Code of Conduct Warning Signs

I’ve got something on my chest that needs to be expressed. It’s likely to be a bit ranty, because I’ve got some scars around dealing with this issue. I want to talk about Codes of Conduct (CoCs).

No Trespassing!

Over the last five years, I’ve watched the uptick in adoption of CoCs in open source conferences. I’ve watched conferences try to adopt a CoC and fall completely flat on their face because they completely misunderstood the needs of minorities at their conferences. In recent years, I’ve watched open source communities start to adopt CoCs. For some communities, a CoC is an after thought, a by-product of community leadership stepping up in many different ways to increase diversity in open source.

However, a worrysome trend is happening: I see communities starting to adopt Codes of Conduct without thinking through the implications of them. A CoC has become a diversity checkmark.

Why is this? Perhaps it’s because stories of harassment has become wide spread. People look at the abuse that G4mer Goobers have thrown at women developers, especially women of color and trans women, and they say, “I don’t want those types of people in my community.” For them, a Code of Conduct has become a “No Trespassing” sign for external harassers.

In general, that’s fine. It’s good to stand up to harassers and say, “That’s not acceptable.” People hope that adding a Code of Conduct is like showing garlic to a vampire: they’ll hiss and run off into the darkness.

Pot, meet Kettle

However, a lot of people who are gung-ho about banning anonymous online harassers are often reluctant to clean their own house. They make excuses for the long-standing harassers in their community, and they have no idea how they would even enforce a CoC against someone who is an entrenched member of the community. Someone who organizes conferences. Someone who is a prolific reviewer. Someone who is your friend, your colleague, your drinking buddy.

You see, no one wants to admit that they are “that person”. It’s hard to accept that everyone, including your friends, are unconsciously biased. It’s even harder to admit that your friends are slightly racist/homophobic/transphobic/etc. No one wants to recognize the ablist language they use in their every day life, like “lame”, “dumb”, or “retarded”. It’s tough to admit that your conference speakers are mostly cis white men because you have failed to network with minorities. It’s difficult to come to grips with the fact that your leadership is toxic. It’s embarrassing to admit that you may be too privileged and so lacking in understanding of minorities’ lived experiences that you may need to reach outside your network to find people to help you deal with Code of Conduct incidents.

Code of Conduct Enforcement

And you will have incidents. People will report Code of Conduct violations. The important question is, how will you handle those incidents and enforce your CoC? You’ve put a “No Trespassing” sign up, but are you willing to escort people out of your community? Take their commit access away? Ask them to take a break from the mailing list? If you don’t decide up front how you’re going to enforce your Code of Conduct, you’re going to apply it unfairly. You’ll give your buddy a break, make excuses like, “But I know they’ve been working on that,” or, “Oh, yeah, that’s just so-and-so, they don’t mean that!”

You need to decide how you’ll enforce a Code of Conduct, and find diverse leadership to help you evaluate CoC violations. And for the love of $deity, if the minorities and louder allies on your enforcement committee say something is a problem, believe them!

Let’s fork it!

Another worrisome trend I see is that the people working on creating Codes of Conduct are not talking to each other. There is so much experience in the open source community leadership in enforcing Codes of Conduct, but it’s become a bike shed issue. Communities without experience in CoC enforcement are saying, “I’ll cherry-pick this clause from this CoC, and we’ll drop that clause because it doesn’t make sense for our community.”

We don’t write legal agreements without expert help. We don’t write our own open source licenses. We don’t roll our own cryptography without expert advice. We shouldn’t roll our own Code of Conduct.

Why? Because if we roll our own Code of Conduct without expert help, it creates a false sense of security. Minorities who rely on a Code of Conduct to grant them safety in an open source community will get hurt. If leadership is implementing a Code of Conduct as a diversity check mark, it papers over the real problem of a community that is unwilling to put energy into being inclusive.

Diversity Check Mark Complete!

I also see smaller communities scrambling to get something, anything, in place to express that they’re a safe community. So they take a standard Code of Conduct and slap it into place, without modifying it to express their communities’ needs. They don’t think about what behaviors they want to encourage in order to make their community a safe place to learn, create, and grow. They don’t think about how they could attract and retain diverse contributors (hint, I recently talked about some ideas on that front). They don’t think about the steps that they as leaders need to take in order to expand their understanding of minorities’ lived experiences, so that they can create a more inclusive community. They don’t think about the positive behaviors they want to see in their community members.

When I see an unmodified version of a Code of Conduct template in a community, I know the leadership has put up the “No Trespassing” sign to stop external harassers from coming in. But that doesn’t mean the community is inclusive or diverse. It could be a walled garden, with barriers to entry so high that only white men with unlimited amounts of spare time and a network of resources to help them can get inside. It could be a barb-wire fence community with known harassers lurking inside. Or it could be a community that simply found another CoC was good enough for them. I can’t know the difference.

Ask for Expert Advice

My take away here is that implementing a Code of Conduct is a hard, long, process of cultural change that requires buy-in from the leadership in your community. Instead of having an all-out bike-shed thread on implementing a CoC, where people cherry-pick legal language without understanding the implementation details of removing that language, go talk with an expert. Safety First PDX, Ashe Dryden, and Frame Shift Consulting are happy to provide consulting, for a fee. If you don’t have money to pay them (and you should pay women for the emotional labor they do to create welcoming communities!), then you’ll need to spend a bunch of time educating yourself.

Read *everything* that Safety First PDX has to say about Code of Conduct design and enforcement. Read the HOW-TO design a Code of Conduct post on the Ada Initiative website. Watch Audrey Eschright talk about Code of Conduct enforcement. Look at the community code of conduct list on the Geek Feminism wiki. These are all a long reads, but these are known experts in the field who are offering their expertise to keep our open source communities safe.

In Conclusion

Don’t roll your own Code of Conduct without expert advice. You wouldn’t roll your own cryptography. At the same time, don’t make a Code of Conduct into a check mark.

4 thoughts on “Code of Conduct Warning Signs

  1. Massive agreement here, especially to your bolded point about rolling your own.

    One question on a point that confused me: “So they take a standard Code of Conduct and slap it into place, without modifying it to express their communities’ needs.”

    I assume said modification should still only occur with expert help? Because this sentence confused me after having just read the previous section on not rolling your own Code of Conduct.

    1. Yes, modification should happen with expert help.

      The modification I’m looking for in particular is the positive behaviors they want to see in their community. That differs if, say you’re working on github vs a mailing list. Maybe your community is gets a lot of newcomers, and you want to make sure everyone is extra welcoming. Maybe your project is complex and an integral part of a system’s security, and that means contributions must be very technically sound. So you prepare newcomers for a lot of patch revs, while reminding long-standing contributors to be patient with newcomers. It’s these sort of unspoken community values that the positive behavior section of a CoC is useful for expressing.

      I also want to see community leadership think about where the CoC extends to. Does it cover IRC or slack? Their conferences? The evening events at conferences? What happens if a community member is harassing another over a non-community social channel? What’s the breadth of the scope of the CoC?

  2. I also agree that one should not roll their own CoC.

    I do have a questions though.Or maybe it is just something that has been on my mind for a number of years.

    As someone who felt that they have been betrayed by a community because of the Pot meets Kettle. How do you truly deal with this. I had a sour taste in my mouth for a couple of years. I felt that in the last year or so I was able to let it all go and be at piece with it.

    But at one of the last conferences i went to. I ran into a bunch of people that I knew from that community. Everyone was real nice except a couple of people that in no way have anything to do with the issues that I was facing years ago. One person even said to me

    “I know what happened with you years ago. And we do not like you around here”.

    This made me extremely sad. This was the first time that I was meeting this person face to face and and all the other days at the conference it seemed as though I had become friends with this person. I am guessing that someone went over to him and said that I had had the altercation with a certain “drinking buddy” and that for that I had broken the CoC.

    I thought to myself that maybe I was not over all the things that had happened. I tried to reassure myself that I was in a different place and a different person. not to mention that I was part of that community anymore. That a simple walk by a both could not change everything so fast again.

    It is hard to move on after feeling like you have put a massive amount of energy into something very quietly and then felt the wrath of the kettle and the pot.


    1. Sooo… I’m not a therapist. I’m not a part of your community. You didn’t provide details of what happened. You haven’t said what you’ve done to earn back the trust you broke. Only that you’re some how hurt that people disapprove of your past behavior. Given that lack of information, I can’t help you at all.

      I will say that there is nothing wrong with telling people about past incidents in a community. The missing stair problem happens all the time, and newcomers get disproportionately hurt by a lack of information about the toxic members of a community. It sucks for a person who has made an honest effort to change, but no one owes you trust. Trust is earned. You broke that trust when you violated the Code of Conduct. The community did not betray you; you betrayed the community by breaking their stated cultural rules.

      If you introduced a massive security hole, like the SSL goto bug, of course people wouldn’t trust you. Some people may not ever let you push code again. Others will eventually let you commit after you’ve been suggesting better code for a period of time. It’s the same with a violation of a Code of Conduct. People have the right to warn each other that you caused someone to feel unsafe, and may do so again, even if you’re trying really really hard not to. Humans are creatures of pattern, and it’s hard to break those patterns.

      So, in short, respect the people that remember what happened. Understand that you hurt them, you broke the community’s trust in you, and they have a right to not trust you now. Each person, based on their past history with people who behaved similarly, will make an individual decision about when (if ever) they trust you again. It is right and valid for people to talk about the incident, because everyone has the right to make informed choices about their own safety. It’s just something you’re going to need to deal with.

Comments are closed.