I think that this is a really bad idea and will only make the centralization
problem much worse. Projects should host their own code and not be dependent
on services that might sell out, change their tune over time or experience
long periods of downtime (I'm looking at you NotABug). By having a large
number of projects entrusting their hosting to only a few, it only sets us up
for failure because it puts us in a situation where we can't trust many core
free software projects that we depend upon.
A prime example of this failure is sourceforge, where about 3% of core
projects that the libreCMC project depends upon can't really be trusted due
to the recent actions of sourceforge and because most of the projects that
have source code there don't sign their packages. Gitorious, another large
host of free software source code, let the community down when it chose to
sell out to a company who has a record of not acting in the best interest of
the free software community. By trusting these large hosts (or growing them),
it gives them too much control and power to manipulate or act against those
who trust or depend upon these free software projects. If we grow another
gitorious or sourceforge, we will only be repeating the last two events yet
again.
Instead, we should have a set of hosting standards that individual projects
follow, advocate for the decentralization of hosting source code repositories
and get developers to sign their source code. If anything, the GNU project
and the FSF should *not* endorse any of these centralized hosting providers
because they will grow and then a) sell out at some point or b) go broke then
fall over due to the fact that no one wants to donate towards hosting costs.
Having all the eggs in one or a few baskets just makes it easier to break all
of the eggs.
