Vorboss Response to Sourceforge Mirror Concerns

Summary

Vorboss Limited operates a number of mirror services (see KB15051405) broadly for the ‘good of the internet’.

One such mirror is operated on behalf of Sourceforge, owned by Dice Inc.

In the last couple of months there has been some controversy relating to some of the recent actions taken by Sourceforge, predominantly in relation to advertising placement on the site, and perhaps most crucially, within software downloads themselves.

This is well documented elsewhere, so we won’t repeat that content, nor will we attempt to pass judgement on that behaviour here.

We have received a number of emails from concerned users, most of which contain a direct request to cease providing service to Sourceforge with immediate effect.

We’ve requested that Sourceforge opens a dialogue with us over this matter, in addition we’ve taken the time to explain to users our position, and also what we’re doing about their concerns.

That correspondence is below. Please note that we haven’t (yet) had a response from Sourceforge.

Last updated 15 June 2015 at 20:30 UTC

What we’ve been saying to users

Most users who have emailed us with their concerns have received a response more-or-less like the one shown below. This has changed slightly over time, however the central message is essentially consistent:

Hi _______,

Thanks for your email. We’ve had a few others like this.

We have a difficult line to tread on this one. Vorboss operates a number of 
services ‘for the good of the internet’ – we have a variety of reasons for 
doing this; some are commercial, some are more altruistic. The mirrors that we 
operate (http://kb.vorboss.net/KB15051405) are one of several such services. 
I’m proud to say that we deliver well over 10TB of mirror data every month for 
no charge.

We’ve taken some time to consider the concerns that people have raised with 
Sourceforge – in general terms I’m in agreement with most of the objections.

This leaves us with some interesting questions:

  1. How do we more accurately define “the good of the internet”?
  2. How do we most effectively make our concerns about the direction of 
     Sourceforge heard?

On the most basic level, we made an agreement as a company to provide a mirror 
service to Sourceforge. So long as they are not in breach of our network usage 
policy (they aren’t), it would set a bad precedent to unilaterally withdraw 
that service, however much we might disagree with a change in the way it is 
used. At a minimum, we would honour the extent of our agreement, particularly 
in respect of notice periods.

To answer the first question, we presently feel that on balance, the content 
being downloaded from our Sourceforge mirror does more good than it does harm. 
Having said that, I agree that if the current trend continues this opinion may 
change. Ultimately, however, no one is forced to download their content. This 
really becomes an argument about the extent to which we protect the less 
technically literate users.

On the second point, we are of the view that as a major contributor to their 
content distribution network, we have a significantly better position than most 
users from which to lobby Sourceforge with regard to this trend. I won’t go 
into details on that, other than to say that we are making our concerns known.

In summary, whilst it’s very tempting to imagine that we might be in a position 
to “flick a switch” and turn the service off, we have to consider what 
obligations we have, what commitments we have made and also the most 
appropriate course of action to try and resolve this disquiet.

I hope that you find this to be a reasonable position and explanation – in the 
very least please be assured that we are not blindly providing service.

I welcome any more feedback that you have and will include that in our internal 
discussions on the matter.

Kind regards,

(...)

What we’ve said to Sourceforge

We have approached Sourceforge with these concerns. We are now happy to publicly share our letter to them (names redacted):

Hi ------,

We're increasingly being contacted by users who are concerned by recent 
changes at Sourceforge. These are all requests for us to discontinue our 
mirror support.

We'd like to have some dialogue with you on this topic to better understand 
your position and the direction of Sourceforge.

Please note that our internal criteria for determining whether will offer 
mirror support to a 3rd party can be summarised as:

  1. Our contribution should be for the overall ‘good of the internet’
  2. The reputational risk must be acceptable
  3. The security and availability risk must be acceptable
  4. The content provider has a legitimate need for financial or technical 
     support or resource

In light of the correspondence that we’ve received, it’s likely that we will 
need to review our status as a Sourceforge mirror on the grounds that:

  1. It may no longer be a net ‘good’ for the internet, especially if it 
     promotes the distribution of adware amongst less technically literate
     users
  2. There may be some increased reputational risk, especially if we don’t  
     [at a minimum] conduct a review of our service provision
  3. There may be an increased security and/or availability risk as a result  
     of the number of disgruntled 3rd parties
  4. The increased quantity of advertising suggests that Sourceforge is a 
     viable cash-generating business and may not have a genuine need for our
     service

Specifically in relation to point (4), I’d like to add that we allocate a 
finite amount of resource to providing mirror services. We therefore try to 
prioritise a balance towards those mirrors which are most necessary (i.e. 
where the projects are unable to fund this themselves).

Rather than jumping to conclusions, I’d appreciate it if we could first have a 
discussion to help inform our internal process as outlined above.

Kind regards,

(...)

What you can do

We appreciate the emails that we’ve received from users. As you can see, action is being taken, albeit we are attempting to be both fair and methodical in our approach.

Please feel free to continue to share your concerns with us by emailing reply@vorboss.com. In addition, we encourage you to share your thoughts with Sourceforge directly.

If you think there is something else that we could or should be doing that isn’t covered in either of our responses above, please let us know.

What else we’re doing

  1. We will continue to update this page if the situation changes.
  2. We are offering free mirror services to any project which is currently hosted at Sourceforge which feels uncomfortable with the current arrangement and is seeking to relocate. Please note that we are not actively soliciting these content owners.