Tweet-by-tweet elaboration: 1 & 2: "substack is powered by ghost" A customer of substack is using a port of an open source ghost theme. 3: some screenshots

Tweet-by-tweet elaboration: 1 & 2: "substack is powered by ghost" A customer of substack is using a port of an open source ghost theme. 3: some screenshots Of the substack sourcecode showing that they're loading an open source ghost JS search UI library from the jsdelivr CDN service. Substack are using an open source front-end lib that the Ghost team open sourced. For other people to use. 4. Screenshots of the substack HTML sourcecode showing the classes are the same as ghost Because they're using an open source theme ported from ghost... 6 & 7. Substack are loading the open source library from "Ghost’s own CDN" First I've heard that Ghost have acquired Jsdelivr. 8. "directly loading scripts from our CDN on their platform is very bad for security [...] Any updates or changes we ship could inadvertently brick their whole platform" I actually do agree that using 3rd party CDNs like Jsdelivr is bad for security (supply chain attacks are a real pain with package managers, using other people's CDNs increase that pain significantly). But... it's not Ghost's CDN & the implication that Ghost could push a release of their open source JS lib to jsdelivr that would brick consumers is pretty sinister. 9. Substack are using MIT without attribution They're not. Already covered by multiple comments on HN & in the Twitter replies. John just doesn't understand how the MIT license he chose works. Tbh he doesn't really seem to understand how open source works in general. --- Note: large companies using open source code and not contributing back is a big problem. It's what Substack are doing and we should talk about it. But that conversation should be informed and fact-based. This thread is ignorance start to finish.