3 ms·

I've been a big fan of ghost for a while, both the software and the company & its values. This thread is really making me rethink the latter. He's just so con

I've been a big fan of ghost for a while, both the software and the company & its values. This thread is really making me rethink the latter. He's just so confidently wrong in every tweet.

lucideer 4y ago
Tweet-by-tweet elaboration: 1 & 2: "substack is powered by ghost" A customer of substack is using a port of an open source ghost theme. 3: some screenshots Of the substack sourcecode showing that they're loading an open source ghost JS search UI library from the jsdelivr CDN service. Substack are using an open source front-end lib that the Ghost team open sourced. For other people to use. 4. Screenshots of the substack HTML sourcecode showing the classes are the same as ghost Because they're using an open source theme ported from ghost... 6 & 7. Substack are loading the open source library from "Ghost’s own CDN" First I've heard that Ghost have acquired Jsdelivr. 8. "directly loading scripts from our CDN on their platform is very bad for security [...] Any updates or changes we ship could inadvertently brick their whole platform" I actually do agree that using 3rd party CDNs like Jsdelivr is bad for security (supply chain attacks are a real pain with package managers, using other people's CDNs increase that pain significantly). But... it's not Ghost's CDN & the implication that Ghost could push a release of their open source JS lib to jsdelivr that would brick consumers is pretty sinister. 9. Substack are using MIT without attribution They're not. Already covered by multiple comments on HN & in the Twitter replies. John just doesn't understand how the MIT license he chose works. Tbh he doesn't really seem to understand how open source works in general. --- Note: large companies using open source code and not contributing back is a big problem. It's what Substack are doing and we should talk about it. But that conversation should be informed and fact-based. This thread is ignorance start to finish.
digianarchist 4y ago
I used to really dislike John. I've sparred with him on Hacker News a couple of times on various issues (under a different account). I then listened to a podcast [0] he was on and basically changed my mind on the guy. I still feel he desperately needs to hire a communications director for Ghost but I've softened my view on him as a person. [0] - https://www.notoverthinking.com/episodes/john-onolan-on-life-as-a-nomad-ghost-and-optimising-for-happiness https://www.notoverthinking.com/episodes/john-onolan-on-life...
- lucideer 4y ago
  Thanks for the rec, I'll definitely try and give it a listen. He can't be that bad if he's behind what Ghost have to date presented themselves as. He does seem to have some pretty severe gaps in technical literacy though: which is very excusable if it's not coupled with blind confidence.

I've been a big fan of ghost for a while, both the software and the company & its values. This thread is really making me rethink the latter. He's just so confidently wrong in every tweet.

lucideer 4y ago

Tweet-by-tweet elaboration: 1 & 2: "substack is powered by ghost" A customer of substack is using a port of an open source ghost theme. 3: some screenshots Of the substack sourcecode showing that they're loading an open source ghost JS search UI library from the jsdelivr CDN service. Substack are using an open source front-end lib that the Ghost team open sourced. For other people to use. 4. Screenshots of the substack HTML sourcecode showing the classes are the same as ghost Because they're using an open source theme ported from ghost... 6 & 7. Substack are loading the open source library from "Ghost’s own CDN" First I've heard that Ghost have acquired Jsdelivr. 8. "directly loading scripts from our CDN on their platform is very bad for security [...] Any updates or changes we ship could inadvertently brick their whole platform" I actually do agree that using 3rd party CDNs like Jsdelivr is bad for security (supply chain attacks are a real pain with package managers, using other people's CDNs increase that pain significantly). But... it's not Ghost's CDN & the implication that Ghost could push a release of their open source JS lib to jsdelivr that would brick consumers is pretty sinister. 9. Substack are using MIT without attribution They're not. Already covered by multiple comments on HN & in the Twitter replies. John just doesn't understand how the MIT license he chose works. Tbh he doesn't really seem to understand how open source works in general. --- Note: large companies using open source code and not contributing back is a big problem. It's what Substack are doing and we should talk about it. But that conversation should be informed and fact-based. This thread is ignorance start to finish.

digianarchist 4y ago

I used to really dislike John. I've sparred with him on Hacker News a couple of times on various issues (under a different account). I then listened to a podcast [0] he was on and basically changed my mind on the guy. I still feel he desperately needs to hire a communications director for Ghost but I've softened my view on him as a person. [0] - https://www.notoverthinking.com/episodes/john-onolan-on-life-as-a-nomad-ghost-and-optimising-for-happiness https://www.notoverthinking.com/episodes/john-onolan-on-life...

lucideer 4y ago
Thanks for the rec, I'll definitely try and give it a listen. He can't be that bad if he's behind what Ghost have to date presented themselves as. He does seem to have some pretty severe gaps in technical literacy though: which is very excusable if it's not coupled with blind confidence.