DuckDuck Debian?

The Debian project is considering a proposal from the DuckDuckGo search engine to accept a percentage of the engine's advertising revenue that originates from web browsers on Debian machines. The project already welcomes donations and has several other organizations that make large contributions, but DuckDuckGo's proposal would require some accounting that would dictate some small changes to the browser software — and that, in turn, raises thornier questions for the project's developers and package maintainers.

Proposals

Stefano Zacchiroli, the current Debian project Leader (DPL), wrote to the debian-project list on March 27, explaining that he had been approached about a possible revenue-sharing agreement with the DuckDuckGo search engine. Two alternatives were proposed.

In the first scenario, the company would donate 25% of its income from inbound traffic on Debian systems (provided that DuckDuckGo is available as a search engine option in a web browser). In the second scenario, the company would donate 50% of its inbound-traffic income from Debian machines if Debian set DuckDuckGo as the default search engine in the browser. In both cases, the company proposed counting Debian traffic by using a modified search URL:

    https://duckduckgo.com/?q={{search}}&t=debian

DuckDuckGo further requested that Debian send a periodic invoice to the company, presumably based on the traffic statistics that the search engine already publishes.

Zacchiroli commented that he had discussed the search URL proposal with Mike Hommey, maintainer of the Iceweasel package (Debian's re-branded version of Mozilla Firefox), who had no objections to the proposed string modification. Zacchiroli said that he was "very much inclined to accept" the proposal, and asked for input from the rest of the project. In particular, he pointed out that DuckDuckGo had a publicly-visible history of donating to open source projects, including other distributions. The main risk, he added, was that the project needed to make clear to the company that the agreement would not interfere with package maintainers' freedom to make their decisions on purely technical grounds. That said, he expressed his confidence that the risk was negligible, and that the maintainers could be trusted to "keep on doing their thing".

Zacchiroli also solicited input from the maintainers of other browsers, clarifying in a later message that DuckDuckGo had initially proposed appending the term "iceweasel" to the search string, to which he and Hommey had counter-proposed "debian" in order to include all of the packaged Web browsers in the arrangement.

The 50%

Several developers expressed concern that taking the "50% proposal" and changing the default search engine would upset standing relationships between Debian and the various browser projects, or between Debian and the displaced search engine. Some questioned whether Mozilla or Google may become unhappy with a change like this. Philip Hands asked whether replacing Google as the default search engine would endanger Google's sponsorship of DebConf or acceptance of Debian as a Google Summer of Code mentor. Steffen Möller said it would put Debian in "competition" with the upstream projects:

Clint Adams strongly disagreed with that sentiment, and said:

Andreas Tille, on the other hand, asked whether Debian and Mozilla truly had a "good" relationship to begin with, given the renaming controversy of a few years ago. But ultimately Charles Plessy's viewpoint seemed to represent the views of most in the conversation, that the crux of the problem was in making a technical change from upstream's default for a non-technical reason.

Peter Samuelson suggested explicitly rejecting the 50% proposal outright, on the grounds that even the appearance of letting money influence a technical decision like the default search engine would be detrimental to the project. To that idea Zacchiroli replied that he had never intended to put the 50% option on the table, and meant only to open the floor to a discussion of the 25% proposal, even if that distinction had been unclear in his first message.

For his part, Iceweasel package maintainer Hommey commented that he would not even "start to consider [DuckDuckGo] as a default until it at least matches the user experience the current default engine provides, including search suggestions and localized results". So there would appear to be no possibility of Debian accepting the 50% proposal at this time.

Privacy and partnership

Although general opinion on the list leaned in favor of the 25% proposal endorsed by Zacchiroli, several people raised concerns. The first was that even the 25% arrangement established too close of a link between the search engine provider and the activities of package maintainers. Möller, in the same message where he speculated about competing with upstream projects, suggested that it would be more consistent and ultimately preferable to list DuckDuckGo as yet another partner that donates to Debian, and ask them to donate whatever amount they see fit. Paul Wise agreed, and said that Debian's time should either be spent building a flexible, user-configurable system for controlling revenue sharing deals, or not to touch them at all.

Zacchiroli replied that although he can see the potential risk in the DuckDuckGo partnership unconsciously affecting the project, he was "quite convinced" that it would not impact the project. If nothing else, he said, the chain between the entity donating the funds (DuckDuckGo) and the people making technical decisions (individual package maintainers) is long enough to mitigate the risk.

Joey Hess raised a privacy issue, noting that incorporating OS information into the User-Agent (or, presumably, the search string itself, which was DuckDuckGo's proposal) would amount to leaking information about the machine to a third party. Thijs Kinkhorst observed that there are already many ways for remote servers to know that a machine is running Debian, including User-Agent and plug-in information. The fact that Iceweasel identifies itself as such is enough, on its own, to identify the system as being a Debian derivative, for example.

Send in the lawyers

Neither the hands-off-donation suggestion nor the privacy question garnered sufficient support to overwhelm the general interest in accepting the DuckDuckGo 25% proposal. The devils are always in the details, though — or, as Jonas Smedegaard commented when Zacchiroli described the 25% as "basically it", there is no "basically it" when legalese is attached.

Smedegaard asked for more details on Debian's end of the agreement, as did others. Zacchiroli alluded to clauses that allowed Debian to challenge the numbers in DuckDuckGo's periodic statistical reports, and allowed either party to terminate the arrangement, but he declined to post the agreement itself on the list because neither side had agreed to make it public. He did make it accessible to Debian Developers, however.

Hess noted that there was also a clause requiring Debian to provide 30 days advance notice before "releasing changes to the implementation of the links". Axel Beckert asked if that meant advance notice of any modifications to the packages, but Zacchiroli expressed his interpretation that only changes to the search string were covered by the clause.

Still other questions about the specifics bubbled up at the end of March, and have yet to be definitively resolved. For example, Russ Allbery asked if the proposed agreement dealt with Debian's relationship to downstream projects:

Plessy asked whether the deal broke with Debian's long-standing policy against advertising. He cited a 2011 incident where the Debian Med project was removed from the Planet Debian feed for inviting users to shop online via an affiliate program that would direct funds back to Debian. Plessy said he did not see much difference between the two arrangements:

At this point, the general consensus appears to be in favor of accepting the 25% proposal, and leaving the decision about deploying the requisite search string change to the maintainer of each individual browser. With Hommey in favor of the change, and Iceweasel being the most well-known browser, Debian can probably expect to start seeing some revenue from DuckDuckGo.

Several project members asked whether there were projected revenue numbers attached to the proposal; Zacchiroli said that he had asked his contact at DuckDuckGo, but that no statistics were available. Consequently, what the deal means for the project is uncertain. "Considering we're talking about a non-default search option, I agree with Mike that the share of our searches will be quite low. But I've no idea how that would map to actual donations". Your author has no doubt, however, that the more slippery questions over adding trackable information to the search string and where to draw the line between acceptable and unacceptable revenue streams will crop up again — particularly if the search kickback ends up being substantial.