Do not expose individual users

[GeorgLink]

Last week on the OSS Health Group call, we discussed exposing individual contributors through the metrics.
Some of our metrics currently return users' login names.
Would these metrics still be informative without exposing individual people?

[howderek]

I think that depends on the metric. I don't think "contributors" would be far less useful without having usernames to further explore a user's timeline of contributions, but "committer_locations" would probably be just as useful.

Either way, we are only using public data so I don't think there's a huge privacy risk. Users who are concerned about privacy probably don't use personally identifiable information on GitHub.

[GeorgLink]

Good point about the ability to drill down to how each metric is informed by the data. Maybe we can limit the level of detail though to avoid exposing usernames. This would be an ethical decision.

A concern beyond privacy is how the data could be used against contributors, for example for job performance evaluation. There will be many things contributors do that cannot be reliably captured through our metrics and thus any conclusion drawn about contributors will be skewed. We do not want to provide a tool that incentivises contributors to think about gaming the metrics which distracts from meaningful contributions.
The request is about staying abstract from individual contributors.

[howderek]

I think that the metrics that operate at the individual level are useless without usernames, if we anonymize the data only the aggregate metrics will be usable. I think that it's useful for projects to be able to understand how individuals are contributing, and our tools will help make individuals who contribute in ways other than committing more visible

[howderek]

If on the call it sounded pretty certain that we want to anonymize it though it can certainly be done

[GeorgLink]

Yes, during the 2017-04-08 call, several people voiced concerns with measuring individual users.
The meeting minutes from 2017-04-18 read:

We might not create metrics that are human centered

I acknowledge that I wrote those minutes and maybe someone else can chip in how they understood what we talked about during that call.

[howderek]

Sounds good! We'll anonymize or aggregate the metrics that currently return usernames.

[GeorgLink]

​Thank you.

[sgoggins]

Is this done?

[GeorgLink]

Is this done?

I don't know if this will ever be done because I think it can serve as a constant reminder.
Does GHdata currently comply with this issue: yes, we could close it.

[howderek]

Yes and no - Yes because GHData's frontend does not display any personally identifiable information. No because GHData has API requests that when made with the "raw" parameter will return all of the rows relevant to a given query, one of which is names (if the data source is GitHub). GHData visualizations will never use names, so I would feel comfortable closing it.

[sgoggins]

We do not expose individual users. The API provides information about users, bur our front end does not expose information about useres.