3 ms·

I somewhat suspect companies that apply "creative" licenses like this haven't been under a corporate legal department before. Using a standard license is great

by scj 7y ago

I somewhat suspect companies that apply "creative" licenses like this haven't been under a corporate legal department before. Using a standard license is great. Using a custom license that is extremely similar to an existing license is not as good, but is usually workable... Showing legal how to use Github so they can confirm the age of the software you're using, then convincing them Github is a reputable party will likely result in an unpleasant conversation at best.

yellowapple 7y ago
> Showing legal how to use Github so they can confirm the age of the software you're using, then convincing them Github is a reputable party will likely result in an unpleasant conversation at best. A conversation made far less pleasant by the ability to feed arbitrary dates into a Git repo's commit history: https://github.com/gelstudios/gitfiti https://github.com/gelstudios/gitfiti I'm sure there's a way to find the actual time a push happened; hopefully it doesn't involve subpoenaing GitHub (or Microsoft, I guess) for logs.
- ilammy 7y ago
  If you're that paranoid for your software, you can vendor the source, sign the tag with publicly-verifiable GPG key, and include some cryptographic timestamp in the description (e.g., hash of the current Bitcoin block or something) Also, print all of that, get the legal to seal the pages, and put them into a safe.
cma 7y ago
> Showing legal how to use Github so they can confirm the age of the software you're using, then convincing them Github is a reputable party will likely result in an unpleasant conversation at best. Wouldn't that be: > Showing legal how to use [Microsoft] Github so they can confirm the age of the software you're using, then convincing them [Microsoft] Github is a reputable party will likely result in an unpleasant conversation at best. Seems that 'Microsoft' prefix might get a bit more clout.
brlewis 7y ago
> Showing legal how to use Github so they can confirm the age of the software you're using, then convincing them Github is a reputable party will likely result in an unpleasant conversation at best. You only have to do that if you're setting up a commercial service that competes with sentry. If you're merely setting it up for your own company's self-hosted use, you don't need that.
- greglindahl 7y ago
  Are you really sure that your big-company legal team won't want to review this odd situation?
  - brlewis 7y ago
    No, but I'm sure they won't have to look at git logs to date the software.
- kyle-rb 7y ago
  >convincing them Github is a reputable party This might be one actual positive of GitHub getting bought by Microsoft: convincing people who don't know anything about software that it's a reputable party.
mdpye 7y ago
While they don't appear super frequent, they cut releases: https://github.com/getsentry/sentry/tags https://github.com/getsentry/sentry/tags Pick one which was cut at a particular point in time and you're done. Doesn't seem that complicated.

by scj 7y ago

yellowapple 7y ago

> Showing legal how to use Github so they can confirm the age of the software you're using, then convincing them Github is a reputable party will likely result in an unpleasant conversation at best. A conversation made far less pleasant by the ability to feed arbitrary dates into a Git repo's commit history: https://github.com/gelstudios/gitfiti https://github.com/gelstudios/gitfiti I'm sure there's a way to find the actual time a push happened; hopefully it doesn't involve subpoenaing GitHub (or Microsoft, I guess) for logs.

ilammy 7y ago
If you're that paranoid for your software, you can vendor the source, sign the tag with publicly-verifiable GPG key, and include some cryptographic timestamp in the description (e.g., hash of the current Bitcoin block or something) Also, print all of that, get the legal to seal the pages, and put them into a safe.

cma 7y ago

> Showing legal how to use Github so they can confirm the age of the software you're using, then convincing them Github is a reputable party will likely result in an unpleasant conversation at best. Wouldn't that be: > Showing legal how to use [Microsoft] Github so they can confirm the age of the software you're using, then convincing them [Microsoft] Github is a reputable party will likely result in an unpleasant conversation at best. Seems that 'Microsoft' prefix might get a bit more clout.

brlewis 7y ago

> Showing legal how to use Github so they can confirm the age of the software you're using, then convincing them Github is a reputable party will likely result in an unpleasant conversation at best. You only have to do that if you're setting up a commercial service that competes with sentry. If you're merely setting it up for your own company's self-hosted use, you don't need that.

greglindahl 7y ago
Are you really sure that your big-company legal team won't want to review this odd situation?
- brlewis 7y ago
  No, but I'm sure they won't have to look at git logs to date the software.
kyle-rb 7y ago
>convincing them Github is a reputable party This might be one actual positive of GitHub getting bought by Microsoft: convincing people who don't know anything about software that it's a reputable party.

mdpye 7y ago

While they don't appear super frequent, they cut releases: https://github.com/getsentry/sentry/tags https://github.com/getsentry/sentry/tags Pick one which was cut at a particular point in time and you're done. Doesn't seem that complicated.