• 0 Posts
  • 21 Comments
Joined 1 year ago
cake
Cake day: August 20th, 2023

help-circle







  • One difference (so far as I know, I’m not an expert on either situation) is that MongoDB requires copyright assignment for contributions seemingly because the license is so restrictive they can’t offer their own service under its terms (without open-sourcing all the software they use to host it). So far as I know Sentry does not require this (although the restriction against running a competing service does not affect them since they are the service, so I’m not sure this argument really holds up that well). Also the fact that that one encumbrance is released after two years helps their case a lot in my eyes.


  • They do allow you to profit off the software though, by using it to host the service for yourself (even as a company), you just can’t offer hosting as a service to compete with them. Obviously this doesn’t offer as much freedom as just a straight MIT or Apache license, but I feel like it still qualifies as open-source; they are only really adding one restriction, and it could even be considered less restrictive than something like GPL (no requirement to open source derived software). I think this license makes a good compromise of being as open as they possibly can without AWS/GCP/Azure eating all of their business without doing any real engineering work.





  • Yes, most of those points are the concerns with warrant canaries. So far as we know the concept is totally untested in court so it’s hard to say what the result would be until it happens.

    Updating the canary should require a human input (like a password to unlock the GPG key), which is not sometime the government would generally get access to (they make a request for data about XYZ user, and the company turns it over; they wouldn’t get actual access to the production system). The government could seek a ruling to force the company to update the canary, but as such a thing hasn’t been granted before (at least as far as we know), it’s not a guarantee. So, there is a chance that the warrant canary will serve to alert users to something happening, which is better than nothing. But because of its untested nature, it might be broken by a court.

    I’m not sure I understand your point about “once it’s triggered it can’t be reset.” If a company fails to update their canary on schedule it means something happened that they can’t disclose. Once they are released from the NDA they can release a new canary explaining what happened.





  • The idea is that there is no such action as “triggering the canary” that the government can stop them from taking. Instead they refrain from updating it, thus alerting people that something has occurred. However, since the point of a canary is that not updating it raises concerns, I’m not sure how this service makes any sense (alerts on new canaries?).

    The idea is that there is a big difference between the government saying “don’t tell anyone about this” and saying “you must make a false statement (the canary) every X amount of time indefinitely.” In the past courts in the US have taken a fairly dim view of the government trying to compel speech. There are some example cases at https://en.m.wikipedia.org/wiki/Compelled_speech#United_States.