Archiving FSCI group in loomio and migrating to a self hosted instance.

This is fine, you can also use #codema:poddery.com on matrix to reach admins of the instance.

It's being served from a docker container currently. For each pull, when we update the app, we will have to add the fonts and make changes to the image. Currently I have found a solution of changing font source to a cdn hosted by wikimedia tools-static.wmflabs.org as it only requires changing a link source to a template file in a folder mapped to the container.

Is that ok with you ?

Hi Akhil,

1. Yes of course... The only reason I noticed this is because of alerts that Privacy Badger showed and I found those alerts rather unusual for this site.
   

2. I think we can set the bar for such technical choices. It might be tough to aim for librejs compliance but at least we can eliminate tracking as far as possible (starting with not loading css/js/font/image assets from CDNs).
   
   Let us work on publishing a set of guidelines for this with examples on how to apply them to common tools.
   
   Incidentally, the value of a CI/CD process is exactly this -- it eliminates the complexity of making source code changes, packaging them into containers and re-deploying the containers. If we start a deployment using such techniques (via Gitlab maybe), then at a later date, we will find it trivial to make such changes.

For example, this very page has a youtube video embedded in a comment. Every time this page is loaded, it sends requests to doubleclick.net and youtube.com. Even if we eliminate all the trackers (via google fonts etc), we are still leaking tracking data to Google.

So apart from technical solutions (where we mirror js / fonts etc), we also need to educate users about the dangers of cross-linking or embedded media. Maybe Loomio can be configured not to embed a video player every time it sees a youtube link. (Or we can disable the youtube embed in the text editor.)

I am personally guilty of not following all of what I have written above (partly because of the wordpress trap & ecosystem)... but if we can be sensitive to it, that might be a good start.

Let me join in there.

I would like FSCI to maintain such a set of guidelines. Would defnitely contribute to that too. Actual application of guidelines to the tools will be easy if the services we run expose such configuration easily. We can then edit the configuration files and be done. Some upstreams will be happy to merge if we make the code changes for configurations. The services deployed like loomio via docker require a bit more effort as we may have to fork, build an image and maintain our changes. Only limiting factor will be the effort the community puts in.

Loomio by default exposes no configuration to stop processing embed youtube link apart from changing the source code yourself. Infact you can see them adding more coverage for processing embed youtube links in the change log related to tag v2.1.1.

As an ex:- to add "Hosted by FSCI" to the footer now requires me to edit a variable value in the running container, and do npm run build on production. And It will be lost when I pull the next stable tagged image of the app.

Personally, I don't want to fork loomio and maintain changes. But as you said, if anyone is ready to maintain a fork and push a CI/CD built docker image from the fork to gitlab registry or docker registry, it'll be a lot easier to do this. We'll need to only change the image to use in the compose file. Also we can do a lot like adding branding of FSCI in that image.
.
PS:- @Kiran S Kunjumon grepped through app code yday and found a set of env variables that is not documented in the deployment repo. I hope to find a suitable one among them that lets me add the FSCI branding somewhere else than footer and don't do this dance again when I pull.

Has this Loomio instance been updated recently? I see a 'Tasks' entry in the menu at loomio.org but not ar codema.in