source access

[Daniel919]

Hi there,

Why not give registered users, that already bought an ioFTPD license, access to view the sourcecode, under a very restrictive license ?

I already started a discussion in IRC about this, but I did not get an acceptable reason, why this would be a disadvantage.


Here you get some of my answers to common thoughts about this:

1. "iniCom will loose a lot of profit."
No, because you have to buy a license FIRST, then you might get access to view the code.

2. "Opensourcing it doesn't necessarily mean it will become better."
It's not opensource (like gpl), it will remain a commercial product.
Of course, I can't predict the future, but there is a big ioFTPD community, and I am sure a lot of users would like to help improving ioFTPD (me included).
An example how this could be done can be found at the end of this message.

3. "Everyone will copy the code."
This will be restricted, so it would be illegal.

4. "If they provide the sourcecode with a licensekey, everybody will get it "illegal", and there's no profit anymore."
This would mean that now everyone has a legal ioFTPD.
I want to say, if someone wants to get an illegal ioFTPD, he will get an illegal ioFTPD, whether the source is viewable or not, it doesn't matter for him.

5. "Why you want to view the source ?"
I would like to help to improve ioFTPD, including new functions etc...
But don't tell me to suggest the single functions I want, thats not the point of this topic.

6. "There will come exploits for it faster then usually."
This would lead to a "what is more secure: closed or open ?" war.
Microsoft is trying the first way, Linux/Solaris/FreeBSD/... the second
I think: more eyes look through the code => more bugs are found => ioFTPD gets more secure

7. "Use a free system + a free ftpd. (Linux + vsftpd)"
If I wanted to do so, then I wouldn't post this message.

There should be something like a bugtracking system, where users can post:
- code.diff files, with functions they included
- bugs they fixed
- code they improved
Details about this can be discussed later.


If these steps would be followed, we can expect to see an ioFTPD ...

... that has a lot more functions
Users can integrate new functions directly, and send their changes to darkone via the bugtracker. Then he just patches them into the source and recompiles ioFTPD.
So one could integrate a new feature immediately, and does not have to suggest it and wait until it's written and integrated (which takes a long time, especially if it has low priority for other users)

... that is more secure
Bugs can be fixed immediately, and patches will be send via the bugtracker.
A new ioFTPD version could follow after some hours.

For iniCom this could mean more profit,
because potential customers will be attracted to ioFTPD, if they see it's continuously getting better and more secure.


I am very serious about this, and again:
This does NOT mean opensource like vsftpd, or other GPL projects.
It will remain commercial.


Please tell me your opinions, and whether you agree or not + reason.

Thanks in advance,
Daniel

[tuff]

IIRC there was a license for source for the old versions, although i dont recall d1 ever mentioning anyone who was actually interested in it

[esmandil]

I like this idea

One additional benefit is that I very much like some of the code snippets D1 is posting from time to time... and would like to see more of them Great for learning it is

[darkone]

For several reasons, I'm not all that worried about users finding remote exploits by investigating the source code:
1) There's so much of it.
2) Complexity of code is much higher than in ordinary multithreaded daemons. Core is not tracable by the most, because there are various processors (threads) performing each task.
3) All memory allocations are being traced, so resources leaks are very unlikely. Daemon is able to recover ~100% of time, if there is not enough memory/resources available.
4) There is no 3rd party code in the source tree (with exception of sha1 library).

But following factors prevents us from doing so:
1) Possible, and likely IP-thefts; using algorithms that have taken months to develope without permission in non ioftpd related projects. It would be next to impossible to monitor this.
2) Illegal (unofficial/underground) code branches would be likely to emerge, if we decided not to implement certain feature(s) that group of users wants.
3) While in many cases other developers could speed up the process, we would have to have a skilled person validating all the input. (outfit needs to be the same, some algorithms need to be profiled and trimmed and the most importantly, not everything is worth implementing)

[ganymede]

(1)
Excuse me but ......just out of interest how does - using algorithms that have taken months to develope without permission IN NON RELATED PROJECTS. -affect you... but then again maybe you think like microsoft its all about ME ME ME ME. - next you going to want to patent something *shrug*

(2)
What do unofficial underground versions matter? people who going to pirate and manipulate will do it anyways - those arent your customers and they wont affect your business.

(3)
Surely any code input is better than none.


sorry just being cynical.

[tuff]

(2) What do unofficial underground versions matter? people who going to pirate and manipulate will do it anyways - those arent your customers and they wont affect your business.

seriously, thats the most ive laughed in a bit, OFCOURSE pirated versions will affect inicom sales

[neoxed]

Darkone has firmly stated his position on this issue, and no amount bickering will change anything.

Thread closed.