Re: [gentoo-nfp] Social contract and its effect on vendors and service delivery.

[Rich Freeman]

On Fri, Jun 26, 2020 at 4:17 PM Alec Warner <antarus@g.o> wrote:
>
> Is it against the social contract to purchase these CDN services?
> Is it against the social contract to purchase these CDN services, even if the services are provided via open source software?
>

IMO the obvious answer to the second question is that purchasing
services that are provided using FOSS is absolutely permitted by the
social contract.  Obviously we should be careful with money, but we're
allowed to spend money on services and in fact have done so in other
cases (like paying for a bug bounty, for accounting services, etc -
generally all using FOSS where it exists).

The first question is more of a grey area.  IMO something like a
mirror/CDN network is really not something we're "depending" on in the
spirit of the social contract.  They're just providing extremely
commoditized services based on completely open protocols, so if the
whole thing were to go away overnight the main thing we'd see is a
lower level of service, and replicating the network with another
provider would be trivial.  For our distfiles/rsync mirrors we don't
audit to make sure every one of those providers is using 100% FOSS,
and I doubt most of their servers are running coreboot.  Those mirrors
are just http/etc and nobody is going to notice if one is running IIS
for some reason.

Now, if we were going to host bugzilla or email or some other core
infra on non-FOSS software I think it would be a much larger concern.
I think the key is that the authoritative source is FOSS, and we're
just using vendors to mirror data using a black box mechanism and open
protocols.

But, I'll be the first to ack that this second bit is a grey area, and
I'm sure there will be others that disagree.  I think it is ok if a
social contract has a bit of grey around the edges, and ultimately the
community can decide how they feel about it.

I realize that you didn't want to get into the fiscal argument, but
I'd toss in my two cents here: it seems like we have a lot of orgs
that donate servers/etc and I know we're always getting requests on
pr@ for "sponsors" (usually cash for SEO, but maybe some could offer
actual hosting).  I actually like depending on donations in kind a lot
more than money because it tends to keep the org rooted in what serves
the broader FOSS/etc community vs being an org that handles a lot of
cash which can sometimes lose perspective.

-- 
Rich