11–20 of 62 posts
Elastic 2, for those who care about such things: https://github.com/Bearer/bearer/blob/v1.0.0/LICENSE.txt
We wanted to find a good balance with a license to allow any team to use it for their own usage no strings attached and at the same time protect us against a big vendor tempted to package our work under their product without us getting a dime... Unfortunately, it happens in this world :(
Elastic 2, for those who care about such things: https://github.com/Bearer/bearer/blob/v1.0.0/LICENSE.txt
Absolutely! We wanted to find a good balance with a license to allow any team to use it for their own usage no strings attached and at the same time protect us against a big vendor tempted to package our work under their product without us getting a dime... Unfortunately, it happens in this world :(
This is a great looking project - we've been looking for tools similar to this to add an extra layer of validation to our codebase. Are you thinking about supporting Java in the future?
Thank you! We were actually thinking Java or PHP for the next one, so I guess it's a +1 on java :D
Earlier quoted context omitted.
Absolutely! We wanted to find a good balance with a license to allow any team to use it for their own usage no strings attached and at the same time protect us against a big vendor tempted to package our work under their product without us getting a dime... Unfortunately, it happens in this world :(
AGPLv3 would ensure any changes by a big vendor would remain freely licensed. The current license for this project fails to meet the Open Source Definition (Criteria 6: No Discrimination Against Fields of Endeavor) since it restricts offering Bearer as a managed service.
Happy to revisit the license in the future when we feel more protected, but for now, we've seen so much bad behaviors in this industry with big vendors taking advantages of small companies like ours.
The big missing feature for these kinds of tools is a workflow and relationship for dev teams to mark findings. Marking them as "false positive" or "only applies if these other conditions are true", or "yes, but we have a mitigation/exception". etc. A fast workflow that allows for less blockers, reduced noise and a focus on things that actually matter.
On the "marking" part, we have two options that will be available super soon: 1) Directly in the code, by adding a special comment that will ignore findings. 2) In the Cloud, an ignore action will forever park an issue, even if it changes line etc. (smart fingerprinting applied). We can't really have that in the OSS since it's state-less.