←back to thread

Grayjay Desktop App

(grayjay.app)
510 points pierrelf | 3 comments | 20 Dec 24 17:33 UTC | HN request time: 0.45s | source
Show context
lrvick ◴[21 Dec 24 07:35 UTC] No.42478077[source]▶
I love the right to repair work Louis Rossmann does, and this project goal as a whole, but this license is a major step backwards for software distribution with high assurances of security, freedom and privacy.

Debian, Arch, Guix, F-droid or any other independent signed reproducible build channels require a true Open Source license to function legally.

The license thus forces users to download unsigned non-reproducible binaries off grayjay servers and trust blindly that their build server is creating binaries from exactly the published code and not compromised to inject tracking or malware not in the public repo (an increasingly common attack they may not even know about for years!). Or say the grayjay domain is hijacked or even a BGP attack or a LAN MITM. All sorts of ways they could be helping distribute malware and not know it with no signatures or reproducible build proofs.

Thing is, your team would not have to solve these problems if you licensed it so the community could solve them for you, as we do for thousands of open source software projects.

I really want to see a project like this take off and would gladly donate, but only if it can be opened up for accountability via third party compilation and distribution channels so it can never be backdoored or co-opted for surveillance if your leadership or release engineers are ever compromised.

Said license: https://github.com/futo-org/Grayjay.Desktop?tab=License-1-ov...

There are other licenses like AGPL that would kill any attempt for someone to rip your code off to make their own proprietary offering, without locking yourself out of established freedom, security, and privacy preserving software distribution channels.

If anyone from the team is reading this, I would be happy to detail and discuss my concerns further as a software supply chain security specialist. Hit me up.

replies(6): >>42479087 #>>42479200 #>>42479315 #>>42479424 #>>42479879 #>>42480938 #
j1elo ◴[21 Dec 24 12:06 UTC] No.42479200[source]▶
I read the license and of course IANAL but it seems clear that Debian, Arch, Guix, F-droid or any other independent signed reproducible build channels can package and distribute their own reproducible builds of this software, as long as it is "free of charge for non-commercial purposes", isn't it?

(a FOSS license would also work, but if I have learned something in HN before, is that don't FOSS if you ever want to make money from something while preventing others from making money off of it)

replies(1): >>42479416 #
xmcqdpt2 ◴[21 Dec 24 13:00 UTC] No.42479416[source]▶
You can take a copy of Debian and resell it or put it in a product and sell that. That’s a pretty important freedom of free software.
replies(1): >>42479605 #
j1elo ◴[21 Dec 24 13:39 UTC] No.42479605[source]▶
And Debian is OK with that, because Debian is not a for-profit company that paid it's developers money to make a product, thus they don't care that others get it and resell it.

For a company, the product itself, what makes money, cannot be OSS, as it makes its resell value effectively zero. If the software was OSS, then the software is _not_ the product, but added values are (support, consulting, etc... the classic trope)

But if the software itself wants to be the product, and is created by devs who require their monthly salary, typically the question is between a non-FOSS license or it not existing at all to begin with. Not between a non-FOSS and a FOSS license.

replies(2): >>42481338 #>>42483744 #
1. jraph ◴[21 Dec 24 18:40 UTC] No.42481338[source]▶
> For a company, the product itself, what makes money, cannot be OSS

It can. I work for XWiki SAS, and we sell some extensions under LGPL at store.xwiki.com. And it works, people and especially companies, choose convenience over installing the tools to compile and install the extensions themselves. It works because it's usual and easy to understand for companies to pay for software, and way easier to justify than donations to sponsor free software.

There are also several open source Android or iOS apps that you can buy. OSMAnd+, Conversations, DAVx⁵, Amaze Tools, Fair apps and are/were examples of this

replies(1): >>42481726 #
2. j1elo ◴[21 Dec 24 19:42 UTC] No.42481726[source]▶
Thanks for your perspective! It is interesting. How does the business plan deal with the chance that it's perfectly in my hands (read: on anyone with whatever motivation, usually commercial) to grab the code and provide the same thing but cheaper or even free?

In this case I feel that the answer might ultimately be that it works because it is mostly a niche market and there are other value adds such as support from the makers themselves, which is always a good thing but already is not the software itself per se.

I don't think many companies would be confortable with such a brittle grasp on their sales. Basically it relies on nobody else wanting to do the same (and maybe risk that they execute better).

Imagine if Photoshop was OSS... well, it is good food for thought.

(EDIT re. the apps you mention: also interesting cases; not sure how much that model is actively hurting them or otherwise helping them, would love to see writeups from the companies or creators)

replies(1): >>42482220 #
3. jraph ◴[21 Dec 24 20:55 UTC] No.42482220[source]▶
> How does the business plan deal with the chance that it's perfectly in my hands (read: on anyone with whatever motivation, usually commercial) to grab the code and provide the same thing but cheaper or even free?

Here, it is just some extensions that are in a repository that is enabled by default in the main product (which is free and open source). Someone forking would not have their repository enabled by default. They could of course distribute their own version of XWiki itself with their repository enabled by default. The extensions we sell also come with some basic support, so there's also that. At some point, if someone forks and sells for cheaper, they'll also need to provide the fixes and the features asked by their customers, at which point they'll not be able to keep up with cheap prices.

I suspect a former colleague who now works as a freelance might be distributing some of these apps to their customers (they contribute some fixes from time to time through pull requests).

I guess if it happens more largely we'd figure something out. Now, it's also not our main income. You might be right that it's niche enough to fly under the radar. Forking and maintaining a cheaper copy might also not be lucrative enough: the apps we sell answer needs of existing customers anyway, so we need to write this code anyway, but someone external would probably find something more lucrative to do with their time. I don't know :-)

Another good example I didn't think about in my first comment is WordPress extensions with their premium plans. Because of the WordPress license, you are forced to distribute your WordPress extension as open source. And this is probably less niche, for the biggest extensions.