Re:Tarsnap critical security bug
by nwmcsween on Tuesday January 18, 2011 @05:03PM
(#2117588)
I planned on modifying tarsnap to work on local files and upload to different resources (dropbox, local, etc) but as I dug in and looked at the license I noticed this little gem in COPYING "Redistribution and use in source and binary forms, without modification,
is permitted for the sole purpose of using the "tarsnap" backup service". Why even provide source if the license doesn't allow me to do anything with said source? I can't create a patch without being litigated and I won't due to that.
[ Parent
| on HN ]
This is silly. Colin clearly isn't going to "litigate" against you. He provides the source precisely so that people can find bugs in it. It's a commercial product, though, not a GNU project. It's a good thing that he provided source code, and it's disingenuous and petty to try to punish him for doing that.
Also, that way he doesn't have to compile/package it for every system somebody might want to run it on.
Why not just have a non-compete clause within the license. At least legally this would allow for internal use with local backups. I highly doubt execution of a similar service using tarsnap would even happen, if that's what the worry is.
Presumably because he has better things to do with his time. His commercial competitors universally do not release their source code at all. Stop picking on him for his license.
Re:Tarsnap critical security bug
by requinot59 on Tuesday January 18, 2011 @05:41PM
(#2117728)
> it's disingenuous and petty to try to punish him
Where does he try to "punish" him?!
Plus it's a real legal concern, sure in practice cperciva will not sue him, but still...
"No matter how secure Tarsnap's design is, however, you don't run the design on your computer — you run the code. For this reason, all of the source code to the Tarsnap client is available. You don't need to simply trust that Tarsnap does things right (and that it isn't a trojan planted by the US government): You can read the source code and check for yourself."
Last § of https://www.tarsnap.com/security.html
I planned on modifying tarsnap to work on local files and upload to different resources (dropbox, local, etc) but as I dug in and looked at the license I noticed this little gem in COPYING...
Exactly. That is deliberate. I don't want to end up competing with my own code.
Why even provide source if the license doesn't allow me to do anything with said source?
So that people can audit it if they wish to do so.
Are you sure you can't do that?