28 ms·

Substack is (not) now powered by Ghost

348 points by agd 4y ago

holgersindbaek 4y ago
I'd loved to have implemented this for my chrismas themed solitaire: https://online-solitaire.com/?theme=christmas https://online-solitaire.com/?theme=christmas. Good job!
pwinnski 4y ago
This is a classy response from the Ghost folks to a clear license violation.
- k__ 4y ago
  What does such a violation usually entail?
- jairajs89 4y ago
  Hey, Substack CTO here. We don't distribute Ghost's code at all and the only piece of code included is a client-side search library used by the third party theme. But that library is actually hotlinked and hosted on jsdelivr (via npm) with no modifications made to it what-so-ever. This includes the line at the top with the license link as Ghost originally built it
  - pwinnski 4y ago
    Thanks for the correction! All the better that the original tweet kept it classy, then. :)
Xeoncross 4y ago
I've always found open source projects to build superior libraries that commercial entities always end up adopting. I've always found commercial entities to build superior products that open source projects always end up adopting. One makes the tools, the other assembles them and sells it. Must be the focus on profits that helps push companies to build products users want, while the love of the craft pushes developers to make the best foundations.
- ambicapter 4y ago
  > Must be the focus on profits that helps push companies to build products users want, while the love of the craft pushes developers to make the best foundations. Shamelessly stealing this line of thinking to use in the future.
  - somrand0 4y ago
    [flagged]
  - Waterluvian 4y ago
    I love this line and I personally think there's nothing wrong with it (not that I'm suggesting anyone implied there is). And this is also how I separate my work from my hobby. I'm proud of those who can make money from a hobby, but I simply do not try. The motivations are fundamentally different and it changes how much I enjoy my hobby. I wish I learned this in my early 20s. I spent years thinking, "if it can't make money or someone's done it better, it's not worth doing."
- pessimizer 4y ago
  Or it's capital preying on basic research funded by the public.
  - nordsieck 4y ago
    > Or it's capital preying on basic research funded by the public. How, exactly, is open source "basic research funded by the public"?
    - dmix 4y ago
      If anything private capital funds OSS as much or more than anything else. OSS is primarily driven by time donation by the coders anyway. If they don't want companies using it there is a well established system to prevent that... it's called licensing.
  - wpietri 4y ago
bluehatbrit 4y ago
I quite O'Nolan's tone here. It's obviously not a collaboration as you might first expect from the top tweet (and title on HN), but he's quite gracious about it at the same time. It would be quite easy to get frustrated and outraged at Substack, we've seen it happen before. However despite the two, fairly substantial, issues he's pretty gracious about it while poking a bit of fun. Hopefully Substack do the right thing here and correct those two problems openly. It would only be a good thing for blogging/publishing if they actually contributed back as well.
- jairajs89 4y ago
  Hey, Substack CTO here. The Ghost-written code in question here is the client-side search library that the third-party theme uses. We link directly to the files hosted on jsdelivr (via npm) which in-turn uses the files Ghost built for distribution. Those files include the license link at the top, as Ghost intended, and are not modified or minified by us at all
  - bluehatbrit 4y ago
    Thanks for the response, I appreciate the correction!
imaurer 4y ago
I really enjoyed this interview with Ghost founder John O’Nolan. Seems like a very smart, classy guy leaving the world better than he found it https://www.indiehackers.com/podcast/139-john-onolan-of-ghost https://www.indiehackers.com/podcast/139-john-onolan-of-ghos...
koopuluri 4y ago
Based on Ghost's MIT license, seems Substack using it is fine, but damn would have been nice to have at least some kind of attribution... leaves a sour taste to take without acknowledging.
- loeg 4y ago
  Ish. Pointing clients at Ghost’s CDN instead of substack isn’t great. Nor is stripping the copyright header.
  - cxr 4y ago
    It doesn't seem that Substack is actually doing either of those things here, contrary to the claims in the original tweet.
- cptcobalt 4y ago
  It's not a "would be nice", it's a license violation to not be using it with copyright attribution. https://twitter.com/JohnONolan/status/1602330414269472769 https://twitter.com/JohnONolan/status/1602330414269472769
  - bombcar 4y ago
    That’s not obviously clear - after all MIT software can be used to produce output that doesn’t need to include a “made by X” - and arguably that’s what ghost provides. And they didn’t even copy the JavaScript to their own CDN …
- dspillett 4y ago
  > Based on Ghost's MIT license, seems Substack using it is fine, As long as they provide appropriate attribution, which apparently¹ they are not so it isn't fine. > but damn would have been nice to have at least some kind of attribution... Not just nice, but required. From the licence: “The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.” Many projects, commercial and other OSS ones, get conformance with MIT and similar licences wrong in this way. ---- [1] Caveat: Going by the Twitter thread. I've not verified this. Maybe they have it somewhere hidden away, so are compliant but minimally so². [2] Which would be a dick move³, but compliant. [3] Which I wouldn't put past them as they are using Ghost's CDN to include some of the stuff instead of covering the hosting for that themselves, which is hard to think is accidental. If this is accidental then I'd never trust them from either a code quality PoV or an infrastructure security PoV.
draw_down 4y ago
tiffanyh 4y ago
> One thing that’s a little disappointing: Ghost uses the MIT license, one of the most permissive OSS licenses there is. Essentially, anyone can do anything they want with our code, with ONE basic requirement: You must include copyright attribution. Which they have not. For a SaaS app, wouldn't that copyright attribution be on the server side, where the code is (hidden from the end user)? Is John stating he expects that copyright attribution to be in the "view source" of the HTML or some other user accessible location? What happens if that HTML/JS is minified/stripped/"compiled"? IANAL: but I'm genuinely curious how this situation is handled. https://twitter.com/JohnONolan/status/1602330414269472769 https://twitter.com/JohnONolan/status/1602330414269472769
- kolaente 4y ago
  As far as I understand it, MIT only requires you to include the attribution next to the binary so ias you guessed next to the source code on the server. However, the js shipped to clients is usually minified and transformed which means it may count as "compiled" and thus the same rules as for binaries would apply. Cases like these are the reason why the AGPL exists.
  - makkesk8 4y ago
    I highly doubt you can count minified as "compiled" Minification is a form of compression. Compilation is a form of conversion from a high level to a lower level interpretation and that is fundamentally different. But then again I'm not a lawyer :)
    - jdsully 4y ago
      The intent is for attribution to be kept with the code. If your minifier removes the attribution you’re likely in violation.
      - bombcar 4y ago
        And the minifier’s job is to remove things like comments which is right where the attribution is likely to be. Now if a third party thing like a cloudflare CDN were minifyer for you and removed it then who violated the license?
rojobuffalo 4y ago
Have any writers migrated from Substack to Ghost? Substack support has been nonexistent for the past 6 months. I've reached out about a handful of broken features and get no response, except in one case months ago where they dismissed it in the weirdest way. Archive search does not work; ex. I have a post about monkeys, it has "monkey" in the title and the body, and when I search "monkey" it doesn't come up in results. The support response said "this is normal, just because a post has a keyword in the title or body doesn't mean it's always included in search results"...what? I asked for clarification and they never replied. It feels like Substack has strayed from the promise of being focused on writing and email. They added "Save" and "Listen" buttons to the top of emails, which are visually prominent; and those buttons make no sense in an email. They're a trick to take people to the iOS app. They endlessly promote new features to writers and readers and it all feels like their trying to lock you into something that's harder to migrate out of.
- busymom0 4y ago
  Hmm I had the opposite experience. I emailed them 3 or 4 bugs and they fixed it. This was several months ago though. I am a paid user to several substacks in case that matters.
  - rojobuffalo 4y ago
    That's interesting. Prior to July I did get replies, but they never fixed anything. "Thanks we'll pass this on to the dev team" but then nothing. I think that's normal but not great. Since July I've sent emails about 3 issues and the only response I got was the one I mentioned above. I'm a writer with a few paid subscribers.
- AlbertCory 4y ago
  I've put in a couple of support requests and gotten reasonably prompt, helpful responses. Possibly you're not a writer? They make it possible for writers to earn a decent amount of money (not that I am) and keep their copyright. Can you tell us another platform that does that better?
- klelatti 4y ago
chrisweekly 4y ago
Whoa! Hotlinking Ghost CDN URLs in Substack production HTML. Yes this is a bad look for Substack. And it puts them - and their users - at Ghost's mercy.
- tiffanyh 4y ago
  It's also incredibly easy for Ghost to prevent hot linking. It just 2-3 lines in your nginx/apache config file that blocks hot linking, and many people consider this a standard practice to do regardless.
- cptcobalt 4y ago
  Totally. I feel like Ghost has integrity and wouldn't resort to shenanigans, but this is a wildly poor security posture and really a faux pas to be forcing ghost to incur CDN costs on this.
- peter422 4y ago
  They are not hotlinking ghost urls... JSdelivr is a giant JS CDN. Ghost is in the url because they developed the library so it's the GitHub path. You could use this library on your website right now... They open sourced it!
  - jairajs89 4y ago
    Hey, Substack CTO. That's exactly right. Thank you for this
    - cxr 4y ago
      There's more to it than that. There are two resources involved. One is using Ghost's (jsdelivr-backed) CDN. The other is just using jsdelivr's CDN for any and every NPM package that gets published in the clear. The asset that thefp.com is using is the one that gets loaded from the latter (the one served from the public CDN), and you can see that this was true even at the time that O'Nolan's screenshots were taken. For some reason, he mixed them up; the only evidence that we have of anyone here using the CDN that Ghost is (presumably) paying for is Ghost's own use of it themselves.
quanticle 4y ago
The way they used our search library is kind of interesting. They could've copied the code locally and modified it to work with the Substack API, but I guess Substack doesn’t have an API? Substack doesn't have an API. Their editor is laughably primitive compared with other solutions. Their visual look hasn't changed at all since their inception. They don't have discoverability. Can anyone tell me what Substack is doing with all the millions of dollars of funding they've taken? We joke about Twitter being massively overstaffed, but Substack, to me, looks just as bloated, organizationally.
- xwowsersx 4y ago
  Maybe you have something else in mind when you say "discoverability", but.. https://substack.com/discover https://substack.com/discover Seems they do have it. As for the bloat, I can't really comment, but would note that Substack did substantial layoffs like everyone else. As for what they're doing: they built mobile apps, adding podcasting and video, etc, better discoverability. I can't say whether they've done "enough" to satisfy you, but I also don't think we should pretend Substack hasn't done any new product development work since inception.
  - quanticle 4y ago
    Those are all fair responses. I guess I just haven't seen much uptake of those new features among the Substack writers that I follow. When they do podcasts, they're hosted by ACast, SimpleCast, or one of the other podcast hosting platforms out there. Videos are hosted on YouTube (like everyone else's). I would prefer if Substack spent more resources on improving its "core" newsletter/blog experience, but I can understand, given their status as a home for controversial writers, their desire to be a self-contained service.
    - vxNsr 4y ago
      My understanding is that these days most technical people are wary of being locked into a single platform, so even though substack is making a pretty compelling walled garden anyone with knowledge of recent SV history is hesitant to dive head first into it. As once they get big enough they’re pretty much guaranteed to do something anti-competitive that is against the interests of their customers/users who now have no choice as the cost of leaving has grown too large.
staunch 4y ago
On the one hand, it does seem like it'd be nice if Substack had signed a support/integration deal with the Ghost team. That way Ghost could have gotten paid something for their hard work, and Substack could have avoided critical mistakes like the CDN security issue. On the other hand, this seems like what success looks like for an MIT licensed project. A big company using the code to power their product without even having to contact, let alone ask permission of, anyone. It seems to feel different for end-user applications like Ghost. But it's not actually any different than if they had powered Substack with SQLite or Postgres.
- shafyy 4y ago
  > But it's not actually any different than if they had powered Substack with SQLite or Postgres. I disagree. It's more comprable to if they used WordPress instead of Ghost. The database is a few layers further down, whereas Ghost is basically 90% of the end product (not sure how much they've adapted, but looks like a lot from John's Tweet)
  - staunch 4y ago
    Well, it's a bit more complicated than that. Substack is positioning themselves to their customers, which are journalists/authors, as a comprehensive alternative to having a normal job working at a newspaper or magazine. That seems to include high-touch customer support, an integrated business model with payments, a mailing list system, a distribution method, etc. It's more of a service than a piece of software. Ghost actually seems to have jumped on Substack's bandwagon by trying to skew their blog software toward being a direct Substack alternative. So Ghost seems to have adopted Substack's business model and Substack seems to have adopted some of their blog technology.
- greenthrow 4y ago
  I don't think you understood the linked thread. The problem is not that they are using Ghost. The problem is they are not including the attribution required by the license.
  - 4y ago
the-printer 4y ago
So at what point does Substack cut the man and his team a check because from the looks of his observations Substack will likely need consultation and support.
- tiffanyh 4y ago
  Sounds like you're describing the SQLite model. Completely permissive license but companies pay for support (or custom features).
  - samhuk 4y ago
    Genuinely curious (I don't know all that much about these things): To what extent does the SQLite model incentivize poor documentation since that would drive use of paid support services?
    - rchaud 4y ago
      If the documentation is poor, the implementers won't even be able to get it to a point where they would consider paying for consulting.
      - samhuk 4y ago
        I mean poor enough that its easy to get set up but more complex usage ends up requiring support services, by which lock in has started occuring.
    - ruuda 4y ago
      For what it's worth, SQLite's documentation is one of the best among all software I've ever used. It's clear, detailed, well-organized, and everything is documented.
gnicholas 4y ago
Huh, so it's a ghost in the machine?
deleted 4y ago
[deleted]
jasonhansel 4y ago
This is why you should use the AGPL. Otherwise, corporations can and will make immense profits from your unpaid work without contributing anything in return. The goal of FOSS should be to create a new ecosystem that puts users in control, not to provide free labor to private enterprises.
- freedomben 4y ago
  OP did not seem to be complaining about it though. In fact he seemed happy about it. Only the lack of attribution was a problem.
  - 40four 4y ago
    Maybe not outright complaining, but the whole thread does come off as a little passive aggressive/ salty to me.
  - nerdawson 4y ago
    It's written in a very passive aggressive way. He's not congratulating substack, he's calling them out. The attribution aspect of it seems intentionally misleading in my view. Are the MSM, who'll be chomping at the bit to attack their competitor, Substack, going to delve into the finer points of software licenses or rather just quote the tweet?
  - jasonhansel 4y ago
    I'm not saying that Ghost should use the AGPL, I'm saying that this is a warning to other projects that use the MIT license and wouldn't want to see their work commercialized this way.
- Kiro 4y ago
  You have no right to dictate what the goal of FOSS is about. It's also patronizing to claim Ghost made some kind of mistake here. They obviously picked MIT for a reason, which means they are fine with companies making profits from their unpaid work.
gizmo 4y ago
Sleazy and disrespectful behavior by substack. Just like medium, all these publishing/newsletter platforms go to $%@& real quick. The first time I saw the "sign up to continue reading" banner I knew substack was done, this just confirms it.
ArnoVW 4y ago
It's a known thing, and it's called the SaaS loophole. https://opensource.stackexchange.com/questions/11467/can-i-use-gpl-software-to-provide-a-commercial-cloud-service https://opensource.stackexchange.com/questions/11467/can-i-u...
huksley 4y ago
I think one of the points that Substack reverse engineered how search works. They use this package https://github.com/TryGhost/sodo-search https://github.com/TryGhost/sodo-search which does not have any docs.
aftbit 4y ago
If you are like me and had never heard of Ghost before today, here's a link to their Github repo: https://github.com/TryGhost/Ghost https://github.com/TryGhost/Ghost
setgree 4y ago
Funny side-note: @substack is the wrong handle, I assume John meant to tag @SubstackInc. AFAIK there's no formal mechanism for bidding on naming rights, but Twitter could easily set up an auction platform, take a small cut off the top, and do quite nicely.
- dibt 4y ago
  You can request an already registered name if you own the brand. Owning the domain substack.com might be enough to prove ownership. People have been successful with this in the past. They may not do anything about it, though, if @substack is being used. Logging into Twitter is enough to keep the account active. I don't know if that is changing with the new owner. I know that Musk said they will be making names for inactive accounts available soon.
  - setgree 4y ago
    That makes sense. It would also make sense to have auctions for high-value handles. Or, to take a page from 'Radical Markets', twitter accounts could be associated with a reservation price (a price at which a person would definitely sell), and 'taxed' (re: charged) a proportion of that reservation price. I believe it was Patio11 who observed that his upper limit on willingness to pay for twitter would be very high. Right now, Twitter doesn't capture any of that. That might only work for bluecheck accounts, not sure. I don't want to lose my random 10 follower account for $100, but neither do I want to pay to be a lurker
satvikpendem 4y ago
If Substack uses Ghost, why not just use Ghost itself? I'm thinking about doing that instead of Substack for my newsletter.
Waterluvian 4y ago
When John says "product engineers" does that mean "the engineers who specifically work on the code that gets used by customers"? Ie. excluding the engineers who do all the support stuff: CI/CD/testing/etc. ?
simonsarris 4y ago
Chris Best of Substack replied: https://twitter.com/cjgbest/status/1602370307884318720 https://twitter.com/cjgbest/status/1602370307884318720 Substack is not "powered by Ghost". Rather, we built our own theming API that’s compatible with themes built for Ghost, including those built by third parties. The Free Press is using a modified Tripoli theme, built by Ahmad Ajmi, under a paid license. This is how this is supposed to work. It's good for the theme developer if we support this – you should check them out here.
- traviswt 4y ago
  Great set of replies and a wonderful example of why hearing both sides is important. You should definitely click and read through Chris' thread, but the final note "We’re definitely up to chat" is a great olive branch.
  - cjbest 4y ago
    Thanks. Happy to answer questions here too.
ben-parry 4y ago
Response from Chris Best Substack's CEO: https://twitter.com/cjgbest/status/1602370307884318720 https://twitter.com/cjgbest/status/1602370307884318720
- raiyu 4y ago
  Seems like minimal overlap potentially if they were just using it for a theme, but the tone is a bit defensive, and I don't think that John was rude in his original tweets and more of like tongue in cheek sort of fun and offering to collaborate. A more direct, yes we use some code, oops we will add attribution, thanks again, much appreciated, would have sufficed.
  - sundarurfriend 4y ago
    If this had been private communication, sure. By putting this on Twitter, it immediately gets turned into something that could spawn clickbait headlines and could tarnish the company's reputation long term. Maybe John didn't mean for any of that, but his tweets don't mention the MIT licence initially and seem like they're building up an allegation. I think Chris responded exactly like a for-profit company's CEO should, pre-emptively countering tech journalist headlines, clearly and concisely describing the situation, and still reaching out for the potential of collaboration.
  - cxr 4y ago
    You're not following/understanding what the linked Twitter threads are actually saying. There is no mention of O'Nolan being rude (although he did make a number of untrue claims, which at least pretty negligent—but that's not a charge that the linked tweets say, either...) There was no code use, and there was no copyright violation/failure of attribution, so there is no "yes we use some code, oops we will add attribution" called for, nor would it even be logical to do so.
ben-parry 4y ago
Response from Chris Best, Substack's CEO: https://twitter.com/cjgbest/status/1602370307884318720 https://twitter.com/cjgbest/status/1602370307884318720
cjbest 4y ago
One of the founders here. Here's a copy of the response I posted on Twitter. -- A response to @JohnONolan here to clear up some serious misunderstandings https://twitter.com/JohnONolan/status/1602330377812643850 https://twitter.com/JohnONolan/status/1602330377812643850 First of all, huge respect to the Ghost team. Their open source contributions are valuable, and their approach to theming enables some great-looking things. That said, some important corrections: Substack is not "powered by Ghost". Rather, we built our own theming API that’s compatible with themes built for Ghost, including those built by third parties. The Free Press is using a modified Tripoli theme, built by Ahmad Ajmi, under a paid license. This is how this is supposed to work. It's good for the theme developer if we support this – you should check them out here. https://aspirethemes.com/themes/tripoli https://aspirethemes.com/themes/tripoli This was relatively quick to build for Substack devs, because the structure of Ghost sites matches Substack fairly closely. With respect to the search library, this is an open source library that we are using in a fully compliant way. John's own screen shot shows that we don't load it "from Ghost’s own CDN", it comes from jsDelivr https://www.jsdelivr.com https://www.jsdelivr.com This is a standard way to use an open source library. It's pulling from the version that the sodo-search maintainers published to NPM (thank you!). It is a good point that we should lock a version, so that if they accidentally published a minor version revision with breaking changes it doesn't cause problems for us. We’ve fixed that. We’re grateful to the developer of the Tripoli theme and to Ghost for its contributors to open source work. We’re exploring ways to give writers more customization on Substack. This is one approach we’re considering but it’s too early to know if we’ll scale it up. And @JohnONolan, thanks for the note at the end about potential collaboration. In our minds, we’re on the same side of an important battle for a better internet. We’re definitely up to chat.
- hiidrew 4y ago
  I love substack. You guys have been doing a lot for the info landscape to return to the blogsphere. But I would love you even more if there was dark mode, I want to read in bed! -sincerely a huge fan of your platform
  - internet_jockey 4y ago
Illniyar 4y ago
A response from substack. https://mobile.twitter.com/cjgbest/status/1602370307884318720 https://mobile.twitter.com/cjgbest/status/160237030788431872... Seems like this is a bit of a clickbait. The theme is made by the substack user, substack is only using a single library from ghost to show search, and the cdn in question is jsdeliver which isn't ghost's cdn, it is basically a cdn for any open source javascript.
- deleted 4y ago
  [deleted]
xNeil 4y ago
Hi Chris! Love what you're doing with Substack. One quick thing though - this may seem weird, but Substack at the moment does not, in my opinion, offer a lot of customisation of the website. If you see a website, it's extremely easy to tell its a Substack. Over the past year, I've only read high quality Substack posts - and my brain has sort of come to instinctively believe that if I see that specific layout, the post will be high quality. E.g. (not a very nice one) but in general, if I see the Medium layout, my brain almost immediately get turned off, believing the quality of the content to be sub-par. I think individual theming, as in the case of The Free Press, takes away that immediate notion. I understand that the vast majority of people will not face this issue, but I think I will. I just wanted to know if you think this is an issue, and if it is, what you'll do to 'counter' it. I'd really like to hear your thoughts on this!
- dang 4y ago
  Please don't post duplicate comments! We'll leave https://news.ycombinator.com/item?id=33958955 https://news.ycombinator.com/item?id=33958955 up.
  - xNeil 4y ago
    Hi! Very sorry - won't happen again.
    - dang 4y ago
      Appreciated!
tiffanyh 4y ago
Is the title of the post still accurate? @dang, thoughts?
- deleted 4y ago
  [deleted]
placatedmayhem 4y ago
Mildly off-topic, but I'm somewhat tired of the reuse of names for different software. Originally, I was confused by this post and why Substack would be using Norton Ghost. There's also the Android post-explotation framework and ImmersionRC's Ghost radio control protocol.
- dmix 4y ago
  As long as it's a distinctly different product category / market it's not a big deal. You can usually glean the meaning from the context pretty quickly. If one brand becomes large then the other one's can just have context added like appending "Norton" to Ghost. Or just say "Ghost blog service".
lucideer 4y ago
I've been a big fan of ghost for a while, both the software and the company & its values. This thread is really making me rethink the latter. He's just so confidently wrong in every tweet.
- lucideer 4y ago
  Tweet-by-tweet elaboration: 1 & 2: "substack is powered by ghost" A customer of substack is using a port of an open source ghost theme. 3: some screenshots Of the substack sourcecode showing that they're loading an open source ghost JS search UI library from the jsdelivr CDN service. Substack are using an open source front-end lib that the Ghost team open sourced. For other people to use. 4. Screenshots of the substack HTML sourcecode showing the classes are the same as ghost Because they're using an open source theme ported from ghost... 6 & 7. Substack are loading the open source library from "Ghost’s own CDN" First I've heard that Ghost have acquired Jsdelivr. 8. "directly loading scripts from our CDN on their platform is very bad for security [...] Any updates or changes we ship could inadvertently brick their whole platform" I actually do agree that using 3rd party CDNs like Jsdelivr is bad for security (supply chain attacks are a real pain with package managers, using other people's CDNs increase that pain significantly). But... it's not Ghost's CDN & the implication that Ghost could push a release of their open source JS lib to jsdelivr that would brick consumers is pretty sinister. 9. Substack are using MIT without attribution They're not. Already covered by multiple comments on HN & in the Twitter replies. John just doesn't understand how the MIT license he chose works. Tbh he doesn't really seem to understand how open source works in general. --- Note: large companies using open source code and not contributing back is a big problem. It's what Substack are doing and we should talk about it. But that conversation should be informed and fact-based. This thread is ignorance start to finish.
- digianarchist 4y ago
  I used to really dislike John. I've sparred with him on Hacker News a couple of times on various issues (under a different account). I then listened to a podcast [0] he was on and basically changed my mind on the guy. I still feel he desperately needs to hire a communications director for Ghost but I've softened my view on him as a person. [0] - https://www.notoverthinking.com/episodes/john-onolan-on-life-as-a-nomad-ghost-and-optimising-for-happiness https://www.notoverthinking.com/episodes/john-onolan-on-life...
bakkoting 4y ago
Here's [1] the actual JS file which Substack is loading, pulled directly from the network tab on the page linked in the thread. Notably, the first line is "For license information please see sodo-search.min.js.LICENSE.txt". But if you go to that file [2], it's not the license _for this file_; it's the licenses _for the OSS code it includes_. I suspect that Substack thought that link pointed to the actual license; I did too before I started writing this comment. Possibly that confusion has lead to some talking past each other. The actual license is at [3], which is obvious if you know how npm packages work, and probably not obvious otherwise. I don't see a link to that file anywhere. [1] https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/sodo-search.min.js https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/s... [2] https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/sodo-search.min.js.LICENSE.txt https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/s... [3] https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/LICENSE https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/LICEN...
benced 4y ago
What a crazy world we live in where someone can license their code and someone else can use the code under the terms of that license.
yawboakye 4y ago
in a non-gotcha world, john of ghost reaches out privately to chris (or someone else) of substack to compare notes and clarify what's going on here. but those regretful days of chivalry are long gone, aren't they? they're replaced by the superior practice of submitting your grievances to the universal jury, in the absence of the accused. civility and principle of charity be damned. a few people have highlighted the calmness of the exchange—i think the public part was absolutely unnecessary. my one-and-a-half cents.

348 points by agd 4y ago

I'd loved to have implemented this for my chrismas themed solitaire: https://online-solitaire.com/?theme=christmas https://online-solitaire.com/?theme=christmas. Good job!

pwinnski 4y ago

This is a classy response from the Ghost folks to a clear license violation.

k__ 4y ago
What does such a violation usually entail?
jairajs89 4y ago
Hey, Substack CTO here. We don't distribute Ghost's code at all and the only piece of code included is a client-side search library used by the third party theme. But that library is actually hotlinked and hosted on jsdelivr (via npm) with no modifications made to it what-so-ever. This includes the line at the top with the license link as Ghost originally built it
- pwinnski 4y ago
  Thanks for the correction! All the better that the original tweet kept it classy, then. :)

Xeoncross 4y ago

I've always found open source projects to build superior libraries that commercial entities always end up adopting. I've always found commercial entities to build superior products that open source projects always end up adopting. One makes the tools, the other assembles them and sells it. Must be the focus on profits that helps push companies to build products users want, while the love of the craft pushes developers to make the best foundations.

ambicapter 4y ago
> Must be the focus on profits that helps push companies to build products users want, while the love of the craft pushes developers to make the best foundations. Shamelessly stealing this line of thinking to use in the future.
- somrand0 4y ago
  [flagged]
- Waterluvian 4y ago
  I love this line and I personally think there's nothing wrong with it (not that I'm suggesting anyone implied there is). And this is also how I separate my work from my hobby. I'm proud of those who can make money from a hobby, but I simply do not try. The motivations are fundamentally different and it changes how much I enjoy my hobby. I wish I learned this in my early 20s. I spent years thinking, "if it can't make money or someone's done it better, it's not worth doing."
pessimizer 4y ago
Or it's capital preying on basic research funded by the public.
- nordsieck 4y ago
  > Or it's capital preying on basic research funded by the public. How, exactly, is open source "basic research funded by the public"?
  - dmix 4y ago
    If anything private capital funds OSS as much or more than anything else. OSS is primarily driven by time donation by the coders anyway. If they don't want companies using it there is a well established system to prevent that... it's called licensing.
- wpietri 4y ago

bluehatbrit 4y ago

I quite O'Nolan's tone here. It's obviously not a collaboration as you might first expect from the top tweet (and title on HN), but he's quite gracious about it at the same time. It would be quite easy to get frustrated and outraged at Substack, we've seen it happen before. However despite the two, fairly substantial, issues he's pretty gracious about it while poking a bit of fun. Hopefully Substack do the right thing here and correct those two problems openly. It would only be a good thing for blogging/publishing if they actually contributed back as well.

jairajs89 4y ago
Hey, Substack CTO here. The Ghost-written code in question here is the client-side search library that the third-party theme uses. We link directly to the files hosted on jsdelivr (via npm) which in-turn uses the files Ghost built for distribution. Those files include the license link at the top, as Ghost intended, and are not modified or minified by us at all
- bluehatbrit 4y ago
  Thanks for the response, I appreciate the correction!

imaurer 4y ago

I really enjoyed this interview with Ghost founder John O’Nolan. Seems like a very smart, classy guy leaving the world better than he found it https://www.indiehackers.com/podcast/139-john-onolan-of-ghost https://www.indiehackers.com/podcast/139-john-onolan-of-ghos...

koopuluri 4y ago

Based on Ghost's MIT license, seems Substack using it is fine, but damn would have been nice to have at least some kind of attribution... leaves a sour taste to take without acknowledging.

loeg 4y ago
Ish. Pointing clients at Ghost’s CDN instead of substack isn’t great. Nor is stripping the copyright header.
- cxr 4y ago
  It doesn't seem that Substack is actually doing either of those things here, contrary to the claims in the original tweet.
cptcobalt 4y ago
It's not a "would be nice", it's a license violation to not be using it with copyright attribution. https://twitter.com/JohnONolan/status/1602330414269472769 https://twitter.com/JohnONolan/status/1602330414269472769
- bombcar 4y ago
  That’s not obviously clear - after all MIT software can be used to produce output that doesn’t need to include a “made by X” - and arguably that’s what ghost provides. And they didn’t even copy the JavaScript to their own CDN …
dspillett 4y ago
> Based on Ghost's MIT license, seems Substack using it is fine, As long as they provide appropriate attribution, which apparently¹ they are not so it isn't fine. > but damn would have been nice to have at least some kind of attribution... Not just nice, but required. From the licence: “The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.” Many projects, commercial and other OSS ones, get conformance with MIT and similar licences wrong in this way. ---- [1] Caveat: Going by the Twitter thread. I've not verified this. Maybe they have it somewhere hidden away, so are compliant but minimally so². [2] Which would be a dick move³, but compliant. [3] Which I wouldn't put past them as they are using Ghost's CDN to include some of the stuff instead of covering the hosting for that themselves, which is hard to think is accidental. If this is accidental then I'd never trust them from either a code quality PoV or an infrastructure security PoV.

draw_down 4y ago

tiffanyh 4y ago

> One thing that’s a little disappointing: Ghost uses the MIT license, one of the most permissive OSS licenses there is. Essentially, anyone can do anything they want with our code, with ONE basic requirement: You must include copyright attribution. Which they have not. For a SaaS app, wouldn't that copyright attribution be on the server side, where the code is (hidden from the end user)? Is John stating he expects that copyright attribution to be in the "view source" of the HTML or some other user accessible location? What happens if that HTML/JS is minified/stripped/"compiled"? IANAL: but I'm genuinely curious how this situation is handled. https://twitter.com/JohnONolan/status/1602330414269472769 https://twitter.com/JohnONolan/status/1602330414269472769

kolaente 4y ago
As far as I understand it, MIT only requires you to include the attribution next to the binary so ias you guessed next to the source code on the server. However, the js shipped to clients is usually minified and transformed which means it may count as "compiled" and thus the same rules as for binaries would apply. Cases like these are the reason why the AGPL exists.
- makkesk8 4y ago
  I highly doubt you can count minified as "compiled" Minification is a form of compression. Compilation is a form of conversion from a high level to a lower level interpretation and that is fundamentally different. But then again I'm not a lawyer :)
  - jdsully 4y ago
    The intent is for attribution to be kept with the code. If your minifier removes the attribution you’re likely in violation.
    - bombcar 4y ago
      And the minifier’s job is to remove things like comments which is right where the attribution is likely to be. Now if a third party thing like a cloudflare CDN were minifyer for you and removed it then who violated the license?

rojobuffalo 4y ago

Have any writers migrated from Substack to Ghost? Substack support has been nonexistent for the past 6 months. I've reached out about a handful of broken features and get no response, except in one case months ago where they dismissed it in the weirdest way. Archive search does not work; ex. I have a post about monkeys, it has "monkey" in the title and the body, and when I search "monkey" it doesn't come up in results. The support response said "this is normal, just because a post has a keyword in the title or body doesn't mean it's always included in search results"...what? I asked for clarification and they never replied. It feels like Substack has strayed from the promise of being focused on writing and email. They added "Save" and "Listen" buttons to the top of emails, which are visually prominent; and those buttons make no sense in an email. They're a trick to take people to the iOS app. They endlessly promote new features to writers and readers and it all feels like their trying to lock you into something that's harder to migrate out of.

busymom0 4y ago
Hmm I had the opposite experience. I emailed them 3 or 4 bugs and they fixed it. This was several months ago though. I am a paid user to several substacks in case that matters.
- rojobuffalo 4y ago
  That's interesting. Prior to July I did get replies, but they never fixed anything. "Thanks we'll pass this on to the dev team" but then nothing. I think that's normal but not great. Since July I've sent emails about 3 issues and the only response I got was the one I mentioned above. I'm a writer with a few paid subscribers.
AlbertCory 4y ago
I've put in a couple of support requests and gotten reasonably prompt, helpful responses. Possibly you're not a writer? They make it possible for writers to earn a decent amount of money (not that I am) and keep their copyright. Can you tell us another platform that does that better?
klelatti 4y ago

chrisweekly 4y ago

Whoa! Hotlinking Ghost CDN URLs in Substack production HTML. Yes this is a bad look for Substack. And it puts them - and their users - at Ghost's mercy.

tiffanyh 4y ago
It's also incredibly easy for Ghost to prevent hot linking. It just 2-3 lines in your nginx/apache config file that blocks hot linking, and many people consider this a standard practice to do regardless.
cptcobalt 4y ago
Totally. I feel like Ghost has integrity and wouldn't resort to shenanigans, but this is a wildly poor security posture and really a faux pas to be forcing ghost to incur CDN costs on this.
peter422 4y ago
They are not hotlinking ghost urls... JSdelivr is a giant JS CDN. Ghost is in the url because they developed the library so it's the GitHub path. You could use this library on your website right now... They open sourced it!
- jairajs89 4y ago
  Hey, Substack CTO. That's exactly right. Thank you for this
  - cxr 4y ago
    There's more to it than that. There are two resources involved. One is using Ghost's (jsdelivr-backed) CDN. The other is just using jsdelivr's CDN for any and every NPM package that gets published in the clear. The asset that thefp.com is using is the one that gets loaded from the latter (the one served from the public CDN), and you can see that this was true even at the time that O'Nolan's screenshots were taken. For some reason, he mixed them up; the only evidence that we have of anyone here using the CDN that Ghost is (presumably) paying for is Ghost's own use of it themselves.

quanticle 4y ago

The way they used our search library is kind of interesting. They could've copied the code locally and modified it to work with the Substack API, but I guess Substack doesn’t have an API? Substack doesn't have an API. Their editor is laughably primitive compared with other solutions. Their visual look hasn't changed at all since their inception. They don't have discoverability. Can anyone tell me what Substack is doing with all the millions of dollars of funding they've taken? We joke about Twitter being massively overstaffed, but Substack, to me, looks just as bloated, organizationally.

xwowsersx 4y ago
Maybe you have something else in mind when you say "discoverability", but.. https://substack.com/discover https://substack.com/discover Seems they do have it. As for the bloat, I can't really comment, but would note that Substack did substantial layoffs like everyone else. As for what they're doing: they built mobile apps, adding podcasting and video, etc, better discoverability. I can't say whether they've done "enough" to satisfy you, but I also don't think we should pretend Substack hasn't done any new product development work since inception.
- quanticle 4y ago
  Those are all fair responses. I guess I just haven't seen much uptake of those new features among the Substack writers that I follow. When they do podcasts, they're hosted by ACast, SimpleCast, or one of the other podcast hosting platforms out there. Videos are hosted on YouTube (like everyone else's). I would prefer if Substack spent more resources on improving its "core" newsletter/blog experience, but I can understand, given their status as a home for controversial writers, their desire to be a self-contained service.
  - vxNsr 4y ago
    My understanding is that these days most technical people are wary of being locked into a single platform, so even though substack is making a pretty compelling walled garden anyone with knowledge of recent SV history is hesitant to dive head first into it. As once they get big enough they’re pretty much guaranteed to do something anti-competitive that is against the interests of their customers/users who now have no choice as the cost of leaving has grown too large.

staunch 4y ago

On the one hand, it does seem like it'd be nice if Substack had signed a support/integration deal with the Ghost team. That way Ghost could have gotten paid something for their hard work, and Substack could have avoided critical mistakes like the CDN security issue. On the other hand, this seems like what success looks like for an MIT licensed project. A big company using the code to power their product without even having to contact, let alone ask permission of, anyone. It seems to feel different for end-user applications like Ghost. But it's not actually any different than if they had powered Substack with SQLite or Postgres.

shafyy 4y ago
> But it's not actually any different than if they had powered Substack with SQLite or Postgres. I disagree. It's more comprable to if they used WordPress instead of Ghost. The database is a few layers further down, whereas Ghost is basically 90% of the end product (not sure how much they've adapted, but looks like a lot from John's Tweet)
- staunch 4y ago
  Well, it's a bit more complicated than that. Substack is positioning themselves to their customers, which are journalists/authors, as a comprehensive alternative to having a normal job working at a newspaper or magazine. That seems to include high-touch customer support, an integrated business model with payments, a mailing list system, a distribution method, etc. It's more of a service than a piece of software. Ghost actually seems to have jumped on Substack's bandwagon by trying to skew their blog software toward being a direct Substack alternative. So Ghost seems to have adopted Substack's business model and Substack seems to have adopted some of their blog technology.
greenthrow 4y ago
I don't think you understood the linked thread. The problem is not that they are using Ghost. The problem is they are not including the attribution required by the license.
- 4y ago

the-printer 4y ago

So at what point does Substack cut the man and his team a check because from the looks of his observations Substack will likely need consultation and support.

tiffanyh 4y ago
Sounds like you're describing the SQLite model. Completely permissive license but companies pay for support (or custom features).
- samhuk 4y ago
  Genuinely curious (I don't know all that much about these things): To what extent does the SQLite model incentivize poor documentation since that would drive use of paid support services?
  - rchaud 4y ago
    If the documentation is poor, the implementers won't even be able to get it to a point where they would consider paying for consulting.
    - samhuk 4y ago
      I mean poor enough that its easy to get set up but more complex usage ends up requiring support services, by which lock in has started occuring.
  - ruuda 4y ago
    For what it's worth, SQLite's documentation is one of the best among all software I've ever used. It's clear, detailed, well-organized, and everything is documented.

gnicholas 4y ago

Huh, so it's a ghost in the machine?

deleted 4y ago

[deleted]

jasonhansel 4y ago

This is why you should use the AGPL. Otherwise, corporations can and will make immense profits from your unpaid work without contributing anything in return. The goal of FOSS should be to create a new ecosystem that puts users in control, not to provide free labor to private enterprises.

freedomben 4y ago
OP did not seem to be complaining about it though. In fact he seemed happy about it. Only the lack of attribution was a problem.
- 40four 4y ago
  Maybe not outright complaining, but the whole thread does come off as a little passive aggressive/ salty to me.
- nerdawson 4y ago
  It's written in a very passive aggressive way. He's not congratulating substack, he's calling them out. The attribution aspect of it seems intentionally misleading in my view. Are the MSM, who'll be chomping at the bit to attack their competitor, Substack, going to delve into the finer points of software licenses or rather just quote the tweet?
- jasonhansel 4y ago
  I'm not saying that Ghost should use the AGPL, I'm saying that this is a warning to other projects that use the MIT license and wouldn't want to see their work commercialized this way.
Kiro 4y ago
You have no right to dictate what the goal of FOSS is about. It's also patronizing to claim Ghost made some kind of mistake here. They obviously picked MIT for a reason, which means they are fine with companies making profits from their unpaid work.

gizmo 4y ago

Sleazy and disrespectful behavior by substack. Just like medium, all these publishing/newsletter platforms go to $%@& real quick. The first time I saw the "sign up to continue reading" banner I knew substack was done, this just confirms it.

ArnoVW 4y ago

It's a known thing, and it's called the SaaS loophole. https://opensource.stackexchange.com/questions/11467/can-i-use-gpl-software-to-provide-a-commercial-cloud-service https://opensource.stackexchange.com/questions/11467/can-i-u...

huksley 4y ago

I think one of the points that Substack reverse engineered how search works. They use this package https://github.com/TryGhost/sodo-search https://github.com/TryGhost/sodo-search which does not have any docs.

aftbit 4y ago

If you are like me and had never heard of Ghost before today, here's a link to their Github repo: https://github.com/TryGhost/Ghost https://github.com/TryGhost/Ghost

setgree 4y ago

Funny side-note: @substack is the wrong handle, I assume John meant to tag @SubstackInc. AFAIK there's no formal mechanism for bidding on naming rights, but Twitter could easily set up an auction platform, take a small cut off the top, and do quite nicely.

dibt 4y ago
You can request an already registered name if you own the brand. Owning the domain substack.com might be enough to prove ownership. People have been successful with this in the past. They may not do anything about it, though, if @substack is being used. Logging into Twitter is enough to keep the account active. I don't know if that is changing with the new owner. I know that Musk said they will be making names for inactive accounts available soon.
- setgree 4y ago
  That makes sense. It would also make sense to have auctions for high-value handles. Or, to take a page from 'Radical Markets', twitter accounts could be associated with a reservation price (a price at which a person would definitely sell), and 'taxed' (re: charged) a proportion of that reservation price. I believe it was Patio11 who observed that his upper limit on willingness to pay for twitter would be very high. Right now, Twitter doesn't capture any of that. That might only work for bluecheck accounts, not sure. I don't want to lose my random 10 follower account for $100, but neither do I want to pay to be a lurker

satvikpendem 4y ago

If Substack uses Ghost, why not just use Ghost itself? I'm thinking about doing that instead of Substack for my newsletter.

Waterluvian 4y ago

When John says "product engineers" does that mean "the engineers who specifically work on the code that gets used by customers"? Ie. excluding the engineers who do all the support stuff: CI/CD/testing/etc. ?

simonsarris 4y ago

Chris Best of Substack replied: https://twitter.com/cjgbest/status/1602370307884318720 https://twitter.com/cjgbest/status/1602370307884318720 Substack is not "powered by Ghost". Rather, we built our own theming API that’s compatible with themes built for Ghost, including those built by third parties. The Free Press is using a modified Tripoli theme, built by Ahmad Ajmi, under a paid license. This is how this is supposed to work. It's good for the theme developer if we support this – you should check them out here.

traviswt 4y ago
Great set of replies and a wonderful example of why hearing both sides is important. You should definitely click and read through Chris' thread, but the final note "We’re definitely up to chat" is a great olive branch.
- cjbest 4y ago
  Thanks. Happy to answer questions here too.

ben-parry 4y ago

Response from Chris Best Substack's CEO: https://twitter.com/cjgbest/status/1602370307884318720 https://twitter.com/cjgbest/status/1602370307884318720

raiyu 4y ago
Seems like minimal overlap potentially if they were just using it for a theme, but the tone is a bit defensive, and I don't think that John was rude in his original tweets and more of like tongue in cheek sort of fun and offering to collaborate. A more direct, yes we use some code, oops we will add attribution, thanks again, much appreciated, would have sufficed.
- sundarurfriend 4y ago
  If this had been private communication, sure. By putting this on Twitter, it immediately gets turned into something that could spawn clickbait headlines and could tarnish the company's reputation long term. Maybe John didn't mean for any of that, but his tweets don't mention the MIT licence initially and seem like they're building up an allegation. I think Chris responded exactly like a for-profit company's CEO should, pre-emptively countering tech journalist headlines, clearly and concisely describing the situation, and still reaching out for the potential of collaboration.
- cxr 4y ago
  You're not following/understanding what the linked Twitter threads are actually saying. There is no mention of O'Nolan being rude (although he did make a number of untrue claims, which at least pretty negligent—but that's not a charge that the linked tweets say, either...) There was no code use, and there was no copyright violation/failure of attribution, so there is no "yes we use some code, oops we will add attribution" called for, nor would it even be logical to do so.

ben-parry 4y ago

Response from Chris Best, Substack's CEO: https://twitter.com/cjgbest/status/1602370307884318720 https://twitter.com/cjgbest/status/1602370307884318720

cjbest 4y ago

One of the founders here. Here's a copy of the response I posted on Twitter. -- A response to @JohnONolan here to clear up some serious misunderstandings https://twitter.com/JohnONolan/status/1602330377812643850 https://twitter.com/JohnONolan/status/1602330377812643850 First of all, huge respect to the Ghost team. Their open source contributions are valuable, and their approach to theming enables some great-looking things. That said, some important corrections: Substack is not "powered by Ghost". Rather, we built our own theming API that’s compatible with themes built for Ghost, including those built by third parties. The Free Press is using a modified Tripoli theme, built by Ahmad Ajmi, under a paid license. This is how this is supposed to work. It's good for the theme developer if we support this – you should check them out here. https://aspirethemes.com/themes/tripoli https://aspirethemes.com/themes/tripoli This was relatively quick to build for Substack devs, because the structure of Ghost sites matches Substack fairly closely. With respect to the search library, this is an open source library that we are using in a fully compliant way. John's own screen shot shows that we don't load it "from Ghost’s own CDN", it comes from jsDelivr https://www.jsdelivr.com https://www.jsdelivr.com This is a standard way to use an open source library. It's pulling from the version that the sodo-search maintainers published to NPM (thank you!). It is a good point that we should lock a version, so that if they accidentally published a minor version revision with breaking changes it doesn't cause problems for us. We’ve fixed that. We’re grateful to the developer of the Tripoli theme and to Ghost for its contributors to open source work. We’re exploring ways to give writers more customization on Substack. This is one approach we’re considering but it’s too early to know if we’ll scale it up. And @JohnONolan, thanks for the note at the end about potential collaboration. In our minds, we’re on the same side of an important battle for a better internet. We’re definitely up to chat.

hiidrew 4y ago
I love substack. You guys have been doing a lot for the info landscape to return to the blogsphere. But I would love you even more if there was dark mode, I want to read in bed! -sincerely a huge fan of your platform
- internet_jockey 4y ago

Illniyar 4y ago

A response from substack. https://mobile.twitter.com/cjgbest/status/1602370307884318720 https://mobile.twitter.com/cjgbest/status/160237030788431872... Seems like this is a bit of a clickbait. The theme is made by the substack user, substack is only using a single library from ghost to show search, and the cdn in question is jsdeliver which isn't ghost's cdn, it is basically a cdn for any open source javascript.

deleted 4y ago
[deleted]

xNeil 4y ago

Hi Chris! Love what you're doing with Substack. One quick thing though - this may seem weird, but Substack at the moment does not, in my opinion, offer a lot of customisation of the website. If you see a website, it's extremely easy to tell its a Substack. Over the past year, I've only read high quality Substack posts - and my brain has sort of come to instinctively believe that if I see that specific layout, the post will be high quality. E.g. (not a very nice one) but in general, if I see the Medium layout, my brain almost immediately get turned off, believing the quality of the content to be sub-par. I think individual theming, as in the case of The Free Press, takes away that immediate notion. I understand that the vast majority of people will not face this issue, but I think I will. I just wanted to know if you think this is an issue, and if it is, what you'll do to 'counter' it. I'd really like to hear your thoughts on this!

dang 4y ago
Please don't post duplicate comments! We'll leave https://news.ycombinator.com/item?id=33958955 https://news.ycombinator.com/item?id=33958955 up.
- xNeil 4y ago
  Hi! Very sorry - won't happen again.
  - dang 4y ago
    Appreciated!

tiffanyh 4y ago

Is the title of the post still accurate? @dang, thoughts?

deleted 4y ago
[deleted]

placatedmayhem 4y ago

Mildly off-topic, but I'm somewhat tired of the reuse of names for different software. Originally, I was confused by this post and why Substack would be using Norton Ghost. There's also the Android post-explotation framework and ImmersionRC's Ghost radio control protocol.

dmix 4y ago
As long as it's a distinctly different product category / market it's not a big deal. You can usually glean the meaning from the context pretty quickly. If one brand becomes large then the other one's can just have context added like appending "Norton" to Ghost. Or just say "Ghost blog service".

lucideer 4y ago

I've been a big fan of ghost for a while, both the software and the company & its values. This thread is really making me rethink the latter. He's just so confidently wrong in every tweet.

lucideer 4y ago
Tweet-by-tweet elaboration: 1 & 2: "substack is powered by ghost" A customer of substack is using a port of an open source ghost theme. 3: some screenshots Of the substack sourcecode showing that they're loading an open source ghost JS search UI library from the jsdelivr CDN service. Substack are using an open source front-end lib that the Ghost team open sourced. For other people to use. 4. Screenshots of the substack HTML sourcecode showing the classes are the same as ghost Because they're using an open source theme ported from ghost... 6 & 7. Substack are loading the open source library from "Ghost’s own CDN" First I've heard that Ghost have acquired Jsdelivr. 8. "directly loading scripts from our CDN on their platform is very bad for security [...] Any updates or changes we ship could inadvertently brick their whole platform" I actually do agree that using 3rd party CDNs like Jsdelivr is bad for security (supply chain attacks are a real pain with package managers, using other people's CDNs increase that pain significantly). But... it's not Ghost's CDN & the implication that Ghost could push a release of their open source JS lib to jsdelivr that would brick consumers is pretty sinister. 9. Substack are using MIT without attribution They're not. Already covered by multiple comments on HN & in the Twitter replies. John just doesn't understand how the MIT license he chose works. Tbh he doesn't really seem to understand how open source works in general. --- Note: large companies using open source code and not contributing back is a big problem. It's what Substack are doing and we should talk about it. But that conversation should be informed and fact-based. This thread is ignorance start to finish.
digianarchist 4y ago
I used to really dislike John. I've sparred with him on Hacker News a couple of times on various issues (under a different account). I then listened to a podcast [0] he was on and basically changed my mind on the guy. I still feel he desperately needs to hire a communications director for Ghost but I've softened my view on him as a person. [0] - https://www.notoverthinking.com/episodes/john-onolan-on-life-as-a-nomad-ghost-and-optimising-for-happiness https://www.notoverthinking.com/episodes/john-onolan-on-life...

bakkoting 4y ago

Here's [1] the actual JS file which Substack is loading, pulled directly from the network tab on the page linked in the thread. Notably, the first line is "For license information please see sodo-search.min.js.LICENSE.txt". But if you go to that file [2], it's not the license _for this file_; it's the licenses _for the OSS code it includes_. I suspect that Substack thought that link pointed to the actual license; I did too before I started writing this comment. Possibly that confusion has lead to some talking past each other. The actual license is at [3], which is obvious if you know how npm packages work, and probably not obvious otherwise. I don't see a link to that file anywhere. [1] https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/sodo-search.min.js https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/s... [2] https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/sodo-search.min.js.LICENSE.txt https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/umd/s... [3] https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/LICENSE https://cdn.jsdelivr.net/npm/@tryghost/sodo-search@1.1/LICEN...

benced 4y ago

What a crazy world we live in where someone can license their code and someone else can use the code under the terms of that license.

yawboakye 4y ago

in a non-gotcha world, john of ghost reaches out privately to chris (or someone else) of substack to compare notes and clarify what's going on here. but those regretful days of chivalry are long gone, aren't they? they're replaced by the superior practice of submitting your grievances to the universal jury, in the absence of the accused. civility and principle of charity be damned. a few people have highlighted the calmness of the exchange—i think the public part was absolutely unnecessary. my one-and-a-half cents.