Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.project > #9403

Re: [pkg-go] Bug#856139: certspotter: long description advertises commercial service

Show all headers | View raw

On Fri, Aug 11, 2017 at 08:03:09AM -0400, Wouter Verhelst wrote:
> If a free software implementation of the remote service exists that a
> package can work with, then it can remain in main. If not, it cannot.

There are no free software server-side implementation of e.g. the ICQ
protocol, as far as I know, but multiple client-side implementations in
main. For that matter, there is no free software server-side
implementation of QUIC, so I guess by that rule, Chromium should be in
contrib as well. Pretty sure that there isn't any kind of consensus for
any of that.

As for certspotter, the conversation has derailed quite a bit -- in part
because Jonas forwarded this to debian-project while stripping almost
the entirety of my reply on the bug, then stripping again all of the
context when days later, he started a new thread from scratch on
debian-devel. Not cool.

To clear things up:
- certspotter is free software, and is used to check Certificate
  Transparency logs, notifying the user if any certificates in the wild
  have been observed matching a domain of theirs.

- The author of certspotter also runs the SSLMate as a commercial
  offering, which hosts a version of certspotter for anyone to use. It's
  free for up to 5 domains, then charging for more, for presumably
  larger enterprises (but these can still opt to run it themselves,
  using certspotter). The SSLMate website, in the menu under "Cert
  Spotter", has "Pricing", "API", "Open Source", in that order, with the
  latter pointing to the GitHub page of certspotter.

- People called SSLMate "non-free" and objected to the certspotter
  description pointing to it. While it is true that it is non-free to
  some extent, as the web dashboard and code that glues certspotter to
  it isn't free (AFAIK), the most interesting and complicated part of it
  (a pretty flexible CT log client) is.

- certspotter does not connect to SSLMate in any way. certspotter
  (either the one locally installed, or the one run by SSLMate) connect
  to the various CT Logs run by CAs, Google etc. In fact, it connects to
  the same CT log servers that Chromium does.

- Certificate Transparency is an IETF protocol (RFC 6962) and is
  implemented, as a client, by both Chromium and Firefox. Google has
  released a a number of freely licensed client libraries, as well as
  their reference implementation of the CT Log server. Even if the
  blanket rule that Wouter mentioned existed, certspotter would satisfy
  it.

- I don't have any personal or business connection to SSLMate or
  certspotter, other than using the software and maintaining the
  package. I haven't communicated with my upstream about this issue
  either and my comment on the bug report are just my views. I just want
  to be fair to a nice upstream, who has graciously released part of
  their business as free (as in speech and as in beer) software, for
  anyone to use instead of using their service.

I read both of the threads so far (sadly, as most of it was offtopic and
a waste of precious DebCamp/DebConf time) and from all the suggestions,
I really appreciated and valued Chris Lamb's response about dropping the
"requires zero setup" bit. I intend to drop that part on the next
upload, whenever that happens.

Regards,
Faidon

Back to linux.debian.project | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#856139: certspotter: long description advertises commercial service Jonas Smedegaard <dr@jones.dk> - 2017-08-05 02:10 +0200
  Bug#856139: certspotter: long description advertises commercial service Paul Wise <pabs@debian.org> - 2017-08-05 15:50 +0200
    Re: Bug#856139: certspotter: long description advertises commercial  service "Dr. Bas Wijnen" <bas@wijnen.dtdns.net> - 2017-08-06 09:30 +0200
    Bug#856139: certspotter: long description advertises commercial service Jonas Smedegaard <dr@jones.dk> - 2017-08-06 17:30 +0200
  Bug#856139: [pkg-go] Bug#856139: certspotter: long description advertises commercial service Vincent Bernat <bernat@debian.org> - 2017-08-06 14:20 +0200
    Bug#856139: [pkg-go] Bug#856139: certspotter: long description advertises commercial service Chris Lamb <lamby@debian.org> - 2017-08-06 14:40 +0200
    Re: [pkg-go] Bug#856139: certspotter: long description advertises  commercial service "Dr. Bas Wijnen" <wijnen@debian.org> - 2017-08-07 20:20 +0200
      Re: [pkg-go] Bug#856139: Bug#856139: certspotter: long description advertises commercial service Vincent Bernat <bernat@debian.org> - 2017-08-07 21:00 +0200
        Debian packages advertising non-free services (was: [pkg-go] Bug#856139: Bug#856139: certspotter: long description advertises commercial service) Ben Finney <bignose@debian.org> - 2017-08-08 01:40 +0200
          Re: Debian packages advertising non-free services Vincent Bernat <bernat@debian.org> - 2017-08-08 07:40 +0200
            Re: Debian packages advertising non-free services Scott Kitterman <debian@kitterman.com> - 2017-08-08 07:50 +0200
              Re: Debian packages advertising non-free services Charles Plessy <plessy@debian.org> - 2017-08-08 09:00 +0200
              Re: Debian packages advertising non-free services Andrey Rahmatullin <wrar@debian.org> - 2017-08-08 10:10 +0200
            Re: Debian packages advertising non-free services Ben Finney <bignose@debian.org> - 2017-08-08 08:20 +0200
      Re: [pkg-go] Bug#856139: certspotter: long description advertises commercial service Sean Whitton <spwhitton@spwhitton.name> - 2017-08-08 05:50 +0200
        Re: [pkg-go] Bug#856139: certspotter: long description advertises  commercial service Wouter Verhelst <wouter@debian.org> - 2017-08-11 14:10 +0200
          Re: [pkg-go] Bug#856139: certspotter: long description advertises commercial service Sean Whitton <spwhitton@spwhitton.name> - 2017-08-11 17:00 +0200
          Re: [pkg-go] Bug#856139: certspotter: long description advertises  commercial service Faidon Liambotis <paravoid@debian.org> - 2017-08-12 00:00 +0200
            Re: [pkg-go] Bug#856139: certspotter: long description advertises commercial  service Jonas Smedegaard <dr@jones.dk> - 2017-08-12 05:50 +0200
            Re: [pkg-go] Bug#856139: certspotter: long description advertises  commercial service "Dr. Bas Wijnen" <wijnen@debian.org> - 2017-08-12 08:30 +0200
              Re: [pkg-go] Bug#856139: certspotter: long description advertises commercial service Vincent Bernat <bernat@debian.org> - 2017-08-12 09:00 +0200
                Are online services also software for Debian's rules? "Dr. Bas Wijnen" <wijnen@debian.org> - 2017-08-12 09:40 +0200
                Re: Are online services also software for Debian's rules? Vincent Bernat <bernat@debian.org> - 2017-08-12 10:00 +0200
              Re: [pkg-go] Bug#856139: certspotter: long description advertises  commercial service Christian Seiler <christian@iwakd.de> - 2017-08-12 10:10 +0200
                Re: Are online services also software for Debian's rules? "Dr. Bas Wijnen" <wijnen@debian.org> - 2017-08-12 11:20 +0200
                Re: Are online services also software for Debian's rules? Vincent Bernat <bernat@debian.org> - 2017-08-12 12:10 +0200
                Re: Are online services also software for Debian's rules? Russ Allbery <rra@debian.org> - 2017-08-12 17:20 +0200
                Re: Are online services also software for Debian's rules? "Dr. Bas Wijnen" <wijnen@debian.org> - 2017-08-13 22:10 +0200
                Re: Are online services also software for Debian's rules? Miles Fidelman <mfidelman@meetinghouse.net> - 2017-08-13 23:10 +0200
                Re: Are online services also software for Debian's rules? Russ Allbery <rra@debian.org> - 2017-08-14 02:30 +0200
                Re: Are online services also software for Debian's rules? Russ Allbery <rra@debian.org> - 2017-08-14 02:30 +0200
                Re: Are online services also software for Debian's rules? "Dr. Bas Wijnen" <wijnen@debian.org> - 2017-08-14 14:10 +0200
                Re: Are online services also software for Debian's rules? Holger Levsen <holger@layer-acht.org> - 2017-08-14 15:00 +0200
                Re: Are online services also software for Debian's rules? "Dr. Bas Wijnen" <wijnen@debian.org> - 2017-08-14 15:10 +0200
                Re: Are online services also software for Debian's rules? Andrey Rahmatullin <wrar@debian.org> - 2017-08-14 15:30 +0200
                Re: Are online services also software for Debian's rules? Marc Haber <mh+debian-project@zugschlus.de> - 2017-08-14 15:30 +0200
                Re: Are online services also software for Debian's rules? Miles Fidelman <mfidelman@meetinghouse.net> - 2017-08-14 19:40 +0200
                Re: Are online services also software for Debian's rules? Andrey Rahmatullin <wrar@debian.org> - 2017-08-14 19:50 +0200
                Re: Are online services also software for Debian's rules? Christian Seiler <christian@iwakd.de> - 2017-08-12 12:10 +0200
                Re: Are online services also software for Debian's rules? Tollef Fog Heen <tfheen@err.no> - 2017-08-12 16:00 +0200
                Re: Are online services also software for Debian's rules? Christian Seiler <christian@iwakd.de> - 2017-08-12 16:20 +0200
                Re: Are online services also software for Debian's rules? Tollef Fog Heen <tfheen@err.no> - 2017-08-12 16:50 +0200
                win32-loader (was: Re: Bug#856139: certspotter: long description advertises commercial service) Didier 'OdyX' Raboud <odyx@debian.org> - 2017-08-12 17:00 +0200
              Re: [pkg-go] Bug#856139: certspotter: long description advertises  commercial service Tobias Frost <tobi@debian.org> - 2017-08-12 17:40 +0200

csiph-web