Freexian & Debian: antitrust, unfair competition against joint authors and volunteers

In a previous report, we looked at how Raphael Hertzog wrote an advocacy for his wife, Sophie Brun, without declaring two significant conflicts of interest. Not only are they husband and wife, they are also business partners in the company Freexian SARL.

The advocacy email included Sophie's Freexian email address. Some people know Raphael Hertzog has some connection with Freexian, which he founded and when they see Sophie's email address, they will realise there is some connection. Nonetheless, the inclusion of Sophie's email address at Freexian is not the same as a declaring they are a married couple running a business together.

If Debian is going to be honest with our community and our values then we need to declare things like that.

Legal framework for handling cults in France

In 2000, the French parliament passed the About-Picard Law 2001 to criminalise some of the most extreme cases of exploitation and brainwashing.

In 2024, a new law was created for defence against extremist groups and support for victims.

The use of public humiliations and Code of Conduct gaslighting means that Debianism is a form of cult under French law.

Australian Rugby team stayed near Freexian

French business records show us that Freexian SARL is located just north of Saint-Etienne. That is a small city about an hour away from Lyon.

I felt that detail in the story is important for another reason. When the rugby team from Australia plays in France, for example, at the recent Rugby World Cup 2023, they stay in Saint Galmier, which is immediately to the north of Freexian.

Remember, the former captain of Australian Rugby is Senator David Pocock and people frequently ask if he is related to me.

When rogue Debianists attacked my family, was it inspired by resentment of Australia's rugby team?

History of Freexian antitrust behaviour and unfair competition in business

In the United States, unfair business practices are prosecuted under criminal law. This is referred to as antitrust law in America or anti-competitive behaviour or unfair trading in Australia.

In France these are civil law disputes. In the French language, the term concurrence deloyale is used to describe antitrust behaviour.

In 1999, we found examples of Raphael Hertzog helping to recruit Decklin Foster, one of the developers who subsequently disappeared. Decklin Foster was also employed at ActBlue, the fundraising platform for the US Democrats, which is currently facing various scandals in Washington.

In 2005, Raphael Hertzog founded Freexian SARL.

The brief history of the corporation is available from the French government business directory.

A more complete history is available at INPI.

The same year, there was a Debianism weekend at TU Darmstadt, a German university, where unpaid developers had to sleep on the desks. Yet some businesses like Freexian SARL seem to be getting money out of Debianism.

There is a public list of participants. We can see that both Raphael Hertzog and one of the confirmed suicide victims, Frans Pop were both at the same work weekend. Was Raphael Hertzog one of the people sleeping on a table?

 

In this email from 2005, Raphael Hertzog is using the organisation name "Debian" in the message headers and he is using the names "Ouaza" and "Freexian" in the message signature at the bottom. In other words, he uses the names of these organisations interchangeably. He is exerting influence over other volunteers who are not employees of his company:

Subject: Re: WTF: Debian security, ex. Linux kernel vulnerabilities
Date: Wed, 21 Sep 2005 08:41:50 +0200
From: Raphael Hertzog <raphael@ouaza.com>
Organization: Debian
To: Martin Schulze <joey@infodrom.org>
CC: security@debian.org, leader@debian.org, debian-private@lists.debian.org

Le mardi 20 septembre 2005 à 16:21 +0200, Martin Schulze a écrit :
> The proper contact would be the security team.

Hi Joey,

I understand that it's difficult to respond to such aggressive mails.
However I believe that the concerns raised are reasonnable.

Andreas he's not the first one detecting very big delays in security
updates. We have all read your various blog posts when you had troubles
with the infrastructure in june... and you're aware that the delays have
been recently mentionned on a LWN article (and now the infrastructure
should be working fine).

It looks like the security team has a real problem in manpower (even if
several people are listed on the team, we need more people which stay
active like you do). And I don't see any evidence that work is done to
resolve this problem.

Please take a few minutes to explain what's planned to fix the various
issues and don't hesitate to ask for help, we have plenty of people
willing to help (maybe you can find skilled volunteers among the
secure-testing team?).

Cheers,
-- 
Raphaël Hertzog -+- http://www.ouaza.com

Freexian : des développeurs Debian au service des entreprises
http://www.freexian.com

Throughout the life of this business, Raphael Hertzog has been using the non-profit Debian infrastructure to promote the business in various ways. For example, Freexian monthly reports are cross-posted on Planet.debian.org, there is a Freexian group in the Salsa Git hosting environment, there is a Freexian tag in bits.debian.org.

 

 

In 2006, there were widespread news reports about the DebConf fight. The leader of Debianism was AJ Towns. He sent a report identifying Holger Levsen as the prime suspect:

Subject: Events at the DebConf Dinner
Date: Fri, 19 May 2006 10:41:19 -0500
From: Anthony Towns <aj@azure.humbug.org.au>
To: debian-private@lists.debian.org
CC: ted@reactor-core.org

Hi,

As promised, details from the dinner:

Ted was seen walking ...

[ ... snip ... ]

As I understand it,

Amaya Rodrigo Sastre asked

Fabio who the lady was, and was led to believe
that she was a prostitute.

[ ... snip ... ]

One of the volunteers, Ana Guerrero, spoke to Hilda and suggested that
it might be a good idea for her to leave.

[ ... snip ... ]

... and the question of whether she was or was not a prostitute was
not raised. As I understand it, at this point Hilda did leave, however
was encouraged to return by Ted and his long-time friend and co-worker,

John Sokol, a former developer of 386BSD and an attendee at DebConf.

At some point, I believe shortly after she returned, some attendees then
decided that it would be all right if she stayed, but Ted left. At this
point Holger and Moray, as mentioned above, manhandled Ted across the
dining hall to the door, where they were intercepted by John. At this
point the rest of the attendees noticed that something was going on, and a
group gathered around ...

[ ... snip ... ]

at which point Ted told him to "Get off me you fucking Nazi".

[ ... snip ... ]

I escorted Ted and
Hilda back to their seats to separate them from the other attendees who
were clearly angry, and tried to determine what was going on. At about
this time, Amaya and Fabio had a heated argument in Spanish, which Amaya
later indicated involved Fabio claiming that Hilda was not a prostitute,
and that he had never said anything that should give that impression.

I also spoke with Moray and Holger, who by this time were talking with
Bdale and some other developers who hadn't been involved, and indicated
that grabbing people to throw them out of the room was entirely wrong. At
this point they both remained extremely angry at the situation, and had
very little to say. I don't believe resorting to violence is remotely
appropriate within Debian, and had the opportunity to speak further about
this with Moray this morning, and hope to have a similar opportunity to
speak with Holger shortly.

[ ... snip ... ]

The report indicates that Holger Levsen was the front man for the mob that rose up against Ted Walther.

The report leaves out one key detail: Amaya Rodrigo Sastre, who was present at the moment the rumour started about Ted Walther bringing a prostitute to the dinner, was actually sleeping with Holger Levsen. This is a common pattern throughout the history of Debianism, the girlfriends are there to start gossip and the boyfriends get worked up into a rage and attack people to please their girlfriends.

Holger Levsen goes on to become one of the key figures in the founding of Debian LTS with Freexian.

Shortly after this, at RMLL in 2006, a group of Debian Developers (joint authors) living in France or having a strong connection to France decided to form a local non-profit association under French law. The name of the association is simply Debian France.

In 2009, Raphael Hertzog and Sophie Brun Hertzog had their first baby at the onset of the Debian pregnancy cluster.

As part of the annual Debianism election process, Enrico Zini asks each candidate:

Please write a list of 5 Debian Developers you would like to kick out of the project.

Enrico Zini becomes known as an attack dog who is used to spread rumours and inflict punishments on other volunteers. He is eventually rewarded with a contract from Freexian after attacking me on multiple occasions.

Think about it for a moment, if your dog bites five people, the authorities are going to have it put down. When Enrico Zini wants to hit people with a hammer, they start talking about whether to use a big hammer or a little hammer.

On 15 August 2010, the night before the Debian Day anniversary, Frans Pop sends his resignation / suicide note to debian-private.

On 17 April 2011, on the same day Carla and I got married Adrian von Bidder-Senn died in Switzerland and it was discussed like a suicide. Read the detailed history of the death. This death marks a significant step change in the rudeness of certain people towards my family and I, leading to various plots and conspiracies in the years that followed the death.

Think about how horrible it is to recall a suicide like this on your wedding anniversary each year.

On 5 May 2011, Raphael Hertzog registered the domain name debian-handbook.info and began using the name in his email signature. Nobody has ever made any dispute about this domain name but they viciously attack other people who register domain names for our Debian work.

Here is an example of Raphael Hertzog interacting with Dropbox about secretly putting binaries into user home directories. The email has his domain name debian-handbook.info at the bottom.

Subject: [rian@dropbox.com: Re: Dropbox Debian Package]
Date: Fri, 28 Oct 2011 10:45:52 +0200
From: Raphael Hertzog <hertzog@debian.org>
To: debian-private@lists.debian.org

[ ObPrivate: I'm sharing a private mail that I don't want to post
  publicly. ]

Hello,

when I packaged nautilus-dropbox, I patched it so that the non-free
software is downloaded and installed in /var/lib/dropbox
instead of ~/.dropbox-dist/. Upsream is unhappy with this because
it means they cannot auto-update the version of dropbox
on user's system.

I have argued using several arguments: first it was not compliant
with the FHS, that software ought to be installed by the admin
and run by the user, and that software should not change
without the user's consent. I added that duplicating the binaries on each
user's account was non-optimal. I also said that it was not good security
wise to have the binaries owned by the user. I might have been a bit
quick in asserting that.

In any case, I wonder what other people think, am I right in
persisting that the official Debian package should not allow
auto-update of the software by installing a copy in $HOME by default?

If yes, what other arguments would you bring forward to convince
them given the response they made to me so far?

Cheers,

PS: The attached mail should never be disclosed.
-- 
Raphaël Hertzog ◈ Writer/Consultant ◈ Debian Developer

Pre-order a copy of The Debian Administrator's Handbook and
help liberate it: http://debian-handbook.info/go/ulule-rh/

In 2012, Raphael Hertzog became president of the non-profit association Debian France. He had this role at the same time that he was running his private company using the Debian trademark. Both the private company and the non-profit association were using the trademark without permission from the wider body of joint authors. This is one of many examples of the French developers simply going out and doing something spontaneously without waiting for authorisation.

Sylvestre Ledru, who is connected with Mozilla, was elected as treasurer.

In 2013, Raphael Hertzog and Sophie Brun Hertzog had their second baby.

In the same year, French developer Lucas Nussbaum was elected for a one year term as leader of Debianism.

Immediately after being elected, Lucas Nussbaum announced he was taking a vacation by sending an email to the debian-private (leaked) gossip network. Of particular interest in the scandal about Debian France and Debian LTS, we can see the trademark@debian.org email address is also on CC:

Subject: [VAC] 28/04 -> 04/05, French Alps
Date: Fri, 26 Apr 2013 19:15:09 +0200
From: Lucas Nussbaum <lucas@debian.org>
To: debian-private@lists.debian.org
CC: trademark@debian.org

Hi,

I'm taking a little break next week. I'll read email at least once every
two days and deal with the urgent things, but I'll postpone non-urgent
things until after that.

I offer beer + key-signing to anyone willing to visit, but be warned
that this involves 1.5 hour of ski touring to reach where I'll be staying.
(GPS: 45.549, 6.918)

Lucas


-- 
Please respect the privacy of this mailing list. Some posts may be declassified
3 years after posting as per http://www.debian.org/vote/2005/vote_002

Archive: file://master.debian.org/~debian/archive/debian-private/

To UNSUBSCRIBE, use the web form at .

He shares his GPS coordinates in the email to debian-private. For all those spreading conspiracy fact about military infiltration of Debianism, could this be the proof?

In January 2014, Red Hat announced they had acquired CentOS and given jobs to the CentOS developers. This created a motive for people to provide a service similar to RHEL and CentOS but based on Debian.

Shortly after that, the leader of Debianism, Lucas Nussbaum, asked Debian France, FFIS (Germany) and debian.ch (Switzerland) to respond to questions about their status under the wider Debian constitution.

On 14 Febuary 2014, Raphael Hertzog, in his role as president of the non-profit Debian France, began sending responses on behalf of the non-profit. His email does not explain anything about his private Debian business and the relationships between the private entity, the non-profit entity and the Debian Developers who simultaneously have roles in more than on organisation.

Somebody who follows Debianism closely will look at that email and understand there are some conflicts of interest. Somebody external to the organisation or somebody reading these documents in the distant future may not be aware of the conflicts of interest. That is why it is vital for the conflicts of interest to be repeated in each critical piece of correspondence where they are relevant. In this case, with the leader of Debianism also being a French person and likely member of the Debian France association that was under scrutiny, it may have been better for Lucas Nussbaum to delegate the examination of the relationships to another subordinate who is well outside the clique of French developers.

In early 2014, the Freexian web site begins promoting a service called Debian LTS. The name of the service Debian LTS is clearly based on the Debian trademark. There is no record of any authorization for Freexian SARL to use the trademark like this.

Raphael Hertzog began using the trademark like this for his private business Freexian SARL at exactly the same time he was acting on behalf of the non-profit association Debian France in their negotiations about using the trademark in the name Debian France, becoming a "Trusted Organisation" and handling assets on behalf of the global body of joint authors. He was aware of various discussions about the strengths and weaknesses of the strategy joint authors had developed for protecting the trademark.

Raphael Hertzog was privy to private discussions about the rights of individual joint authors and third party organisations wanting to use the trademark for economic benefit. At exactly the same time those discussions were taking place, he cleverly designed the Debian LTS service name and began using it to entice other organisations to sign contracts with his external business.

On 14 April 2014, the French developer Lucas Nussbaum was elected for a second year as leader of Debianism.

On 12 May 2014, the Debian Project News email is distributed by French developer Cédric Boutillier. These newsletters are distributed very widely to people who don't subscribe to the email discussion lists. Cédric Boutillier includes comments about Freexian's project Debian LTS:

Subject: Debian Project News - May 12, 2014
Date: Mon, 12 May 2014 22:27:19 +0200
From: Cédric Boutillier <boutil@debian.org>
To: debian-news@lists.debian.org

------------------------------------------------------------------------
The Debian Project                                http://www.debian.org/
Debian Project News                    debian-publicity@lists.debian.org
May 12, 2014                  http://www.debian.org/News/weekly/2014/08/
------------------------------------------------------------------------

Welcome to this year's eighth issue of DPN, the newsletter for the
Debian community. Topics covered in this issue include:

  * Debian members vote to accept a code of conduct
  * Registration open for DebConf14
  * SPARC removed from Jessie
  * Promising future for Debian in embedded systems
  * Bits from the Release Team
  * Bits from the systemd + GNOME sprint
  * Other news
  * Upcoming events
  * New Debian Contributors
  * Important Debian Security Advisories
  * New and noteworthy packages
  * Work-needing packages
  * Want to continue reading DPN?


Debian members vote to accept a code of conduct
-----------------------------------------------

Just after the election of the Debian Project Leader, Debian members
were called by Kurt Roeckx [1], Debian secretary, to vote on a general
resolution for a code of conduct proposed by Wouter Verhelst. This code
of conduct [2] promoting respect, good faith, collaboration, conciseness
and openness has been adopted by Debian Members [3]. It can be modified
via further general resolutions. More details about the results of this
vote can be found on the page of the website dedicated to this general
resolution [4].

    1: https://lists.debian.org/debian-devel-announce/2014/04/msg00004.html
    2: http://www.debian.org/code_of_conduct
    3: https://lists.debian.org/20140428213635.GA10933@roeckx.be
    4: http://www.debian.org/vote/2014/vote_002


[ ... snip ... ]

Bits from the Release Team
--------------------------

Regular security support for Debian GNU/Linux 6.0, "squeeze", will be
terminated [17] on May 31, 2014. A new suite named "squeeze-lts" and
containing only two architectures, i386 and amd64, will be made
available with support extended until February 2016 to provide a five
year support cycle. A reminder that the scheduled freeze date [18] for
Jessie has been set for six months from now on Wednesday, November 5,
2014. In the same message, Niels Thykier reported on the Release Team's
architecture meeting [19], held on April 12, 2014, about the status of
the architectures and considering their suitability for Jessie.
Recursive auto-removals have returned, with warnings to the maintainers
of the involved packages prior to removal.

   17: https://lists.debian.org/debian-security-announce/2014/msg00082.html
   18: https://lists.debian.org/debian-devel-announce/2013/10/msg00004.html
   19: https://lists.debian.org/debian-devel-announce/2014/05/msg00000.html


Bits from the systemd + GNOME sprint
------------------------------------

Jordi Mallach sent bits [20] from the Debian sprint where the Debian
GNOME core team and systemd Debian maintainer gathered in Antwerp,
Belgium. Over two days, the ten participants discussed a variety of
topics to do with systemd and GNOME integration in Debian. After some
improvement in the packaging workflow for systemd, version 208 of
systemd has been uploaded to experimental. The GNOME team initiated
several transitions, improved the status of GNOME 3.12 in Debian [21],
and discussed the feasibility of having Debian Jessie shipped with 3.14.
The participants also jointly discussed how to configure and start
display managers, and may have come to a working solution to this
problem, which is complicated by the number of packages providing
display managers and init systems. They also used this opportunity to
sign new, stronger GnuPG keys in order to help the effort to abandon
older and weaker keys [22]. The participants thank the sponsors, most
notably INUITS, which provided the venue, and Debian and its donors for
covering the travel expenses for five of the attendees. A few of the
attendees were kindly sponsored by their employers.

   20: https://lists.debian.org/20140501232614.GA29827@oskuro.net
   21: http://www.0d.be/debian/debian-gnome-3.12-status.html
   22: https://lists.debian.org/20140303181359.GA68761@gwolf.org

[ ... snip ... ]

On 27 May 2014, Axel Beckert (XTaran) creates a section in the official Debian wiki server for Freexian SARL's "Debian LTS" service (wiki log).

In 2014, Linuxhotel, which is closely aligned with the FSFE misfits, began giving money to Freexian SARL. In fact, Linuxhotel appears to be one of the founding sponsors of Debian LTS.

On 16 June 2014, the Debian Publicity Team publishes an announcement on the high-profile Debian web site where they promote the Freexian company:

For organizations that cannot contribute their own workforce to the LTS team, Freexian — a French company owned by Debian Developer Raphaël Hertzog — offered to act as an intermediary between organizations interested in funding LTS work, and individual Debian contributors preparing LTS security updates. For more information, see Freexian's description of their proposal.

In the same announcement, they pretend that Debian LTS is being created by volunteers.

We would like to thank the volunteers who joined the LTS team

On 8 July 2014, Lucas Nussbaum, in his role as leader of Debianism, publishes an email with a list of four non-profit associations authorised to hold money and other assets on behalf of Debianism. The Debian France association is included on the list.

In November 2014, Raphael Hertzog admits that the Code of Conduct is used for censorship. When people ask questions about Freexian SARL business practices with the Debian trademark / Debian LTS service name, the developers paid by Raphael Hertzog can start a pestering campaign sending messages to "debian-moderation".

 
Subject: Host COC related discussions on a new list
Date: Wed, 26 Nov 2014 09:37:50 +0100
From: Raphael Hertzog <hertzog@debian.org>
To: Miriam Ruiz <miriam@debian.org>
CC: debian-private@lists.debian.org <debian-private@lists.debian.org>

Hi,

On Tue, 25 Nov 2014, Miriam Ruiz wrote:
> We seem to be moving in circles, with the same arguments and
> contra-arguments all the time. The current recursive pattern we are
> having is:

Indeed, let's see if we can improve this. For example by moving
COC-related discussion to a new list nicknamed
debian-moderation@lists.debian.org.

> a) Person X says something inappropriate, without consciously wanting
> to offend or without acknowledge that whatever they say might be
> offended
> b) Person Y complains about it and say that it's not appropriate

That person Y would reply privately to the person and put
debian-moderation@lists.debian.org in copy. If enough persons do the
same, X is more likely to apologize.

> c) Either person X apologizes or a significant number of other people
> acknowledge that it was indeed inappropriate, then try to turn page
> ang move on
> d) Other people become upset that person X's comment was critisized
> and turn the debate into an abstract discussion about censorship

At the same time, if we have other people who dislike the message
of Y, because they don't agree, the discussion would stay on
debian-moderation (or more likely there would be no discussion at all
because those persons are unlikely to subscribe to debian-moderation
at all).

What do you think ?

debian-moderation@lists.debian.org would only allow subscriptions
by Debian contributors (to avoid external trolls). It could be watched
by listmasters to send official warnings when they see someone has gone
too far.

I'm not sure about the archives. I would like to keep them public but I'm
not convinced that it's necessarily a good idea.

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: http://www.freexian.com/services/debian-lts.html
Learn to master Debian: http://debian-handbook.info/get/


-- 
Please respect the privacy of this mailing list. Some posts may be declassified
3 years after posting as per http://www.debian.org/vote/2005/vote_002
Archive: file://master.debian.org/~debian/archive/debian-private/
To UNSUBSCRIBE, use the web form at <http://db.debian.org/>.

On 29 January 2015, an official meeting of Freexian was conducted. The minutes were filed with the local tribunal and they are available here. The first thing to note is the appointment of Sophie Brun Hertzog as a director. Notice that here she is using her married name while in Debianism she is one of the women deceiving people with the use of her maiden name.

 

The second thing to note from the meeting minutes is the fact these people are paying themselves a salary and giving themselves five weeks paid vacation each year. Remember the people who killed themselves? Remember the people sleeping on the desks at TU Darmstadt? Did they ever get a vacation or were they victims of exploitation?

 

In 2015, Raphael Hertzog ceased being president of the non-profit Debian France and became an ordinary member of the board. Nicolas Dandrimont became the new president of the non-profit association.

In 2015, Sophie Brun Hertzog left her career as an industrial engineer and began working in technology as part of her husband's company Freexian.

In October 2015, Chris Lamb begins receiving payments from Raphael Hertzog and Freexian.

Another blog post from Hertzog tells us they pay people EUR 75 per hour. The blog post alerts us to various concerns about the way Debianism has fallen into disrepute. Hertzog states that to receive money, "you are Debian Developer or a Debian Maintainer". In other words, they realize they can negatively impact somebody's economic situation by disparaging their ability as a Debian Developer.

The same checklist states:

you must respect the Debian code of conduct and respond to queries about your work from fellow community members;

The implication is that Debian's Code of Conduct gaslighting requires unpaid volunteers to be available twenty four hours per day, seven days per week or they will impede your employability. This is a form of blackmail that enables modern slavery.

When people talk about the Code of Conduct gaslighting in Debianism, they try to imitate the language of professional organisations but what they are really telling us is that we are not allowed to ask questions about money.

In other words, when this Code of Conduct gaslighting arises, both Debianism and Freexian end up in violation of the French criminal code in respect of cult-like organisations.

Under copyright law, all joint authors are entitled to an equal share of every donation. We are all entitled to see accounts for the donations received, including the names of the donors. All those details are hidden from us. From time to time, emails like this appear from joint authors who are blissfully unaware of what is really happening with the money:

Subject: Debian funding model
Date: Thu, 26 Nov 2015 12:34:26 +0800
From: Paul Wise <pabs@debian.org>
Organization: Debian
To: debian-private <debian-private@lists.debian.org>

On Wed, 2015-11-25 at 22:35 -0200, Thadeu Lima de Souza Cascardo wrote:

> The Conservancy has been put in this critical situation because they
> depended on companies (or their surrogate) for funding.

I wonder what Debian's current funding model is; clearly we have both
corporate funding (mostly of DebConf) and individual donations, but I
wonder what the proportion is, whether we should be shifting more of
that towards funding based on individual supporters and what the
consequences of a shift towards that could be and how it could work. 
Could the auditors or DPL comment on this?

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

In June 2016, people begin a campaign of defamation against Dr Jacob Appelbaum. Of particular note was an email that Enrico Zini sent to a journalist demanding that news reports should not question the credibility of the gossip and they should present the gossip as fact.

The defamation conspiracy was so intense that people vandalised Dr Jacob Appelbaum's home in Berlin.

 

Paul Tagliamonte suggested using the Debian Press Team / Debian Publicity Team gangsters to spread the defamation as far as possible. Notice how Tagliamonte is always top-posting in this email thread. This is against the convention of replying in-line that is normally followed in Debianism. The top-posting is often a sign that somebody is sending the emails from a mobile device while at their workplace. In the case of Paul Tagliamonte, his workplace was the White House.

This is significant because Freexian subsequently employees a member of the Debian Publicity Team who they can use as a weapon of defamation against commercial rivals.

Subject: 	Re: Expulsion of Jacob Appelbaum <error>
Date: 	Tue, 21 Jun 2016 07:37:43 -0400
From: 	Paul R. Tagliamonte <paultag@gmail.com>
To: 	Russell Coker <russell@coker.com.au>
CC: 	Debian Private List <debian-private@lists.debian.org>



Seems like a thing the Press team could help coordinate.

On Jun 21, 2016 7:27 AM, "Russell Coker" <russell@coker.com.au> wrote:

    http://www.itwire.com/business-it-news/open-source/73441-appelbaum-banned-from-debian-events-after-sexual-misconduct-charges.html

    Well the DPL has decided to go public about it after all.

    In future I think it would be better to have a plan for these
    things. To have an argument on this list about whether information
    should be released while the DPL is sending it all to a journalist
    isn't the way things should go.

    On 21 June 2016 8:57:56 PM AEST, Jonathan Dowland <jmtd@debian.org>
    wrote:
     >Please do not CC me, I am subscribed to the list.
     >
     >On Tue, Jun 21, 2016 at 08:04:01PM +1000, Russell Coker wrote:
     >> Mattia suggests that it's already public that he was expelled for
     >anyone who
     >> knows how to interpret it.
     >>
     >> Why can't we just state it outright instead of leaving clues in
     >Wikipedia?
     >> The social contract says that we won't hide problems. Why are we
     >trying to
     >> hide this problem?
     >
     >I don't think Debian has taken ownership of whatever is written on
     >Wikipedia,
     >but we certainly aren't hiding it: It's there on the NM page in plain
     >sight.
     >There's a big difference between hiding something and making an active
     >effort
     >to draw attention to it.
     >
     >The action that has been taken has been for the sake of the safety and
     >well
     >being of other Debian members, NOT as some kind of white-knight
     >publicity
     >stunt. There's no *need* to shout it from the rooftops as that
    does not
     >further the former goal.

    --
    Sent from my Samsung Galaxy Note 3 with K-9 Mail.

Here is one of the messages that Enrico Zini sent to a journalist:

Subject: On coverage of Abbelbaum being "banned" from Debian
Date: Wed, 22 Jun 2016 09:34:50 +0200
From: Enrico Zini <enrico@enricozini.org>
To: andrew.matler@itwire.com
CC: debian-private@lists.debian.org

Dear Editor in Chief of iTWire,

you may want to do something about this article by Sam Varghese on
Debian revoking membership of Jacop Appelbaum:
http://www.itwire.com/business-it-news/open-source/73441-appelbaum-banned-from-debian-events-after-sexual-misconduct-charges.html

While the first part is factually correct in its DPL quote, the article
ends with baseless hints of Debian and Tor having fallen victims to
manipulations by GCHQ psyops.

[ ... snip ... ]

In October 2016, Nicolas Dandrimont, who was both president of the non-profit Debian France and an administrator in Google Summer of Code and Outreachy ask me to consider his partner, who appears to be a much younger man undergoing transgender conversion, as a candidate for the paid Outreachy internship, this was the Debian Paris love nest scandal. Obviously there are huge ethical concerns in offering diversity money and status in the community to a young man as they are considering a gender change. It is not clear if the scandal was known througout all of the Debian France board of 2016, which included Raphael Hertzog.

In April 2017, Chris Lamb was elected leader of Debianism.

Throughout the time Chris Lamb was director of Debianism, he was also receiving payments from Freexian SARL. Here is a report from April 2017, the month where he was elected. People seemed to know they were voting for an employee of Freexian to be leader of Debianism. Here is an example of a report from December 2017 where Freexian SARL admits paying Lamb for 13 hours work in October 2017. For January 2018, they report paying Lamb for 18 hours work. Similar reports are available for other months.

On 25 April 2017, one week after Chris Lamb was elected leader of Debianism, the fellowship elected me as their representative to the Free Software Foundation Europe in Berlin. The date is significant because it is ANZAC Day. In the world of Debianism, there seemed to be significant resentment on the part of Chris Lamb because his ego could not tolerate the fact that another Debian Developer had been elected into a significant leadership role at exactly the same time as his election.

At the same time, I was employed by one company in the UK and I was also running another company based in the UK. The UK was still part of the European Union. My employer, the other company and Raphael Hertzog's company Freexian SARL were competitors.

Immediately after the Debianists elected Chris Lamb as the leader, Jeremy Bicha, who was on parole for child sex and incest, had the confidence to request permission to become a Debian Developer too. As described in a dedicated reported on the subject nobody expressed any concerns about that guy and his history.

In May 2017, Chris Lamb and I both went to the OSCAL conference in Tirana, Albania for the first time. The OSCAL conferences were run on weekends as a social / hobbyist activity.

It was a very relaxed event and one of the Albanian organisers, Elio Qoshi, who was 24 years old, brought his girlfriend. I only discovered about this a few months later: the girlfriend was only 15 or 16 years old. Here is a picture where Freexian employee/contractor Chris Lamb and Elio Qoshi are pictured together at the Red Hat table.

 

 

Here is that picture of ex-Prince Andrew, Jeffrey Epstein and Lord Mandelson together in their bathrobes.

 

I think it was July 2017 when other women told me about the underage scandal. Another few weeks later, the man responsible, Elio Qoshi, resigned from his role as a Fedora ambassador. Red Hat, who are responsible for Fedora, did not give any warning about the situation to other volunteers. See the reports about the Albanian female whistleblowers for more details about how the scandal was exposed.

In September 2017, we received the black cat harassment judgment in favour of our cats. This was about paw behaviour. In Zurich a dispute like this is normally a private matter but rogue Debianists started spreading rumours about harassment.

In November 2017, I moved from Zurich, in the German-speaking part of Switzerland to Lausanne in the French-speaking part of Switzerland.

While I am a native English speaker, my knowledge of French is better than my knowledge of German. My home in Lausanne was much closer to the headquarters of Freexian SARL in Saint-Étienne, France.

Looking at the map, we can see how the business centres of Lyon and Geneva are very close to each other. Consultants and small businesses from cities throughout the region are competing against each other for the same pool of clients.

 

Freexian SARL has a lot of French clients in the region and they also recruited some clients in Switzerland, including CERN, Wingo, Roche and Adfinis AG, a notable Red Hat partner.

Various leaks show that Chris Lamb, an employee or subcontractor of Freexian SARL began engaging in antitrust or unfair trade practices. The relationship between joint authors of Debian is a peer to peer relationship. The Debian Project Leader, who was Chris Lamb, does not pay us and therefore does not have any right to give orders to the rest of us. Nonetheless, Chris Lamb would regularly impose upon people and he would spread defamatory rumours about people who refused to obey him.

In January 2018, I went to St-Cergue for the event Rencontres Hivernales du Libre. This annual event is in a mountain village just north of Geneva. I think this is when people first realized I had relocated to the French-speaking region and started plotting against my family and I. It is an event where people do technical work and ski:

 

In March 2018, Anisa Kuci, one of the Albanian female whistleblowers sends an email thanking me for my support and confirming that Elio Qoshi, with the underage girlfriend, is the root cause of all harassment and abuse problems:

Subject:        Re: "free travel"
Date:   Mon, 5 Mar 2018 23:51:28 +0100
From:   Anisa Kuci <anisakuci9@gmail.com>
To:     larjona@debian.org
CC:     Chris Lamb <lamby@debian.org>, Daniel Pocock <daniel@pocock.pro>,
leader@debian.org, antiharassment@debian.org


Hello Chris, Daniel, Laura,

Thank you very much for being so supportive.

I read the comments on the thread and to be honest I am really sad that
Elio [Qoshi] said that. It is not true at all.

They (Elio & Redon) pretend to support women but on the other hand their
behavior towards many of us shows the opposite.

Daniel I feel bad because you have encouraged and helped not only me,
but so many other people, no matter if they are Open Labs members or
not, and also all the attendees from Kosova to learn new things, to work
and improve their skills and knowledge. They are doubting your good
intentions just to remove the attention from the shady things that they
are doing.

The free travel comment is really offensive to me and i feel it should
be offensive to every woman who is part of the community.
I have been contributing and supporting Open Labs since its early days,
and I have put a lot of effort and time, I do this because I believe in
what it is meant to stand for and without waiting something in exchange,
but the situation lately has been not very positive. Daniel has been
present by chance in few cases where situations have been very hard to
go through.

I would definitely like to talk to any of you and tell you more about
everything that is happening here, its fine to me whether it is a video
call, call or just emails.
Please tell me what would be more convenient to you.

King greetings,
Anisa

On 5 March 2018 at 18:10, Laura Arjona Reina <larjona@debian.org> wrote:

    Hello

    El 5 de marzo de 2018 17:40:00 CET, Chris Lamb <lamby@debian.org> escribió:
    >[Adding antiharrassment to CC]
    >
    >Daniel Pocock wrote:
    >
    >> If Elio or anybody else has made any other comments like this on the
    >> private members channel or Telegram and you want to discuss them with
    >me
    >
    >[..]
    >
    >Anisa, please feel to drop Daniel from any replies you wish to make, if
    >you even wish to do so.
    >
    >(Daniel, thank you for your concern but we have got it from this point
    >onwards. There will be no need for you to reply further on this
    >thread.)
    >
    >

    I may be silent but I'm listening (reading here and also subscribed
    to the OpenLabs Forums, and up to date with the (public) English
    posts so far).

    Ping me if you need anything.
    Best regards

    --
    Laura Arjona Reina
    https://wiki.debian.org/LauraArjona
    Sent with K-9 mail

Notice the condescending comments from the Freexian SARL employee/contractor Chris Lamb. He is trying to downplay the seriousness of the abuse and deter Anisa Kuci from making any written reply about it. She ignored him and she wrote the inconvenient truth at that moment in the history of the scandal.

Why was the Freexian SARL employee/contractor Chris Lamb trying to protect the 24-year-old Albanian man with an underage girlfriend? There are pictures of Raphael Hertzog's children at DebConf25 in France and a convicted paedophile Jeremy Bicha was invited to come to France and speak at the conference. Why are they covering up these paedophiles?

At exactly the same time, Francois Thiébaud of Switzerland, a brothel owner, had partnered with the greffier from a Swiss tribunal, Mathieu Elias Parreaux to sell legal protection insurance. The men in robes, the men in wigs and the men with trademarks all seem to enjoy having this power over women.

The Debian Code of Conduct gaslighting and the Swiss laws on criminal speech are very similar: they protect dirty men like these and they punish the people like me who took a risk to protect the dignity of our female colleagues.

In July 2018, I went to Strasbourg, in France for the Rencontres Mondiales du Logiciel Libre ( official 2018 RMLL web site). Other developers and Debian users saw that I was making an effort to establish connections in the French-speaking Debian and open source communities. Some people seem to resent the competition from an English-speaker (anglophone).

In reprisal and to frustrate my attempt to compete in the region, Chris Lamb, who was still a subcontractor of Freexian SARL, had formally recruited other joint authors, including Enrico Zini, to engage in harassment and defamation.

From: Chris Lamb <lamby@debian.org>
To: da-manager@debian.org
Subject: Requesting the demotion of Daniel Pocock (pocock)
Date: Sun, 05 Aug 2018 14:26:23 +0100

Dear Debian Account Managers,

I am writing to you to request that Daniel Pocock (pocock) be demoted
from DD to DM.

[ ... snip defamation ... ]

For the same month, August 2018, Raphael Hertzog / Freexian published a report where they admit they are paying Chris Lamb, the Debian leader, while he is actively seeking to raise the unwashed masses of social media fools against Freexian's competitors:

Like each month, here comes a report about the work of paid contributors to Debian LTS.

Individual reports

...

Chris Lamb did 18 hours.

...

Chris Lamb, Enrico Zini, Raphael Hertzog and Freexian have never paid anything to the rest of us. They simply have no right to give us orders or change the priorities of our work or tell us what we can and can't speak about.

The collusion between multiple people to exert control over somebody without paying that person is a form of criminal exploitation.

The defamation tactics used to exert control over people also serve to disrupt the competition between Freexian SARL and the companies operated by Chris Lamb's victims. Therefore, as well as being a case of defamation and exploitation, it is an example of antitrust behaviour or unfair competition.

DebConf18 was taking place at the same time Chris Lamb was engaged in this conspiracy to start rumours about my family and I.

Enrico Zini, a future employee of Freexian, gave a talk on 3 August 2018 on the topic "Multiple People". In the talk he hints at the gay power politics that is wrecking Debianism and humiliating healthy people. It looks like Chris Lamb sought to exploit these tendencies to add weight to his vendetta against my family and I.

At the end of November 2018, I attended the UN Forum on Business and Human Rights in Geneva. This was at the very moment the defamation gang was hard at work trying to create the impression that I am some kind of neanderthal or cave man. A video of me asking a question at the UN in Geneva sent the rogue Debianists into a frenzy:

When they saw the way I explained the inconvenient truth, these vicious attack dogs became even more determined to hurt my family and I.

In September 2018, Freexian employee/contractor Chris Lamb and the Albanian man with the underage girlfriend Elio Qoshi start distributing emails denouncing my family and I and encouraging people to attack me:

 

This is another extreme example of how people competing with Freexian are subject to dirty tricks. In fact, Israel's Mossad has also used Albanians in cyberwarfare against Iran.

At the same time, in September 2018, I published a report warning people that the FSFE misfits were engaged in identity fraud or what the French call parasitisme. Shortly after revealing the FSFE scandals, I decided to completely resign from the FSFE.

In November 2018, Matthias Kirschner, who is president of the FSFE misfits met with the Freexian employee/contractor Chris Lamb at the SFSCon in Bolzano, Italy. They had a discussion about how they could work together to spread defamation about competitors of Freexian. Matthias Kirschner sent a written report to other FSFE misfits where he told them:

One general wish -- which I agreed with -- from Debian was to better share information about people...

When the leaders or two organisations collude like this to sabotage the reputation of a commercial rival it is a clear case of unfair trading or antitrust conspiracy. Matthias Kirschner admitted these illegal conversations took place.

In December 2018, Cardinal George Pell, formerly archbishop of Melbourne and treasurer of the Vatican, became the most senior clerical figure ever convicted in the ongoing Catholic abuse crisis. The conviction was eventually overturned, nonetheless, immediately after the conviction, on Christmas Eve, Enrico Zini, the attack dog, used the debian-private mailing list to distribute rumours about abuse to over a thousand people. My cousin was only eight years old when he joined the choir in Melbourne and these rumours were the most hideous violation of privacy. Remember, Chris Lamb, who was already paid by Freexian SARL, had encouraged Enrico Zini and others to engage in this defamation racket.

At the same time, in December 2018, Raphael Hertzog, the founder of Freexian used the debian-project mailing list to encourage cyberbullies to join in with his employee Chris Lamb, violate the privacy of my family and spread rumours that there had been some behaviour problem.

Subject: Re: Censorship in Debian
Date: Fri, 21 Dec 2018 10:02:53 +0100
From: Raphael Hertzog <hertzog@debian.org>
To: debian-project@lists.debian.org

Hi,

On Fri, 21 Dec 2018, Adam Borowski wrote:
> Thank you for illustrating so well why Daniel's words were spot on.  Your
> response is exactly why censorship must not be tolerated in Debian.

Such a message is not constructive and actually hurts any further
discussion. First of all, while it may be obvious to you, I don't see
in what way Russ's response "illustrates Daniel's word". But I'm not
sure that I want to read your justification, you seem to have a very
low level of empathy for other persons' feelings.

Anyway, nobody has been censored here. It looks like some people including
Norbert and Daniel have had inappropriate behavior that have been reported
to the anti-harassment team. That team made decisions and acted, even in
coordination with the Debian Account Managers.

[ ... snip defamation ... ]

Remember, Raphael Hertzog's company Freexian pays money to Chris Lamb. Lamb then started the conspiracy in August 2018 asking the Debian Account Managers to spread rumours. Now Raphael Hertzog is telling everybody else a lie. Raphael Hertzog is telling people that some mysterious stranger made an independent complaint to the Debian Account Managers. This is a lie because it all intersects with people affiliated with his company and the target of the defamation are competitors of his company.

Raphael Hertzog previously told us he only pays EUR 75 per hour. As I charge more than this, I would never be one of his employees and he saw me as a competitor.

Shortly after this, Charles Plessy told us there were "monster threads" on the debian-private (leaked) mailing list. We can now see the root cause of these "monster threads" were the emails sent by Freexian employee/contractor Chris Lamb.

 
Subject: Re: Censorship in Debian
Date: Fri, 28 Dec 2018 07:42:29 +0100
From: Charles Plessy <plessy@debian.org>
To: debian-project@lists.debian.org

Le Wed, Dec 26, 2018 at 05:35:38PM +0900, Charles Plessy a écrit :
> 
> Whether DD -> DM demotions will happen again and are going to become a
> new tool for solving social conflicts is an important decision that
> needs an open discussion where conesnsus is being sought.

Unsurprisingly there are monster threads on explusions on
debian-private.  Parts are specific to some people, and parts are about
procedure.  I am not going to read the threads, because I do not want to
be bound to secrecy about the discussion on the procedure.

I think that this disucssion must be public.  This disucssion can be
done in a civil, slow-paced way that foccuses on exploring together the
pros and cons of multiple directions.  Redoing it from scratch on one of
our mailing lists would be a good opportunity to reboot it in a more
productive and less divisive way some time in January when everybody has
cooled down.

I invite the decision makers to start and lead this discussion.

Have a nice day, and for those who celebrate a new year, my wishes for a
happy new one !

Charles

-- 
Charles Plessy
Debian Med packaging team,
http://www.debian.org/devel/debian-med
Akano, Uruma, Okinawa, Japan

France is a country that is well known for giving employees the thirty-five hour week and generous vacations. The conspiracy of Freexian employee/contractor Chris Lamb created these "monster threads" throughout the Christmas season when most people were resting with their families and friends.

I replied to Charles Plessy's public email. I told everybody that this type of cyberbullying increases the risk of suicides for both victims and witnesses:

 
Subject: Re: Cyberbullying (was: Censorship) in Debian
Date: Sat, 29 Dec 2018 00:25:49 +0100
From: Daniel Pocock <daniel@pocock.pro>
To: debian-project@lists.debian.org

On 28/12/18 07:42, Charles Plessy wrote:
> Le Wed, Dec 26, 2018 at 05:35:38PM +0900, Charles Plessy a écrit :
>> Whether DD -> DM demotions will happen again and are going to become a
>> new tool for solving social conflicts is an important decision that
>> needs an open discussion where conesnsus is being sought.
> Unsurprisingly there are monster threads on explusions on
> debian-private.  Parts are specific to some people, and parts are about
> procedure.  I am not going to read the threads, because I do not want to
> be bound to secrecy about the discussion on the procedure.


Anybody with any experience of cyberbullying or harassment wouldn't
simply cringe at this, they would be looking on in horror at the very
existence of these "monster threads" in a community that is so
influential and respected as Debian.

Please take a moment and think about what is the worst that eventually
happens when a community (or it's leader) abuses members in this way
indefinitely.

https://cyberbullying.org/cyberbullying_and_suicide_research_fact_sheet.pdf

The people who unleashed this monster need to take responsibility.  They
have created and sustained this state of hostility, since 20 September,
every other wayward communication that has come up is a consequence of
that.  No member of this community should ever have been expected to
bear such a heavy burden.

Stop this now.  Make sure it never happens again in Debian.  It is that
simple.

Regards,

Daniel

--
Debian Developer
https://danielpocock.com

In January 2019, one of Enrico Zini's colleagues, Joerg Jaspert (Ganneff) used another Git repository to spread rumours about abuse.

Most outsiders were unable to see all the connections to Freexian SARL and other vested interests pushing the culture of blackmail and defamation. Here are some comments that appeared on the Debian-dug-in (Indian) mailing list:

Subject: Re: Regarding ongoing furious discussions at debian-project ML & understanding
Date: Mon, 7 Jan 2019 14:58:41 +0000
From: shirish शिरीष <shirishag75@gmail.com>
To: debian-in <debian-dug-in@lists.debian.org>
CC: Daniel Pocock <daniel@pocock.pro>, Amey Abhyankar <sco1984@gmail.com>

at bottom :-

On 07/01/2019, Amey Abhyankar <sco1984@gmail.com> wrote:
> Hello All,
>
> I guess most of us are subscribed to debian-project mailing list.
>
> I am reading tons of e-mails since last 2 weeks at debian-project
> which are furious in many ways.
> However I am unable to fully understand the core issue & why,by whom,where
> etc.
>
> If anybody from our DL has better understanding, pls brief here in
> simple English language thanks.
> Due to length of those e-mails with several legal language formats
> it's difficult to understand the issue :-/
>
> Thanks & Regards,
> Amey.
>

Dear Amey,
This was shared in brief by the monthly anti-harrasment mailing list.
Perhaps a bit more insight could be gained by Daniel Pocock's blog
post on the same topic -

https://danielpocock.com/debian-human-rights-paradox

At the end, it's politics and Debian is as much a political
environment as it's a technical one. So one has to be thoughtful when
interacting with people irrespective of gender, race or whatever their
political bias might be.

It is a complex topic but pushing it under the carpet is not the
solution because it does impact each and every one around us.

It is useful so know and educate ourselves how to talk to people who
are non-binary in nature. One of the reasons why I didn't share about
Debconf 2016 much was because there were non-binary people there and I
didn't know how to address them, both while interacting with them and
afterwards while writing about them. I did share the blog posts with
few DD's to ask if they knew a better way but didn't get any response.

If I didn't write about them, it would have been excluding them which
again would not be the right thing to do.

Sage Sharp's blog is educative in that reference -

https://sage.thesharps.us/2017/10/24/binaries-are-for-computers/

Apart from that what has been called out is the way that the DAM's
reacted which seems far from open. If anybody were called out in a
similar manner, we wouldn't know what would be the right reaction and
the right people to reach or the right procedure to follow.

The questions could be like -

1. When should the accuser know about something s(he) is being accused of ?
2. Should s(he) be given proper space and something on record rather
than in closed loop systems which are also open to abuse.

I don't see any way out in the current mess but do empathise with both
the parties in this case, both Sage as well as the developer, blogger
in question as both have been wronged.

-- 
          Regards,
          Shirish Agarwal  शिरीष अग्रवाल
  My quotes in this email licensed under CC 3.0
http://creativecommons.org/licenses/by-nc/3.0/
http://flossexperiences.wordpress.com
EB80 462B 08E1 A0DE A73A  2C2F 9F3D C7A4 E1C4 D2D8

At the end of January 2019, Lucy Wayland died. There was some concern that the "monster threads" and other negativity created by conspiracies may have contributed to the death. Charles Plessy had posted his message on 28 December 2018, that is, the anniversary of the death of Debian's founder, Ian Murdock.

In February 2019, while the corpse of Lucy Wayland was in the morgue, Molly de Blanc, who was rumoured to be the girlfriend of Freexian SARL employee/contractor Chris Lamb, gave a speech at the FOSDEM conference in Brussels, Belgium. She used the conference to mock my family. She displayed a slide depicting a cat behind bars and encouraged people to spread rumours about my family on her "whisper network".

 

I contacted one of the former interns I had mentored in the Google Summer of Code (GSoC). Like many people on the fringe of Debianism, he couldn't understand it but he could see the cliques are very rude to all the rest of us.

Subject: Re: Debian situation
Date: Tue, 26 Feb 2019 15:19:39 +0530
From: Pranav Jain <contact@pranavjain.me>
To: Daniel Pocock <daniel@pocock.pro>

Hi Daniel,
Thanks for your email.

I wasn't aware about any communications as I wasn't subscribed to that
mailing list. I spent couple of hours going through the mailing list
archive and also read your last blog. It's very sad and also
demotivating to know that you have been going through so many things.

I wasn't aware about these things and was contributing to Google
Summer of Code 2019 as an admin. We recently got selected as an
organisation too.

Is there something I can do to make things better? I always felt that
Debian would be a second home for me where I can come and contribute
free mindedly. But, I am not sure if I would be able to cope up and
live up to so much of rudeness.

On Tue, Feb 26, 2019 at 4:58 AM Daniel Pocock <daniel@pocock.pro> wrote:
>
>
> Hi Pranav,
>
> Have you seen the discussions in debian-project in the last few months?
>
> Did you understand what is really going on in Debian now?
>
> Regards,
>
> Daniel
>
>


-- 
Regards,

Pranav Jain

 

In July 2019, the DebConf19 conference took place in Brazil. At the conference dinner, four of the women from Albania are seated at the same table as men from Freexian. One of those men, the Freexian employee/contractor Chris Lamb is sitting right beside Anisa Kuci, the woman who had confided in me about abuse by Elio Qoshi. The woman next to her is Kristi Progri. Both of these women were suddenly given jobs and eventually ended up together at GNOME foundation. They are prohibited from telling anybody what certain men really did in Albania.

 

The next woman is Elena Gjevukaj from Kosovo. After the conference, she told me the girls were subject to emotional blackmail. The ringleaders wanted them to denounce me. Women who refused to join the gossip were given the cold shoulder:

that's why I was telling you but also in email because the moment that they saw my position they just kind of ignore me like you know I wasn't part of this dark topic I didn't want to be part of that and that was the reason that I wasn't not ignored they were still polite to me and what they wouldn't I know for a fact they wouldn't talk about anything in front of me

Sitting on the other side of the same table is Holger Levsen. He was the prime suspect in the fight at DebConf6. He was one of the first people listed in monthly reports about Freexian.

 

In August 2019, Molly de Blanc went to the conference FrOSCon in Germany where she encouraged the people who use free software to form gangs and push the developers.

Molly bully: "We can use our collective power to push others"

 

The words and the drawing from Molly de Blanc, the "Multiple People" talk from a future Freexian SARL employee/contractor Enrico Zini and the collusion between a current Freexian SARL employee/contractor Chris Lamb and the Albanian pimp Elio Qoshi are all proof of the same criminal behaviour in the immediate vicinity of Freexian SARL. When a business competitor appears or when any responsible adult asks any serious questions about ethical conduct, multiple people form a gang to hurt that person, their business and their family. The people in proximity to Freexian SARL openly talk about using the tactics of gangsters.

Throughout that period, Debianism was gripped by internal discussions about the censorship crisis. People like Raphael Hertzog were hiding their conflicts of interest. They hid the original messages from Freexian employee/contractor Chris Lamb that started the crisis and they tried to make it look like a debate about cultural differences and the Zizian / transgender supremecy problems. Notice how Raphael Hertzog often sends messages like this where he tells people to stop challenging the cyberbullies. He doesn't reveal that he is paying many of the same cyberbullies who he is defending:

Subject: Re: Cultural differences and how to handle them
Date: Thu, 4 Jul 2019 10:18:18 +0200
From: Raphael Hertzog <hertzog@debian.org>
To: Roberto C. Sánchez <roberto@debian.org>, debian-project@lists.debian.org

On Wed, 03 Jul 2019, Roberto C. Sánchez wrote:
> On Wed, Jul 03, 2019 at 05:33:25PM +0200, Ole Streicher wrote:
> > Being german, I think that Debian should honor discriminated minorities,
> 
> Being a discriminated against minority, I think Debian should *not*.

And since Debian is do-ocracy, it's not your call. You can disagree with
the publicity team, but it's their call and a call they made while trying
to put our diversity statement into application.

Can we stop this discussion now, please?

Unless you really want to revert their decision via a general
resolution... but even in that case, the discussion here doesn't help to
go forward with this.

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: https://www.freexian.com/services/debian-lts.html
Learn to master Debian: https://debian-handbook.info/get/

In September 2019, there was controversy about the relationship between Freexian and Debianism:

Subject: Re: Using Debian funds to support a gcc development task
Date: Sun, 29 Sep 2019 16:15:30 +0200
From: Raphael Hertzog 
To: Hector Oron 
CC: John Paul Adrian Glaubitz , debian-project@lists.debian.org

Hi,

On Sun, 29 Sep 2019, Hector Oron wrote:
> > Not sure what the problem with LTS is. I thought companies pay for the
> > extra effort. I think it's a perfectly fine business model.
> 
> As a very simple summary, companies pay another company (Debian
> unrelated) to use Debian volunteers time and Debian resources.
> Debian does not get any share of that work.

I'm afraid that this summary is too simple and thus misleading.

* Freexian (the "another company") is not owned by Debian, but it's not
  unrelated to Debian. I funded that company, as a Debian developer, to
  let me contribute to Debian while being paid by customers who are Debian
  users.
* Freexian doesn't "use Debian volunteers", nobody is forced to work for
  Freexian, they all asked to join the team of paid contributors. But
  Freexian pays them for the LTS work, that's correct.
* While we use Debian resources, we are using Debian resources just like
  any other Debian contributor, the fact that we are paid doesn't change
  anything. Many Debian contributors are being paid as part of their work.
  It's just more visible in this case.

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: https://www.freexian.com/services/debian-lts.html
Learn to master Debian: https://debian-handbook.info/get/

In the response above, Raphael Hertzog does not tell us which volunteers are receiving payments. He does not tell us that some of the volunteers receiving the payments are involving in punishing other volunteers. He does not comment on the fact that Freexian is using the Debian trademark to establish direct business relationships with the clients.

When Mark Shuttleworth established his own company, Canonical Ltd and started to employee some fo the volunteers, he chose a distinctive name for his product: Ubuntu. Yet Raphael Hertzog has decided to call his product Debian LTS which is based on the "Debian" trademark.

Later in November 2019, somebody dares to suggest the gangsters are comparable to the Inquisition. Once again, Raphael Hertzog criticises the comparison. Hertzog's response is dishonest because he doesn't reveal that some of the people running the Inquisition are actually paid by his company Freexian.

Subject: Re: Community Team - where we want to go
Date: Tue, 12 Nov 2019 10:10:52 +0100
From: Raphael Hertzog <hertzog@debian.org>
To: debian-project@lists.debian.org

On Mon, 11 Nov 2019, Norbert Preining wrote:
> On Mon, 11 Nov 2019, Gerardo Ballabio wrote:
> > That is, the team would rule on individual cases, rather than issuing
> > "lists of things not to do". IMHO that pretty much would make it a
> > court with the power to judge project members. And I'm not sure that
> > the team not taking actual measures, but just making "recommendations"
> > to other people who are empowered to take action, would make a
> > difference. In fact, that would be curiously similar to how the
> > Inquisition proceeded: technically they never executed anyone, they
> > just sent people to the secular authority with the "recommendation" to
> > burn them at the stake.
> > 
> > And if the people empowered to take action can disagree with the
> > recommendation and apply their own judgement, well, that would make
> > the "ultimate authority" concept void, and I would say, would nullify
> > the whole point of having the team "interpret the CoC".
> 
> +1

-10 for introducing a comparison that has no place in Debian. We're not
executing or burning people.

That's the kind of comparison that contributes to the bad atmosphere and
is pushing reasonable people to add more rules, so this goes towards your
own goals of wanting less thought police and more freedom.

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Support Debian LTS: https://www.freexian.com/services/debian-lts.html
Learn to master Debian: https://debian-handbook.info/get/

In April 2020, he encourages people to move from the use of traditional mailing lists to the Discourse forum software. The Discourse software has some very big disadvantages for privacy and censorship but Raphael Hertzog doesn't mention that at all. He is hoping that some of his employees/contractors will control the Discourse server and use it to spy on everybody else and prune any discussions that are inconvenient for his business Freexian.

Subject: What are your thoughts on discourse?
Date: Wed, 18 Mar 2020 11:00:51 +0100
From: Raphael Hertzog <hertzog@debian.org>
To: debian-vote@lists.debian.org

Hello dear DPL candidates,

I would like all the candidates to reply to this question on discourse:
https://discourse.debian.net/t/dear-dpl-candidates-what-are-your-thoughts-on-discourse/75

Please create an account and answer there. At least it would give you a
feeling of how it looks like to use it.

The kind of discussions that we have in debian-vote is very much suited
for something like discourse where we can +1 with like, etc.

I would encourage others DD asking questions to try to use discourse and
just use the mail to inform of the discussion started on discourse.

Cheers,
-- 
  ⢀⣴⠾⠻⢶⣦⠀   Raphaël Hertzog <hertzog@debian.org>
  ⣾⠁⢠⠒⠀⣿⡁
  ⢿⡄⠘⠷⠚⠋    The Debian Handbook: https://debian-handbook.info/get/
  ⠈⠳⣄⠀⠀⠀⠀   Debian Long Term Support: https://deb.li/LTS

This is part of a disturbing trend in the technology sector. Ringleaders want to micro-manage discussions and monitor the behaviour of the participants. They do not know how many times somebody looks at an email message but if the discussion is in a forum web site they can see which users looked at it.

Towards the end of 2020, Galia Mancheva published a report about the extraordinary psychological abuse and harassment inflicted by Matthias Kirschner at the FSFE. Some of her words:

I took FSFE to court. This is my story ... fired all the full-time women in the office in the two months leading up to the elections ... A weekend of non-stop calls ... He even texted telling me I should answer my phone, for my own better. Even after my lawyer warned him to terminate all attempts to communicate with me and send someone else to pick up my work laptop, he came in person to my house, and was very irritated that I was not alone.

These overbearing men are obsessed with controlling the lives of women and volunteers.

One of the founding supporters of the Debian LTS project at Freexian is the LinuxHotel which is also sponsoring the FSFE misfits under Matthias Kirschner. These organisations form a cluster of toxic behaviour and blackmail.

As they say in gangster movies: follow the money.

In February 2021, when many businesses were suffering due to the pandemic, Raphael Hertzog submitted an advocacy for his wife, Sophie Brun, to be given a Debian Developer title. This would clearly increase the prestige of his own business. On the Freexian web site, they publish a list of every team member and they write the title "Debian Developer" next to each of them. A screenshot of the team list is reproduced at the bottom of this report. He did not reveal he was writing the advocacy for his wife. Sophie Brun also received advocacies from SZ Lin, Samuel Henrique and Hugo Lefeuvre.

In March 2021, Molly de Blanc called for a public lynching of her old boss Dr Richard Stallman (RMS).

Debianists decided to have a vote (General Resolution / GR) on whether the Debian name could be used in the lynching.

The way each developer voted is publicly visible.

We can look back at the way Freexian affiliated developers voted and we can they are among the villains who wanted the toxic culture of publicly denouncing people.

                       Tally Sheet for the votes cast.

   The format is:
       "V: vote         Login   Name"
 The vote block represents the ranking given to each of the
 candidates by the voter.
 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

     Option 1--------->: Call for the FSF board removal, as in rms-open-letter.github.io
   /  Option 2-------->: Call for Stallman's resignation from all FSF bodies
   |/  Option 3------->: Discourage collaboration with the FSF while Stallman is in a leading position
   ||/  Option 4------>: Call on the FSF to further its governance processes
   |||/  Option 5----->: Support Stallman's reinstatement, as in rms-support-letter.github.io
   ||||/  Option 6---->: Denounce the witch-hunt against RMS and the FSF
   |||||/  Option 7--->: Debian will not issue a public statement on this issue
   ||||||/  Option 8-->: Further Discussion
   |||||||/
V: 51328746	        hertzog	Raphaël Hertzog
V: 12347756	       paravoid	Faidon Liambotis
V: 12347856	          lamby	Chris Lamb
V: 11246653	         enrico	Enrico Zini
V: 312---45	         holger	Holger Levsen
V: 1234--56	       terceiro	Antonio Terceiro
V: 3124--56	       cjwatson	Colin Watson
V: 12347865	       stefanor	Stefano Rivera

Dr Stallman's organisation the Free Software Foundation is in some ways another competitor. It is wrong for people at Freexian to tell another organisation who their leader should be. It is even more wrong to write such rampant defamation about the leader of the other organisation.

When a group of men gather together like this to attack another man for economic reasons they are a mafia.

In April 2021, at the height of the pandemic, I created a new company, Software Freedom Institute in the Canton of Vaud, Switzerland.

Throughout the following months, there were intense attacks on my new company from every direction.

In July 2021, Sophie Hertzog Brun, the wife of Raphael Hertzog, was finally added to the list of Debian Developers. It had only taken six months to process her application while other people have waited years without getting anywhere.

In September 2021, I went to the village of Courgent, near Paris, to visit the war graves. I published a video about the ceremony at the war graves. The pilot of the aircraft that crashed in Courgent is Flying Officer Philip Wyatt Ryan, an alumnus of Xavier College, the same school my father and I had both attended in Melbourne.

After I published the video, the rogue Debianists went nuts. A few weeks later, in November 2021, the Debian Publicity Team gangsters published a "Statement on Daniel Pocock" to deter me from visiting the war graves again.

Compare, the visit to the war graves on 18 September 2021:

 

and the reprisal from the rogue Debianists a few weeks later:

 

The small-minded people at Debian resented the images of me wearing a suit and tie at an official event. They created images like this depicting me as a person with mental illness:

 

These rumours and insults only started appearing after Chris Lamb attacked my family and I in 2018.

In January 2022, Jeremiah C. Foster sent an email asking people to talk about how Freexian money could be used in Debianism:

Subject: Survey proposal about the usage of money in Debian
Date: Mon, 24 Jan 2022 11:02:20 -0500
From: Jeremiah C. Foster 
To: debian-project@lists.debian.org

Hello,

The Debian contributors behind Freexian would like to get some broad
feedback from all Debian developers on various questions related to
the usage of money in Debian.

[ ... snip ... ]

The email doesn't address the ethical problems. Nonetheless, in the course of the year 2022, over $120,000 was spent on kill money to denounce my family and my business . Most of this money went to lawyers. None of it went to the developers.

Here is the line from the 2022 financial report:

 

In March 2022, a UDRP legal panel ruled that IBM Red Hat had harassed my company and my family through their abuse of the UDRP administrative procedure.

Remember, some of the Freexian clients, like Adfinis AG in Switzerland are also affiliated with IBM Red Hat. They resented the fact I had called out the inconvenient truth about the underage relationships in Albania.

In retaliation, a few days later, Dominik George packs together with bisexual mafiosi Enrico Zini. They publish more messages on the debian-devel mailing list encouraging people to engage in anti-competitive behaviour and vilify me.

A few days after that, in April 2022, Raphael Hertzog declared that Freexian SARL had started to employ both Dominik George and Enrico Zini immediately after they attacked me. This smells like a reward for their aggression against a Freexian competitor.

The number of paid contributors increased significantly, we are pleased to welcome our latest team members: Andreas Rönnquist, Dominik George, Enrico Zini and Stefano Rivera.

Everybody knows that Enrico Zini regularly sends messages about attacking the status or reputation of other joint authors. These are the tactics of gangsters.

Freexian SARL's decision to employ a mafiosi who undermines the status of his peers, Freexian competitors, is a significant escalation of these vendettas.

By preventing other joint authors from speaking and viciously attacking our reputations, Enrico Zini creates more work for his masters at Freexian SARL.

Between September and October 2022, the Freexian SARL web site was changed and started using a new logo that looks very similar to the official Debianism logo but it is inverted and rotated ninety degrees.

Snapshot with old logo from 20 September 2022:

 

Snapshot with new logo from 13 October 2022:

 

The official Debian logo on the Debian.org web site:

 

The Debianism logo is protected by a trademark registration but there has been no attempt whatsoever to prevent Freexian SARL developers from profiting from this association with the trademark.

In June 2023, Red Hat announced the end of public RHEL source code. This was the end of the road for RHEL-based distributions similar to the defunct CentOS project. This decision by Red Hat increased the value of the Debian LTS business controlled by Freexian SARL.

Exactly twelve months after Red Hat killed off CentOS, Daniel Bristot de Oliveira a 37-year-old employee who spent his whole life promoting Red Hat's open source philosophy had a mysterious death.

Around the same time, the GNOME misfits began ferociously spreading public defamation of Sonny Piers. Like all the previous cases of gangsters making up stories about volunteers, there is no evidence about what Sonny Piers is accused of doing wrong. All we know is that over 20,000 people looked at the defamation in the GNOME Discourse forum. This is a lynching.

The state of Queensland in Australia passed a groundbreaking law against coercive control in domestic relationships. This law may be applicable to some of the open source cults like Debianism because people are expected to share rooms at conferences and we are not allowed to ask questions about money.

Between 6 June 2024 and 14 June 2024, Jean-Pierre Giraud and Jean-Paul Guillonneau make various changes to the official Debian web site for the purpose of denouncing me and deceiving voters in the European Parliament (MEP) elections. In particular, they falsely claim to have created a judgment. The fake judgment has the date of the Kristallnacht, the night of broken glass that started the Holocaust (10 November).

At that moment, Jean-Pierre Giraud was treasurer of the non-profit Debian France association.

Additionally, Jean-Pierre Giraud and Donald Norwood are both members of the notorious Debian Publicity Team which is used for spreading libel from time to time.

On 4 October 2024, Donald Norwood published an announcement telling us "Debian welcomes Freexian as our newest partner!". The announcement is a very strongly positive endorsement of Raphael Hertzog's business and it is completely the opposite of the negative statements these gangsters published about my family and I.

 

On 15 October 2024, Frans Spiesschaert made more changes to the Dutch language version of the web page denouncing my family and I.

There seems to be some connection from the intensely negative attack the Debian Publicity Team made on my family in June 2024 up to the very positive statement they made about Raphael Hertzog's company Freexian in October 2024. It appears the team of gangsters were simultaneously editing and reviewing both of these documents in multiple languages.

The convicted paedophile Jeremy Bicha is one of the maintainers of the GNOME packages in Debianism. In 2025, he was invited to give a talk at DebConf25 in France. What did Sonny Piers and I do that is worse than the crimes of Jeremy Bicha? We dared to utter the inconvenient truth about the behaviour of these gangsters and cliques. In the world of Debianism, mentioning the inconvenient truth is punished more severely than raping your nine-year-old sister.

At the same time, the clique told British Army veteran Phil Wyett that he will never be good enough to be a real Debian Developer. Phil lives with a disability and he has no history of raping children. Why are the cliques telling him that he is inferior to Jeremy Bicha?

Looking through the history of Debian LTS we can find examples of Chris Lamb working on packages related to GNOME. Here is a security advisor for gnome-shell:

To: debian-lts-announce@lists.debian.org
Subject: [SECURITY] [DLA 2374-1] gnome-shell security update
From: Chris Lamb <lamby@debian.org>
Date: Tue, 15 Sep 2020 07:24:51 -0400 (EDT)

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2374-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                           Chris Lamb
September 15, 2020                            https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : gnome-shell
Version        : 3.22.3-3+deb9u1
CVE ID         : CVE-2020-17489
Debian Bug     : #968311

It was discovered that there was an issue around revealing passwords
in the "gnome-shell" component of the GNOME desktop.

In certain configurations, when logging out of an account the
password box from the login dialog could reappear with the password
visible in cleartext.

For Debian 9 "Stretch", this problem has been fixed in version ...

[ ... snip ... ]

If Chris Lamb and Jeremy Bicha both worked on the GNOME packages, did they ever work together? Did Chris Lamb introduce Jeremy Bicha to Elio Qoshi and the other Albanians? Notice that Jeremy Bicha joined Debianism at exactly the same time we discovered a risk to underage participants in Albania.

Now we can see why the core Debianists are more comfortable with the convicted paedophile than they are with professional developers like me. They have a lot of things to hide. People with stuff to hide form organisations like this where they all agree to stay silent about things like the little sister crime or the identity fraud at the FSFE. They keep it all from the public, no matter what. When professional developers get nervous, rumours appear about somebody breaking the Code of Conduct / Code of Silence.

The fact that Frans Pop sent his resignation/suicide note the night before Debian Day gives a strong hint that everybody in the world of Debianism shares some responsibility for his death. By raising the link between the beloved so-called "community", the toxic culture and the Debian Suicide Cluster, I proved they did something close to murder. People have to reflect on their responsibility. For many of these people, the fear of being held accountable for those suicides and accidents is greater than the fear of being photographed with the paedophile. That is why they defend the paedophile's right to come back into society but they fiercely insist on lifetime censorship against those of us who dared to tell the truth about the toxic culture that murders people.

On 14 July 2025, at DebConf25 in Brest, France, Freexian employee Enrico Zini uses a hammer as a metaphor for blackmailing and exploiting people and destroying competitors. Enrico Zini's philosophy can be linked to the Freexian SARL philosophy on censorship and Code of Conduct gaslighting.

 

In July 2026, Adrian Bunk has sent a lengthy report to the debian-project detailing his concerns about the social, financial and security risks of Freexian SARL's parasitic behavior. Among other things, he gives an example of (Mark) Lee Garrett getting paid over 130 hours for work that other people are doing for free.

 
Subject: Freexian, security and Debian
Date: Sun, 19 Jul 2026 19:57:21 +0300
From: Adrian Bunk <bunk@debian.org>
To: debian-project@lists.debian.org

1. Overview
-----------

This email covers two topics that are separate but have some intersection:

There has to be a clearer separation between what Freexian activities
are under oversight of Debian and can be called Debian and might happen
on our infrastructure - and what is an external company competing for
customers in our ecosystem.

While there is no lack of DDs interested in earning money doing LTS and
ELTS work, there is fewer interest in doing the same work unpaid in our
security team instead. In recent weeks I got the impression that the two
members who are doing nearly all the work in our security team seem to
be struggling to keep up with the increased workload due to AI, and I am
worried we might lose our security team to burnout.


2. Debusine, and Freexian in general
------------------------------------

While it is laudable that Freexian has the explicit goal of helping
Debian, Debian giving preferential treatment to one company might
outweigh the benefits when this drives away other contributors.

While there is valid criticism at the current use of GitLab in our core
infrastructure,[1] using Debusine in our infrastructure would be worse:

Similar to GitLab, Freexian SARL is a private for-profit company.

Similar to Gitlab, Debusine is Open Source that is also commercially
offered as SaaS.[2]

Worse than GitLab Inc., which is a neutral player providing equal offers
to everyone in the Debian ecosystem, Freexian SARL is competing directly
with the businesses and employers of many other contributors (including
many DDs) in our ecosystem.[3]

There are technical reasons why Debusine is IMHO not suitable for our
core infrastructure, but the point that this is a product of a company
competing in our ecosystem alone should be sufficient that Debian keeps
some distance from it.

A company asking on debian-devel-announce for volunteers to work unpaid
on their product is problematic.[4]

Two of the accepted Google Summer of Code 2026 projects are improvements
for Debusine.[5]

Does Google know that they pay students to work on a company product,
mentored by people working for that company?
Are the Debian mentors paid by Freexian for the mentoring?

Decisions which GSoC applications to select are made by the Outreach
delegation.
A majority of the Outreach delegates are receiving income from Freexian.
[6,7]
Did these delegates recuse themselves from GSoC due to the conflict of
interest?


3. ELTS
-------

Freexian ELTS is a commercial offer by an external company that has to
be clearly separate from anything called Debian.

It is problematic that information about Freexian ELTS is offered on the
same company website as the information about Debian LTS,[8] and that
Debian gives the impression of official status of ELTS by listing it in
distro-info and distro-info-data.

It should be made clearer to our users what is Debian and what is a
commercial offer by an external company, and Debian LTS information
should be moved to our website.


4. LTS
------

After an intervention from Freexian,[9,10] the regular support of
bookworm was shortened from what was originally planned - while longer
full support would have been better for our users, it would have been
worse for Freexian.

Until recently Freexian was transparent about the monthly Debian LTS
payments to individual contributors (multiply with € 85/hour[6]),[11]
but Freexian now removed this transparency.[12]

When non-profits like the Linux Foundation and companies sponsor
something that is called "Debian Long Term Support"[14] and is provided
on our (sponsored) infrastructure, we need more transparency and not less.

It would be appropriate that Freexian sends detailed monthly financial
reports to a public Debian mailing list, including stating for each work
item invoiced by a Freexian contributor how much Debian LTS money was
spent on it.

Sending such a financial report for June 2026 at the same time as the
report about work done in June 2026 would be a good start.

With approximately € 300k annually[13] Debian LTS is among the larger
budgets in Debian.

Our publicity refers to "Debian and its LTS Team", and Debian does
encourage funding Debian LTS.[14] Debian recommending to fund Debian LTS
instead of recommending donating to Debian might be redirecting some
donations from Debian to Debian LTS.

Since the topic that Freexian no longer wanted my services will
invariably come up:

While there are many people who are doing good work in LTS (and ELTS)
and where the hours invoiced are in a reasonable relation to the work
done, a not so small part of money goes to the half dozen Freexian
contributors where the amount of hours invoiced always felt like an
order of magnitude larger than the quantity and quality of work
delivered. My conflict with Freexian management was around me trying
to get Freexian to do something about it.

Some examples:

Freexian contributors who might suddenly show up on the last day of a
month, do some rather trivial work, and invoice 30 or 50 hours every
month.[15]

A Freexian contributor invoices 19.5 hours[16] (€ 1657.50) from Debian
LTS (plus additional hours from ELTS) with a monthly report[17] that is
largely made up:

The zfs-linux DLA was issued, but this was the 4th month where money was
invoiced for working on this package[17,18,19,20] and no other DLA was
issued by this contributor during that time.

"Worked on phpmyadmin, zabbix, and atril but couldn’t complete them.
Will get back to it next month." There is not much trace of any work
done (or even a DLA issued) on these packages by this contributor.

Most front desk work (mainly triaging) is done with git commits, but
there is not a single commit by this contributor in the git tree[21]
during this week. The list of what was claimed to be triaged and Auto
EOL’d also looks quite similar to what was claimed to be worked on
(and invoiced) a month earlier.[18]

The cheeky "PS: it’s not. :)" for claimed debugging work regarding the
xz backdoor?
This would also have created git commits.
LTS was marked not affected by a member of our security team,[22]
and the ELTS releases were marked not affected by a different Freexian
contributor 2 weeks later.[23]

This monthly report was an example not an exception for this Freexian
contributor, and a point could be made that a DD who is defrauding
Debian LTS is defrauding Debian and should therefore be expelled
from Debian.

After sending analysis of more than one monthly report to the Freexian
managers responsible for LTS and ELTS I gave up, and the person is still
a Freexian contributor today.

A Freexian contributor, who as Debian maintainer of the package in
question should already know it quite well, invoices 130.75
hours[24,25,26,27]
(€ 11 113.75) from Debian LTS (plus additional hours from ELTS) without
ever delivering an LTS update for the package in LTS (buster) and
without doing any other significant work during these months.[28,29,30,31]

The response I got from the Freexian managers responsible for LTS and ELTS:

  Santiago and I have communicated with <contributor> and we are
satisfied   that the work reported is appropriate to the hours invoiced
for July,   and the same going back to April. Based on that, we see no
need for   further action.


5. Workload of our Security Team (and LTS)
------------------------------------------

For all incoming CVEs, our security team does:
- map it to the Debian package name (or mark as not-for-us)
  - For a CVE in a Debian package our security team does:
    - link to the upstream advisory
    - often search for the upstream commit(s) fixing it,
      and link to them in the security tracker
    - triage whether the CVE warrants a DSA for the package

All CVE triaging and tracking, and work assignment for both our security
team and LTS, happens in the same git tree. It is worth noticing that
the two members who are doing most work in our security team together
average nearly 50 commits per day, mostly with CVE triaging and
tracking.[32]

Initial LTS triaging is not hard based in this work already done by our
security team.

The number of DSAs went from ~20 per month a year ago to ~60 per month
today.
That's an average of 2 DSAs our security team issues every day.

Different from what some people anticipated in discussions before LTS:
Actual work in LTS is often just taking what the security team has
already published as a DSA one release further back.
Sometimes backporting is some work, but this is not done in the hard
cases - when something is hard usually either the package is listed as
no longer supported or the CVE is marked as "ignored" with a comment
like "too invasive to fix".
This hard work would be the part where providing 5 years of support
would not work unpaid, due to both the skills and the effort required.

To be fair, people with the qualifications to fix hard issues (including
doing hard backports) in security are not available at the hourly rate
paid in LTS, and the security teams of commercial distributions
providing long-term support are also far better resourced.

Debian LTS pays security team work done by the security team member who
is also a Freexian contributor.[33,34,35,36]
Why does Debian LTS pay one security team member, but not the ones who
are doing most of the work?

At the hourly rate paid in LTS the money available equals two full-time
positions, and one option would be to offer the members of our security
team who are doing nearly all of the work this money so that they can
quit (or at least reduce the hours at) their current work and work full-
time on Debian security including LTS.

Other solutions are possible, but Debian continuing to offer the same
work paid and unpaid in different teams is not sustainable.



[1] but there was no better option available at the time
[2] https://www.freexian.com/services/debusine/
[3] https://www.freexian.com/services/
[4] https://lists.debian.org/debian-devel-announce/2025/08/msg00005.html
[5] https://summerofcode.withgoogle.com/programs/2026/organizations/debian
[6] https://www.freexian.com/lts/debian/details/#faq
[7] https://www.freexian.com/about/team/
[8] https://www.freexian.com/lts/
[9] https://lists.debian.org/debian-release/2025/09/msg00507.html
[10] https://lists.debian.org/debian-release/2025/09/msg00509.html
[11] https://www.freexian.com/blog/debian-lts-report-2025-09/
[12] https://www.freexian.com/blog/debian-lts-report-2026-05/
[13] https://www.freexian.com/lts/debian/
[14] https://lists.debian.org/debian-announce/2026/msg00007.html
[15] LTS and ELTS combined
[16] https://www.freexian.com/blog/debian-lts-report-2024-03/
[17] https://web.archive.org/web/20240620143011/https://utkarsh2102.org/
posts/foss-in-march-24/
[18] https://web.archive.org/web/20240620141659/https://utkarsh2102.org/
posts/foss-in-feb-24/
[19] https://web.archive.org/web/20260414090616/https://utkarsh2102.org/
posts/foss-in-jan-24/
[20] https://web.archive.org/web/20260213185556/https://utkarsh2102.org/
posts/foss-in-dec-23/
[21] https://salsa.debian.org/freexian-team/extended-lts/security-tracker
[22] https://salsa.debian.org/freexian-team/extended-lts/security-
tracker/-/commit/49a400ede5d
[23] https://salsa.debian.org/freexian-team/extended-lts/security-
tracker/-/commit/c3f49879ae1
[24] https://www.freexian.com/blog/debian-lts-report-2024-04/
[25] https://www.freexian.com/blog/debian-lts-report-2024-05/
[26] https://www.freexian.com/blog/debian-lts-report-2024-06/
[27] https://www.freexian.com/blog/debian-lts-report-2024-07/
[28] https://lists.debian.org/debian-lts/2024/05/msg00004.html
[29] https://lists.debian.org/debian-lts/2024/06/msg00002.html
[30] https://lists.debian.org/debian-lts/2024/07/msg00014.html
[31] https://lists.debian.org/debian-lts/2024/08/msg00002.html
[32] https://salsa.debian.org/security-tracker-team/security-tracker/-/
commits/master
[33] https://www.freexian.com/blog/debian-lts-report-2026-01/
[34] https://dl.gambaru.de/blog/202601_LTS_ELTS_report.txt
[35] https://www.freexian.com/blog/debian-lts-report-2026-03/
[36] https://dl.gambaru.de/blog/202603_LTS_ELTS_report.txt

Please watch my crowdfunding video to learn more about the lawsuit in US federal court.