[tor-project] The Tor Project Social Contract

[Matthew Finkel]

On Wed, Aug 03, 2016 at 02:16:23PM -0400, Paul Syverson wrote:
> On Wed, Aug 03, 2016 at 07:34:03PM +0200, Lunar wrote:
> > Paul Syverson:
> > > On Wed, Aug 03, 2016 at 04:49:00PM +0000, Alison wrote:
> > > > The added line is "we will make most of our tools free of cost". Is that
> > > > descriptive enough?
> > 
> > I'm not sure it covers the intent that (at least for me) came with this
> > discussion. I'd like us to state we don't want cost to be a barrier to
> > access our tools, rather than just a half-statement.
> > 
> > > "Most" might invite people to contemplate what fraction of the tools are
> > > free of cost: Is it 51%, three-quarters, all but a few exceptions, etc.?
> > > This is a distraction from the point being made.
> > > 
> > > How about, "We will generally make our "
> > 
> > I like the long list, but it might be too long…
> > 
> > Anyway, another angle:
> > 
> >     3. Our tools are universally available to access, use, adapt, and
> >        distribute
> > 
> >     The more diverse our users, the less simply being a user of Tor
> >     implies about any user, so we aim to create tools that anyone can
> >     access and use. We do not restrict access to our tools unless it is
> >     for the security of all users. {+Wealth should not be a determining
> >     factor to access our tools, and we do our best to distributed them
> >     free of charge or at a fair price.+} We design, build, and deploy
> >     our tools without collecting identifiable information about our
> >     users.  We expect the code and research we publish to be improved by
> >     many different people, and that is only possible if everyone has the
> >     ability to use, copy, modify, and redistribute our tools.
> > 
> > I'm glad we're trying to improve this.
> 
> Me too. I don't like "fair price" though, since it is already
> contentious in many cases (As an example that sometimes surfaces in
> public: is including the cost of development of a drug or disease
> treatment a determiner of the fair price for the patient?)
> 
> Also, sometimes it's not the price per se but the need for
> an economic transaction that can be a barrier to access.
> 
> Here's another refinement on yours that maybe does what both
> of us want. (I also added back 'services' to 'tools' rather than give the
> whole list. Please object if you think even that is too much.)
> 
> >     3. Our tools are universally available to access, use, adapt, and
> >        distribute
> > 
> >     The more diverse our users, the less simply being a user of Tor
> >     implies about any user, so we aim to create tools that anyone can
> >     access and use. 
> 
> Ability to pay should not be a determining factor in access to our
> tools or services, and we do our best to make these available to all
> users without restriction. More generally, we do not restrict access
> to our tools unless it is for the security of all users.
> 
> >     We design, build, and deploy our tools without collecting
> >     identifiable information about our users.  We expect the code
> >     and research we publish to be improved by many different people,
> >     and that is only possible if everyone has the ability to use,
> >     copy, modify, and redistribute our tools.

Originally I favored Lunar's version, but after thinking about it for some
time I think Paul's phrasing is important and re-enforces a point Nathan
made about simply not having the option of paying for something, even if
someone can monetarily afford it.

I worry this commitment is becoming lengthy, but it's important and I'm glad
Mike started this discussion. I also just noticed a slight contradiction
that's now arising regarding restricting access to our tools. I'll try
rephrasing it. I also sometimes mis-read the first sentence and coupled "less
simply" instead of "simply being". I'll include a suggested rewording for that,
too.

  The more diverse our users, the less is implied about any person by simply
  being a Tor user.  This diversity is a fundamental goal and we aim to create
  tools and services anyone can access and use.  Someone's ability to pay for
  these tools or services should not be a determining factor in their ability
  to access and use them.  Moreover, we do not restrict access to our tools
  unless it is for improving the security of all users.  In addition, we expect
  the code and research we publish will be reviewed and improved by many
  different people, and that is only possible if everyone has the ability to
  use, copy, modify, and redistribute this information.  We also design, build,
  and deploy our tools without collecting identifiable information about our
  users.

Unfortunately, now the last sentence seems like an add-on and doesn't fit very
well. I think it's an essential commitment we should make, but maybe it doesn't
belong under #3? Is #6 a better place? On the other hand, now I worry this focus
on free access encourages advertisement-based solutions which are generally not
suitable for our goals, and explicitly saying we don't collect identifiable
information maybe prevents this. Should we mention third-parties? This seems
like a rabbit hole...

I think it's important we remember this is an aspirational document, too, and
not strictly something that describes what we do or could do in the future.