[Labs-l] Labs privacy policy questions

[Pine W]

I think the situation with passwords has been clarified. Thanks for that.

However, there is still the matter of Labs users potentially logging and
publishing the IPs of users who access the tool. My impression that this
forbidden by policy but not by technical means. Can the wording of "By
using this project, you agree that any private information you give to this
project may be made publicly available and not be treated as confidential."
be made more narrow to reflect that, in fact, it's not true that "any
private information you give to this project may be made publicly available
and not treated as confidential" unless a tool owner is breaking policy?

Also, I'm wondering what to do about the vulnerability of user IPs being
recorded and tracked. It sounds like there are three options:
1. Use technical means to prevent Labs tools from loading external
resources that could potentially track IPs
2. Prohibit this practice by policy, and run some kind of background check
on tool admins similar to what's done for CUs
3. Keep the status quo of warning users of potential disclosure but not do
much to protect users against improper disclosure.

Finally, it seems to me that the penalty for publishing private information
in violation of Labs policy should involve far more than simply revoking
Labs permissions. I think that this would merit the same kind of legal
action that would likely be brought to bear if a checkuser or WMF employee
did the same thing. There can be real-world consequences for users whose
private information is made public, and therefore I think that it's
appropriate that real-world legal action be explicitly included in the
scope of possible consequences for misconduct of this kind, and I think
that this should be noted in the Labs Terms of Use.

Thoughts?

I'm also looping in Michelle and James.

Pine
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.wikimedia.org/pipermail/labs-l/attachments/20160309/12f7d796/attachment.html>