The commit log will contain most of these email addresses, and LDAP probably has the rest. It's not really possible to prevent this stuff being published in a git-based system on an open source project.

Gerrit is a code review system backed up by git. In git when you do a modification of code, you pack it in a commit which has metadata attached to it, namely the author of the code which is a name and an email address. To send a commit to Gerrit you have to be authenticated and your account has an email address attached to it, Gerrit verify that your account email matches the commit author email, else it rejects it. So in short, the email filled in Gerrit is already public since that is the same that is attached to the git commits!

The email notifications are sent to the owner of the Gerrit change as well as all reviewers. People are on CC so one can eventually reply to the notification email and communicate with all people involved outside of Gerrit. That is probably not so much used though. It also let you know who has seen the message or is currently receiving notifications.

The emails in Gerrit are not going to be hidden or made private at all. Though if that is a concern maybe we could get a large notice when an account is registered stating that the email addressed used for the account will be made publicly available. I think the account registration is done via https://wikitech.wikimedia.org/ so maybe add the message to the registration page as well as in the user preference pan. It might be doable by customizing mediawiki messages on the wiki.

Then please remove me from the gerrit review system.

It may be difficult/impossible to do that without removing you from LDAP which can break all sorts of things, most obviously your labs access

Then tell me how we are complying with the Wikimedia privacy policy.

We are committed to:

  -     Describing how your information may be used or shared in this Privacy Policy.

  -     Using reasonable measures to keep your information secure.

  -     Never selling your information or sharing it with third parties for marketing purposes.

  -     Only sharing your information in limited circumstances, such as to improve the Wikimedia Sites, to comply with the law, or to protect you and others.
  -     Retaining your data for the shortest possible time that is consistent with maintaining, understanding, and improving the Wikimedia Sites, and our obligations under law.

I quickly talked to @Aklapper about it and rephrased the whole task so that instead of being a technical solution (hide emails in Gerrit) it goes to the root cause: people not realizing sending a git patch ends up publishing their email address.

Probably we need to highlight that when users create an account or change their user email (in Special:Preferences).

Then, one can say by that sending a patch in git, they are voluntary disclosing their email address and hence it is not a breach of term of uses / Privacy policy. Then I am neither a lawyer nor an unexperimented user.

+ Privacy in case that pokes the right people to further talk about it. Maybe one can loop in Cloud-Services and WMF-Legal as well ?

@hashar It is not even making a patch. Someone simply adding you into review a patch does it.

In T151529#2822053, @demon wrote:

I've marked your account inactive (so you can't login) and pruned all of the comments you've ever made. There's a change with your name on it, but there's nothing that I can do there, it's git history and permanent (even there, I scrubbed what I could).

That sounds like quite a bit of sysadmin work for one user, perhaps "difficult" was the wrong word though. I'm not happy with the idea of deleting comments, this could mess with context in historical discussions.

In T151529#2822160, @Krenair wrote:

In T151529#2822053, @demon wrote:

I've marked your account inactive (so you can't login) and pruned all of the comments you've ever made. There's a change with your name on it, but there's nothing that I can do there, it's git history and permanent (even there, I scrubbed what I could).

That sounds like quite a bit of sysadmin work for one user, perhaps "difficult" was the wrong word though. I'm not happy with the idea of deleting comments, this could mess with context in historical discussions.

It took me like 5-10 minutes tops, it wasn't hard. I wouldn't worry about it since you weren't the one having to do the work ;-)

There weren't enough comments on anything interesting to matter.

Well that's when it becomes publicly available.

Unless you're saying there should also be a notice when you change your email, though I suspect the registration time one covers it