3 ms·

> Nowhere on the Keycloak home page does it say "just a hobby project" or anything that would remotely indicate that it is not a serious project and that you sh

> Nowhere on the Keycloak home page does it say "just a hobby project" or anything that would remotely indicate that it is not a serious project and that you shouldn't use the software. https://github.com/keycloak/keycloak/blob/main/LICENSE.txt#L144-L175 https://github.com/keycloak/keycloak/blob/main/LICENSE.txt#L... Indeed 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.

ziddoap 2y ago
Point 7 buried in the license document of the github repository is very much not https://www.keycloak.org/ https://www.keycloak.org/
- willcipriano 2y ago
  Customers have been refunded in full.
  - mardifoufs 2y ago
    Red hat consumers have been refunded? Where?
    - willcipriano 2y ago
      As per the terms here: https://www.keycloak.org/pricing https://www.keycloak.org/pricing
      - mardifoufs 2y ago
        The point is that red hat also sells keycloak and develops it. I agree that most users don't pay, but your point is a bit weird considering that some people do actually pay/paid for its development and still do not get a refund
- lucianbr 2y ago
  You really feel that anything that is not directly on the home page does not matter? A link to a separate document explicitly named as containing the conditions of license, warranty and such should not count? Seems like an absurd view to me. For all that I think RedHat is not a poor hobbyist and morally at fault. It's just a different matter altogether. The terms under which the software is provided are clearly spelled and in public view. You're just inventing a reason to disregard them.
  - ziddoap 2y ago
    >You really feel that anything that is not directly on the home page does not matter? No, that's not what I said. When it comes to software like this (one of the most important components of your security architecture), hiding the fact that you wont fix vulnerabilities unless you feel like it halfway down in your legalese-filled license is unethical. I think it's absurd that people are defending this position. We're not talking about a weather app made by Joe Somebody for a weekend project.
    - lucianbr 2y ago
      > Point 7 buried in the license document of the github repository is very much not https://www.keycloak.org/ https://www.keycloak.org/ Not a single word in this comment refers to "software like this (one of the most important components of your security architecture)". I guess you realized the absurdity of your position and moved the goalposts to something else.
      - ziddoap 2y ago
        What? Can you explain where you think I set goalposts, and how you think I moved them? Because I am not following.
    - LaSombra 2y ago
      The Linux kernel, probably one of the most critically important pieces of software nowadays, is licenced mainly under the GPL version 2.0[0], and other compatible licenses, and provides a section and 2 paragraphs on how there is no warranty for those who decide to use it. """ NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. """ No Linux kernel engineer is obliged to fix any bugs, even security vulnerabilities, if one decides to, but since there's so much at stake, kernel engineers will end up fixing at their own timeframes, as they see fit. [0] https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html
- jillyboel 2y ago
  Is this the first time you heard of open source licenses or something? This is standard boilerplate, and it's hilarious to think you get to ask for more from a project you're not even contributing to.
  - ziddoap 2y ago
    I'm not asking for more. I'm saying I think it is scummy to do the bare minimum when you're advertising yourself as a critical piece of security software and encouraging the use of the software in real security-critical applications.
    - sneak 2y ago
      They are literally explicitly stating that the software does not claim to be fit for purpose. You can’t have it both ways.
      - ziddoap 2y ago
        They are advertising on their website, extremely prominently, that they are fit for your all of identity management needs. Are they allowed to put a single paragraph in their license file that runs counter to all of their other marketing, advertising, and communication efforts? For sure! Is it shitty to do that? I think so. Just be upfront, it's not hard. If your software isn't fit for security-critical applications, don't pretend it is.
        jillyboel 2y ago
        I suppose it's best if you never use any open source software ever again because they all do that. Like I said, it's standard boilerplate and it's absurd to think you get to wish for more from an open source project that you aren't contributing to. Of course this boilerplate is necessary else you get people like yourself demanding unreasonable things.
        ziddoap 2y ago
- vetinari 2y ago
  So what gives you a right to download and use the software in the first place? The copyright law forbids that by default. What permission other than the license do you have?
  - ziddoap 2y ago
    I'm not sure what point you are trying to make but thankfully, given that they obviously can't be trusted to maintain security-critical software (despite what they imply on their website and marketing material), I haven't downloaded or used it or recommended it anywhere while consulting.

ziddoap 2y ago

Point 7 buried in the license document of the github repository is very much not https://www.keycloak.org/ https://www.keycloak.org/

willcipriano 2y ago
Customers have been refunded in full.
- mardifoufs 2y ago
  Red hat consumers have been refunded? Where?
  - willcipriano 2y ago
    As per the terms here: https://www.keycloak.org/pricing https://www.keycloak.org/pricing
    - mardifoufs 2y ago
      The point is that red hat also sells keycloak and develops it. I agree that most users don't pay, but your point is a bit weird considering that some people do actually pay/paid for its development and still do not get a refund
lucianbr 2y ago
You really feel that anything that is not directly on the home page does not matter? A link to a separate document explicitly named as containing the conditions of license, warranty and such should not count? Seems like an absurd view to me. For all that I think RedHat is not a poor hobbyist and morally at fault. It's just a different matter altogether. The terms under which the software is provided are clearly spelled and in public view. You're just inventing a reason to disregard them.
- ziddoap 2y ago
  >You really feel that anything that is not directly on the home page does not matter? No, that's not what I said. When it comes to software like this (one of the most important components of your security architecture), hiding the fact that you wont fix vulnerabilities unless you feel like it halfway down in your legalese-filled license is unethical. I think it's absurd that people are defending this position. We're not talking about a weather app made by Joe Somebody for a weekend project.
  - lucianbr 2y ago
    > Point 7 buried in the license document of the github repository is very much not https://www.keycloak.org/ https://www.keycloak.org/ Not a single word in this comment refers to "software like this (one of the most important components of your security architecture)". I guess you realized the absurdity of your position and moved the goalposts to something else.
    - ziddoap 2y ago
      What? Can you explain where you think I set goalposts, and how you think I moved them? Because I am not following.
  - LaSombra 2y ago
    The Linux kernel, probably one of the most critically important pieces of software nowadays, is licenced mainly under the GPL version 2.0[0], and other compatible licenses, and provides a section and 2 paragraphs on how there is no warranty for those who decide to use it. """ NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. """ No Linux kernel engineer is obliged to fix any bugs, even security vulnerabilities, if one decides to, but since there's so much at stake, kernel engineers will end up fixing at their own timeframes, as they see fit. [0] https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html https://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html
jillyboel 2y ago
Is this the first time you heard of open source licenses or something? This is standard boilerplate, and it's hilarious to think you get to ask for more from a project you're not even contributing to.
- ziddoap 2y ago
  I'm not asking for more. I'm saying I think it is scummy to do the bare minimum when you're advertising yourself as a critical piece of security software and encouraging the use of the software in real security-critical applications.
  - sneak 2y ago
    They are literally explicitly stating that the software does not claim to be fit for purpose. You can’t have it both ways.
    - ziddoap 2y ago
      They are advertising on their website, extremely prominently, that they are fit for your all of identity management needs. Are they allowed to put a single paragraph in their license file that runs counter to all of their other marketing, advertising, and communication efforts? For sure! Is it shitty to do that? I think so. Just be upfront, it's not hard. If your software isn't fit for security-critical applications, don't pretend it is.
      - jillyboel 2y ago
        I suppose it's best if you never use any open source software ever again because they all do that. Like I said, it's standard boilerplate and it's absurd to think you get to wish for more from an open source project that you aren't contributing to. Of course this boilerplate is necessary else you get people like yourself demanding unreasonable things.
        ziddoap 2y ago
vetinari 2y ago
So what gives you a right to download and use the software in the first place? The copyright law forbids that by default. What permission other than the license do you have?
- ziddoap 2y ago
  I'm not sure what point you are trying to make but thankfully, given that they obviously can't be trusted to maintain security-critical software (despite what they imply on their website and marketing material), I haven't downloaded or used it or recommended it anywhere while consulting.