r/selfhosted

16h ago

u/zaevlad

Would you trust an app that only open-sources what runs on your server?

Need Help

I've been thinking lately about where the line between open and closed source actually sits, and I'd like to hear what other developers think.

Take a program that, at the user's request, logs into their server, installs a couple of its own components and then keeps an eye on things like whether the site is up and whether the disk is running out of space. Everything it collects stays on the user's own server, and the program just shows it to them on their own computer. Sounds harmless, but in practice it has full access to someone else's machine, and the user has to take it on faith that it doesn't touch anything it shouldn't and doesn't send anything anywhere.

It seems to me there's a fairly obvious model here. Everything that lands on the user's server and runs there is open: the install scripts, the program that runs on the server, even the commands the app sends to it.…