Hi @Paladox I know it since we already talked on IRC, but you should add that you already mailed legal and your question if the volunteer NDA is right and all that.

I can just confirm meanwhile that the LDAP group "nda" is for this use case, volunteers with (some kind of) NDA who should have login to logstash (and some other web UIs).

LDAP NDA access effectively means getting access to private and sensitive information, on multiple servers and services, across the board. As such, it's more than just signing a piece of paper or making a good faith promise; it's about one proving they are trustworthy to handle sensitive information (either ours, or of our users'), to be careful with what they access, to listen to instructions about what to do (and not do) with the information they access, and to think carefully before they act.

I do not think the requestor has demonstrated this kind of behavior in our past interactions, and as such I'm afraid I'll have to object to this request. My objection is final -at least as far as LDAP access goes- but not permanent; if @Paladox demonstrates thoughtfulness and cautiousness in the future, this can be revisited in due time.

I think there's probably other ways we can help Paladox contribute in this area that don't require the nda access - is this just about wanting to view the Gerrit exceptions that are now in logstash?

In T181446#3791114, @Legoktm wrote:

I think there's probably other ways we can help Paladox contribute in this area that don't require the nda access - is this just about wanting to view the Gerrit exceptions that are now in logstash?

That was the impetus yes. Tbh, the vast majority of data in logstash is ridiculously boring and doesn't need to be NDA'd, but let me not sidetrack this discussion.

I was the one who encouraged Paladox to apply for access here as his ability to view log data from Gerrit will greatly benefit everyone -- he's basically my first officer when it comes to the Gerrit :)

Confirmed. This was about Gerrit logs. If there was a way to request "logstash but just Gerrit" then that would have been the request. Paladox is the one who did the majority of the work to move logs into logstash in the first place (to enable volunteers to read them without shell access) and works with Gerrit upstream so i also encouraged him. That said, it doesn't change that the "nda" group does a lot more than that and the permission system is not fine-tuned enough to allow it "per service".

Do we have alerts for Gerrit exceptions? If we could set up IRC alerts (or something else), paladox could follow those and have someone with logstash access look up the traceback for him. It kind of sucks but would at least allow him to continue his work in this area.

In T181446#3791417, @Legoktm wrote:

Do we have alerts for Gerrit exceptions? If we could set up IRC alerts (or something else), paladox could follow those and have someone with logstash access look up the traceback for him. It kind of sucks but would at least allow him to continue his work in this area.

Not right now, but should be much more possible now that we're on logstash.