Hacker News Reader

Comment by IshKebab | Hacker News Reader

I always thought 4 years was very generous. I don't think there are many pieces of software I could persuade my boss to pay for if the alternative was using a free 4 year old version. At 2 years there's no chance. Most software we use is 2 years old without even trying.

View on HN

You can host and use Sentry internally yourself, for free, right now (the latest version). Lots of people do.

What you can’t do is leverage that source to compete against its authors, e.g. launch a competing monitoring service. (Please consult the license.)

TBH Sentry versions starting from 10 is kinda messy from infrastructure perspective. Sometimes it looks like artificially crafted to be complex to install and operate as a single node to serve like max 100k events/day.

It's definitely not intentional that self hosted is hard to run, and it's also a concern for us internally. The hard truth is that the scale at which Sentry's largest SaaS installation operates we need to make decisions which are unfortunate for smaller setups. However we're very aware of this challenge. It does not just show up for self hosted, it also complicates the development environments etc. It's not something that is done to harm people who want to self host, it's the consequence of our struggler of balancing the scale we have.

Thank you for insights. I know how hard it could be to design pluggable backends to fulfill different scaling requirements. Local development hurdles are a real chore, good luck with taming the beast!

Your boss apparently doesn't really care about security posture... which is a shame. Most software that's 2 years old, much less 4 years old, is missing numerous security patches introduced in more recent versions. But I guess you could be in an industry that doesn't run up-to-date software? Typically, 2-4 years is EOL.

The source code to the fixed versions is still available in those cases, and there's essentially no chance that even verbatim copies of the patches for most security fixes would pass the threshold of creativity to be copyrightable. Worst case scenario, you have to work with another person to have them study the fixes that upstream publishes and then explain the vulnerability to you so you can write a fix of your own.

So essentially you pay your engineers to maintain a fork, so you can use the software for "free." Then the question of "build vs buy" eventually arises, because maintaining a fork is a costly maintenance burden, and is essentially the "build" side of that question. Seems like the license would be working as intended then. ;)

Besides, this assumes you're creating a competing work. Most use cases of FSL can self-host the latest code. That's the whole point.

For something like Sentry that's typically not a huge problem.

Only the "receive errors from application" endpoints needs to be public; everything else can be gated behind a VPN or HTTP password or whatever. While it's certainly true that such an endpoint can have security problems, it's a pretty small surface area.

Besides, what kind of interesting stuff is there in Sentry? When configured correctly, probably not too much, depending on what type of app you're using it with.

Reply on news.ycombinator.com