TL;DR: If you write or manage software for the SCA, I’d love to get your feedback on this proposed license agreement intended to document the Society’s ability to continue using and maintaining the software even if you someday become unavailable.
Given the high proportion of technical professionals in the Society’s ranks, it is no surprise that the SCA has a long history of informal software development: folks developing small custom applications to facilitate some part of their office’s or local group’s operations. However, this process has by-and-large been uncoordinated, and policy for it has been slow to coalesce.
One recurrent issue in this area has been the lack of clear licensing practices. In a few cases, copyright has explicitly been transferred to the Society, but in the majority of cases the issue has not been considered, leaving the copyright in the hands of the original developer. In most cases, there is no written license agreement, which is usually fine while the original developer remains involved in local activities, but can become problematic if they move away or drop out of Society activities, as nobody knows for sure if the group has the right to to continue using the software, to make changes to it, or to share it with other branches of the SCA.
In April 2015, the Society’s Publications Office undertook a survey, variously referred to as the “Evolution of SCA Communications” or “Newsletter & Communications Survey,” which asked participants about the channels they used to obtain information about SCA activities.
At the next quarterly meeting of the Board of Directors, the Publications Office submitted a flurry of proposed policies and actions based on the survey results.
TL;DR: Democratic governance requires logistical competence, but for more than half a year garbled address data and other issues with membership records have complicated the branch pollings that are supposed to be part of routine Society operations.
As previously discussed here, the SCA recently migrated its membership database from the Members Only platform it had used since 2012 over to a service offered by Neon One.
Unfortunately, the data migration appears to have introduced errors in the membership records that have been difficult to correct. Some people found that their address had been reset to a location where they had lived years ago; others found that their zip or post codes were wrong; and some had their membership numbers changed. Folks with family memberships had their own set of problems; in some cases, membership numbers were swapped between two relatives, and in one case a person who requested a new membership card instead received one addressed to a recently-deceased relative.
TL;DR: Earlier this summer the SCA configured their Neon CRM membership portal to show registered users their member number. I discovered a vulnerability in Neon One’s software that allowed technically-savvy users to use that capability to change their member number to any value they desired.
After this was reported, the link to the vulnerable screen was removed, but the screen still exists and the vulnerability in the underlying Neon CRM software appears to remain unpatched.
In February the SCA completed the migration of its membership data from an aging legacy system (“Members Only”) to a new platform hosted by Neon One. Their Neon CRM service now appears to function as the system of record for the Society’s member records, including modern names, addresses, and payment information, as well as SCA-specific data such as Society name, kingdom, and member number.
The SCA will soon stop asking local event organizers to pay for venue insurance certificates by sending their personal credit card number to the corporate office via email, as it had been doing for the last two decades.
It turns out the switch from MembersOnly to NeonOne has made this dramatically easier, and we can access member data in just a few lines of Python without scripting Chrome or hand-crafting any RPC calls.
I have sent the following letter regarding the sanction of Brian De Moray to the Society Seneschal, the Board Comments address, and the Ombudsman for IT, with copies to the Society IT Manager, Society Webminister, East Kingdom Webminister, and Brian De Moray himself. As always, I included my modern name and member number. Receipt was acknowledged less than two minutes later; I suspect they’re having a busy weekend over there. I will update if further action is taken.
To the Society’s Seneschal and Board of Directors, greetings from the East.
I write to you today to ask you to reconsider the January 2020 sanction of Brian De Moray, as the information available in the public record suggests that this decision may have been made in error.
TL;DR: Brian De Moray is a Master of Defense and of the Pelican in Atlantia, who was sanctioned by the Society in January 2020 for an innocuous 113-word Facebook post commenting on software development work he was doing as a volunteer for the kingdom.
As far as I can tell from the information available to me, this sanction appears to have been an error, made in haste by a Board that misinterpreted some technical jargon they didn’t understand, and should be reversed.
I first became aware of this case when it was mentioned in the context of the Wistric Saga, being discussed by Aeron Harper in the second part of his “Tale of Six Sanctions” essay. Aeron’s article was focused on the procedures and policies of the sanctions process, and understandably glossed over some of the technical details, but as a software developer, my curiosity was piqued.
I’ve submitted this question to the “Topical Town Hall Request” form, but it’s obscure enough that I’m not terribly optimistic about seeing it addressed in upcoming meetings:
According to the October 19, 2019 organization chart available from sca.org, the Society Webminister is the only officer with kingdom/local counterparts who does not report through the Society President — instead they report to the Manager of Information Technology, who reports directly to the Board.
Why is this reporting structure different than every other role in the organization?