Hacker News Reader

Comment by buildbot | Hacker News Reader

> We also review the source for IP/security concerns before releasing.

Any modifications you make need to also be open sourced.

Best practice when releasing source code generally is making sure no one left API keys, etc. in source code. (Obviously you never check secrets in in the first place, keeping them separate, but it's still worth automated and manual review before releasing.)

That's not IP, that's secrets. IP needs to be included.

Logos, art, and similar? I would have guessed that would not need to be included.

Those would be provided by a CDN, with some storage service underneath that. Configuration secrets that (transitively) point to these services should be injected by the build system and have no business being in source code.

Trade secrets are a type of IP.

They mean 'configuration secrets'. Those variables used for internal authorization and configuration that should never be leaked outside the organization. If source code of AGPL software is modified and used for an online service, it needs to be published in respecting the license, and best any 'trade secrets' are isolated. The only other alternatives are to use the code as-is or build a proprietary solution from scratch.

I know what they meant.

My point is that the uses of the term at as disparate as they're making it. You would be sued under trade secret law if you intentionally leaked them.

> I know what they meant.

If you did, "Trade secrets are a type of IP." seems to be an unrelated assertion to the thread.

> You would be sued under trade secret law if you intentionally leaked them.

To embed trade secrets into an open source fork, would suggest either the intent to withhold the modified source, ignorance, or flat out incompetence. Anyone, be it a lone hacker or a large organization, can simply fork the source on the platform it's hosted on (e.g., GitHub, GitLab) at a click of a button.

It is a requirement of AGPL that all deployed updates to a product or online service need published source[0]. Once again, very simple to have this running off CI/CD. If there are trade secrets in that source... oh well, they have to be published too. So the simple solution is to not have them in there in the first place (i.e., abstract it away).

[0] https://news.ycombinator.com/item?id=40032179

Best practice is to not have secrets in your source code. Those should be supplied by an internal service, or injected by your build pipeline at the least.

Reply on news.ycombinator.com