bhark/konsent

A platform designed to help groups make decisions without hierarchy and representatives, built on anarchist values.

Konsent

Important note on the state of Konsent

Konsent is no longer being maintained or developed upon. The project was put in the grave after stumbling into some deeper misconceptions in the model. Konsent is not in a usable state! A new application and model is slowly making its way into existence, and is under slow development as of November 2021.

...but all is not lost

As of mid-january 2022, the outlines of a development team (more like a mutual aid network, really) is beginning to take form. Revamping Konsent will be a primary goal.

Step one is designing a decision-making flow on the basis of what we learned from Konsent so far. There's talk of integrating communication and planning tools as well, to turn Konsent into an organizational tool in itself. Development-wise, it looks like we'll be working with Svelte, Sveltekit and Python Flask Supabase, real hip SPA/SSR-style.

Write an email to [email protected] if you're interested in participating.

About

It's about time that we rethink the way we make decisions collectively. Konsent is my suggestion for an alternative to moderation, an alternative to hierarchy and unequal freedom. Konsent is a platform designed to help groups make decisions without hierarchy and representatives, built on anarchist values.

Here's a brief explanation of the concept:

When you register a new account, you link the account to a community, using a password provided to you by the community members. Once registered, you are given the ability to post new issues as well as participate in solving existing issues.

When a new issue is posted by a member of the union, it goes through three phases before being marked as solved. Here's a brief explanation of the three phases:

• Phase 1: Other members of the union can vote for issues they feel are relevant. When an issue has been voted for by half of the community, it will progress to phase 2.

• Phase 2: The community may suggest what they feel would be an appropriate solution to the issue at hand. They may also vote for other solutions that they agree with. After one day, the issue will progress to phase 3, bringing the solution with the most votes along with it.

• Phase 3: Community-members may veto the solution if they feel that the solution is deeply disturbing, and can in no way benefit the greater good of the community. If a community-member decides to veto a solution, he will have to provide a reason for the veto. The name of the member who vetoed will be visible to every community-member. If no veto has been put in place after one day, the issue will be marked as solved, and the solution will be carried out.

The concept of Konsent is just as much under development as the code-base, and everything is potentially subject to change. If you have any ideas on how we could improve the concept, share them in a new post on /f/konsent.

Installation

If you want to give Konsent a try on your local machine, here's how it's done. There's a setup script included, if it doesn't work properly you'll want to install manually.

Automatic Installation

• Install Python 3.

• Clone Konsent using git, git clone https://github,cm/dellitsni/Konsent/ or download and unzip somewhere safe.

• Install dependencies by running python setup.py install.

• Start your MySQL/MariaDB server and create a new database called konsent.

• Populate the database by running python konsent createdb.

Manual Installation

• Install Python 3.

• Clone Konsent using git, git clone https://github.com/dellitsni/Konsent/ or download and unzip somewhere safe.

• Use pip to install the dependencies: pip install flask flask-mysqldb flask-sqlalchemy wtforms bcrypt flask-login.

• Use pip to install the dependencies: pip install flask flask-mysqldb flaks-sqlalchemy wtforms bcrypt flask-login.

• Install konsent as a module by running pip install konsent in Konsent's parent folder. If you want to develop on Konsent, add the -e flag.

• Start your MySQL/MariaDB server and create a new database called konsent.

• Populate the database by running python konsent createdb.

Running Konsent after installation

Konsent has a few optional parameters. Execute from base directory using: python konsent runserver -d [DATABASE NAME] -p [DATABASE PASSWORD] -H [DATABASE HOST] -u [DATABASE USER]

How to contribute

You don't have to know anything about programming or the likes to contribute to Konsent - developing the concept further is currently just as important. Concept development happens on /f/Konsent. Discussion happens both on GitHub and Raddle.

Contributing to the code-base is easy if you know Python and the basics of Git, and there's lots to be done. Simply install all the dependencies, as explained in the chapter above, grab your favorite code editor, take a look at the open issues and fire away. We're following the branching model explained here loosely. We're following the PEP8 style guide.

If you're planning to participate regularly and want to introduce yourself and get to know the others, you can do so on our Raddle forum.

You can ship your changes pretty much however you want, although a good old pull-request is preferred. Alternatively, contact dellitsni or one of the other developers on raddle.me.

konsent's Issues

Add details to phase 3

• Who voted for the chosen solution
• How many votes did it get
• How many voted for different solutions.

Captcha on registration and union registration

A simple automated script would be pretty devastating. There's Flask-Captcha, but it seems pretty dead. Then of course there is ReCaptcha, but that's not an option. There's also the more primitive and light-weight flask-session-captcha, it's newer but very bare-bones.

Add testing

Hello! pytest is my goto testing framework but this can happen with the builtin unittest module too, any preference? selenium can also help for testing webapps

Implement PEP 8

For the sake of readability, @surrealbytes and i agreed on the PEP 8 styling convention. The documentation for PEP 8 can be found here.

Should also be added to README.md, in the Contribution section.

Newly created issue has 24-hour-ago timestamp

When I created my first issue, the "your post have been published" page showed that my issue was 23h 59min old (immediately after creation). See attached screenshot.

The problem seemed to go away after refresh, and the time showed correctly.

Make user log in to create a union?

Allow unions to configure the amount of required votes in phase 1

If such a configuration is called for, it should skip phase 1 and go directly to phase 2. Solution proposals should be in the form of an integer input. A text input should be optional alongside the integer input.

[updated] Remove display name and enforce better passwords

As things are now, multiple accounts can exist with the same usernames and/or display names. This results in some strange behavior upon login, and creates general confusion to who is who.

Relax the password requirements

They're overkill and don't add much in terms of security. A length requirement should be enough.

Suggested by Belsima

Implement CSRF protection

There's currently no protection against cross-site request forgery. It's pretty simple to implement, and shouldn't be much of an issue.

Make an explanation mandatory when vetoing

Better password security

Password security as it is is not suitable for production use :

• We are using sha256, which is too fast for password hashing (see this)
• The hashes are unsalted, which make cracking a breeze

I would recommend switching back to passlib, which implements recommended algorithms and conveniently wraps hashing.

[update] Konsent development is taking a break

Due to disputes between me and the Raddle community (the primary purpose of Konsent), I'll be taking a break from development. There's no real motivation right now.

I will for sure come back to this project later, and i will still be taking care of pull requests and so on.

Only accounts created before the start of a post should be able to participate in that post in the later phases

Originally suggested by surreal on Raddle.

Remember sessions

Right now, users are logged out when they close their browser. Logging in every time you open the page gets annoying quickly. We could use cookies to remember users even after they've closed their browser.

Add tests for phase updating

See #57

Make a list of union members accessible to union members

The community should be able to see who is signed up to their union. This would also help to prevent the creation of fake accounts in order to manipulate votes.

Display how many times a post have been reset in phase 2

Right now there's no way to know how long a post has been resting in phase 2 without finding a solution.

Allow for three letter usernames

As suggested by Pop.

Allow users to leave their union

Impose a lower limit on resting time

Perhaps 30 minutes to an hour would be fine.

sqlalchemy.exc.IntegrityError Duplicate entry for key 'username'

sqlalchemy.exc.IntegrityError: (_mysql_exceptions.IntegrityError) (1062, "Duplicate entry 'test_username' for key 'username'") [SQL: 'INSERT INTO users (password, username, authority, union_id) VALUES (%s, %s, %s, %s)'] [parameters: ('cc246a15ad402a7483b435d05f2a954c12bb3a84d87555cd0e68806488516f92', 'test_username', 0, 1)] (Background on this error at: http://sqlalche.me/e/gkpj)

happens when trying to create a user with the same credentials,
can anyone reproduce?

Clean things up

In its current state, Konsent is somewhat of a mess. Before we do anything big, we should focus on cleaning up the code and making things easier to get into.

Replace passlib with hashlib

As @surrealbytes pointed out, passlib is old and should be replaced with the built-in hashlib.

Make voting onymous

As pointed out by a Redditor, Konsent is currently vulnerable to vote manipulation by the administrator of the database. To combat this, we should make voting onymous.

i18n

Add support for other languages, and guidelines so that people can contribute translations.

Allow users to participate in more than one Union

Restrict user/display names to alphanumeric characters

alphanumeric + underscore

Show how many votes are required for progression in phase 1

As suggested by Pop.

Give each 'phase' a name

This will make each phase distinct both from the user
and developer perspective. It would also make it easier
to add new phases without getting lost with 'phase' + integer names.

Constrain name and password length

Tried this with the #25 branch and atm it's sqlalchemy library that does the check and raises an exception, haven't tested with master/develop branches but it must be kinda the same.
Not sure if wtforms can put constraints, i will have to take a look at this cool lib.

Registration issue

sqlalchemy.exc.OperationalError

sqlalchemy.exc.OperationalError: (_mysql_exceptions.OperationalError) (1048, "Column 'union_id' cannot be null") [SQL: 'INSERT INTO users (password, username, authority, union_id) VALUES (%s, %s, %s, %s)'] [parameters: (b'$2b$12$KMStSnHgfbpgCppqxaTdUedwpbqL48SO8yt8y.H9t9GxEeagCog4O', 'test_username_8164375762522296', 0, None)] (Background on this error at: http://sqlalche.me/e/e3q8)

Fix selenium tests inconsistency

The .click() method on elements seems to be kinda buggy, if the response takes long
enough selenium doesn't wait and the tests continue and just fail, there seems also to be some lag on loading pages in selenium.

We can either change the click() method with get(url) that waits until the page is loaded
or use WebDriverWait but meh..

We've almost closed every issue in the v. 0.2a milestone

Looks like we're almost ready to merge develop into master, just one more issue left in the milestone, #11. Is there anything we should add to the milestone?

Reset timer if no solution is found in phase 2

If a solution hasn't been suggested in time, the post shouldn't be marked as solved with the solution being "None". Instead, the timer should reset until a solution is found.

Completion date are being reset for all solved posts when a post is solved

I suppose it's just a simple MySQL mistake somewhere. If so I'll fix it tommorow.

Pythoneverywhere not progressing issues

This seems to be a pythoneverywhere problem indeed, locally this works as expected.
Maybe we should add some logging to the update_phases and see what pythoneverwhere's console prints?

Allow users to add links to external discussion during phase 2

As we discussed in this thread.

Decision making paradigm

After a brief research there seem to be a lot of decision-making paradigms. At this moment majority-voting is implemented as part of phase2. We should consider the arguments people made about implementing a consensus decision-making paradigm and which implications this might have with the implementation. We could try and make the phases abstract enough so users/unions can choose and pick which one they want or choose a specific paradigm and build on that.

Prevent duplicate unions

Multiple unions can currently exist with the same name.

Exclude inactive users from the total needed vote count for progression from phase 1 to 2

As suggested by Tequila_Wolf.

Phases update is not consistent

At the moment updating the phases is something that happens only on requests and not automatically, meaning that some issues will stay in a phase, even though the time has passed, until someone requests
a view.

User profiles and profile management

As suggested by Pop, allowing users to have a "profile" page including a bio and some management tools would be a good idea.

Allow authors to configurate the resting time of their issue

As discussed in #17, an optional input on the "new post" page would probably be enough.