News for hackers. Stuff that matters.
Re:SpiderOakONE – Zero Knowledge Cloud Storage by hedora on Monday January 02, 2017 @04:29PM (#13304707)
I really want to give you guys money, but can't trust you without having client and server side source. I need client side source so third parties can freely audit your work. I need server side source so I can store my data at some random colo and wrap the rack in tinfoil (more realisitcally, so I know I can just switch providers if you are out of business in ten years).

Have you considered licensing your stuff using the BSL: http://monty-says.blogspot.com/2016/08/applying-business-sou...

This would let me pay you to continue your (very important!) work, and let me recommend your service to others.

[edit: For people not familiar with the BSL: It makes it easy to say things like:

"This release of the software is free for the first 100MB, then $10/TB after that. Licensing the software gives you non-transferrable rights similar to a BSD license. On Jan 2, 2027, the above usage restriction will expire, leaving the software with a BSD-style license"

You bump the expiry date on each release, so cheapskates have to wait 10 years for new features, and the developers have to continuously improve the software to maintain a revenue stream.]

Re:SpiderOakONE – Zero Knowledge Cloud Storage by rarrrrrr on Monday January 02, 2017 @05:10PM (#13304985)
Thank you for your interest in SpiderOak and valuing work to improve the choices available that preserve privacy.

For what it's worth, everything we've built since 2008 has published source code. Most recently that's Semaphor[1], which is written in Go and React.

I think it's very important that products have what Zooko calls an "economic feedback loop" to be successful. As just one example, volunteer projects rarely have staff that do the grinding but necessary work of testing that each release works well on every version of all support operating systems and platforms, because it isn't fun. I think this is why although some teams publish their client source code, very few service providers publish their server source code. It would make it too easy for competitors to emerge and undercut on price while giving little back (the biggest cost is the often the development work itself.)

That said, we've been in business for 10 years and are not going away! Thanks for your feedback.

[1] https://spideroak.com/solutions/semaphor/business/tour

Re:SpiderOakONE – Zero Knowledge Cloud Storage by hedora on Monday January 02, 2017 @05:40PM (#13305162)
I'm sympathetic to the economic feedback problem you're describing. I think the BSL addresses the concern about undercutting. Sure, people could pirate your software, but short of that, it probably makes more sense to implement from scratch than either wait ten years, or fork code that is ten years old, which is all your competitors could do with the source. Honestly, I would probably just pay for your service after spending a few hours spot checking the source.

Anyway, I'd love to hear your thoughts on the licensing model, even if you're not considering it at spideroak.

Re:SpiderOakONE – Zero Knowledge Cloud Storage by sreitshamer on Monday January 02, 2017 @07:45PM (#13305747)
Is open source really required? We at Haystack Software make a backup app (Arq) with client-side encryption that doesn't require any server side code (it supports a number of cloud providers' APIs). We don't publish the app's source, but the data format is open/documented, the data go in your cloud account, and you can monitor network traffic from it to ensure it's not connecting to us or anyplace unwanted. Your data don't come to us at all -- they're sent to your cloud account.
Re:SpiderOakONE – Zero Knowledge Cloud Storage by nyolfen on Monday January 02, 2017 @09:30PM (#13306202)
any plans for a linux client?