3 ms·

Upspin is one of Google's many Open Source projects. It's not really skunkworks, per se, just something that we wanted to work on and were lucky enough to be su

by enneff 10y ago

Upspin is one of Google's many Open Source projects. It's not really skunkworks, per se, just something that we wanted to work on and were lucky enough to be supported by Google in doing so. The email addresses are Upspin user names whose public keys are registered with a central server, key.upspin.io. To act as an Upspin client, you need to sign up: https://upspin.io/doc/signup.md https://upspin.io/doc/signup.md Requests made by Upspin users are signed with those public keys. Servers validate those users by validating the signatures against the key published by key.upspin.io.

cyberferret 10y ago
Gotcha, thanks for the extra info. So you still have to sign up with the Upspin service to be able to consume shared files? I was under the impression from the post that it was an 'account free' type of service, in as much as you can publish a URL where people can grab files, but still provided a level of access control, and I was having a hard time reconciling that in my head.
- enneff 10y ago
  You need to register your public key with key.upspin.io in order to speak to any Upspin servers, so in that sense it is not "account free". You need to prove to others that you are who you say you are. There is an "all" permission that shares with the world (see https://upspin.io/doc/access_control.md https://upspin.io/doc/access_control.md) but in most cases we expect people will share with a specific set of named users.
  - toomuchtodo 10y ago
    Will Upspin key servers be operated by a non-Google entity so as to allow the global filesystem to continue to function after Google decides to no longer support the project?
    - simonh 10y ago
      What happens when that non-Google entity decides to no longer support the project? Now you're dependent on two organisations continuing support instead of just one. It sounds like the project code is all publisgedcthough, so it should be possible to operate a private or alternative upspin network.
cookiecaper 10y ago
This doesn't really clarify what an "unofficial" Google project is. Does it mean that people don't work on it full-time and it's a 20% project? Does it mean that it was developed at home without using Google's resources, so they don't have an ownership interest in it, but they are letting it be hosted on their infrastructure and announced on their blog to be nice? Does it mean that Google isn't sure how long it will want to continue to contribute resources? Does it mean that support is only available on an ad-hoc basis (isn't that the case with all free Google products)? Does it mean that serious customers shouldn't rely on it to work reliably? Does it not really mean anything, and just thrown on there for legal protection (against what?)?
- Gigablah 10y ago
  Looks like it's an open source project by individuals who also happen to be employed by Google, and the extent of Google's involvement is the copyright. Edit: looking at the LICENSE file, scratch that, it appears Google doesn't even own the copyright.
  - versteegen 10y ago
    Not really. Google owns the copyright for all code contributed by Google employees on Google time, and currently they are the only copyright holder [1]. In order to contribute you have to sign the standard Google Contributor License Agreement (either [0] or the corporate version) which gives Google a perpetual irrevocable copyright and patent license. Since the project is BSD licensed anyway, unless you're contributing something you intend to patent, you're giving Google nothing by signing the CLA: you still own the actual copyright. (Based on my skimming the agreement; IANAL) [0] https://cla.developers.google.com/about/google-individual https://cla.developers.google.com/about/google-individual [1] https://github.com/upspin/upspin/blob/master/AUTHORS https://github.com/upspin/upspin/blob/master/AUTHORS
- enneff 10y ago
  I didn't write the "unofficial" part, but I can answer the questions: > Does it mean that people don't work on it full-time and it's a 20% project? That there are a few of us paid full-time to work on this, plus some 20% contributors. > Does it mean that it was developed at home without using Google's resources, so they don't have an ownership interest in it, but they are letting it be hosted on their infrastructure and announced on their blog to be nice? No, this was developed by Google employees on Google's time. > Does it mean that Google isn't sure how long it will want to continue to contribute resources? I'm not sure what "Google" thinks about this, but I do know that the foreseeable future this is what I and my other teammates will be working on. > Does it mean that support is only available on an ad-hoc basis (isn't that the case with all free Google products)? There is definitely no support for Upspin beyond us and the community helping people on the mailing list. > Does it mean that serious customers shouldn't rely on it to work reliably? As is stated in the README, Upspin is still very rough. It's early days. > Does it not really mean anything, and just thrown on there for legal protection (against what?)? I'm not sure what "unofficial" means in this case but I hope I have answered your questions sufficiently.
webmaven 10y ago
Is there a list anywhere of these unofficial Google Open Source projects?

by enneff 10y ago

cyberferret 10y ago

Gotcha, thanks for the extra info. So you still have to sign up with the Upspin service to be able to consume shared files? I was under the impression from the post that it was an 'account free' type of service, in as much as you can publish a URL where people can grab files, but still provided a level of access control, and I was having a hard time reconciling that in my head.

enneff 10y ago
You need to register your public key with key.upspin.io in order to speak to any Upspin servers, so in that sense it is not "account free". You need to prove to others that you are who you say you are. There is an "all" permission that shares with the world (see https://upspin.io/doc/access_control.md https://upspin.io/doc/access_control.md) but in most cases we expect people will share with a specific set of named users.
- toomuchtodo 10y ago
  Will Upspin key servers be operated by a non-Google entity so as to allow the global filesystem to continue to function after Google decides to no longer support the project?
  - simonh 10y ago
    What happens when that non-Google entity decides to no longer support the project? Now you're dependent on two organisations continuing support instead of just one. It sounds like the project code is all publisgedcthough, so it should be possible to operate a private or alternative upspin network.

cookiecaper 10y ago

This doesn't really clarify what an "unofficial" Google project is. Does it mean that people don't work on it full-time and it's a 20% project? Does it mean that it was developed at home without using Google's resources, so they don't have an ownership interest in it, but they are letting it be hosted on their infrastructure and announced on their blog to be nice? Does it mean that Google isn't sure how long it will want to continue to contribute resources? Does it mean that support is only available on an ad-hoc basis (isn't that the case with all free Google products)? Does it mean that serious customers shouldn't rely on it to work reliably? Does it not really mean anything, and just thrown on there for legal protection (against what?)?

Gigablah 10y ago
Looks like it's an open source project by individuals who also happen to be employed by Google, and the extent of Google's involvement is the copyright. Edit: looking at the LICENSE file, scratch that, it appears Google doesn't even own the copyright.
- versteegen 10y ago
  Not really. Google owns the copyright for all code contributed by Google employees on Google time, and currently they are the only copyright holder [1]. In order to contribute you have to sign the standard Google Contributor License Agreement (either [0] or the corporate version) which gives Google a perpetual irrevocable copyright and patent license. Since the project is BSD licensed anyway, unless you're contributing something you intend to patent, you're giving Google nothing by signing the CLA: you still own the actual copyright. (Based on my skimming the agreement; IANAL) [0] https://cla.developers.google.com/about/google-individual https://cla.developers.google.com/about/google-individual [1] https://github.com/upspin/upspin/blob/master/AUTHORS https://github.com/upspin/upspin/blob/master/AUTHORS
enneff 10y ago
I didn't write the "unofficial" part, but I can answer the questions: > Does it mean that people don't work on it full-time and it's a 20% project? That there are a few of us paid full-time to work on this, plus some 20% contributors. > Does it mean that it was developed at home without using Google's resources, so they don't have an ownership interest in it, but they are letting it be hosted on their infrastructure and announced on their blog to be nice? No, this was developed by Google employees on Google's time. > Does it mean that Google isn't sure how long it will want to continue to contribute resources? I'm not sure what "Google" thinks about this, but I do know that the foreseeable future this is what I and my other teammates will be working on. > Does it mean that support is only available on an ad-hoc basis (isn't that the case with all free Google products)? There is definitely no support for Upspin beyond us and the community helping people on the mailing list. > Does it mean that serious customers shouldn't rely on it to work reliably? As is stated in the README, Upspin is still very rough. It's early days. > Does it not really mean anything, and just thrown on there for legal protection (against what?)? I'm not sure what "unofficial" means in this case but I hope I have answered your questions sufficiently.

webmaven 10y ago

Is there a list anywhere of these unofficial Google Open Source projects?