes for at least a year or more.
As for security, potential abuse of power, etc. Yes, it’s theoretically possible for any admin to do significant damage if they really want to. One thing worth noting though is that the admin does NOT own the domain name. That legally belongs to simplicitus. And ggoreo (or whoever else is on the hosting team account) can also download a full off-site backup himself.
On top of all that, I can say as somebody who’s done the job for a year and a half that having more responsibility tends to make most people behave responsibly, and also that none of you are interesting enough to have your personal information looked into :)
4 Likes
So, one other thing, and I promise I’m not raising objections for the sake of being contrary, this is a real concern. And also don’t take this the wrong way jmakin. But just a couple days ago you made this post in the About Moderation thread:
I remember seeing more than one similar post from you in the past (I’m not going to go dig them up but if I’m wrong let me know).
So my concern here is the possibility that you get fed up and want to leave, or even just reduce your involvement in the site. I could envision that situation impacting the site negatively in various ways.
I can think of some ways to mitigate the risks along these lines, some of which have just been touched on. But could we talk about that more and flesh it out? Including specifically identifying who could/would be able to step in, immediately if necessary, if you leave the site (and this includes the “getting hit by a bus” scenario that is a risk that we have always been facing and will always face regardless of who the individuals are).
And one final thing… I know I’m probably frustrating some people in this thread right now but I’m speaking my piece…
It’s clear you have some strong opinions about what and how people are posting. Will you be able to resist (as zz has laudably mostly been able to) the temptation to use your admin powers or perceived authority to directly or indirectly influence the site more than any regular member could/would?
I’m asking this question because I’ve been pondering if I should step up and volunteer to take on or assist with this role. And honestly, for me, the answer could well be no, so I think I’m going to hold back for now.
Like I said, please don’t take this the wrong way. These are real questions that I’m asking because I care about the site.
1 Like
I’m a yes because he’s a good person but I’m going to go on the record and say I think jmakin is a bit of a nut.
There’s room for 2 imo and no reason you and jmakin can’t both be on Team Admin.
you don’t need to tiptoe around my feelings, I understand the concerns raised. I have thought about them too.
The drama lately is bugging me but it is trivially easy to tune it out, by just muting entire sections of this forum, which I am likely to do if it does not stop. That is just my personal consumption of the site we’re talking about here. I would treat this role like a job, which maybe isn’t healthy, but it’s how I approach everything in my life.
Regarding what to do if the worst were to happen, we have a backup in ggoreo, and microbet willing to step in. One of the first things I am going to do, which maybe zikzak has already done, is extensively document all the steps and procedures involved in doing this, so it is repeatable even by a monkey in the future. That is what I do for my job - I enable other people to use complex technologies. Even though this seems relatively simple, even for a non-techie - it is daunting, and I would just want to make it idiot proof.
Regarding me abusing mod powers, and maybe it doesn’t reflect well on me, but I am far too lazy and apathetic to do anything malicious like that. And, honestly, I feel I am exposing myself to a little amount of risk on my end.
Like, I have a blog that I keep fairly intimate details of my life in. I write in detail about my mental health (I try to reduce the stigma whenever I can). If I were to do something, if someone in retaliation truly wanted to make my life extremely difficult it would be possible. And honestly that makes me a little uncomfortable. But, I really like this community, and I don’t want to cause harm to it or abuse its trust. If placing a large amount of trust in me is problematic, I can understand that, but I don’t know how else to communicate that I just want to help, I am interested and qualified, and think I am probably one of the best people here for this role.
I am open to any suggestions on how to make this more comfortable for people, I wouldn’t want any distrust. Because that shit sucks.
5 Likes
it is true, but a lot of geniuses were mad
jk
1 Like
Chart of current key roles, if this is helpful to anybody:
| . | zikzak | ggoreo | simplicitus | spidercrab |
|---|---|---|---|---|
| Owns unstuckpolitics.com domain | X | |||
| DNS admin access | X | X | ||
| Active server root access | X | |||
| Potential server root access | X | |||
| Forum Admin | X | X | ||
| Can download backups | X | X | ||
| Controls Patreon and Paypal accounts | X | |||
| Pays the hosting bill | X |
4 Likes
Does the active server root access require forum admin? I imagine no, right? Unless you need to test stuff, maybe. If that makes anyone more comfortable, idk, maybe just remove forum admin from it.
I wouldn’t be concerned about you having forum admin, but if server root doesn’t require it, I don’t think the same person should have it. Jmakin (and perhaps sensibleperson or others) having server root and gregorio (and perhaps others) being forum admin seems perfect to me.
microbet brings this up sometimes and imo it is not practical for those roles to be completely divorced. The only reason we need a server admin is to support the forum, and you can’t do the server admin part very easily if you can’t also access the forum admin stuff. They’re effectively the same job.
What everybody is trying to work around isn’t a technical issue but a power one, and there’s no way to get around the fact that whoever has root access has total access to everything. Even if you’re locked out of the forum software you can take control right back from the command line.
1 Like
Thanks very much for making this post. It has helped me feel much more comfortable about the situation.
I have a few reactions and thoughts of varying relevance, which I’ll intersperse below.
That’s good to hear, and I appreciate you being willing and able to hear this out in an objective and thoughtful way.
Muting stuff seems like it could work; I woke up fretting about the forum this morning and decided to mute the About Unstuck section… Didn’t happen obviously. If you do mute the About section, maybe consider putting the Help thread on Notify, in case there are trouble reports?
The bolded is a fantastic idea and in my thinking about this was something that I would want to have done as well. I thought the handoff process would be a great opportunity to take notes about everything involved that could be fleshed out into real documentation later.
One small thing, can we get ggoreo in here to confirm that he could keep things going if “something” happened?
I think the bolded is about all we can ask from people. I appreciate you being explicit about it too.
Thanks again for the post. I’m comfortable enough now to put my vote in.
3 Likes
The few things that haven’t already been mentioned here are very easy to document. I think people are envisioning things as far more complex than they really are. We run a stock Ubuntu distro and stock forum software with one minor change. In fact, it will be my parting advice to always track current releases and to not do any significant customization.
I think you could add kre8tive to the list. He runs the site’s twitter.
1 Like
Yea, I try to obscure myself. I had to take some measures a few years ago to protect myself. But even so, it feels like a risk to me.
If the list is intended to be comprehensive, we could also possibly add the Google ads account (whatever it’s called, I remember Spidercrab mentioning it) and/or Amazon affiliate account (if still relevant).
Those were under my control and are no longer relevant. Google stole our money and none of the others ever generated anything.