3 ms·

> Socket is built by a team of open source maintainers with over 1 billion monthly downloads. Everyone on the Socket team is an open source maintainer. So is S

> Socket is built by a team of open source maintainers with over 1 billion monthly downloads. Everyone on the Socket team is an open source maintainer. So is Socket.dev open source? On your Github (https://github.com/SocketDev https://github.com/SocketDev) I cannot find the Github App source code. So being such proponents of open source, why don't you release it as open source?

feross 5y ago
We want to open source as much of Socket as we can. However, our first priority is to build a sustainable company. This whole party ends with us losing our jobs if we fail to make this profitable. As a maintainer I know how much time it takes to run an open source project beyond just writing code. There's triaging issues, reviewing PRs, answering questions, adding support for alternative operating systems/runtimes, and more. At this precise moment we just don't have that capacity, although I look forward to the day when we'll be able to share more of the code publicly.
- encryptluks2 5y ago
  I don't know how installing a GitHub app to give someone access to a company's repositories improves security. Might as well require people to enter an email address to learn what your product is.
  - feross 5y ago
    You're right that introducing a GitHub app comes with certain risks, but "security" isn't a monolithic concept. For many people, installing a security tool like Socket to prevent supply chain attacks will on-net improve their security posture. Also, for the record, the Socket GitHub app was designed to only read package manifest files such as `package.json`, `package-lock.json`, and `yarn.lock`. It doesn't read other files, and it definitely doesn't send those files to remote servers.
    - teaearlgraycold 5y ago
      I think it would be awesome if Socket could be used through an auditable GitHub Action where developers can manually send over just their package*.json files.
      - feross 5y ago
        We agree. It's on our roadmap.

feross 5y ago

We want to open source as much of Socket as we can. However, our first priority is to build a sustainable company. This whole party ends with us losing our jobs if we fail to make this profitable. As a maintainer I know how much time it takes to run an open source project beyond just writing code. There's triaging issues, reviewing PRs, answering questions, adding support for alternative operating systems/runtimes, and more. At this precise moment we just don't have that capacity, although I look forward to the day when we'll be able to share more of the code publicly.

encryptluks2 5y ago
I don't know how installing a GitHub app to give someone access to a company's repositories improves security. Might as well require people to enter an email address to learn what your product is.
- feross 5y ago
  You're right that introducing a GitHub app comes with certain risks, but "security" isn't a monolithic concept. For many people, installing a security tool like Socket to prevent supply chain attacks will on-net improve their security posture. Also, for the record, the Socket GitHub app was designed to only read package manifest files such as `package.json`, `package-lock.json`, and `yarn.lock`. It doesn't read other files, and it definitely doesn't send those files to remote servers.
  - teaearlgraycold 5y ago
    I think it would be awesome if Socket could be used through an auditable GitHub Action where developers can manually send over just their package*.json files.
    - feross 5y ago
      We agree. It's on our roadmap.