Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Making Truth Social Comply with the AGPL

boehs.org

Post reply on HN
Print view View original

31–40 of 99 posts

Re: Making Truth Social Comply with the AGPL

#31

Post by dbmikus »

gpm wrote: post #20
truthsocial wrote: post #12

Thank you for your request (routed through legal, which added a day or so of latency). Main issue is we don't have an automated pipeline to update the published tarball/zipfile from our internal source control system, so it has to be done manually, and no one has that as a specific task. We also review the source for IP/security concerns before releasing. We will probably add a quarterly task to update it, until/unle…

> We will probably add a quarterly task to update it, until/unless we start maintaining a public branch and do it automatically. Unless you only update the code running on the website quarterly, I don't think this complies with the license.

Just curious, does AGPL require actively publishing the source code, or making it available upon request within a reasonable timeframe?

Re: Making Truth Social Comply with the AGPL

#32

Post by gpm »

dbmikus wrote: post #31
gpm wrote: post #20

Earlier quoted context omitted.

> We will probably add a quarterly task to update it, until/unless we start maintaining a public branch and do it automatically. Unless you only update the code running on the website quarterly, I don't think this complies with the license.

Just curious, does AGPL require actively publishing the source code, or making it available upon request within a reasonable timeframe?

My understanding is it requires active publishing, but I'm not a lawyer. Here's what I believe to be the relevant section

> 13. Remote Network Interaction; Use with the GNU General Public License.

> Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.

I'm particularly looking at "from a network server at no charge, through some standard or customary means of facilitating copying of software", I don't believe "upon emailed request" qualifies.

Re: Making Truth Social Comply with the AGPL

#33

Post by truthsocial »

maxbond wrote: post #29
truthsocial wrote: post #12

Thank you for your request (routed through legal, which added a day or so of latency). Main issue is we don't have an automated pipeline to update the published tarball/zipfile from our internal source control system, so it has to be done manually, and no one has that as a specific task. We also review the source for IP/security concerns before releasing. We will probably add a quarterly task to update it, until/unle…

What's the work culture like at Truth Social? Are you guys mostly remote? How many developers are there? Are you hiring a lot of new people? Is there an ideological current to the workplace culture? I won't be applying, but I'm genuinely curious what it's like to work at a company in such a unique situation.

Pretty good! Relatively small team (between 10 and 100), biased toward senior with a few ~5 year more intermediate people, mostly remote across the US although we do have an office and try to get together monthly to quarterly. Ironically, lots of open source contributors. We are hiring for a few roles but mostly just being opportunistic rather than needing to hire. Remarkably little turnover for a tech company. We've all worked at multiple other places made the conscious decision to make this a good place to work.

Biggest challenges are supporting multiple platforms (iOS, Android, Web), all the backend infra, etc at scale with a small team -- i.e. normal startup stuff. Also the perennial challenge of doing new features vs. making things more robust.

A lot of info in the SEC filings as well as news articles (many of which are predictably biased for partisan reasons).

Re: Making Truth Social Comply with the AGPL

#34

Post by defrost »

KRAKRISMOTT wrote: post #27
fnordpiglet wrote: post #24

Earlier quoted context omitted.

Masks don’t protect against viral licenses either. IP isn’t a valid claim to withhold the source. Security needs to be managed outside the code via vaults and other runtime secret stores. There’s no leg to stand on for not releasing the entire code consistently.

The other mastodon instances voluntarily chose to refuse to peer with Truth Social. Maybe they should show their face in court too.

On what basis?

Can you expand on what legal obligation to peer you believe they have?

Re: Making Truth Social Comply with the AGPL

#35

Post by yyyfb »

truthsocial wrote: post #18
birdiesanders wrote: post #15

Earlier quoted context omitted.

You could just, like, turn it all off and go on holiday.

We believe in free speech and giving a voice to the deplatformed, so while we could, we won't.

ISIS and Al Qaeda are deplatformed too. Will you carry their speech?

Re: Making Truth Social Comply with the AGPL

#36

Post by h0l0cube »

truthsocial wrote: post #22
buildbot wrote: post #16

Earlier quoted context omitted.

> We also review the source for IP/security concerns before releasing. Any modifications you make need to also be open sourced.

Best practice when releasing source code generally is making sure no one left API keys, etc. in source code. (Obviously you never check secrets in in the first place, keeping them separate, but it's still worth automated and manual review before releasing.)

Best practice is to not have secrets in your source code. Those should be supplied by an internal service, or injected by your build pipeline at the least.

Re: Making Truth Social Comply with the AGPL

#37

Post by davorak »

buildbot wrote: post #26
truthsocial wrote: post #22

Earlier quoted context omitted.

Best practice when releasing source code generally is making sure no one left API keys, etc. in source code. (Obviously you never check secrets in in the first place, keeping them separate, but it's still worth automated and manual review before releasing.)

That's not IP, that's secrets. IP needs to be included.

Logos, art, and similar? I would have guessed that would not need to be included.

Re: Making Truth Social Comply with the AGPL

#38

Post by margalabargala »

gpm wrote: post #20
truthsocial wrote: post #12

Thank you for your request (routed through legal, which added a day or so of latency). Main issue is we don't have an automated pipeline to update the published tarball/zipfile from our internal source control system, so it has to be done manually, and no one has that as a specific task. We also review the source for IP/security concerns before releasing. We will probably add a quarterly task to update it, until/unle…

> We will probably add a quarterly task to update it, until/unless we start maintaining a public branch and do it automatically. Unless you only update the code running on the website quarterly, I don't think this complies with the license.

Strictly speaking, the source code needs to be made to users upon request. It doesn't need to be proactively published. That's just the easiest way to do it.

So it would be within the license to update "quarterly, and whenever someone bothers to ask".

Re: Making Truth Social Comply with the AGPL

#39

Post by truthsocial »

bavent wrote: post #19
truthsocial wrote: post #12

Thank you for your request (routed through legal, which added a day or so of latency). Main issue is we don't have an automated pipeline to update the published tarball/zipfile from our internal source control system, so it has to be done manually, and no one has that as a specific task. We also review the source for IP/security concerns before releasing. We will probably add a quarterly task to update it, until/unle…

[flagged]

Probably misidentified as spam; filtering isn't really based on content, but at various times we've used third party tools to deal with abuse and have been constantly improving and bringing those in-house. If you email support with the details they can address it.

The biggest footgun I remember was some religious content (Christ on the cross, specifically) being identified as bad by some of these tools and filtered, which we obviously prioritized correcting.

No UGC site really has this solved 100%. Look at Twitter today with the porn reply bots. Facebook has 3-4 orders of magnitude more employees dedicated to filtering content than we have in our entire company. Automation ("AI" plus multiple signals) is the solution, but it's a hard problem.

Re: Making Truth Social Comply with the AGPL

#40

Post by margalabargala »

dbmikus wrote: post #31
gpm wrote: post #20

Earlier quoted context omitted.

> We will probably add a quarterly task to update it, until/unless we start maintaining a public branch and do it automatically. Unless you only update the code running on the website quarterly, I don't think this complies with the license.

Just curious, does AGPL require actively publishing the source code, or making it available upon request within a reasonable timeframe?

The latter.
Post reply on HN