Should I be concerned about the independence and future health of open source projects versus the risk of corporate take-over?Scenario:  Today I was updating some open-source application packages (R) and my update procedures failed.  I quickly tracked the problem down to some new firewall rules which were blocking all .edu domains and sites using HTTPS certs not signed by "appropriate" authorities.  My IT Network team uses firewall appliances which accept "rules from a trusted vendor".The R project and CRAN package mirrors are hosted on many servers globally:    The mirroring servers are owned by a "diverse" community.  And also a "microsoft.com" domain server.On one hand, I give KUDOS to Mircosoft for supporting the R-project and open source by hosting a mirrorlOn the other hand, Microsoft does like to acquire software projects for the sake of making a profit, and by hosting a mirror site they can monitor the R-community and gain insight into usage patterns.  If Microsoft can influence the firewall rules, they can blacklist other mirror sites and drive more traffic to their "trusted" mirror, then use this traffic for surveillance then assimilation.I don't mean to single out Microsoft here.  Any large internet software company could do the same.There may be a legitimate reason for blocking .edu domains:  are they an easier target vector for inserting malicious code into open-source projects?But, I do see a potential ethical conflict whereby a large company can influence firewall rules to drive open-source project traffic towards themselves for purposes of surveillance and assimilation.When Microsoft purchased GitHub, I had concerns, but it was done publicly.  Tweaks to firewall rules are not public, and concern me more.Am I overly concerned about this corporate risk of surveillance and assimilation?  Is there a FSF or EFF manifesto that already warns of this?