Both Section 7(ii) and Section 8 allow users to provide the Corresponding Source from a network location so long as it is provided at no charge.
I would like to add additional requirements.
The basic thing I'm looking for is that the source be made publicly available and not put behind some wall of inconvenience (such as requiring a specific device or requiring a user account, etc). Below are three sections: 1) stuff I want to prevent, 2) stuff I don't want to prevent, 3) stuff I'm not sure about.
## Stuff I want to prevent
A person providing source shouldn't make a user do any of the following in order to be able to download the source:
* Create a user account * Undergo identity verification/authentication (or sign in with some third party service like Facebook or Twitter) * Complete a survey or lengthy data collection process. * First request send a request to the host that your IP address be added to a whitelist * Require the use of running proprietary software in order to download the source code (e.g., requiring the use of some proprietary App Store App). * Require the use of a specific kind of device or require a person to spoof device metadata (similar to how the Android App store will prevent you from downloading an App that is not compatible with a certain device). * Require some PACER like step of having a PIN mailed to you in the mail.
With the exception of PACER, I have encountered each of the above issues when trying to download source of programs licensed under the GPL.
## Stuff I don't want to prevent
At the same time, I wouldn't want to prevent a person distributing the source from doing things that are sensible.
* Blacklisting spammer/crawler IP addresses. * Require users to fill out a captcha * Tracking basic info provided in HTTP headers * Provide a user with simple instructions like: 'in order to download this source, please enter the username "public" and password "anonymous" to the following form'.
## Stuff I'm not sure about
* Requiring the user to use a version control systems (e.g., providing access only over a "git clone" statement).
* Requiring the user to connect to some weird protocol even if there is free software that can connect to it (e.g., like, imagine if f-droid didn't have an HTTP interface, but it used some weird interface and it only provided source via the f-droid app interface running on your Replicant/Android/Linux OS) -- in order to connect from GNU/Linux you'd either have to figure out how to get f-droid running on GNU/Linux or you'd need to figure out how to create a connection to the store).
* Operating system requirements. For example, people do not build Android Apps on top of Android, they build them on top of a different OS.