| One of the founders here. Here's a copy of the response I posted on Twitter. -- A response to @JohnONolan here to clear up some serious misunderstandings
https://twitter.com/JohnONolan/status/1602330377812643850 First of all, huge respect to the Ghost team. Their open source contributions are valuable, and their approach to theming enables some great-looking things. That said, some important corrections: Substack is not "powered by Ghost". Rather, we built our own theming API that’s compatible with themes built for Ghost, including those built by third parties. The Free Press is using a modified Tripoli theme, built by Ahmad Ajmi, under a paid license. This is how this is supposed to work. It's good for the theme developer if we support this – you should check them out here.
https://aspirethemes.com/themes/tripoli This was relatively quick to build for Substack devs, because the structure of Ghost sites matches Substack fairly closely. With respect to the search library, this is an open source library that we are using in a fully compliant way. John's own screen shot shows that we don't load it "from Ghost’s own CDN", it comes from jsDelivr
https://www.jsdelivr.com This is a standard way to use an open source library. It's pulling from the version that the sodo-search maintainers published to NPM (thank you!). It is a good point that we should lock a version, so that if they accidentally published a minor version revision with breaking changes it doesn't cause problems for us. We’ve fixed that. We’re grateful to the developer of the Tripoli theme and to Ghost for its contributors to open source work. We’re exploring ways to give writers more customization on Substack. This is one approach we’re considering but it’s too early to know if we’ll scale it up. And @JohnONolan, thanks for the note at the end about potential collaboration. In our minds, we’re on the same side of an important battle for a better internet. We’re definitely up to chat. |
> John's own screen shot shows that we don't load it "from Ghost’s own CDN", it comes from jsDelivr
That bit was the strangest part of the accusations, this is the Ghost CEO, he should know jsDelivr is not really "their" CDN but a generic asset host.
> "However, directly loading scripts from our CDN on their platform is very bad for security." https://twitter.com/JohnONolan/status/1602330410490396672
jsDelivr is meant exactly for this purpose though, isn't it? For JS files to be reused across different sites so it can be cached easier? Not locking versions is the only real issue here.