Hacker News Reader

Comment by JohnTHaller | Hacker News Reader

It is worth being clear that TrueCrypt is not an 'Open Source project'. The source is available, but it is under a proprietary license designed to discourage forks and reuse and allowing the original authors to sue you. The one-off TrueCrypt license means that TrueCrypt code can not be utilized under any OSI-recognized open source licenses as it is incompatible with them. The FSF, Ubuntu, etc all agree that TrueCrypt can't be considered open source. The source is available, but it's difficult for you to use it other than to analyze it.

View on HN

I'm not an expert, but I thought there was a distinction between what's meant by "Open Source" and "Free Software". The way I understand it:

Open Source: You can analyze the source code and build it yourself - which is great if you don't trust anyone to give you binaries from what you analyzed. Usually at least free as in "free beer".

Free Software: Open source software which gives you lots of permissions via its license, while making sure you get to keep these permissions. Usually free as in "free speech" (in addition to "free beer").

TrueCrypt not being free as in speech is a bummer, but being able to inspect the code and build it yourself is a critical advantage, especially when it comes to cryptography. I have a hard time imagining BitLocker not having any backdoors built in. At the very least it'll have some kind of weak random number generator or whatever, making sure that with the right algorithm you get to crack it within a few minutes or so.

From Wikipedia [1]:

"In production and development, open source as a development model promotes a) universal access via free license to a product's design or blueprint, and b) universal redistribution of that design or blueprint, including subsequent improvements to it by anyone"

So no, "open source" doesn't just mean being able to read the source code; it also means being able to modify and redistribute it, just like "free software". The difference between the two terms isn't very meaningful in practical terms, IMHO.

[1] http://en.wikipedia.org/wiki/Open_source

No, there is a meaningful difference [1].

Free (as in freedom) Software guarantees that the end user can always get, modify, and redistribute the source, by requiring any use of the source code to be under the same license. In short, copyleft.

For example [2], since linksys modified and extended GPL'd code (the linux kernel) in creating the WRT54G wireless router, they had to release their work under the GPL too, which is how to OpenWrt project was created.

The term Open Source applies to projects with more permissive licenses, such as the MIT license, where there is not obligation to release your modified version of the source to the end user.

[1]: https://www.gnu.org/philosophy/free-software-for-freedom.htm... [2]: http://en.wikipedia.org/wiki/OpenWrt#History

Free software is a subset of open source software. Truecrypt wasn't open source software, as in it didn't have an open source license. It was proprietary, with no ability to fork it, but the source code was available. It's like Microsoft making available the source code of Windows on Github so everyone can see it - without giving it an open source license.

> Free software is a subset of open source software

No, they're the same set.

http://jordi.inversethought.com/blog/5-things-we-have-forgot...

Edit: before you knee-jerk downvote, please read my link. Open source is a term coined by OSI as a replacement synonym for free software. We have somehow culturally forgotten this. We keep repeating some other version of the facts for some reason and have forgotten what "open source" really means.

This is not even vaguely true.

Please read my link. Open source is a term coined by OSI as a replacement synonym for free software. We have somehow culturally forgotten this. We keep repeating some other version of the facts for some reason and have forgotten what "open source" really means.

The term predates OSI.

No. Please read my link above. This is thing #2 in my link above. Christine Petersen coined the term. OSI was then formed under this term.

There is an unrelated "open source intelligence" older term, about how to spy on people using publicly-available sources, but nobody called software "open source" before OSI. Eric Raymond confirms as much:

http://www.catb.org/~esr/open-source.html

In the abstract of the same text by Raymond, http://www.catb.org/~esr/writings/cathedral-bazaar/cathedral...:

>"By mid-1996 I thought I was beginning to understand. Chance handed me a perfect way to test my theory, in the form of an open-source project that I could consciously try to run in the bazaar style. So I did—and it was a significant success." //

OSI started in 1998 yet here is Raymond saying he did an open-source project in 1996. Not only that be he was copying an established style of software authorship which was already open source. Whilst the wording may not have been widely used, perhaps not at all, until 1998 open source was already a thing. OSI tried to create a tightly defined word but they created usage of the term to cover what was - as we see above - already a thing. The thing that existed didn't and doesn't fit neatly in to the OSD and nor should it. Usages change as well but here I think those who [it seems] coined the term and set it free used it in a different way to some of the community from the start.

It would be interesting to do a survey of the HN crowd to see what they consider the term "open source" to mean.

You are of course open source software existed for a long time before it was called that, way back to the early 1960's. People called it free software for a long time. And not just Stallman called it that, even the BSDs did and still do, despite hating RMS and all he stands for (GNU, GPL...)

ESR edits his texts a lot, and CATB came out before 1998. I don't know if I can track down a first edition of CATB and see what term ESR used here, but I bet it wasn't "open source". Note how he hyphenates it, according to his recommendation in the thing I linked.

I cut-pasted and reused his hyphenation, I noted it well. He uses "open-source software" and just "open source". Did I err in this regard?

That aside, it doesn't matter if he wrote the line last week about making an open source project in 1996, it's recognition that open source per se (as opposed to the name) started prior to OSI and their OSD. It was an established thing that they tried to straight-jacket in to a particular definition.

I was pointing out his hyphenation to point out how it's something that nobody does, just like almost nobody writes e-mail anymore instead of email. The term seemed new at the time, so esr thought he needed special recommendations on how to use it.

And yes, I agree again with you, open source existed for a long time before OSI. It was and is called free software. All that OSI attempted to do was provide a more business-friendly synonym for free software, but their message seems to have gotten distorted, and people seem to think that open source is something different from free software. It was never meant to be different.

> I'm not an expert, but I thought there was a distinction between what's meant by "Open Source" and "Free Software".

No, there is no difference:

http://jordi.inversethought.com/blog/5-things-we-have-forgot...

I think you have mixed "Open-Source" and "Free Software".

TrueCrypt IS Open-Source. You can read the source.

It is not, however, free software. It's free to use, but not free as in GPL.

TrueCrypt IS Open-Source. You can read the source.

Depending on whose definition you accept, simply being able to "read the source" does not make something "open source". While not accepted by everyone, the Open Source Initiative's "Open Source Definition"[1] is a very widely accepted definition of what it means to be "Open Source".

I would posit that "Shared Source"[2] is a more accurate term for a project where the source is available, but the license doesn't permit all of the things required by the OSD.

[1]: http://opensource.org/osd-annotated

[2]: http://en.wikipedia.org/wiki/Shared_source

Yes, there's some confusion because the term "open source" was around before OSI attempted to define it.

If my understanding is correct, the TrueCrypt developers were attempting to make an "OpenSource(tm)" license, but the OSI folks had some technical objections. So the software falls into a gray area where it's not quite officially OpenSource, but it still could be modified and distributed by third parties.

> Yes, there's some confusion because the term "open source" was around before OSI attempted to define it.

No, it was not. OSI coined it. Specifically, Christine Petersen coined it.

It appears to be such a natural term now that we have become convinced that we were using it before OSI, but we weren't. The earliest OED citation for "open source" is from 1998, around the time when OSI coined it. If you have an earlier citation, please submit it to the OED. I don't believe one exists.

There is an unrelated term "open source intelligence" which is indeed older, but nobody called software "open source" before OSI.

Sorry, no reference. But I recall the term was not eligible for a trademark for some reason.

I don't know why Bruce Perens apparently trademarked a bunch of things but not "open source" itself. However, as part of its trademark policy, OSI asks that people do not call software "open source" if it's not under an OSI-approved license:

http://opensource.org/trademark-guidelines#Usage_That_Does_N...

"open source" is descriptive (even if you capitalise it). Descriptions aren't trademarks; that's probably why.

You are conflating 'open source' and 'source available' (sometimes referred to as 'shared source' like when Microsoft makes source available for Windows to partners). Having the source available does not make it open source.

Open source means the source is available under an open source license, as recognized by the OSI. This gives you the freedom to modify and reuse it.

>Open source means the source is available under an open source license, as recognized by the OSI. //

I've been part of the [F]OSS community (mainly on the receiving side!) for ~15 years but have never seen it specified that OSS has to comply with an OSI definition.

"open source" [de-capitalisation is purposeful to distinguish with "Open Source [OSD]"] has always simply meant that the source was available to view for those the program was distributed to. For example - IIRC - Star Office was a paid application initially but was open source as those who purchased it could request the source code. Way back in the day people/companies would even make nominal charges to cover media and distribution of the source and still be "open source". Of course not all open source is free-gratis, clearly one can charge for open source. But, moreover, not all open source is free-libre either, just being open source doesn't mean that you have to have a GPL/LGPL/Berkley/CC or whatever compatible license.

I'm pretty sure I recall the OSI starting; we had open source software before that. The OSI's "Open Source" is not coterminous with "open source". For example someone distributing a linux distro that specified that no proprietary software could be bundled as part of the distro would be excluded by the OSI's definition from terming the distro "Open Source" whilst it could very clearly be completely open source. Similarly if you say "may not be used for development or activation or control of weapons designed to cause harm" as part of your license you can allow any type of source manipulation you like but the OSI's definition would say your software is not "Open Source".

FOSS (Free [-libre] Open Source Software) gives you the freedom to modify and reuse it, though there still might be relicensing controls. That's why we have FOSS and OSS definitions in the first place, the Free-libre bit wouldn't be necessary otherwise. No need to try and overload the language to push an ideological position like OSI appear to have done.

> TrueCrypt IS Open-Source. You can read the source.

No, open source means a lot more than "the source is visible".

http://jordi.inversethought.com/blog/5-things-we-have-forgot...

It could be true, that open source meaning is different now. But still I would use open-source by its current definition. Open source's meaning has expanded than what you describe. Which is why we now have Free AND Open Source Software(FOSS).

If you would look around there are lot of licenses built around this point. All open sourced software are not free. Some allow owner to restrict its use like not allowed to be used commercially.

If I had to sum it up these two would be orthogonal: 1. Closed-source vs open-source 2. Proprietary vs free.

Reply on news.ycombinator.com