The Debian project is considering a proposal from the DuckDuckGo search engine to accept a
percentage of the engine's advertising revenue that originates from web
browsers on Debian machines. The project already welcomes donations and
has several other organizations that make large contributions, but
DuckDuckGo's proposal would require some accounting that would dictate some small changes to the browser software — and that, in turn, raises thornier questions for the project's developers and package maintainers.
Stefano Zacchiroli, the current Debian project Leader (DPL), wrote
to the debian-project list on March 27, explaining that he had been
approached about a possible revenue-sharing agreement with the DuckDuckGo
search engine. Two alternatives were proposed.
In the first scenario, the company would donate 25% of its income from
inbound traffic on Debian systems (provided that DuckDuckGo is available as
a search engine option in a web browser). In the second scenario, the
company would donate 50% of its inbound-traffic income from Debian machines
if Debian set DuckDuckGo as the default search engine in the browser. In
both cases, the company proposed counting Debian traffic by using a
modified search URL:
requested that Debian send a periodic invoice to the company, presumably
based on the traffic statistics that the search engine already publishes.
Zacchiroli commented that he had discussed the search URL proposal with Mike Hommey, maintainer of the Iceweasel package (Debian's re-branded version of Mozilla Firefox), who had no objections to the proposed string modification. Zacchiroli said that he was "very much inclined to accept" the proposal, and asked for input from the rest of the project. In particular, he pointed out that DuckDuckGo had a publicly-visible history of donating to open source projects, including other distributions. The main risk, he added, was that the project needed to make clear to the company that the agreement would not interfere with package maintainers' freedom to make their decisions on purely technical grounds. That said, he expressed his confidence that the risk was negligible, and that the maintainers could be trusted to "keep on doing their thing."
Zacchiroli also solicited input from the maintainers of other browsers, clarifying in a later message that DuckDuckGo had initially proposed appending the term "iceweasel" to the search string, to which he and Hommey had counter-proposed "debian" in order to include all of the packaged Web browsers in the arrangement.
Several developers expressed concern that taking the "50% proposal" and
changing the default search engine would upset standing relationships
between Debian and the various browser projects, or between Debian and the
displaced search engine. Some questioned whether Mozilla or Google may
become unhappy with a change like this. Philip Hands asked
whether replacing Google as the default search engine would endanger
Google's sponsorship of DebConf or acceptance of Debian as a Google Summer
of Code mentor. Steffen Möller said
it would put Debian in "competition" with the upstream projects:
At the moment we are perceived as enthusiasts serving upstream developers
with the best possible presentation of their work. Once we start getting
money through their tools, they may possibly start thinking differently.
Clint Adams strongly disagreed with that sentiment, and said:
I reject and resent the idea that any software project has the entitlement to profit off of my web traffic.
Treating the change of a query string as theft is as ridiculous as broadcast TV stations telling me I'm robbing them by skipping commercials.
I was horrified to see this attitude espoused in the Ubuntu-Banshee episode.
Andreas Tille, on the other hand, asked whether Debian and Mozilla truly had a "good" relationship to begin with, given the renaming controversy of a few years ago. But ultimately Charles Plessy's viewpoint seemed to represent the views of most in the conversation, that the crux of the problem was in making a technical change from upstream's default for a non-technical reason.
Peter Samuelson suggested explicitly rejecting the 50% proposal outright, on the grounds that even the appearance of letting money influence a technical decision like the default search engine would be detrimental to the project. To that idea Zacchiroli replied that he had never intended to put the 50% option on the table, and meant only to open the floor to a discussion of the 25% proposal, even if that distinction had been unclear in his first message.
For his part, Iceweasel package maintainer Hommey commented
that he would not even "start to consider [DuckDuckGo] as a default
until it at least matches the user experience the current default engine
provides, including search suggestions and localized results." So
there would appear to be no possibility of Debian accepting the 50%
proposal at this time.
Privacy and partnership
Although general opinion on the list leaned in favor of the 25% proposal endorsed by Zacchiroli, several people raised concerns. The first was that even the 25% arrangement established too close of a link between the search engine provider and the activities of package maintainers. Möller, in the same message where he speculated about competing with upstream projects, suggested that it would be more consistent and ultimately preferable to list DuckDuckGo as yet another partner that donates to Debian, and ask them to donate whatever amount they see fit. Paul Wise agreed, and said that Debian's time should either be spent building a flexible, user-configurable system for controlling revenue sharing deals, or not to touch them at all.
Zacchiroli replied that although he can see the potential risk in the DuckDuckGo partnership unconsciously affecting the project, he was "quite convinced" that it would not impact the project. If nothing else, he said, the chain between the entity donating the funds (DuckDuckGo) and the people making technical decisions (individual package maintainers) is long enough to mitigate the risk.
Joey Hess raised
a privacy issue, noting that incorporating OS information into the
User-Agent (or, presumably, the search string itself, which was
DuckDuckGo's proposal) would amount to leaking information about the
machine to a third party. Thijs Kinkhorst observed
that there are already many ways for remote servers to know that a machine
is running Debian, including User-Agent and plug-in information. The fact
that Iceweasel identifies itself as such is enough, on its own, to identify
the system as being a Debian derivative, for example.
Regardless of how detailed the tracking abilities of DuckDuckGo's proposal
are, however, Zacchiroli argued that per Debian's governance model, the
ultimate choice ought to be left up to each browser package maintainer:
All in all, as a project we should simply see the agreement as something like "for every web browser in Debian who decides to use t=something, Debian will receive donations". If, due to the usual way we maintain packages, including upstream relationships, that set will shrink to nothing, too bad. The agreement will simply allow the set to exist, it will not magically fill it with browsers that implement t=something.
Send in the lawyers
Neither the hands-off-donation suggestion nor the privacy question garnered sufficient support to overwhelm the general interest in accepting the DuckDuckGo 25% proposal. The devils are always in the details, though — or, as Jonas Smedegaard commented when Zacchiroli described the 25% as "basically it", there is no "basically it" when legalese is attached.
Smedegaard asked for more details on Debian's end of the agreement, as
did others. Zacchiroli alluded
to clauses that allowed Debian to challenge the numbers in DuckDuckGo's
periodic statistical reports, and allowed either party to terminate the
arrangement, but he declined to post the agreement itself on the list
because neither side had agreed to make it public. He did make it
accessible to Debian Developers, however.
Hess noted that there was also a clause requiring Debian to provide 30 days advance notice before "releasing changes to the implementation of the links." Axel Beckert asked if that meant advance notice of any modifications to the packages, but Zacchiroli expressed his interpretation that only changes to the search string were covered by the clause.
Still other questions about the specifics bubbled up at the end of March, and have yet to be definitively resolved. For example, Russ Allbery asked if the proposed agreement dealt with Debian's relationship to downstream projects:
Is DuckDuckGo aware of the fact that Debian is upstream of a number of derivative distributions that just import our packages, and if we modify our packages to do this, other distributions will be counted as "Debian" for their revenue-sharing purposes even if they aren't exactly?
For example, Ubuntu would inherit this behavior for the web browsers they just import from Debian, unless they went out of their way to change it.
Related, do they realize that we cannot and will not enforce any of the terms of their contract with us on any derivative distribution that happens to import Debian web browser packages?
whether the deal broke with Debian's long-standing policy against
advertising. He cited a 2011 incident
where the Debian Med project was removed from the Planet Debian feed for
inviting users to shop online via an affiliate program that would direct
funds back to Debian. Plessy said he did not see much difference between
the two arrangements:
It is hard to guess where to draw the line between what is acceptable and
what is unacceptable regarding revenue sharing agreements and their
advertisement. I hope that the decision that will be taken about
DuckDuckGo's proposition will be accompanied by a clarification on what we
can generalise from it.
At this point, the general consensus appears to be in favor of accepting the 25% proposal, and leaving the decision about deploying the requisite search string change to the maintainer of each individual browser. With Hommey in favor of the change, and Iceweasel being the most well-known browser, Debian can probably expect to start seeing some revenue from DuckDuckGo.
Several project members asked whether there were projected revenue numbers attached to the proposal; Zacchiroli said that he had asked his contact at DuckDuckGo, but that no statistics were available. Consequently, what the deal means for the project is uncertain. "Considering we're talking about a non-default search option, I agree with Mike that the share of our searches will be quite low. But I've no idea how that would map to actual donations." Your author has no doubt, however, that the more slippery questions over adding trackable information to the search string and where to draw the line between acceptable and unacceptable revenue streams will crop up again — particularly if the search kickback ends up being substantial.
to post comments)