Sourcegraph: self-hosted Git service with semantic code navigation/search/review • Hacker News Board

Re: Sourcegraph: self-hosted Git service with semantic code navigation/search/review

#111

Post by digikata » Tue, Nov 24, 2015, 9:47 PM UTC

sqs wrote: post #58

digikata wrote: post #54

Earlier quoted context omitted.

Well if the intent is that Sourcegraph Core is "for teams of any size", and the code at https://src.sourcegraph.com/sourcegraph is the Core, then it seems like the LICENCE file in the source should be updated to reflect the intent and not say it's limited. Inside https://src.sourcegraph.com/sourcegraph@master/.tree/LICENSE it has a line that says: "Use Limitation: 15 users"

Sourcegraph CEO here. Thanks for the feedback. We are working on making this smoother/clearer, but the way it works is that the license refers to the posted pricing. The posted pricing on Sourcegraph.com says $0 for teams of any size for the non-enterprise features. When you exceed 15 users, there is also a license you'll receive that explicitly says that, but we wanted to keep it simple when you are just getting sta…

I guess I'm still confused on what the website says re: pricing and limitations of Sourcegraph Core, and what the LICENSE file in the source code repository says.

The LICENSE file starts:

Fair Source License, version 0.9

Licensor: Sourcegraph Inc.

Software: Sourcegraph Core

Use Limitation: 15 users

...

But I think "Sourcegraph Core" is described as teams of any size on the website.

Re: Sourcegraph: self-hosted Git service with semantic code navigation/search/review

#112

Post by dragonwriter » Tue, Nov 24, 2015, 9:48 PM UTC

nickpsecurity wrote: post #100

dragonwriter wrote: post #89

Earlier quoted context omitted.

> It replicates once it attaches to things. No, it doesn't. > This is true even of distributing a large amount of non-free code while someone in organization unknowingly included a tiny amount of copyleft code. If a single work is distributed that is based on copyleft code (not a mere aggregation that includes copyleft code and other code), then not licensing the resulting work as specified in the copyleft license is…

Now, it's possible my memory is messing me up again or I bought into a false explanation of the legal issues. To be clear, your saying that my worry was inaccurate and one person including GPL code into a new, released version of a proprietary app doesn't require the whole, linked source of that app be released under GPL? That happening is very virus-like but if it can't then it wouldn't be virus-like.

> To be clear, your saying that my worry was inaccurate and one person including GPL code into a new, released version of a proprietary app doesn't require the whole, linked source of that app be released under GPL?

If the inclusion suffices to make the app as a whole a derivative work under copyright law (the FSF has a particular opinion on linking, but that opinion is not included in the license), then it would require you to offer the app under the GPL, failure to do so would be a violation of the GPL.

There is nothing "virus-like" here. The license doesn't attach without your knowledge. You may face consequences for the breach if you don't comply with the GPL terms, and releasing the whole work under the GPL may be the most convenient way of dealing with that -- then again, it may not.

Re: Sourcegraph: self-hosted Git service with semantic code navigation/search/review

#113

Post by nickpsecurity » Tue, Nov 24, 2015, 9:48 PM UTC

sulam wrote: post #24

Somasis wrote: post #7

Earlier quoted context omitted.

You would be better off selling services akin to what GitLab does for sustenance.

Completely disagree. Services models seem to very much limit what companies like this can achieve. It also creates a perverse incentive for the company to make a product that needs service contracts to manage. They tend to produce more closed-source "addons" as well.

Exactly. Empirical research I saw showed that most companies in that market don't do so well in either profits or longevity. The majority of them we see here also intend to sell out.

Re: Sourcegraph: self-hosted Git service with semantic code navigation/search/review

#114

Post by dragonwriter » Tue, Nov 24, 2015, 9:51 PM UTC

digikata wrote: post #111

sqs wrote: post #58

Earlier quoted context omitted.

Sourcegraph CEO here. Thanks for the feedback. We are working on making this smoother/clearer, but the way it works is that the license refers to the posted pricing. The posted pricing on Sourcegraph.com says $0 for teams of any size for the non-enterprise features. When you exceed 15 users, there is also a license you'll receive that explicitly says that, but we wanted to keep it simple when you are just getting sta…

I guess I'm still confused on what the website says re: pricing and limitations of Sourcegraph Core, and what the LICENSE file in the source code repository says. The LICENSE file starts: Fair Source License, version 0.9 Copyright (c) 2015 Sourcegraph Inc. Licensor: Sourcegraph Inc. Software: Sourcegraph Core Use Limitation: 15 users ... But I think "Sourcegraph Core" is described as teams of any size on the website.

From other comments, I gather that (to make things as confusing as possible) Sourcegraph Core is released under the Fair Source License with a 15 user limitation, but the fee for > 15 users is $0/user, so its basically a free (gratis, not Free/libre) shared-source model.

Re: Sourcegraph: self-hosted Git service with semantic code navigation/search/review

#115

Post by nickpsecurity » Tue, Nov 24, 2015, 9:55 PM UTC

bradrydzewski wrote: post #55

Somasis wrote: post #7

Earlier quoted context omitted.

You would be better off selling services akin to what GitLab does for sustenance.

Gitlab graduated from Ycombinator and raised a 4MM series A round. While these are both tremendous accomplishments and important milestones for any startup, it may be a bit premature to declare their business model a success.

As I said in another comment, many of the companies pushing this model are VC-funded with intent to sell out and their operation disappears into a big company (or disappears). We should distinguish between business models that are just to get an acquisition and that support long-term growth. Cheap addons with OSS/FOSS seems mainly to work in the former.

Re: Sourcegraph: self-hosted Git service with semantic code navigation/search/review

#116

Post by nickpsecurity » Tue, Nov 24, 2015, 10:00 PM UTC

dragonwriter wrote: post #112

nickpsecurity wrote: post #100

Earlier quoted context omitted.

Now, it's possible my memory is messing me up again or I bought into a false explanation of the legal issues. To be clear, your saying that my worry was inaccurate and one person including GPL code into a new, released version of a proprietary app doesn't require the whole, linked source of that app be released under GPL? That happening is very virus-like but if it can't then it wouldn't be virus-like.

> To be clear, your saying that my worry was inaccurate and one person including GPL code into a new, released version of a proprietary app doesn't require the whole, linked source of that app be released under GPL? If the inclusion suffices to make the app as a whole a derivative work under copyright law (the FSF has a particular opinion on linking, but that opinion is not included in the license), then it would req…

"The license doesn't attach without your knowledge."

It does if one person on a large team did it without others' knowledge. This doesn't occur for most, non-copyleft code. At that point, if it's a derivative work, then your codebase looses its value as it gets GPL'd just because GPL'd code touched it. Preventing that outcome would require both preventative methods and constant vigilance.

Kind of like avoiding getting sick from a virus and spreading it everywhere.

Note: A former Microsoft employee told me in a prior discussion they identified this exact risk and took steps to prevent it. I never knew if it was paranoia or what could legally happen. Interesting to find last year that my hypothetical scenario actually played out to a degree in FOSS's arch-rival of that period.

Re: Sourcegraph: self-hosted Git service with semantic code navigation/search/review

#117

Post by bradrydzewski » Tue, Nov 24, 2015, 10:14 PM UTC

nickpsecurity wrote: post #115

bradrydzewski wrote: post #55

Earlier quoted context omitted.

Gitlab graduated from Ycombinator and raised a 4MM series A round. While these are both tremendous accomplishments and important milestones for any startup, it may be a bit premature to declare their business model a success.

As I said in another comment, many of the companies pushing this model are VC-funded with intent to sell out and their operation disappears into a big company (or disappears). We should distinguish between business models that are just to get an acquisition and that support long-term growth. Cheap addons with OSS/FOSS seems mainly to work in the former.

I agree. I was responding to the parent comment suggesting Sourcegraph should adopt a similar business model to GitLab and I was pointing out that perhaps GitLab's business model has not been proven successful yet

Re: Sourcegraph: self-hosted Git service with semantic code navigation/search/review

#118

Post by nickpsecurity » Tue, Nov 24, 2015, 10:17 PM UTC

bradrydzewski wrote: post #117

nickpsecurity wrote: post #115

Earlier quoted context omitted.

As I said in another comment, many of the companies pushing this model are VC-funded with intent to sell out and their operation disappears into a big company (or disappears). We should distinguish between business models that are just to get an acquisition and that support long-term growth. Cheap addons with OSS/FOSS seems mainly to work in the former.

I agree. I was responding to the parent comment suggesting Sourcegraph should adopt a similar business model to GitLab and I was pointing out that perhaps GitLab's business model has not been proven successful yet

Exactly. Way too early.

Re: Sourcegraph: self-hosted Git service with semantic code navigation/search/review

#119

Post by dragonwriter » Tue, Nov 24, 2015, 10:23 PM UTC

nickpsecurity wrote: post #116

dragonwriter wrote: post #112

Earlier quoted context omitted.

> To be clear, your saying that my worry was inaccurate and one person including GPL code into a new, released version of a proprietary app doesn't require the whole, linked source of that app be released under GPL? If the inclusion suffices to make the app as a whole a derivative work under copyright law (the FSF has a particular opinion on linking, but that opinion is not included in the license), then it would req…

"The license doesn't attach without your knowledge." It does if one person on a large team did it without others' knowledge. This doesn't occur for most, non-copyleft code. At that point, if it's a derivative work, then your codebase looses its value as it gets GPL'd just because GPL'd code touched it. Preventing that outcome would require both preventative methods and constant vigilance. Kind of like avoiding gettin…

> > The license doesn't attach without your knowledge.

> It does if one person on a large team did it without others' knowledge.

No, the license never attaches to your code without a positive decision on your part to offer your code under the license.

Now, if someone does something that makes the code legally a derivative work of GPL code without knowledge of the person releasing the code, the obligation to release the code under the GPL or not at all may be created and breached without knowledge of the person doing the release, but the license still has not attached to your code.

When the breach is detected, you may decide that the best way to deal with the breach is to offer the code under the GPL.

> This doesn't occur for most, non-copyleft code.

Any code, under any license with any obligations attached to redistribution of derivative works -- or which simply prohibits redistributing such works -- can create unexpected breaches when someone includes them in a work without knowledge of the person responsible for the release; copyleft licenses are not at all special in this regard.

> At that point, if it's a derivative work, then your codebase looses its value as it gets GPL'd just because GPL'd code touched it.

No, again, your code base only becomes GPL because you choose to offer it under the GPL. IIRC, the few GPL violation cases (in the US, at least) that have gone to court and not been settled have resulted in fines and injunctions on distributing the GPL-dependent software.

> Note: A former Microsoft employee told me in a prior discussion they identified this exact risk and took steps to prevent it. I never knew if it was paranoia or what could legally happen. Interesting to find last year that my hypothetical scenario actually played out to a degree in FOSS's arch-rival of that period.

The description of the GPL as "viral" was central to Microsoft's PR effort against Free Software in general and Linux in particular.

So, its not really surprising to hear that from that source.

Re: Sourcegraph: self-hosted Git service with semantic code navigation/search/review

#120

Post by beliu » Tue, Nov 24, 2015, 10:25 PM UTC

durin42 wrote: post #68

sqs wrote: post #63

Earlier quoted context omitted.

Sourcegraph CEO here. Fair Source is not an open-source license. It is intended to be an improvement over closed source (GitHub, Bitbucket, etc.) and open core (where many important bits are closed source). Fair Source is not intended to support forking and independent redistribution. If you fork a Fair Source-licensed project and try to distribute it, users would have to also acquire a license from the original auth…

I mentioned this over on lobste.rs, but I'll mention it here in brief: fair.io does a really bad job of stating this intent. The elevator pitch mentions open source but not proprietary. Please consider rewording fair.io to be clearer about the non-open-source intent here.

Thanks for this suggestion. We want to make it clear that Fair Source is not Open Source. We've updated the summary in the header: https://fair.io. Hope this is clearer!