Re: Freexian, security and Debian

On Wed, Jul 22, 2026 at 03:20:42PM +0200, Lucas Nussbaum wrote:
> Hi,

Hi Lucas,

> On 19/07/26 at 19:57 +0300, Adrian Bunk wrote:
> > 2. Debusine, and Freexian in general
> > ------------------------------------
> > 
> > While it is laudable that Freexian has the explicit goal of helping 
> > Debian, Debian giving preferential treatment to one company might
> > outweigh the benefits when this drives away other contributors.
> 
> A long time ago, I was the DPL when Debian LTS was set up.
> 
> I was very careful at the time to defend a setup where mutiple actors
> could collaborate on Debian LTS. I think that this still holds: if
> someone if sufficiently unhappy with Freexian's contributions to LTS,
> there's space to setup other actors, with their own funding models.

it is not wrong that there is in practice exactly one company/delegation/...
for something like Debian LTS, many companies and individuals competing 
for Debian LTS sponsors wouldn't be better.

Currently the top news on our homepage talks about "Debian and its LTS 
Team" and suggests to our users to consider funding it, and "Freexian is 
just an intermediary company" on the page in our wiki this news links to 
does not sound as if this sponsorship we endorse is money Freexian could 
use for anything other than LTS.

My view of what is actually happening is that Freexian is developing 
from an unofficial for-profit subsidary of Debian with some transparency 
to a normal closed external company.

> > While there is valid criticism at the current use of GitLab in our core 
> > infrastructure,[1] using Debusine in our infrastructure would be worse:
> > 
> > Similar to GitLab, Freexian SARL is a private for-profit company.
> > 
> > Similar to Gitlab, Debusine is Open Source that is also commercially 
> > offered as SaaS.[2]
> > 
> > Worse than GitLab Inc., which is a neutral player providing equal offers 
> > to everyone in the Debian ecosystem, Freexian SARL is competing directly 
> > with the businesses and employers of many other contributors (including 
> > many DDs) in our ecosystem.[3]
> 
> Unlike GitLab, Debusine does not have an Open Core business model, where
> the editor could decide to remove important features from the Community
> Edition we are using. It is pure GPLv3 with no CLA. I think that's a key
> distinction.

GPLv3 would not make a difference if the company decided that only the
Community Edition would be available self-hosted, with the full version
only offered as SaaS.

An obvious example would be Debian adopting a strong anti-AI position,
since there is likely a good business case for AI support in the SaaS offer.

It is also not rare (e.g. Atlassian, SourceForge) that the self-hosted 
version is discontinued. Then we are in the alioth situation in any case.

> Lucas

cu
Adrian