Vorboss Response to Sourceforge Mirror Concerns

Summary

Vorboss Limited operates a number of mirror services (see KB15051405) broadly for the ‘good of the internet’.

One such mirror is operated on behalf of Sourceforge, owned by Dice Inc.

In the last couple of months there has been some controversy relating to some of the recent actions taken by Sourceforge, predominantly in relation to advertising placement on the site, and perhaps most crucially, within software downloads themselves.

This is well documented elsewhere, so we won’t repeat that content, nor will we attempt to pass judgement on that behaviour here.

We have received a number of emails from concerned users, most of which contain a direct request to cease providing service to Sourceforge with immediate effect.

We’ve requested that Sourceforge opens a dialogue with us over this matter, in addition we’ve taken the time to explain to users our position, and also what we’re doing about their concerns.

That correspondence is below. Please note that we haven’t (yet) had a response from Sourceforge.

Last updated 15 June 2015 at 20:30 UTC

What we’ve been saying to users

Most users who have emailed us with their concerns have received a response more-or-less like the one shown below. This has changed slightly over time, however the central message is essentially consistent:

Hi _______, Thanks for your email. We’ve had a few others like this. We have a difficult line to tread on this one. Vorboss operates a number of services ‘for the good of the internet’ – we have a variety of reasons for doing this; some are commercial, some are more altruistic. The mirrors that we operate (http://kb.vorboss.net/KB15051405) are one of several such services. I’m proud to say that we deliver well over 10TB of mirror data every month for no charge. We’ve taken some time to consider the concerns that people have raised with Sourceforge – in general terms I’m in agreement with most of the objections. This leaves us with some interesting questions: 1. How do we more accurately define “the good of the internet”? 2. How do we most effectively make our concerns about the direction of Sourceforge heard? On the most basic level, we made an agreement as a company to provide a mirror service to Sourceforge. So long as they are not in breach of our network usage policy (they aren’t), it would set a bad precedent to unilaterally withdraw that service, however much we might disagree with a change in the way it is used. At a minimum, we would honour the extent of our agreement, particularly in respect of notice periods. To answer the first question, we presently feel that on balance, the content being downloaded from our Sourceforge mirror does more good than it does harm. Having said that, I agree that if the current trend continues this opinion may change. Ultimately, however, no one is forced to download their content. This really becomes an argument about the extent to which we protect the less technically literate users. On the second point, we are of the view that as a major contributor to their content distribution network, we have a significantly better position than most users from which to lobby Sourceforge with regard to this trend. I won’t go into details on that, other than to say that we are making our concerns known. In summary, whilst it’s very tempting to imagine that we might be in a position to “flick a switch” and turn the service off, we have to consider what obligations we have, what commitments we have made and also the most appropriate course of action to try and resolve this disquiet. I hope that you find this to be a reasonable position and explanation – in the very least please be assured that we are not blindly providing service. I welcome any more feedback that you have and will include that in our internal discussions on the matter. Kind regards, (...)

What we’ve said to Sourceforge

We have approached Sourceforge with these concerns. We are now happy to publicly share our letter to them (names redacted):

Hi ------, We're increasingly being contacted by users who are concerned by recent changes at Sourceforge. These are all requests for us to discontinue our mirror support. We'd like to have some dialogue with you on this topic to better understand your position and the direction of Sourceforge. Please note that our internal criteria for determining whether will offer mirror support to a 3rd party can be summarised as: 1. Our contribution should be for the overall ‘good of the internet’ 2. The reputational risk must be acceptable 3. The security and availability risk must be acceptable 4. The content provider has a legitimate need for financial or technical support or resource In light of the correspondence that we’ve received, it’s likely that we will need to review our status as a Sourceforge mirror on the grounds that: 1. It may no longer be a net ‘good’ for the internet, especially if it promotes the distribution of adware amongst less technically literate users 2. There may be some increased reputational risk, especially if we don’t [at a minimum] conduct a review of our service provision 3. There may be an increased security and/or availability risk as a result of the number of disgruntled 3rd parties 4. The increased quantity of advertising suggests that Sourceforge is a viable cash-generating business and may not have a genuine need for our service Specifically in relation to point (4), I’d like to add that we allocate a finite amount of resource to providing mirror services. We therefore try to prioritise a balance towards those mirrors which are most necessary (i.e. where the projects are unable to fund this themselves). Rather than jumping to conclusions, I’d appreciate it if we could first have a discussion to help inform our internal process as outlined above. Kind regards, (...)

What you can do

We appreciate the emails that we’ve received from users. As you can see, action is being taken, albeit we are attempting to be both fair and methodical in our approach.

Please feel free to continue to share your concerns with us by emailing reply@vorboss.com. In addition, we encourage you to share your thoughts with Sourceforge directly.

If you think there is something else that we could or should be doing that isn’t covered in either of our responses above, please let us know.

What else we’re doing