5 ms·

...there code always has and continues to be open source. Is there some law that states a project must publish X code changes in Y timespan?

by rOOb85 6y ago

fastball 6y ago
Well take it further – is is still open-source if you update the public repo once every 10 years? For the vast majority of people, OSS in 2021 means having a public repo hosted somewhere that all commits are pushed to, or PRs are made to. Periodically updating a public repo with changes made to a private repo is not really what people have in mind.
- cptskippy 6y ago
  Were they updating the Server during the periods where the public repo wasn't receiving updates? That's like requiring a developer to push their local changes hourly/daily for a task that's been committed to but not completed.
  - remram 6y ago
    Yes, they were. There has been multiple "releases" too, with version numbers, which I assume went into production. When you're using a product for which you can't get the source code, the product is not open source. Commits: https://github.com/signalapp/Signal-Server/commits/master https://github.com/signalapp/Signal-Server/commits/master No push between: April 20, 2020 and April 6, 2021.
    - cptskippy 6y ago
      > Yes, they were. There has been multiple "releases" too, with version numbers, which I assume went into production. You can't say affirmatively that yes they deployed but then say it's an assumption. Either they did or they didn't. If they didn't deploy the code to production prior to the commit then I see no problem with what they did.
      - dogecoinbase 6y ago
        I noted this in another comment, but if they _did not_ update the code in production, they ran with known vulnerabilities in the server side for many months: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#comments https://github.com/signalapp/Signal-Server/commit/3432529f9c... There's no good option here.
        cptskippy 6y ago
        Interestingly one of the comments in that thread refers to the server code as a reference implementation. This implies that Signal's server code isn't opensource, and that this code is just a reference implementation. The readme.md on the repo doesn't really clarify one way or another on the matter.
      - remram 6y ago
        I am 99% sure they did. I can't say affirmatively that anyone is running anything exactly, but they now claim they did.
        cptskippy 6y ago
        > I am 99% sure they did. Why? > I can't say affirmatively that anyone is running anything exactly Signal provides a means for reproducing Android builds so you can affirmatively determine what you're running. https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ > but they now claim they did. Signal claims they shipped server updates without releasing code? Do you have a link to that? When others were complaining about the lack of an update to server, they're complaining about the client and server APIs being out of sync. Reading through these comments, I don't get the impression that the server code published is what's actually running. In fact the following comment even refers to it as a reference implementation: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#commitcomment-47509056 https://github.com/signalapp/Signal-Server/commit/3432529f9c... At the end of the day, it doesn't really matter much what server code is running since the Clients manage encryption and the Server has no insight into the messages being exchanged.
- jefftk 6y ago
  The biggest example I can think of projects that worked this way was how WebKit and Android would publish code dumps with every release. You can't go longer than that: if you put out releases without updating the source you're not open source.
- qqii 6y ago
  And to take it even further, doesn't this bend the AGPLv3 licence to an extent?
  - eitland 6y ago
    If the code is entirely theirs they can do whatever they want including going all proprietary for all new releases tomorrow or moving to MIT.
    - qqii 6y ago
      Can they? First they'd have to never have accepted contributions, then if they ran an updated version on their server wouldn't they be in vialation of AGPL (not providing end users, in this case specifically those who use Signal an updated codebase).
      - IiydAbITMvJkqKf 6y ago
        If they have never accepted contributions, then they are the sole copyright holder, and thus can do whatever they want with the code. Including not providing the source code to users. You can't sue the copyright holder for infringing their own copyright.
      - hiq 6y ago
        They have a CLA, the legal side of things is clear. They can use their code however they want, the licenses are only relevant for others. When you contribute, you basically license your code under a permissive license to Signal (because of the CLA).
dogecoinbase 6y ago
In this case, they not only didn't update with changes, but didn't address specific concerns about known vulnerabilities in their outdated repo: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#comments https://github.com/signalapp/Signal-Server/commit/3432529f9c...
SuchAnonMuchWow 6y ago
It is not about how often you update your project. To be open source, you need to publish the source of applications you run. It's as simple as that: "we developed this app, and it's running on our servers, and the source can be found here". They kept updating their server app for a year, without publishing their source. This is not open source. Signal server code was not open source for a year.
geofft 6y ago
Isn't the allegation that they made changes to the deployed version of their production server that were not pushed to the GitHub project? (i.e., that they stopped updating the server repository for around a year, but not just implausible but contradicted by evidence that they never changed the server code for about a year?) If so, then the code quite simply is not open source by any possible definition. I agree with you that a project that is dormant, or even receiving internal development that is still under review, can defensibly be called "open source" even if the development isn't happening in the open. (For instance, your favorite begrudgingly-GPL-compliant hardware vendor who releases .zip files every time they release a new product is releasing "open source" code.) But if the source code to the Signal server isn't even published, it can't be open.

...there code always has and continues to be open source. Is there some law that states a project must publish X code changes in Y timespan?

by rOOb85 6y ago

...there code always has and continues to be open source. Is there some law that states a project must publish X code changes in Y timespan?

fastball 6y ago

Well take it further – is is still open-source if you update the public repo once every 10 years? For the vast majority of people, OSS in 2021 means having a public repo hosted somewhere that all commits are pushed to, or PRs are made to. Periodically updating a public repo with changes made to a private repo is not really what people have in mind.

cptskippy 6y ago
Were they updating the Server during the periods where the public repo wasn't receiving updates? That's like requiring a developer to push their local changes hourly/daily for a task that's been committed to but not completed.
- remram 6y ago
  Yes, they were. There has been multiple "releases" too, with version numbers, which I assume went into production. When you're using a product for which you can't get the source code, the product is not open source. Commits: https://github.com/signalapp/Signal-Server/commits/master https://github.com/signalapp/Signal-Server/commits/master No push between: April 20, 2020 and April 6, 2021.
  - cptskippy 6y ago
    > Yes, they were. There has been multiple "releases" too, with version numbers, which I assume went into production. You can't say affirmatively that yes they deployed but then say it's an assumption. Either they did or they didn't. If they didn't deploy the code to production prior to the commit then I see no problem with what they did.
    - dogecoinbase 6y ago
      I noted this in another comment, but if they _did not_ update the code in production, they ran with known vulnerabilities in the server side for many months: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#comments https://github.com/signalapp/Signal-Server/commit/3432529f9c... There's no good option here.
      - cptskippy 6y ago
        Interestingly one of the comments in that thread refers to the server code as a reference implementation. This implies that Signal's server code isn't opensource, and that this code is just a reference implementation. The readme.md on the repo doesn't really clarify one way or another on the matter.
    - remram 6y ago
      I am 99% sure they did. I can't say affirmatively that anyone is running anything exactly, but they now claim they did.
      - cptskippy 6y ago
        > I am 99% sure they did. Why? > I can't say affirmatively that anyone is running anything exactly Signal provides a means for reproducing Android builds so you can affirmatively determine what you're running. https://signal.org/blog/reproducible-android/ https://signal.org/blog/reproducible-android/ > but they now claim they did. Signal claims they shipped server updates without releasing code? Do you have a link to that? When others were complaining about the lack of an update to server, they're complaining about the client and server APIs being out of sync. Reading through these comments, I don't get the impression that the server code published is what's actually running. In fact the following comment even refers to it as a reference implementation: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#commitcomment-47509056 https://github.com/signalapp/Signal-Server/commit/3432529f9c... At the end of the day, it doesn't really matter much what server code is running since the Clients manage encryption and the Server has no insight into the messages being exchanged.
jefftk 6y ago
The biggest example I can think of projects that worked this way was how WebKit and Android would publish code dumps with every release. You can't go longer than that: if you put out releases without updating the source you're not open source.
qqii 6y ago
And to take it even further, doesn't this bend the AGPLv3 licence to an extent?
- eitland 6y ago
  If the code is entirely theirs they can do whatever they want including going all proprietary for all new releases tomorrow or moving to MIT.
  - qqii 6y ago
    Can they? First they'd have to never have accepted contributions, then if they ran an updated version on their server wouldn't they be in vialation of AGPL (not providing end users, in this case specifically those who use Signal an updated codebase).
    - IiydAbITMvJkqKf 6y ago
      If they have never accepted contributions, then they are the sole copyright holder, and thus can do whatever they want with the code. Including not providing the source code to users. You can't sue the copyright holder for infringing their own copyright.
    - hiq 6y ago
      They have a CLA, the legal side of things is clear. They can use their code however they want, the licenses are only relevant for others. When you contribute, you basically license your code under a permissive license to Signal (because of the CLA).

dogecoinbase 6y ago

In this case, they not only didn't update with changes, but didn't address specific concerns about known vulnerabilities in their outdated repo: https://github.com/signalapp/Signal-Server/commit/3432529f9c018d75774ce89f3207b18051c26fe7#comments https://github.com/signalapp/Signal-Server/commit/3432529f9c...

SuchAnonMuchWow 6y ago

It is not about how often you update your project. To be open source, you need to publish the source of applications you run. It's as simple as that: "we developed this app, and it's running on our servers, and the source can be found here". They kept updating their server app for a year, without publishing their source. This is not open source. Signal server code was not open source for a year.

geofft 6y ago

Isn't the allegation that they made changes to the deployed version of their production server that were not pushed to the GitHub project? (i.e., that they stopped updating the server repository for around a year, but not just implausible but contradicted by evidence that they never changed the server code for about a year?) If so, then the code quite simply is not open source by any possible definition. I agree with you that a project that is dormant, or even receiving internal development that is still under review, can defensibly be called "open source" even if the development isn't happening in the open. (For instance, your favorite begrudgingly-GPL-compliant hardware vendor who releases .zip files every time they release a new product is releasing "open source" code.) But if the source code to the Signal server isn't even published, it can't be open.