Why isn't this open source?

[ymndoseijin]

Is this actually open source, where's the source code for the app?

[IzzySoft]

You app is currently listed in my repo.But while this Git repo says it's MIT licensed, I indeed find no code here –and the code in LibreScore has not been updated for 2 years while there are steady releases being published. Without the source code being available, I'd have to remove the app again from my repo. So can you please point out and make it available?

[sealsrock12]

The app is not open-source. The MIT license does not necessarily give any rights for source code. It is just for "a copy of this software and associated documentation files."

https://github.com/LibreScore/LibreScore is a different program. The "LibreScore App" is the only LibreScore project which is not open-source.

[IzzySoft]

Thanks for the clear words – removing it from my repo then.

[PeterNjeim]

Is this actually open source, where's the source code for the app?

LibreScore is the name of a suite of programs, all of which were open source, until the release of this app. The app unfortunately retains the "Libre" name as that is what Xmader named the whole suite. This app will remain the only closed-source program in the LibreScore suite until an unspecified future date.

[grh0]

Is there a particular reason why the App is closed?
It's pretty confusing TBH.
One usually associates software with "libre" in the title as Gnu licensed project ... but at least open source.
This particular aspect appears to be neither.

I sincerely hope the intention is not to mislead...

[PeterNjeim]

The MIT license is also considered "libre". I will reiterate once again, the name of the suite, which was decided years ago by Xmader, is "LibreScore", and all the software he made was open source, as expected. Then one day we decided to make an app, this is well after Xmader already left the project. The name of the app is "LibreScore" because that's the name of the suite, it's unfortunate but at this point "LibreScore' is a brand name. The reason it's closed source is explained in the Discord server. Keep bug reports in GitHub, and meta discussion in Discord, thanks.

[grh0]

I think a couple of simple things could done to clarify the status of this project and mitigate concerns:

• Provide a clear explanation in the README that this repo contains no source code - only releases, and that the source code itself is currently proprietary.
• Provide an OpenPGP key and signatures for the releases contained here, signed by this key.

I think it is reasonable that users should be concerned about the functionality and veracity of binary applications they discover on sites like GitHub, and treat such applications with caution.

[PeterNjeim]

Not sure why you'd need to say in the README that there isn't source code. It's clear from the fact there isn't code that it's closed-source (only folders are docs and l10n). This discussion was opened because the user knew it was closed-source and was asking why. This discussion is about why it's closed-source, not about whether it's open-source or not (the user was giving us the benefit of the doubt when saying "is this actually open source", in reality the user knew it wasn't and asked for "where the source code was" since he knew it wasn't here).

Every release is currently signed. If this is about GitHub being compromised and malicious users making their own malicious versions of the LibreScore app, I'm not sure how that's possible as it's closed-source. If GitHub was compromised, wouldn't the malicious users also change the OpenGPG key shared by me on GitHub? I'm not sure what to make of this bullet point. If users are concerned about the binary, they may run a virus scan on it, as was done by this user (#8), and we will work to resolve it if any false positives arise. Otherwise, you can treat this proprietary app as you do any other proprietary app, if lots of people seem to be using it without problem, it's probably without problem.

It is unreasonable to assume a project is malicious if it's closed-source. That is precisely why EDLLT's comments were deleted, as they were pure misinformation. A project is malicious if it does malicious things. If you find any malicious packets with Wireshark, please open an issue in this repository. If not, keep the conspiracy theories to yourself (general you, not specifically grh0 you). As for the "if it's on GitHub it should be open source" claim, that's easy. GitHub is a popular website to distribute binaries, with version history, issue tracking, and more. We also already use GitHub for our other programs, there's no reason to switch websites. I know many projects that use GitHub solely as an issue tracker, I'm sure you know some as well.

As for why this project went the route that OpenAI went, starting "open" and "libre" and then later developing proprietary software. Well, for OpenAI it's to pay their employees more. For us, we rejected donations every time someone insisted, as we're not here to make money. The reason it's closed-source, as succinctly explained on the Discord server, is due to legal issues. There isn't any further explanation on Discord because the content is sensitive, and we were in contact with the EFF (not anymore though). The most analogous situation is that of youtube-dl's legal trouble, it's considered a legal gray area. Only a select few people on the Discord server got the privilege of learning the exact details of this issue, and they now have the "Trusted" role on Discord. I've told them not to share the details with anyone so I don't think talking to them will get you any closer. Just allow us to resolve this issue ourselves, once it's resolved (no ETA), we can share the details.

[grh0]

It's clear from the fact there isn't code that it's closed-source (only folders are docs and l10n)

One may not initially notice this.

If GitHub was compromised, wouldn't the malicious users also change the OpenGPG key shared by me on GitHub?

The standard way to distribute keys is via a channel external to the github project, i.e. a key-server, or a website at a domain owned by the developers. Therefore a hacker would need to compromise more than place.

Once users had your published key saved on their keychains it would be obvious if the signature had come from a different key for a subsequent release than the one they had saved.

It is unreasonable to assume a project is malicious if it's closed-source.

I'm not suggested this. (Although the likes of R. Stallman would describe close-sourced software as "unethical")
The MIT licence is described as an "open source" licence. Most software under this licence includes source code to a lesser or greater degree. To include NO source code is not a licence violation - but it is certainly unusual.

A project is malicious if it does malicious things.

Yes - but most would want to take preventative measures to detect any potential "malicious things" BEFORE compromising one's system by installing such software.

[PeterNjeim]

Since most users of this project are not power users, the utility of using OpenGPG keys is limited. I also doubt GitHub's servers will be compromised anytime soon, and once again, even if they were, they couldn't make a malicious version of LibreScore since it's closed-source. This scenario seems impossible anyways, would they compromise the file on Azure? Would they compromise GitHub's frontend and change the download link URL?

I didn't say you suggested that, I added nuance to my paragraph halfway through, responding to your claim about closed-source software published on GitHub specifically and how it cannot be viewed as malicious.

You seem to have responded to tiny parts of my paragraphs, most of what I said already pre-emptively responds to what you replied with. Antivirus software doesn't see a problem, and not a single report of malicious activity has been made.

Since this has moved to tangential discussion, I probably won't be responding further as I've answered the OP's question. Thanks for your input though, it's appreciated