5 ms·

Still doesn't explain why it's all not at least source-available. I'm not going to complain if they don't use open-source licenses such as MIT or (A)GPL, but st

Still doesn't explain why it's all not at least source-available. I'm not going to complain if they don't use open-source licenses such as MIT or (A)GPL, but straight up not making the source code publicly readable at all is a big strike against it.

dagi3d 4y ago
Making it opensource is no guarantee at all(if there could be any), for instance it could be more dangerous: anyone could spot a security hole and take advantage of it without reporting it, there is no guarantee there would be a responsible disclosure.
- EMIRELADERO 4y ago
  Are you vouching for security through obscurity?
  - dagi3d 4y ago
    When systems and code are audited and pentested by third parties, I don't see any benefit of actually making anything public.
samwillis 4y ago
There is good insight into this from this comment from them in 2014: https://1password.community/discussion/comment/114870/#Comment_114870 https://1password.community/discussion/comment/114870/#Comme...
- EMIRELADERO 4y ago
  That seems to be about transitioning to an open-source model. I don't mean that. I mean simply having their git repo publicly accesible in a read-only fashion. No external contributions, no license, etc. I see no reason not to do this, especially for such a security-oriented service. You should be striving for as much transparency as possible.
  - dylan604 4y ago
    Because they like being in business vs just giving away their software? Where is the repo of software that you've paid an unknown number of developers to work on for multiple years over multiple versions that you charge for and run a viable business employing all of the peoples?
    - deleted 4y ago
      [deleted]
    - counttheforks 4y ago
      You should perhaps read up on software licenses and what it means when code is public but unlicensed.
    - deleted 4y ago
      [deleted]
    - ilyt 4y ago
      Just because source code is available doesn't mean you can legally use it. That's why every "the company source code got stolen!" news is nothingburger, no competitor can use it, it would be huge liability to be caught using it, and it "only" matters for people that might find bugs in it.
  - aidos 4y ago
    They are in the business of doing business. How much of the codebase that makes up their business model would you like them to expose?
    - nequo 4y ago
      Bitwarden is in the business of doing business, too. But their source code is publicly available. A lot of it is even under GPL: https://github.com/bitwarden/server/blob/master/LICENSE_FAQ.md https://github.com/bitwarden/server/blob/master/LICENSE_FAQ....
      - 4y ago

dagi3d 4y ago

Making it opensource is no guarantee at all(if there could be any), for instance it could be more dangerous: anyone could spot a security hole and take advantage of it without reporting it, there is no guarantee there would be a responsible disclosure.

EMIRELADERO 4y ago
Are you vouching for security through obscurity?
- dagi3d 4y ago
  When systems and code are audited and pentested by third parties, I don't see any benefit of actually making anything public.

samwillis 4y ago

There is good insight into this from this comment from them in 2014: https://1password.community/discussion/comment/114870/#Comment_114870 https://1password.community/discussion/comment/114870/#Comme...

EMIRELADERO 4y ago
That seems to be about transitioning to an open-source model. I don't mean that. I mean simply having their git repo publicly accesible in a read-only fashion. No external contributions, no license, etc. I see no reason not to do this, especially for such a security-oriented service. You should be striving for as much transparency as possible.
- dylan604 4y ago
  Because they like being in business vs just giving away their software? Where is the repo of software that you've paid an unknown number of developers to work on for multiple years over multiple versions that you charge for and run a viable business employing all of the peoples?
  - deleted 4y ago
    [deleted]
  - counttheforks 4y ago
    You should perhaps read up on software licenses and what it means when code is public but unlicensed.
  - deleted 4y ago
    [deleted]
  - ilyt 4y ago
    Just because source code is available doesn't mean you can legally use it. That's why every "the company source code got stolen!" news is nothingburger, no competitor can use it, it would be huge liability to be caught using it, and it "only" matters for people that might find bugs in it.
- aidos 4y ago
  They are in the business of doing business. How much of the codebase that makes up their business model would you like them to expose?
  - nequo 4y ago
    Bitwarden is in the business of doing business, too. But their source code is publicly available. A lot of it is even under GPL: https://github.com/bitwarden/server/blob/master/LICENSE_FAQ.md https://github.com/bitwarden/server/blob/master/LICENSE_FAQ....
    - 4y ago