5 ms·

The one liner is great to have. I love that homebrew does that. For a project that you host, to be able to install it super fast and just get on with it is a hu

The one liner is great to have. I love that homebrew does that. For a project that you host, to be able to install it super fast and just get on with it is a huge plus. However I chose not run this because it's a compiled binary and the source is nowhere to be seen. I choose not to trust a binary that I found on a forum from the internets. :) I'm much more likely to try something like Wekan and evaluate it seriously just because I know that me and my team can build whatever features we need and we can trust the code because we can read it. So does the business model work in the environment you're in? Eg giving the source to people who pay for it? Maybe it would be better to do something like eg nginx or cassandra or gitlab - have an OSS version and some premium version or at least some support contract with gold support or similar. It's a tough space to be fighting in with mature products and free products. How can you separate yourself from these other guys in a way that will still make you money? If it's just a self hosted trello alternative, that space may already be cloudy with Wekan. You need some differentiating quality to sit beside trello and wekan I think.

medvednikov 11y ago
Thanks a lot for such a thorough comment! You are right, asking people to run the binary on their servers is not a good idea. I guess I have no other choice but to provide the source code to the clients, just like Atlassian does. I just did some research, and it looks like GitHub are protecting their source code: http://stackoverflow.com/questions/13185814/how-github-enterprise-protects-the-code-they-deliver-on-virtual-machines http://stackoverflow.com/questions/13185814/how-github-enter... How do they get away with this?
- dmix 11y ago
  An about page about who you are would be a good start. Additionally, what country your from would be of interest. Most importantly would be your incentives for doing this project. If it's money, how to you plan to monetize? Do you plan to sell your users data? etc. Trust is critical. Almost all of us Linux users run at least a few prepackaged binaries on our systems. But they come from trustworthy sources such as big companies like Github. These proprietary binaries are usually vetted by security researchers as well to detect any malicious behaviour. Additionally, I'd recommend posting SHA checksums and offering a more traditional "Download" button as an alternative to the one-liner. TLDR: You're asking people to take a risk on a new project, without any indiciation of who's behind it or why they should trust you.
  - cyphar 11y ago
    > Trust is critical. Almost all of us [GNU/]Linux users run at least a few prepackaged binaries on our systems. But they come from trustworthy sources such as big companies like Github. These proprietary binaries are usually vetted by security researchers as well to detect any malicious behaviour. Speak for yourself. I explicitly have removed all proprietary software from my machine. The whole "vetted by security researchers" is such a vague metric with mixed results. One researcher will find 30 bugs while another will find 5 in the same time. > Additionally, I'd recommend posting SHA checksums and offering a more traditional "Download" button as an alternative to the one-liner. > TLDR: You're asking people to take a risk on a new project, without any indiciation of who's behind it or why they should trust you. Which is why he should just release the source. Then trust isn't a factor. I don't trust random people on the internet. And no, I don't trust GitHub or whoever you want to pick.
    - kbutler 11y ago
      > I explicitly have removed all proprietary software from my machine Video drivers? BIOS? These are possible, but every individual's weighting of the difficult trade-offs may be different.
      - cyphar 11y ago
        I use Intel's free software drivers. I've got libreboot on one or two of my machines (the others are work machines, so I'm fairly sure my employer wouldn't let me flash libreboot onto the BIOS). I wish RISC-V and free hardware design FPGAs would be a thing soon so I can get rid of the proprietary Intel microcode. Not sure what I'll do about video then though.
    - dmix 11y ago
      > I explicitly have removed all proprietary software from my machine. So you don't use a desktop operating system? Or smartphone?
      - akerro 11y ago
- cyphar 11y ago
  > I guess I have no other choice but to provide the source code to the clients, just like Atlassian does. Is there a reason you don't want to do that? It clearly works. Release your code under the BSD or GPL licenses and provide it to your customers. If you did that, I'd be happy to pay for software like that. But for me, free (as in freedom) software is a requirement for anything I'm going to run on my machine.
- sdesol 11y ago
  > How do they get away with this? They have a unique offering and they are a trusted brand. If you have neither, you are relying on blind faith. For the vast majority of business to consumer products, this isn't a problem. However, in your case, you have a product that requires the installer to be somewhat knowledgeable, hence the scrutiny. The easiest way to gain credibility is to have an incumbent vouch for you. For example, if Trello were to say, if you want to host your own Trello like solution, there is no better option than X, then most people wouldn't really care about installing a binary. Since your solution isn't novel enough for people to take that leap of faith, you really have no other choice but to make the source available or try to align yourself with an established incumbent. For example, create your product so it has tight integration with an Atlassian product and sell your solution through Atlasisan's marketplace. Or create a tight integration with GitHub and try to get it listed as an integration partner. And so forth.
  - masukomi 11y ago
    Spot on. Couldn't agree more. I didn't download it because I didn't know anything about the creator, couldn't see the source, and had not evidence that it wasn't just some malware with a useful looking screenshot.

medvednikov 11y ago

Thanks a lot for such a thorough comment! You are right, asking people to run the binary on their servers is not a good idea. I guess I have no other choice but to provide the source code to the clients, just like Atlassian does. I just did some research, and it looks like GitHub are protecting their source code: http://stackoverflow.com/questions/13185814/how-github-enterprise-protects-the-code-they-deliver-on-virtual-machines http://stackoverflow.com/questions/13185814/how-github-enter... How do they get away with this?

dmix 11y ago
An about page about who you are would be a good start. Additionally, what country your from would be of interest. Most importantly would be your incentives for doing this project. If it's money, how to you plan to monetize? Do you plan to sell your users data? etc. Trust is critical. Almost all of us Linux users run at least a few prepackaged binaries on our systems. But they come from trustworthy sources such as big companies like Github. These proprietary binaries are usually vetted by security researchers as well to detect any malicious behaviour. Additionally, I'd recommend posting SHA checksums and offering a more traditional "Download" button as an alternative to the one-liner. TLDR: You're asking people to take a risk on a new project, without any indiciation of who's behind it or why they should trust you.
- cyphar 11y ago
  > Trust is critical. Almost all of us [GNU/]Linux users run at least a few prepackaged binaries on our systems. But they come from trustworthy sources such as big companies like Github. These proprietary binaries are usually vetted by security researchers as well to detect any malicious behaviour. Speak for yourself. I explicitly have removed all proprietary software from my machine. The whole "vetted by security researchers" is such a vague metric with mixed results. One researcher will find 30 bugs while another will find 5 in the same time. > Additionally, I'd recommend posting SHA checksums and offering a more traditional "Download" button as an alternative to the one-liner. > TLDR: You're asking people to take a risk on a new project, without any indiciation of who's behind it or why they should trust you. Which is why he should just release the source. Then trust isn't a factor. I don't trust random people on the internet. And no, I don't trust GitHub or whoever you want to pick.
  - kbutler 11y ago
    > I explicitly have removed all proprietary software from my machine Video drivers? BIOS? These are possible, but every individual's weighting of the difficult trade-offs may be different.
    - cyphar 11y ago
      I use Intel's free software drivers. I've got libreboot on one or two of my machines (the others are work machines, so I'm fairly sure my employer wouldn't let me flash libreboot onto the BIOS). I wish RISC-V and free hardware design FPGAs would be a thing soon so I can get rid of the proprietary Intel microcode. Not sure what I'll do about video then though.
  - dmix 11y ago
    > I explicitly have removed all proprietary software from my machine. So you don't use a desktop operating system? Or smartphone?
    - akerro 11y ago
cyphar 11y ago
> I guess I have no other choice but to provide the source code to the clients, just like Atlassian does. Is there a reason you don't want to do that? It clearly works. Release your code under the BSD or GPL licenses and provide it to your customers. If you did that, I'd be happy to pay for software like that. But for me, free (as in freedom) software is a requirement for anything I'm going to run on my machine.
sdesol 11y ago
> How do they get away with this? They have a unique offering and they are a trusted brand. If you have neither, you are relying on blind faith. For the vast majority of business to consumer products, this isn't a problem. However, in your case, you have a product that requires the installer to be somewhat knowledgeable, hence the scrutiny. The easiest way to gain credibility is to have an incumbent vouch for you. For example, if Trello were to say, if you want to host your own Trello like solution, there is no better option than X, then most people wouldn't really care about installing a binary. Since your solution isn't novel enough for people to take that leap of faith, you really have no other choice but to make the source available or try to align yourself with an established incumbent. For example, create your product so it has tight integration with an Atlassian product and sell your solution through Atlasisan's marketplace. Or create a tight integration with GitHub and try to get it listed as an integration partner. And so forth.
- masukomi 11y ago
  Spot on. Couldn't agree more. I didn't download it because I didn't know anything about the creator, couldn't see the source, and had not evidence that it wasn't just some malware with a useful looking screenshot.