3 ms·
We want to open source as much of Socket as we can. However, our first priority is to build a sustainable company. This whole party ends with us losing our jobs
by feross 5y ago
We want to open source as much of Socket as we can. However, our first priority is to build a sustainable company. This whole party ends with us losing our jobs if we fail to make this profitable.
As a maintainer I know how much time it takes to run an open source project beyond just writing code. There's triaging issues, reviewing PRs, answering questions, adding support for alternative operating systems/runtimes, and more. At this precise moment we just don't have that capacity, although I look forward to the day when we'll be able to share more of the code publicly.
- encryptluks2 5y agoI don't know how installing a GitHub app to give someone access to a company's repositories improves security. Might as well require people to enter an email address to learn what your product is.
- feross 5y agoYou're right that introducing a GitHub app comes with certain risks, but "security" isn't a monolithic concept. For many people, installing a security tool like Socket to prevent supply chain attacks will on-net improve their security posture. Also, for the record, the Socket GitHub app was designed to only read package manifest files such as `package.json`, `package-lock.json`, and `yarn.lock`. It doesn't read other files, and it definitely doesn't send those files to remote servers.
- teaearlgraycold 5y agoI think it would be awesome if Socket could be used through an auditable GitHub Action where developers can manually send over just their package*.json files.
- feross 5y agoWe agree. It's on our roadmap.