Skip to main content
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
Re: [dataspace-dcp-dev] [dataspace-protocol-base-dev] How about following the Eclipse Community Code of Conduct also in the Eclipse Dataspace Working Group?
The two security lists are standard features for all Eclipse projects. Access to these lists is intentionally limited per our security policy.

Our open source projects operate in an open and transparent manner. All code is available without restriction, and project communication either occurs or is summarised in public channels. Our project teams endeavour to keep the playing surface level by being open to contribution and by defining a path for folks to acquire additional responsibilities within the project (e.g., move from contributor to committer).

Security and vulnerability management come with some special requirements. The security mailing lists are accessible only to the project committers. This provides them with a means to discuss vulnerabilities before we are ready to disclose them publicly. Project teams are given clear instructions that these lists are for security/vulnerability topics only. This channel allows a project team to, for example, respect a disclosure embargo. We have had lengthy discussions about this. All vulnerabilities, along with a summary of decisions made during mitigation, must be disclosed per our security policy (the timing of disclosure depends on many factors).

There is a path that an individual can follow to gain access to this list: develop a reputation of making high quality contributions to the project, gain the trust of the existing project team, and get invited by the project team to join them as a committer. This is a completely open process.

HTH,

Wayne

On Wed, Aug 13, 2025 at 4:53 AM Javier Valiño <javier.valino@xxxxxxxxxxxxxxxxxxxxxx> wrote:
Dear Detlef,

(Reducing also the list of emails to keep those relevant)

Let me try to answer your questions here, complementing Sebastian’s inputs.

Please refer to the list 1) through 7) mentioned below and kindly let me know, if I missed 
some DCP-related mailing list.
It seems you are referring to project mailing lists. Those are managed directly by the projects. I can see Sebastian already provided more info about DSP. I am sure the colleagues from DCP can also do so.
I can just help you on the EDWG ones (see below)

At which publicly available mailing list was there an announcement for 

1) the existence of RC4 of DCP, 
You can track all releases (not versions) on the Eclipse project webpage, Governance tab. You will see the details of this release in detail here.

2) any request for comments and a related technical specification review, 
There is no need to wait for a release to provide comments to a project. They are open to those anytime using the project tools (in this case Github). 
The DCP release review according to Eclipse rules has been conducted in this open Gitlab issue by our colleagues from the EMO. 

3) any mentioning of a subsequently planned submission as PAS to ISO?
This is not part of the release process for specifications or the project development process for Eclipse. This is an option specification projects in some WGs can use once the release is complete.
Our intention as EDWG to do this has been presented consistently during the past years.
As soon as we start this we will also inform the community.

4) any opening of a ballot to approve such a specification review?
You are right here that we made a mistake on the announcement. As DSP and DCP were our first releases at EDWG, we used to start the voting by mistake the private specification list instead of the public specification one.
The EMO notified us about this and that is why you can see the announcement of the results for both protocols on the right list. Sorry for that.
Anyhow, please note this is just informative, only the strategic members and our committer representative can vote here.

5) any transparent casting of votes related to a technical review and its approval?
The summary of votes and email thread history is included in the message on the already mentioned public mailing list here.

Probably yes, but the minutes systematically refer to additional details and attachments, which 
are unfortunately only accessible to members of the Steering and Specification committees. 
The minutes capture all our discussions and activities. If a reference is included but accessible just for committee members is usually because (1) a member explicitly says this is confidential or (2) it is a discussion in progress that will be kept internal until the outcome is ready, and then published. In both cases, the minutes reflect the essence of the topic, the extra link will point to extended information.

Sorry, but this practice is very questionable, everything else but open and inclusive and hence
certainly not in line with your code of conduct https://www.eclipse.org/org/documents/Community_Code_of_Conduct.php. 

The pledge of the Eclipse Foundation contains very friendly words, like "open" and "inclusive", 
but it seems the practice within EDWG does neither follow the spirit nor the letter of this code. 
IMHO, we are following our rules and processes, including the code of conduct. Please note this is a bold allegation and we take this things seriously. Our colleagues from EMO can help me here if needed.
For the EDWG, I think it is fair to assume that, as per our charter, and as Sebastian already pointed out, EDWG members have different roles and attributions than non EDWG members. If the ambition is to be involved in these discussions and additional information, I would also encourage to join the EDWG as strategic members.
Then, for the projects (in this case DCP), I think they are also operating by the rules. They all have mailing lists and ways for the community to interact. But please note they have also limited resources. If a project receives a comment/suggestion which is valid but it is (1) not in the roadmap agreed or (2) they have no expertise to cover it, it would be very difficult for them to implement. 
If there is a contribution you would like to push on a given project, my suggestion would be to directly propose the code update. This will ease its evaluation and merge.
And, if the committers of a given project decide not to include it anyhow (which they can do as per the development process, providing good reasoning why), you can also start another project with the desired feature and you will have the same level of support from our side to release and standardise it.

I am subscribed to the following four publicly accessible mailing lists, which somehow seem 
to be related to the questionable DCP:

The DCP colleagues can help here, this is a project specific mailing list

Good, this is the mailing list for general announcements about the EDWG and the Eclipse projects regarding Dataspaces

The DSP colleagues can help here, this is a project specific mailing list

Great, this is the list were we will post specification ballots

For some obscure reason it seems that I am not able to subscribe to the  

The DCP colleagues can help here, this is a project specific mailing list

The DSP colleagues can help here, this is a project specific mailing list

This is the way it is supposed to be. This mailing list is reserved for Specification Committee members.

I hope this clarifies the situation.
I understand the EF and the EDWG both have numerous processes, communication means and platforms which are not easy to understand and follow.
Please make sure you have all the information. I will be happy to help you on this any time (as I did yesterday, including at least 4 other email exchanges before this one that were not included in the forwarded email).
Please also make sure you direct your concerns to the right place. I can help on the EDWG related issues. Then projects are self-sovereign, so any feedback for them should be directed to the project members.

Best regards,

Javier Valiño
DataSpaces Program Manager | Eclipse Foundation Europe GmbH
+34 687 442 681 | eclipse.org | Twitter | LinkedIn | YouTube | Instagram | Bluesky | Mastodon
Community. Code. Collaboration. 

| 






On 13 Aug 2025, at 09:48, Sebastian Steinbuss <Sebastian.Steinbuss@xxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:

Dear Detlef,

(reducing the cross-posting to the DSP and EDWG list)

Welcome to our mailing list on the Dataspace Protocol, and thank you for your interest in our work.

I must admit that I cannot fully follow your thoughts in this message, but I would like to react to three aspects:
  1. This mailing list is about the Dataspace Protocol, DSP, not the Decentralized Claims Protocol, DCP.
  2. I understand your concern 3. The release of the DSP and the Release Candidates have not been announced on the mailing list. The team decided to use our GitHub for information exchange, and we conduct monthly community calls to inform and discuss. 
    1. Please find the information on the community calls here: https://github.com/eclipse-dataspace-protocol-base/DataspaceProtocol/discussions/11 . In the last call on July 10, we informed in detail on the release process. At the moment, the calls are on summer break and we will continue in September. 
    2. The Milestone planning, including the release candidates, has been posted in our GitHub repository in the discussions. This is open for everyone to react to and discuss. https://github.com/eclipse-dataspace-protocol-base/DataspaceProtocol/discussions/136. Please be aware that the initiation of the PAS Process was mentioned there already and communicated before. 
    3. However, I fully understand your expectation to be informed via the mailing list on the status and next steps. The project team will include this channel in future communication. I understand this as an improvement, but not as a fix to any kind of issue.  Nevertheless, for the Dataspace Protocol, I do claim that we operate open and inclusive manner. We are fully aligned with the Community Code of Conduct.  
    4. This includes the release review, which was announced via the Dataspace Protocol Website and which you can find also here:https://gitlab.eclipse.org/eclipsefdn/emo-team/emo/-/issues/1001
  3. Regarding your comment on EDWG, I am sure that Javier can explain much better, but I am very sure that this working group operates in an open and inclusive manner. We publish the minutes of our meetings (Steering Committee and Specification Committee) and inform about their publication on our mailing lists. However, please read more about our Working Group in our charter https://www.eclipse.org/org/working-groups/eclipse-dataspace/charter/ . Joining our committees requires membership in the Working Group or being elected as a committer member. I invite you to do both: become a member of our Working Group and support us with your knowledge and expertise, and become a committer to our projects. Our Open-Source projects are successful because of the people who support us with their knowledge and expertise and because of the organizations standing behind them and us. 

    If there is anything we or I can support you with, let us keep the discussion open - in a way following our Code of Conduct, which includes not only openness and inclusiveness, but also a lot of other things which I would summarize as: let's be nice to each to other.

    Best wishes
    Sebastian 
    . 

    1.  . 

--
 
Sebastian STEINBUSS (Mr.)

 

 

From: dataspace-protocol-base-dev <dataspace-protocol-base-dev-bounces@xxxxxxxxxxx> on behalf of Detlef Hühnlein (ecsec GmbH) via dataspace-protocol-base-dev <dataspace-protocol-base-dev@xxxxxxxxxxx>
Sent: Wednesday, August 13, 2025 8:31 AM
To: Javier Valiño Llamazares <javier.valino@xxxxxxxxxxxxxxxxxxxxxx>
Cc: Detlef Hühnlein (ecsec GmbH) <detlef.huehnlein@xxxxxxxx>; emo@xxxxxxxxxxx <emo@xxxxxxxxxxx>; dataspace-dcp-dev@xxxxxxxxxxx <dataspace-dcp-dev@xxxxxxxxxxx>; dataspace-wg@xxxxxxxxxxx <dataspace-wg@xxxxxxxxxxx>; dataspace-protocol-base-dev@xxxxxxxxxxx <dataspace-protocol-base-dev@xxxxxxxxxxx>; dataspace-wg-spec@xxxxxxxxxxx <dataspace-wg-spec@xxxxxxxxxxx>; license@xxxxxxxxxxx <license@xxxxxxxxxxx>
Subject: [dataspace-protocol-base-dev] How about following the Eclipse Community Code of Conduct also in the Eclipse Dataspace Working Group?
 
Good Morning Javier, 
>Which mailing list are you referring to?

Please refer to the list 1) through 7) mentioned below and kindly let me know, if I missed 
some DCP-related mailing list.

>The one indicated in my 2 first emails is open and anyone can subscribe. That is the one used for the spec ballots, precisely for them to be open.

At which publicly available mailing list was there an announcement for 

1) the existence of RC4 of DCP, 
2) any request for comments and a related technical specification review, 
3) any mentioning of a subsequently planned submission as PAS to ISO?
4) any opening of a ballot to approve such a specification review?
5) any transparent casting of votes related to a technical review and its approval?

I walked through a large variety of mailing lists mentioned below, but I was 
unfortunately not able to find anything related to the five points above.  :-(

>The only private mailing list are the ones used to call for meetings or discuss internal committee issues for the Steering and Specification committees. 
>They don’t hold discussions, those are reflected on the minutes. 

Probably yes, but the minutes systematically refer to additional details and attachments, which 
are unfortunately only accessible to members of the Steering and Specification committees. 

Why?

Sorry, but this practice is very questionable, everything else but open and inclusive and hence
certainly not in line with your code of conduct https://www.eclipse.org/org/documents/Community_Code_of_Conduct.php. 

The pledge of the Eclipse Foundation contains very friendly words, like "open" and "inclusive", 
but it seems the practice within EDWG does neither follow the spirit nor the letter of this code. 

Why? 



I am subscribed to the following four publicly accessible mailing lists, which somehow seem 
to be related to the questionable DCP:

1) dataspace-dcp-dev (https://accounts.eclipse.org/mailing-list/dataspace-dcp-dev)
2) dataspace-wg (https://accounts.eclipse.org/mailing-list/dataspace-wg)
3) dataspace-protocol-base-dev (https://accounts.eclipse.org/mailing-list/dataspace-protocol-base-dev) 

For some obscure reason it seems that I am not able to subscribe to the  

6) dataspace-protocol-base-security (https://accounts.eclipse.org/mailing-list/dataspace-protocol-base-security)
7) dataspace-wg-specification-committee (https://accounts.eclipse.org/mailing-list/dataspace-wg-specification-committee)

Please let me know, if I missed one or more important DCP-related mailing lists and
any potentially convincing arguments, why it is not necessary to follow the 
Code of Conduct of the Eclipse Foundfollow also within the Eclipse Dataspace Working Group. 

Best Regards,
    Detlef

PS: I now need to start my trip to Ghent for the ARES2025 conference in which
I have tomorrow a DCP-related talk (see https://2025.ares-conference.eu/program/edid/ and 
https://tinyurl.com/ARES2025), but I will certainly come back to you and the colleagues
within the EDWG to follow up on this general discussion and the even more important 
technical issues, which in my opinion need to be fixed urgently - before there can be
submitted as PAS to ISO. Please stay tuned - and keep in mind that the Eclipse Foundation 
still has a good repudiation and it is probably not worth to put this at risk for a single 
highly disputable technical specification.

-----
The messages for the different release candidates BEFORE RC4 marked yellow below were as follows:
- RC3 (10.04.2025)
- RC2 (27.02.2025)
- RC1 (19.12.2024)

The crucial RC4, which is intended to be shipped to ISO, has not even be announced yet on this mailing list. :-(

There does not seem to be any mail related to the planned submission of DSP or DCP to ISO. :-(



The message for DSP RC1 marked in yellow below was on 27.02.2025. 
which is most likely intended to be shipped to ISO, has not even be announced yet on this mailing list. :-(



I see in the archive of this mailing list, that there have been ballots for the initiation of
specification projects including 
- the initiation of a ballot for the creation of DCP on  21.05.2024 (https://www.eclipse.org/lists/dataspace-wg-spec/msg00012.html) 
- a couple of positive votes on the mailing list and
- the conclusion of the ballot on 30.05.2024 (https://www.eclipse.org/lists/dataspace-wg-spec/msg00021.html)

Unfortunately, I can not see any similar ballot with respect to the start of any 
voting on the approval of any DCP spec on this list, but only the miracuously appearing result
of the ballot https://www.eclipse.org/lists/dataspace-wg-spec/msg00050.html. 
I am pretty sure, that a ballot for "Eclipse Dataspace Decentralized Claims Protocol Release Review", 
which has not even be announced in some way can not formally be approved. Right? 


Furthermore I would be very interested in joining https://accounts.eclipse.org/mailing-list/dataspace-dcp-security, 
because I assume that there are important security issues with DCP, which need to be fixed here before PASsing anything
to ISO. Unfortunately it is currently not possible to subscribe. :-( 

Why?



 
The same problem exists with the dataspace-protocol-base-security mailing list. 

Why?



It is needless to say, that I would love to be subscribed to the mailing list 
dataspace-wg-specification-committee, as there are serious topics to be discussed - especially around DCP. 
Unfortunately, this is "currently not possible". 

Why?



Am 12.08.2025 um 19:53 schrieb Javier Valiño Llamazares:
Hi Detlef,

Which mailing list are you referring to?
The one indicated in my 2 first emails is open and anyone can subscribe. That is the one used for the spec ballots, precisely for them to be open.

The only private mailing list are the ones used to call for meetings or discuss internal committee issues for the Steering and Specification committees. They don’t hold discussions, those are reflected on the minutes. 

Best regards,

Javier Valiño
DataSpaces Program Manager | Eclipse Foundation Europe GmbH
+34 687 442 681 | eclipse.org | Twitter | LinkedIn | YouTube | 

El 12 ago 2025, a las 19:43, Detlef Hühnlein <detlef.huehnlein@xxxxxxxx> escribió:


Hallo Javier, 
one more last remark. 
While it may, or may not, be in line with the rules of this very 
specific working group within the Eclipse Foundation to keep out 
contributors from the private dataspace wg mailing list, it is 
certainly not in line with the principle of openness I expected to 
be followed in the Eclipse Foundation. 
Best Regards,
    Detlef 


-------- Weitergeleitete Nachricht --------
Betreff: Undelivered Mail Returned to Sender
Datum: Tue, 12 Aug 2025 19:18:39 +0200 (CEST)
Von: Mail Delivery System <MAILER-DAEMON@xxxxxxxx>
An: detlef.huehnlein@xxxxxxxx


This is the mail system at host smtp.ecsec.de.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster.

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The mail system

<dataspace-wg-spec-request@xxxxxxxxxxx>: host mail.eclipse.org[198.41.30.200]
said: 550 5.1.1 <dataspace-wg-spec-request@xxxxxxxxxxx>: Recipient address
rejected: User unknown in local recipient table (in reply to RCPT TO
command)

<Nachrichtenteil als Anhang.tmp>
<ForwardedMessage.eml>
-- 
Dipl. Inform. (FH)
Dr. rer. nat. Detlef Hühnlein
ecsec GmbH
Sudetenstrasse 16
96247 Michelau
Germany
Phone  +49 9571 948 1020
Mobile +49 171  9754980
Mail   detlef.huehnlein@xxxxxxxx

ecsec GmbH
Sudetenstrasse 16
96247 Michelau
Germany

Registered at Court of Coburg HRB 4622
EUID: DED4401V.HRB4622

Directors:
Tina Hühnlein
Dr. Detlef Hühnlein

This e-mail may contain strictly confidential information and is intended for the person to which it is addressed only. Any dissemination, even partly, is prohibited. If you receive this e-mail by mistake, please contact the sender and delete this e-mail from your computer, including your mailserver. Except in case of gross negligence or wilful misconduct we accept no liability for any loss or damage caused by software or e-mail viruses.

oophRcdrNxH1RdDB.pnguVnVGG8Px10dDJcm.pngHS1nhTdsQ6WNHu2A.pngG9KACXbRu6J830A6.pngJaEPNOn0ET4Bjf0U.png8P1kJcvY2dIs1H8R.pngdLvqHwJinDximj6O.png


--
The Eclipse Management Organization | Eclipse Foundation

Back to the top