Recommending conda distributions

[aterrel]

Hello all,

A group of NumFOCUS project leads came together at the summit this week. Concerned over the legal notices sent to many of the users of the software we maintain, we are recommending the community adopt a conda distribution that allows for scientific researchers to use this software without fear of legal action. To that goal the NumFOCUS Infrastructure committee is asking for feedback on the statement we have composed at the following link:

Installation Documentation Recommendation - NumFOCUS Infrastructure Committee

If you agree with the statement, please add your name to the stakeholders page. If you have concerns, please add comments either here or on the document. The committee will take all the comments into consideration and amend the recommendation as appropriate.

Thank you for your consideration,
Andy Terrel
VP Infrastructure, NumFOCUS

Edit: We will leave the comment period open for one month as it has been suggested that a week is too short.

[jezdez]

Hey Andy, I've provided some feedback to you already on the NumFOCUS Slack and the document a few times, thanks to everyone who has participated in writing this recommendation draft.

I do feel one week of feedback is a little short, especially since you've asked for comments on a Saturday. Do you think we could extend that by a week?

For others, who don't know myself, I'm a conda steering council member, and tech lead on the team at Anaconda that contributes to the conda OSS project, which is a multi-stakeholder community project, with governance policy etc. I've also co-led the initiative to apply for NumFOCUS fiscal sponsorship, which was approved in 2022, upgrading from a NumFOCUS affiliated project. I've recently coauthored an overview of conda's ecosystem to provide more context following the concerns raised within the conda ecosystem regarding Anaconda Inc's Terms of Service.

Since I believe recommendations for other channels besides Anaconda's distribution don't magically make things easier, I wanted to mention that conda-forge is an all-volunteer organization with limited funding, which isn't recommended to be used for environments with sensitive information. We should clearly spell this in the recommendation out, to make sure that the expectations are clearly set. Software from conda-forge is maintained in good faith, but isn't verified, since the individual package maintainers build the conda-forge conda packages.

Also, to my knowledge, Anaconda Inc leadership is investigating the feedback it has received about its Terms of Service, which Peter confirmed publicly on LinkedIn. I'd suggest getting a statement from Anaconda included in this recommendation to set the record straight, how that investigation concluded.

Lastly, I wanted to provide some feedback on how I perceived the start of the work on this recommendation: I wasn't able to attend the NumFOCUS project summit 2024 for family reasons since I couldn't make the trip across the pond again, and was surprised when I only heard through the grapevine the topic to be discussed at the summit's unconference. That seemed odd given conda's status as a fiscally sponsored project, and the agreement related to communication with NumFOCUS projects.

I would basically have appreciated if you had sent a notice (or anyone really, like our usual contact Arliss) to the conda steering council (and the conda-forge core team even given the topic?) ahead of the summit, given the seriousness of the topic.

I do worry that with the short comment period and the lack of notification ahead of the summit, that you've not given the conda ecosystem members enough opportunity to participate in the debate of this topic, which doesn't feel great to me. Let's figure out what we can do in the future so NumFOCUS feels like they can reach out to their projects.

[aterrel]

Well I just proposed 1 week because it seemed sufficient. Might as well make it a month if a week is too short. I did send this recommendation out to the Conda Steering committee to comment here or on the document.

This was not a planned discussion at the summit, a result of folks asking what to do with so many institutions now banning conda. By giving this recommendation and fully informing our users about the license fees, we are hoping to stop institutions from banning the tools we rely upon.

[ocefpaf]

1 month would be nice. The conda community meets every 15 days, same for the conda-forge community, and both would like to discuss that document in those meetings to better explain everything to those interested.

[jezdez]

@aterrel Just a quick update that Anaconda has published a status update on the Terms of Service review that would be good to consider for the recommendation: https://www.anaconda.com/blog/update-on-anacondas-terms-of-service-for-academia-and-research