5 ms·

You should be always skeptic but when someone write "Pure transparency — trust our code, not our words" in an EXTRA BIG font, you should be extra skeptic.

sharipova 3y ago
(co-founder of anytype) our main promises are privacy, end-to-end encryption, user controlled keys, self-hosting, p2p sync - all of which should add up to what we can user autonomy from the software provider which we believe to be important. To prove these claims the best way is open the source code. As promises of encryption and ownership stay promises unless you can be sure of it. That was one main motivation and why we think it's worth highlighting.
- master-lincoln 3y ago
  Is there a way to make sure I am using the code you published and not a different version?
  - requilence 3y ago
    We do releases in the Github Actions CI. So you can inspect the CI logs and published artefacts(desktop/android). Then you can compare the binaries checksums. I would appreciate ideas on how we can make it more transparent
- Zambyte 3y ago
  So I see the networking portions of the code are Free Software - that's great. How are people expected to use it if their use does not fall under "non-commercial use" as defined in the client license? Do you expect people to write their own clients for commercial use, or do you offer commercial licenses?
  - pronkin 3y ago
    For non-commercial use, you're prohibited from selling it, but using it within your organization is permitted
    - mbreese 3y ago
      You do realize this also means that a for-profit company can’t use the software at all, right? Unmodified, modified, whatever. I don’t think that was your intent, but that’s exactly how it reads. Or maybe that is your intent?
  - pronkin 3y ago
    The idea if you want to sell clients, you need to get a permission form our association.
    - Zambyte 3y ago
      Why not use the GPL?
      - pronkin 3y ago
        Because we want to provide other organizations with the opportunity to offer paid sync services, we needed to incorporate the concept of a network into the license. We crafted the license with that consideration in mind
        Zambyte 3y ago
        > Because we want to provide other organizations with the opportunity to offer paid sync services Why do you think the GPL is not compatible with this?
        mbreese 3y ago
        Exactly… Plus, they can always offer other licenses in addition to the GPL (or really AGPL would be a better fit for their concerns). It’s their software, so they can license it to anyone with whatever terms they want. (Assuming there aren’t outside contributions, but even that can be dealt with)
        Zambyte 3y ago
        > Plus, they can always offer other licenses in addition to the GPL Yep, that's exactly what I was thinking. They're clearly offering alternative licenses to the one in the public repository. There is no reason the same tactic couldn't be applied with the GPL.
        maxloh 3y ago
        You may employed a wrong strategy. To prevent paid sync services, you should license your protocols and data formats in AGPL, which requires derivative work (third-party sync services) to be open sourced. The client app in contrast, should be fine even in permissive licenses.

sharipova 3y ago

(co-founder of anytype) our main promises are privacy, end-to-end encryption, user controlled keys, self-hosting, p2p sync - all of which should add up to what we can user autonomy from the software provider which we believe to be important. To prove these claims the best way is open the source code. As promises of encryption and ownership stay promises unless you can be sure of it. That was one main motivation and why we think it's worth highlighting.

master-lincoln 3y ago
Is there a way to make sure I am using the code you published and not a different version?
- requilence 3y ago
  We do releases in the Github Actions CI. So you can inspect the CI logs and published artefacts(desktop/android). Then you can compare the binaries checksums. I would appreciate ideas on how we can make it more transparent
Zambyte 3y ago
So I see the networking portions of the code are Free Software - that's great. How are people expected to use it if their use does not fall under "non-commercial use" as defined in the client license? Do you expect people to write their own clients for commercial use, or do you offer commercial licenses?
- pronkin 3y ago
  For non-commercial use, you're prohibited from selling it, but using it within your organization is permitted
  - mbreese 3y ago
    You do realize this also means that a for-profit company can’t use the software at all, right? Unmodified, modified, whatever. I don’t think that was your intent, but that’s exactly how it reads. Or maybe that is your intent?
- pronkin 3y ago
  The idea if you want to sell clients, you need to get a permission form our association.
  - Zambyte 3y ago
    Why not use the GPL?
    - pronkin 3y ago
      Because we want to provide other organizations with the opportunity to offer paid sync services, we needed to incorporate the concept of a network into the license. We crafted the license with that consideration in mind
      - Zambyte 3y ago
        > Because we want to provide other organizations with the opportunity to offer paid sync services Why do you think the GPL is not compatible with this?
        mbreese 3y ago
        Exactly… Plus, they can always offer other licenses in addition to the GPL (or really AGPL would be a better fit for their concerns). It’s their software, so they can license it to anyone with whatever terms they want. (Assuming there aren’t outside contributions, but even that can be dealt with)
        Zambyte 3y ago
        > Plus, they can always offer other licenses in addition to the GPL Yep, that's exactly what I was thinking. They're clearly offering alternative licenses to the one in the public repository. There is no reason the same tactic couldn't be applied with the GPL.
      - maxloh 3y ago
        You may employed a wrong strategy. To prevent paid sync services, you should license your protocols and data formats in AGPL, which requires derivative work (third-party sync services) to be open sourced. The client app in contrast, should be fine even in permissive licenses.