Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CodeCov is now Open Source

about.codecov.io

Post reply on HN
Print view View original

11–20 of 179 posts

Re: CodeCov is now Open Source

#11

Post by LapsangGuzzler »

danpalmer wrote: post #8
dmm wrote: post #6

"I've decided to become vegetarian. From now on I only eat meat on Wednesdays." "That's not what vegetarian means!" BSL is not open source.

To extend the metaphor though... only eating meat on Wednesdays is much better than eating it every day, and releasing the source and accepting contributions, even if under a licence not recognised as meeting the full open-source standards, is still much of the value.

Completely agree, and if BSL allows the project to continue making enough money to sustain itself instead of being turned completely over to the community and risk becoming abandoned, then I’m all for it.

Re: CodeCov is now Open Source

#13

Post by YPCrumble »

People often claim that open source is more secure, which is implied in this release. But the CodeCov breach that leaked any secrets provided to CI/CD pipelines [1] was done via a bash script available to anyone to read the code. The breach wasn't complex at all. It was just that nobody noticed for a long time that the bash uploader script sent all secrets to a random IP address.

It makes me wonder what the benefit really is to being open source. Is it just marketing?

https://about.codecov.io/security-update/

Re: CodeCov is now Open Source

#14

Post by waithuh »

dmm wrote: post #6

"I've decided to become vegetarian. From now on I only eat meat on Wednesdays." "That's not what vegetarian means!" BSL is not open source.

They are making an effort though. Public-available code and open source go hand in hand, even if they have overwhelmingly different principles.

They, as a business, found it more advantageous to make their product available to the public. There are of course business interests rooted in it, (like ending support for their paid product, or gaining free publicity/more sponsorships) but shooing away acts like these just make going open source all around a worse business choice.

Re: CodeCov is now Open Source

#16

Post by koolba »

LapsangGuzzler wrote: post #9
dmm wrote: post #6

"I've decided to become vegetarian. From now on I only eat meat on Wednesdays." "That's not what vegetarian means!" BSL is not open source.

Would you rather they just keep their source completely closed then? I just don’t understand the criticism of a company transparently acting in its best interest (in what I would consider to be a completely reasonable way).

They could just as easily word the press release ETL be “… releasing the source code”.

“Open Source” has a specific meaning. It’d be like saying “…is now free!” with “free” defined as some price I consider to round to zero. It’s clearly misrepresenting the word which has a specific meaning.

Re: CodeCov is now Open Source

#17

Post by zeeg »

YPCrumble wrote: post #13

People often claim that open source is more secure, which is implied in this release. But the CodeCov breach that leaked any secrets provided to CI/CD pipelines [1] was done via a bash script available to anyone to read the code. The breach wasn't complex at all. It was just that nobody noticed for a long time that the bash uploader script sent all secrets to a random IP address. It makes me wonder what the benefit r…

It’s not about security for us, but about accessibility of technology. Open source lifts the barriers on who can use software (eg outside of politics, compliance, etc), and enables knowledge share. It’s - from Sentrys angle - how we enable any developer to take advantage of our technology, hopefully enabling them to solve other problems and grow the industry.

Re: CodeCov is now Open Source

#18

Post by twleo »

YPCrumble wrote: post #13

People often claim that open source is more secure, which is implied in this release. But the CodeCov breach that leaked any secrets provided to CI/CD pipelines [1] was done via a bash script available to anyone to read the code. The breach wasn't complex at all. It was just that nobody noticed for a long time that the bash uploader script sent all secrets to a random IP address. It makes me wonder what the benefit r…

Open source does not magically make your software more secure. Community needs to audit the code if they are going to use it instead of trusting blindly.

Re: CodeCov is now Open Source

#19

Post by the_mitsuhiko »

dmm wrote: post #6

"I've decided to become vegetarian. From now on I only eat meat on Wednesdays." "That's not what vegetarian means!" BSL is not open source.

I think the BSL constitutes as Open Source. I’m obviously biased here as someone working at Sentry but here is my reasoning. If you download source today and just wait long enough it is 100%, unquestionably Open Source as per OSI Definition.

There are projects that only release Open Source licensed code in very irregular intervals and they are still Open Source. BSL is rolling Open Source with delay.

Re: CodeCov is now Open Source

#20

Post by orra »

koolba wrote: post #16
LapsangGuzzler wrote: post #9

Earlier quoted context omitted.

Would you rather they just keep their source completely closed then? I just don’t understand the criticism of a company transparently acting in its best interest (in what I would consider to be a completely reasonable way).

They could just as easily word the press release ETL be “… releasing the source code”. “Open Source” has a specific meaning. It’d be like saying “…is now free!” with “free” defined as some price I consider to round to zero. It’s clearly misrepresenting the word which has a specific meaning.

'[Old versions] will be open source' would, I think, also be a fair description. Right now it's source available proprietary freeware; in three and a half years it (specifically, the now-current version) will be open source.

For this reason, I think the Business Source License (BSL) (with an Open Source Change License) is less nefarious than the Server Side Public License (SSPL).

Post reply on HN