|
|
|
|
|
by klyrs
2153 days ago
|
|
This is concerning for this project especially because it's being pitched to journalists. It's easy to maintain a backdoored version and an apparently secure version. Only ship backdoored binaries, and only distribute apparently secure source. By not allowing third-party builds, you can effectively lock everybody into using the backdoored version while maintaining a pretense of openness and security. This is a critical example of why the distinction between free vs open exists. |
|
I totally agree that you could have a back door and that be something possible to distribute in a binary. That's a legitimate risk. At the same time I think it's disingenuous to say that opening the source code on GitHub is not adequate protection but having some sort of third-party builds would be adequate protection against that. I think having those source code in the open is the ultimate protection against sort of backdooring. And from there anyone can download and run it using node or they can make their own binaries. And with respect to using any bineries distributed by anyone else everyone needs to use their own risk tolerance. At the same time I don't think the license that I've made precludes third-party builds with the meaning of that being other people building their own binary from the source code and distributing that for other people, I feel okay you can do that you just can't charge people for it, or use it as part of a paid service or project intended to make money, and you can't deploy it for them as part of a paid service. Unless you're already working in that organization and making this deployment as part of the ordinary course of your duties (like you can't be doing this as a contractor, and it can't be part of being contracted to work for them). One purpose of this restriction obviously is to get organizations to contract Dosyago corporation when they need help to deploy that Dosyago IP. A way to make money through consulting that's an alternative to selling per seat or per site licenses.
So I definitely think the criticisms of this license are valid at the same time it's important to be clear about what actually, you know, the restrictions are and what the risks of that are.
I definitely think people should exercise caution with regard to any software but they should also protect themselves against misinformation. So in that light it is I think in the interests of everyone's safety to have an informed and open discussion. That's why I'm addressing what seems to me to be a misrepresentation, and why and I'm also not bristling and anyone raising concerns about the license. I think it's perfectly valid and it totally makes sense for them to be upset about this.